Breaking Bad Habits

4 Ways Your Employees Are Putting Your Business At Risk Of Cyber-Attack

A couple years ago, TechRepublic ran a story with the following headline: “Employees Are Almost As Dangerous To Business As Hackers And Cybercriminals.” From the perspective of the business, you might think that’s simply inaccurate. Your company strives to hire the best people it can find – people who are good at their jobs and would never dream of putting their own employer at risk.

Your employees are instrumental when it comes to protecting your business from cyberthreats. But they can also become targets for hackers and cybercriminals, and they might not know it. Here are four ways your employees might be endangering your business and themselves — and what you can do about it.

1. They’re Not Practicing Safe And Secure Web Browsing. One of the most basic rules of the Internet is to not click on anything that looks suspicious. These days, however, it can be harder to tell what’s safe and what isn’t.

A good rule of thumb is to avoid websites that do not have “https” in front of their web address. The “s” tells you it’s secure – https stands for Hypertext Transfer Protocol Secure. If all you see is “http” – no “s” – then you should not trust putting your data on that website, as you don’t know where your data might end up.

Another way to practice safe web browsing is to avoid clicking on ads or by using an ad blocker, such as uBlock Origin (a popular ad blocker for Google Chrome and Mozilla Firefox). Hackers can use ad networks to install malware on a user’s computer and network.

2. They’re Not Using Strong Passwords. This is one of the worst IT security habits out there. It’s too easy for employees to use simple passwords or to reuse the same password over and over again or to use one password for everything. Or, worse yet, all of the above.

Cybercriminals love it when people get lazy with their passwords. If you use the same password over and over, and that password is stolen in a data breach (unbeknownst to you), it becomes super easy for cybercriminals to access virtually any app or account tied to that password. No hacking needed!

To avoid this, your employees must use strong passwords, change passwords every 60 to 90 days, and not reuse old passwords. It might sound tedious, especially if they rely on multiple passwords, but when it comes to the IT security of your business, it’s worth it. One more thing: the “tedious” argument really doesn’t hold much water either, thanks to password managers like 1Password and LastPass that make it easy to create new passwords and manage them across all apps and accounts.

3. They’re Not Using Secure Connections. This is especially relevant for remote workers, but it’s something every employee should be aware of. You can find WiFi virtually everywhere, and it makes connecting to the Internet very easy. A little too easy. When you can connect to an unverified network at the click of a button, it should raise eyebrows.

And unless your employee is using company-issued hardware, you have no idea what their endpoint security situation is. It’s one risk after another, and it’s all unnecessary. The best policy is to prohibit employees from connecting to unsecured networks (like public WiFi) with company property.

Instead, they should stick to secure networks that then connect via VPN. This is on top of the endpoint security that should be installed on every device that connects to your company’s network: malware protection, antivirus, anti-spyware, anti-ransomware, firewalls, you name it! You want to put up as many gates between your business interests and the outside digital world as you can.

4. They’re Not Aware Of Current Threats. How educated is your team about today’s cyber security threats? If you don’t know, or you know the answer isn’t a good one, it’s time for a change. One of the biggest threats to your business is a workforce that doesn’t know what a phishing e-mail looks like or doesn’t know who to call when something goes wrong on the IT side of things.

If an employee opens an e-mail they shouldn’t or clicks a “bad” link, it can compromise your entire business. You could end up the victim of data breach. Or a hacker might decide to hold your data hostage until you pay up. This happens every day to businesses around the world – and hackers are relentless. They will use your own employees against you, if given the chance.

Your best move is to get your team trained up and educated about current threats facing your business. Working with a managed service provider or partnering with an IT services firm is an excellent way to accomplish this and to avoid everything we’ve talked about in this article. Education is a powerful tool and, when used right, it can protect your business and your employees.

To learn more about how to safeguard your business, or if you are looking for an expert to help you find the best solutions for your business talk to GCInfotech about a free technology assessment.

Published with consideration from TechAdvisory.org SOURCE

Your employees are your first line of defense when it comes to protecting your business from cyberthreats. Human error is one of the single biggest culprits behind cyber-attacks. It comes down to someone falling for a phishing scam, clicking an unknown link or downloading a file without realizing that it’s malicious.

Because your team is so critical to protecting your business from cyberthreats, it’s just as critical to keep your team informed and on top of today’s dangers. One way to do that is to weave cyber security into your existing company culture.

How Do You Do That?

For many employees, cyber security is rarely an engaging topic. In truth, it can be dry at times, especially for people outside of the cyber security industry, but it can boil down to presentation. That isn’t to say you need to make cyber security “fun,” but make it interesting or engaging. It should be accessible and a normal part of the workday.

Bring It Home For Your Team. One of the reasons why people are often disconnected from topics related to cyber security is simply because they don’t have firsthand experience with it. This is also one reason why many small businesses don’t invest in cyber security in the first place – it hasn’t happened to them, so they don’t think it will. Following that logic, why invest in it at all?

The thing is that it will eventually happen. It’s never a question of if, but when. Cyberthreats are more common than ever. Of course, this also means it’s easier to find examples you can share with your team. Many major companies have been attacked. Millions of people have had their personal data stolen. Look for examples that employees can relate to, names they are familiar with, and discuss the damage that’s been done.

If possible, bring in personal examples. Maybe you or someone you know has been the victim of a cyber-attack, such as ransomware or a data breach. The closer you can bring it home to your employees, the more they can relate, which means they’re listening.

Collaborate With Your Employees. Ask what your team needs from you in terms of cyber security. Maybe they have zero knowledge about data security and they could benefit from training. Or maybe they need access to better tools and resources. Make it a regular conversation with employees and respond to their concerns.

Part of that can include transparency with employees. If Julie in accounting received a phishing e-mail, talk about it. Bring it up in the next weekly huddle or all-company meeting. Talk about what was in the e-mail and point out its identifying features. Do this every time phishing e-mails reach your employees.

Or, maybe Jared received a mysterious e-mail and made the mistake of clicking the link within that e-mail. Talk about that with everyone, as well. It’s not about calling out Jared. It’s about having a conversation and not placing blame. The focus should be on educating and filling in the gaps. Keep the conversation going and make it a normal part of your company’s routine. The more you talk about it and the more open you are, the more it becomes a part of the company culture.

Keep Things Positive. Coming from that last point, you want employees to feel safe in bringing their concerns to their supervisors or managers. While there are many cyberthreats that can do serious damage to your business (and this should be stressed to employees), you want to create an environment where employees are willing to ask for help and are encouraged to learn more about these issues.

Basically, employees should know they won’t get into trouble if something happens. Now, if an employee is blatantly not following your company’s IT rules, that’s a different matter. But for the day-to-day activities, creating a positive, educational, collaborative environment is the best way to make cyber security a normal part of your company culture.

Plus, taking this approach builds trust, and when you and your team have that trust, it becomes easier to tackle issues of data and network security – and to have necessary conversations.

Need help creating a cyber security company culture that’s positive? Don’t hesitate to reach out to your managed services provider or IT partner! They can help you lay the foundation for educating your team and ensure that everyone is on the same page when it comes to today’s constant cyberthreats.

If you are looking for an expert to help you find the best solutions for your business talk to GCInfotech about a free technology assessment

Published with consideration from TechAdvisory.org SOURCE

Decryptors

There are several ransomware decryptors now, thanks to communities of white hat hackers concerned about increasing ransomware attacks worldwide. While some of these decryptors do come with a price, the rest are free or for a minimum donation.

The state of ransomware in 2021 so far

Businesses need to deal with ransomware both from outside and within. On one hand, there are more cybercriminals trying to infiltrate your network. On the other hand, careless and unknowing staff can easily let ransomware enter your network. For instance, employees may be tricked into providing their access credentials in phishing sites, or they may click links to websites that upload ransomware downloaders onto their machines.

The statistics are sobering. Ransomware cost businesses more than $75 billion per year. Over the past two years, ransomware attacks have increased by over 97%. And compared to the first two months of 2017, ransomware campaigns that were initiated from phishing emails increased by 109% in the same span of time this year.
According to studies, there will be a ransomware attack targeting a business every 11 seconds in 2021. That is up from every 14 seconds in 2019, and every 40 seconds in 2016. And the trend is that the rate will continue to increase over the years.

Zombie ransomware is easy to defeat

Not every type of infection is targeted to individual organizations. Some infections may result from self-propagating ransomware strains, while others may come from cyberattackers who are hoping targets become so scared that they pay up before doing any research on how dated the strain is and how to remove it.

No matter what the circumstances of your infection are, always check the following lists to see whether free decryption tools have been released to save you a world of hurt:

Prevention

But even when you can get your data back for free, getting hit with ransomware is no walk in the park. There are essentially three basic approaches to prevent ransomware:

  • First, train your employees about what they should and shouldn’t open when browsing the web and checking email.
  • Second, back up your data as often as possible to quarantined storage. As long as access to your backed-up data is extremely limited and not directly connected to your network, you should be able to restore everything in case of an infection.
  • Finally, regularly update all your software solutions (operating systems, productivity software, and antivirus). Most big-name vendors are quick to patch vulnerabilities, and you’ll prevent a large portion of infections just by staying up to date.

Whether it’s dealing with an infection or preventing one, the best option is to always seek professional advice from seasoned IT technicians. It’s possible that you could decrypt your data with the tools listed above. In reality, most ransomware strains destroy your data after a set time limit, and you may not be able to beat the clock. And even if you do, you probably won’t have the expertise to discern where your security was penetrated.

Don’t waste time fighting a never-ending stream of cyberattacks — hand it over to us and be done with it. Call us today to find out more.

If you are looking for an expert to help you find the best solutions for your business talk to GCInfotech about a free technology assessment

Published with consideration from TechAdvisory.org SOURCE

As businesses have become more reliant on technology, they’ve also become a prime target of cybercriminals. If you want to protect your organization from cyberattacks, make sure your cybersecurity system doesn’t have the following flaws.

Open wireless networks

With just one main internet line and a couple of wireless routers, an entire office can get online. A wireless internet connection saves money, but there’s a risk that it might be unsecure.

It’s not enough to plug in a wireless router and create a basic network to secure your wireless network. If you have an open network, anyone within range can connect. With simple tools and technical know-how, cybercriminals can capture incoming and outgoing data, and even attack the network and any device connected to it.

Ensure that all wireless networks in the office are secured with strong passwords. Some service providers that install hardware when setting up networks will often just use an easy-to-guess password for the router. Change this password immediately to minimize the risk of unauthorized users gaining access to your network.

Unsecure email

Most companies that have implemented a new email system in the past couple of years are most likely secure. This is especially true if they use cloud-based platforms or well-known email systems like Exchange, which offer enhanced security and scanning.

The businesses that are at risk are those using older systems like Post Office Protocol, or systems that don’t encrypt passwords (also known as “clear passwords”). If your system doesn’t support encryption, anyone with the right tools can compromise your systems and data.

Unsecure mobile devices

Mobile devices help you stay connected and productive while out of the office. However, if you use your tablet or smartphone to connect to office systems without proper security measures in place, you run the risk of compromising your networks.

Imagine you have linked your work email to your smartphone but don’t have a password enabled. If the device goes missing, anyone who picks it up can have access to your email and your sensitive information. The same applies if you install a malicious mobile app. If you use this same device to connect to your company’s network, the malware will spread across your systems and disrupt your business operations.

Ensure that employee devices have adequate security, such as passcodes, and your company has sufficient security policies in place to regulate their use. Lastly, implement mobile device management solutions to prevent employee devices from being a security risk to your network.

Anti-malware software that isn’t properly maintained

Anti-malware software needs to be properly installed and maintained if they are going to stand a chance of keeping your systems secure.

If your anti-malware scans are scheduled during business hours, some employees may just turn the scanner off because it slows down their computers. This makes your systems vulnerable to malware.

The same goes for not updating your anti-malware software regularly. Updates are important for anti-malware applications because they implement new databases that contain recently discovered threats and fixes.

Lack of firewalls

A firewall is a security tool that filters network traffic and protects data from being accessed from outside the network. While many modems or routers include firewalls, they are often not powerful enough for business use.

Get a firewall that covers the whole network at the point where data enters and exits (usually before the routers). These are business-centric tools that should be installed by an IT partner like a managed IT services provider for them to be most effective.

How do I ensure proper business security?

The best way to secure business systems and networks is to work with an IT partner like us. Our managed services can help you set up cybersecurity measures and ensure that they are managed properly. Tech peace of mind means you can focus on growing your business. Contact us today to learn more.

If you are looking for an expert to help you find the best solutions for your business talk to GCInfotech about a free technology assessment

Published with consideration from TechAdvisory.org SOURCE

Seafest Web Browser

The internet is a Wild West of sorts. One can never know what kind of cyberthreat they’ll come across. This is why businesses should use secure web browsers to keep threats at bay. But how safe are the popular browsers of today? Let’s find out.

Microsoft Edge

Microsoft Edge, Windows 10’s current default browser, is an improvement over its predecessor Internet Explorer (IE). Edge is based on the open source Chromium browser, resulting in a powerful and efficient browser that supports Progressive Web Apps and Google Chrome extensions.

Edge’s main advantage is that it is Windows 10 computers’ native browser, which means it should integrate more seamlessly with the Windows OS ecosystem in terms of power usage and data security. It uses Windows Defender SmartScreen to protect users from phishing and malware attacks. And it has a three-level defense against third-party trackers, allowing users to choose between Basic, Balanced, and Strict levels of blocking trackers from collecting personal data and monitoring browsing behavior.

Safari

Safari is a graphical web browser developed by Apple for iOS, iPad OS, and macOS. The current iteration is Safari 14, released September in 2020 alongside macOS Big Sur, and it’s also compatible with Catalina and Mojave.

Safari has long been using a system called Intelligent Tracking Prevention (ITP) that identifies and prohibits trackers from accessing a user’s personal data. Safari 14’s Privacy Report feature shows all the trackers ITP has blocked. Safari also has secure password monitoring, which notifies users if any of their saved passwords in iCloud shows up in a data breach. The browser, however, is only available on Apple devices, with full capabilities found only on MacBooks and Macs.

Mozilla Firefox

Mozilla Firefox is a free and open-source web browser developed by the Mozilla Foundation. It is widely available across platforms, even on Unix and Unix-like operating systems such as FreeBSD, OpenBSD, illumos, and Solaris Unix.

Because of Firefox’s open-source development platform, it can be quite unsecure to use on public computers. For personal and single-user business devices, however, Firefox is relatively safe, especially once all security features are activated and tweaked to your needs. Some key features include a password manager called Firefox Lockwise, a third-party tracker protection system, Private Browsing, and Firefox Monitor, which checks if your email address has been compromised in a data breach.

Mozilla also has a Bug Bounty program, which offers a financial reward to anyone who can identify gaps and holes in Firefox code, so the browser can be patched and improved as urgently as possible. Mozilla also promises no legal action against anyone who complies in good faith under its Bug Bounty program, including any claim under the DMCA for circumventing technological measures.

Google Chrome

Google Chrome is a cross-platform web browser developed by Google. It is the default browser for Google’s line of laptops and third-party Chromebooks. Chrome utilizes a process allocation model to sandbox tabs. Sandboxing is a security mechanism for separating running programs to keep software vulnerabilities from spreading.

Chrome also regularly updates two sets of blacklists, one for phishing and one for malware, which it uses to warn users of potentially harmful sites. It also touts site isolation and predictive phishing protection features that receive regular and critical updates every six weeks and within 24 hours of a threat being discovered, respectively.

Being aware of how your web browser stacks up against the competition is only half the battle. Ransomware like WannaCry can spread to uninfected systems through a gap in the Windows security framework, and most other malware infections prey on human error. What your business needs is a comprehensive security audit. For more information, call us today.

To learn more about how to safeguard your business, or if you are looking for an expert to help you find the best solutions for your business talk to GCInfotech about a free technology assessment.

Published with consideration from TechAdvisory.org  SOURCE

authentication

A secure login process is an excellent way to protect your business from cybercriminals.
When it comes to verifying user identity, you can choose between two-step authentication and two-factor authentication. Learn the difference between the two so you can have a better appreciation of your cybersecurity options.
If you want to improve your business’s cybersecurity, you should take a closer look at your authentication process. Two-step and two-factor authentication are two of the most commonly used authentication methods. Many businesses use the terms two-step and two-factor authentication interchangeably, but there are subtle differences between the two.

Two-step authentication

A two-step authentication process requires a single-factor login (such as a password or biometric reading) as well as another similar type of login credential that a user must provide. This process typically requires entering a password for the first step and entering another security code for the second step, which may be accomplished by providing a one-time code generated by an authenticator app such as Google Authenticator.

Two-step authentication adds an extra step in the verification process, making it more secure than single-step authentication (i.e., providing only a password). However, if a person or business is hacked, it won’t be enough to stop hackers from getting a hold of whatever they are looking for.

Two-factor authentication

Two-factor authentication, a subset of multifactor authentication, is significantly more secure than two-step authentication. This type of authentication requires two different types of information to authenticate a user’s identity. For example, it could be a combination of a fingerprint or retinal scan as well as a password or passcode. Because of the additional authentication information required, hackers would have great difficulty breaking into a network using a two-factor authentication system.

Which one is better?

Relying on a single-factor authentication process is no longer sufficient in ensuring the safety of your network. Securing the authentication process and making it difficult for cybercriminals to access your network should be on top of your priorities. Deciding whether to use two-step or two-factor authentication largely depends on your business’s specific security requirements. To take the stress out of securing and protecting your network, call us today for expert cybersecurity advice.

To learn more about how to safeguard your business, or if you are looking for an expert to help you find the best solutions for your business talk to GCInfotech about a free technology assessment.

Published with consideration from TechAdvisory.org  SOURCE

Managed IT Services

Today’s companies need technology to function. Without it, businesses cannot compete and succeed. But with technology comes the ever-constant threat of hackers and cybercriminals. That’s why small- and mid-sized businesses need to protect themselves with robust cybersecurity solutions managed by IT professionals.

The numbers

According to the Ponemon Institute’s 2019 State of Cybersecurity in Small and Medium-Sized Businesses (SMBs) survey, cyberattacks have increased dramatically. Here in the United States, 76% of companies were attacked in 2019, a significant leap from 55% in 2016. Sixty-nine percent of US businesses reported data breaches in 2019, up from 50% in 2016.

The financial consequences have also increased considerably. The average cost spent by companies because of damage to or theft of IT assets and infrastructure increased from $1.03 million in 2017 to $1.2 million in 2019. Costs due to disruption to normal operations increased from an average of $1.21 million in 2017 to an average of $1.9 million in 2019.

The attacks

Globally, the most common forms of attack on SMBs are those that rely on deception: phishing (57%), stolen or compromised devices (33%), and credential theft (30%). Worse, cybercriminals are targeting SMBs more, with reported attacks having increased from 60% in 2017 to 69% in 2019.

Why managed services?

Partnering with MSPs is the most effective way to prevent attacks and protect your business from malicious threats. MSPs offer a full range of proactive IT support that focuses on advanced security, such as around-the-clock monitoring, data encryption and backup, real-time threat prevention and elimination, network and firewall protection, security awareness training, and more.

And because managed services are designed to identify and fix weak spots in your IT infrastructure, you’ll optimize the digital backbone of your business processes. You’ll have faster network performance, a solid business continuity and disaster recovery strategy, and minimal downtime. One of the best things about managed services is that you get a dedicated team of IT professionals ready to assist you for any technology problems you may encounter. This is much more effective and budget-friendly than having in-house personnel handling all your IT issues.

Being proactive when it comes to cybersecurity is the only way to protect what you’ve worked hard to build. If you’d like to know more about how managed services can benefit your business, just give us a call — we’re sure to help.

To learn more about how to safeguard your business, or if you are looking for an expert to help you find the best solutions for your business talk to GCInfotech about a free technology assessment.

Published with consideration from smallbiztechnology.com  SOURCE

Cybersecurity

It is good to have an IT team and/or a third-party partner like a managed services provider (MSP) that helps keep your company protected against cyberthreats. It is even better to have all stakeholders be involved in preventing data breaches. Here’s how everyone can be proactive when it comes to cybersecurity.

Understand the threats you’re facing

Before any small- or medium-sized business (SMB) can work toward preventing cyberattacks, everyone involved needs to know exactly what they’re up against. Whether you’re working with in-house IT staff or an MSP, you should review what types of attacks are most common in your industry. Ideally, your team would spearhead this review a few times a year.

Reevaluate what it is you’re protecting

Once you have a list of the biggest threats to your organization, you need to take stock of how each one threatens the various cogs of your network. Map out every company device that connects to the internet, what type of data they have access to (regulated, mission-critical, low-importance, etc.), and what services are currently protecting those devices.

Create a baseline of protection

By reviewing current trends in the cybersecurity field and auditing your current technology framework, you can begin to get a clearer picture of how you want to prioritize your preventative measures versus your reactive measures.

Before you can start improving your cybersecurity approach, you need to know where your baseline is. Devise a handful of real-life scenarios and simulate them on your network. Network penetration testing from trustworthy IT professionals will help pinpoint weak spots in your current framework.

Finalize a plan

All these pieces will complete the puzzle of what your new strategy needs to be. With an experienced technology consultant on board for the entire process, you can easily synthesize the results of your simulation into a multipronged approach to proactive security.

Proactive measure What it entails
Security awareness seminars for all internal stakeholders Train everyone from the receptionist to the CEO about effective security practices such as password management, proper mobile device usage, and spam awareness.
Updated anti-malware software or cloud-based service Protect your data and systems against the latest and most menacing malware.
Routine software patches and upgrades Minimize the chances of leaving a backdoor to your network open.
Web filtering services Blacklist dangerous and inappropriate sites for anyone on your network.
Perimeter defenses (e.g., intrusion prevention systems and hardware firewalls) Scrutinize everything trying to sneak its way in through the borders of your network.
Policy of least privilege Limit users’ access only to the data they need to fulfill their tasks.
Data segmentation Rank data according to sensitivity and build micro-perimeters around high-value datasets.
Full-disk encryption Make data stored in computers and portable devices unreadable so that if these machines are stolen, the files they have inside remain secure.
Virtual private networks Make data transmitted across unsecured connections unreadable so that intercepting it would become futile.
Strict access controls Prevent unauthorized access to accounts by using strong passwords, multifactor authentication, and auto screen locks and logouts for idle users.
AI-powered network monitoring Identify suspicious user and software behaviors such as employees accessing files outside their departments.

As soon as you focus on preventing downtime events instead of reacting to them, the productivity and efficiency of your IT infrastructure will increase to levels you’ve never dreamed of. Start your journey to enhanced cybersecurity by giving us a call for a demonstration.

To learn more about how to safeguard your business, or if you are looking for an expert to help you find the best solutions for your business talk to GCInfotech about a free technology assessment.

Published with consideration from smallbiztechnology.com  SOURCE

COVID-19 has forced companies large and small to rapidly retool the way they do business, with even the smallest businesses making remote work arrangements for employees. But while the pandemic has inspired an unprecedented surge of cyber attacks, including a heap of new security challenges for business, many small companies aren’t rewriting cyber security policies or implementing new security measures at the same rate as larger companies, and it seems the smaller the company, the fewer the changes.

With the economy beginning to contract, many small businesses may be struggling to find the funds or staff to address evolving cybersecurity concerns. Small businesses already make up 43 percent of cyber crime targets in the U.S., and in 2019, data breaches cost small businesses an average of $200,000, with 60 percent of those attacked going out of business within six months.

Improving cyber security might cost some money, but it’ll surely be worth keeping your business afloat — and it might even be cheaper than the cost of a data breach. Protecting yourself is often as simple as implementing a few smart policies, and using the right security tools.

Update Your Policies to Address the Realities of Remote Work

If you have employees working remotely during the crisis, you need to implement some policies that acknowledge the unique security risks of working from home. First of all, employees won’t be behind a company firewall, and might not have company security software running on their systems.

Require that employees access company data over a private network — anyone who doesn’t have access to a home network should be required to work onsite, where they can access a secure connection. Public connections, like those in coffee shops or libraries, might not be available anyway, and if they are, they’re not safe — hackers can jump on them to access your data. Clarify that employees shouldn’t save company data to their personal devices, including storage like flash drives, personal cloud storage, or personal email. All of these are insecure places to store data.

Use the Right Tools

Software solutions are available to give you and your employees the tools you need to stay secure while working in a challenging situation. Employees can use a Virtual Private Network (VPN) to access your company’s internal network and even use a virtual desktop there, which provides both storage solutions and an extra layer of security.

Employees will also need endpoint security, including anti-malware protection and firewall protection. Advanced threat protection will include security for endpoints and other network devices and email, as well as malware protection. The best advanced threat protection offers real-time monitoring to catch breaches and other attacks before they do too much damage.

Train Your Employees

Of course, employees will need regular security check-ins to make sure their security features are optimized. However, they’ll also need additional training in cybersecurity, especially as everyone is on-edge and stressed-out at the moment — in other words, employees are more likely than ever before to be in the perfect state of mind to fall for a phishing email or other social engineering tactic. Regular training, even if it’s just videos and online quizzes, will help keep employees on their toes, and will maybe help you single out individuals who need further attention.

Supply Devices

If you can, it’s safest to supply your employees the devices they need to work from home. It’s more fair to the employees, who may otherwise have to use old or underpowered equipment, or scramble to come up with what they need on their own. But it’s not just about fairness — you have much more control over what happens on company devices, and you can, at least in theory, keep employees from using them for personal stuff. This can help keep hackers from compromising your company data, since you don’t know what emails your employees are answering in their downtime, or which questionable websites they might be visiting. Their personal devices could already be compromised.

The COVID-19 pandemic has been dangerous in all kinds of ways, some more predictable than others. Make sure your company is aware of the dangers COVID-19 poses for your cyber security, so you protect yourself on every front.

To learn more about how to safeguard your business, or if you are looking for an expert to help you find the best solutions for your business talk to GCInfotech about a free technology assessment.

Published with consideration from smallbiztechnology.com  SOURCE

Password Security

The National Institute of Standards and Technology (NIST) created many of the password best practices you probably loathe — using a combination of letters, numbers, and special characters. The NIST now says those guidelines were ill-advised and has changed its stance. Find out why and what this means for you.

The problem

The issue isn’t that the NIST advised people to create easy-to-crack passwords, but their previous advice inadvertently made people create weak passwords using predictable capitalization, special characters, and numbers, like “P@ssW0rd1.”

Such a password may seem secure, but the strings of characters and numbers could easily be compromised by hackers using common algorithms.

What’s more, the NIST also recommended that people change their passwords regularly, but did not specify how and when to change them. Since many people thought their passwords were already secure because they’ve included special characters in them, most only added or changed one character.

The NIST essentially forced everyone to use passwords that are hard for humans to remember but easy for a hacker’s algorithm to crack.

Eventually, the institution admitted that this can cause more problems than solutions. It has reversed its stance on organizational password management requirements, and is now recommending banishing forced periodic password changes and getting rid of complexity requirements.

The solution

Security consultant Frank Abagnale and Chief Hacking Officer for KnowBe4 Kevin Mitnick both see a future without passwords. Both security experts advise enterprises to implement multifactor authentication in login policies.

This requires a user to present two valid credentials aside from a password to gain access to an account. This could be a code sent to the account owner’s smartphone, a login prompt on a mobile device, or a facial or a fingerprint scan. This way, hackers’ login efforts are futile unless they fulfill the succeeding security requirements.

Moreover, Mitnick recommended implementing long passphrases of 25 characters or more, such as “recedemarmaladecrockplacate” or “cavalryfigurineunderdoneexalted.” These are much more difficult to guess and less prone to hacking. As for the frequency of changing passphrases, it will depend on a company’s risk tolerance.

Simply put, passwords should be longer and include nonsensical phrases and English words that make it almost impossible for an automated system to crack.

You should also enforce the following security solutions within your company:

  • Single sign-on – allows users to securely access multiple accounts with one set of credentials
  • Account monitoring tools – recognizes suspicious activity and locks out hackers

When it comes to security, ignorance is your business’s kryptonite. If you’d like to learn about what else you can do to remain secure, just give us a call.

To learn more about how to safeguard your business, or if you are looking for an expert to help you find the best solutions for your business talk to GCInfotech about a free technology assessment.

Published with consideration from TechAdvisory.org SOURCE