,

The 5 most common security breaches

These days, the security of various IT systems is constantly being called into question. From attacks on mobile devices to ever-increasing types of malware, many businesses are struggling to stay on top of their security. One of the best ways to stay protected is to be aware of common cybersecurity issues. To that end, here are five common ways your security can be breached.

#1. You are tricked into installing malicious software

One of the most common ways a system’s security is breached is through downloaded malware. In almost every case where malware is installed, the user was tricked into downloading it.

A common trick used by hackers is planting malware in software hosted on warez and torrent websites. When users visit the site, they are informed that they need to download the software in order for the site to load properly. Once downloaded, the malware infects the system. In other cases, hackers send emails with a malware-infected attachment.

There is a nearly limitless number of ways you can be tricked into downloading and installing malware. Luckily, there are steps you can take to avoid this:

  • Never download files from an untrusted location. If you are looking at a website that is asking you to download something, make sure it’s from a company you know and trust. If you are unsure, it’s best to avoid downloading and installing the software.
  • Always look at the name of the file before downloading. A lot of malware is often disguised with names that are similar to legitimate files, with only a slight spelling mistake or some weird wording. If you are unsure about the file, then don’t download it. Instead, contact us so we can verify its authenticity.
  • Stay away from torrents, sites with adult content, and video streaming sites. These sites often contain malware, so avoid them altogether.
  • Always scan a file before installing it. Use your antivirus scanner to check downloaded apps before opening them. Most scanners are equipped to do this by right-clicking the file and selecting Scan.

#2. Hackers are able to modify the operating system (OS) settings

Many users are logged into their computers as admins. Being an administrator allows you to change all settings, install programs, and manage other accounts.

If a hacker manages to access your computer with you as the admin, they will have full access to your computer. This means they could install other malicious software, change settings, or even completely hijack the machine. The biggest worry about this, however, is if a hacker gets access to a computer used to manage the overall network. Should this happen, they could gain control of the entire network and do as they please.

To avoid this, limit the administrator role only to users who need to install applications or change settings on the computer. Beyond this, installing security software like antivirus scanners and keeping them up to date, as well as conducting regular scans, will help reduce the chances of being infected, or seeing infections spread.

#3. Someone physically accesses your computer

These days, it seems like almost every security threat is trying to infect your IT infrastructure from the outside. However, there are many times when malware is introduced into systems, or data is stolen, because someone has physically accessed your systems.

Let’s say you leave your computer unlocked when you go for lunch and someone walks up to it, plugs in a malware-infected USB drive, and physically infects your system. They could also access your system and manually reset the password, thereby locking you out and giving them access.

Secure yourself by setting up a password to control access to your computer. You should also lock, turn off, or log off from your computer whenever you step away from it.

Beyond that, disable drives like CD/DVD and connections like USB if you don’t use them. This will limit the chances of anyone using these removable media to infect your computer.

#4. Someone from within the company infects the system

We’ve seen a number of infections and security breaches that were carried out by a disgruntled employee. They could delete essential data, or remove it from the system completely. Some have even gone so far as to introduce highly destructive malware. The most effective way to prevent this, aside from ensuring your employees are happy, is to limit access to systems.

Your employees don’t need access to everything, so reexamine what your employees have access to and make the necessary adjustments. For example, you may find that people in marketing have access to finance files or even admin panels. Revoke unnecessary access rights and ensure that employees only have access to the files they need.

#5. Your password is compromised

Your password is the main way you can verify and access your accounts and systems. The issue is, many people have weak passwords. And with the steady increase in the number of stolen user account data, it could only be a matter of time before they can crack your password and compromise your account.

To add insult to injury, many people use the same password for multiple accounts, which could lead to a massive breach. Therefore, you should use strong and different passwords for your accounts.

To further enhance your password security, utilize multi-factor authentication (MFA), which uses more than one method of verifying a user’s identity, such as a fingerprint or a one-time code.

To learn more about how to safeguard your business, or if you are looking for an expert to help you find the best solutions for your business talk to GCInfotech about a free technology assessment.

Published with consideration from TechAdvisory.org SOURCE

/by

What are 2-step and 2-factor authentication?

In the digital age, cybersecurity should be one of the top priorities for anyone who goes online. One way is to vet those who are trying to access your systems. But when it comes to verifying users’ identity, many are unaware of the two kinds of authentication measures available. Read on to know the differences between two-step authentication and two-factor authentication.

If you want to improve your business’s cybersecurity for you and your customers, you should look at your authentication process. Two-step and two-factor authentication are two of the most commonly used options in cybersecurity. Many businesses use the terms two-step and two-factor authentication interchangeably. There are, however, subtle differences between the two.

Two-step authentication

A two-step authentication process requires a single-factor login (such as a password or biometric reading) as well as another similar type of login that is essentially sent to the user. For example, you may have a password for your first step and then receive a one-time-use code on your cell phone as the second step.

Two-step authentication adds an extra step in the verification process, making it more secure than single-step authentication (i.e., just the password). However, if a person or business is hacked, it won’t be enough to stop hackers from getting a hold of whatever they are looking for.

Two-factor authentication

On the other hand, there is two-factor authentication (sometimes referred to as multifactor authentication), which is significantly more secure. This type of authentication requires two different types of information to authenticate a user’s identity. For example, it could be a combination of a fingerprint or retinal scan as well as a password or passcode. Because the types of information are different, it would require a hacker a great deal more effort to obtain both forms of authentication.

The difference between the two

In essence, every two-factor authentication is a two-step authentication process, but the opposite is not true. With this information in mind, make sure that you are using the right type of authentication in your business to keep your company and customer information as secure as possible.

Your network needs the best security technology has to offer. The type of authentication you should use is just one of hundreds of choices that must be made to achieve that end. To take the stress out of securing and protecting your network, call us today for all the help you could ever ask for.

To learn more about how to safeguard your business, or if you are looking for an expert to help you find the best solutions for your business talk to GCInfotech about a free technology assessment.

 

Published with consideration from TechAdvisory.org SOURCE

 

 

/by
,

Why should I use private browsing?

You may think that you’re not online enough to risk your safety, or that you never visit unsafe sites. However, the world wide web is a vast network where the exchange of information is often difficult to track. Here are some good reasons to “go incognito”.

With the headlines about data breaches and cyberattacks greeting you every time you go online, it seems impossible to have a surefire, foolproof way to keep your information secure. Sometimes cyber predators are relatively harmless, but oftentimes, their goal is to steal identities and financial information. Virus scanners and firewalls can definitely help, but here’s an added layer of protection when you go online.

What is private browsing?

Your web browser — whether it be Chrome, Edge, Firefox, Safari, or Opera — stores the addresses of the sites you visit, cookies that track your activity, passwords you’ve used, and temporary files you’ve downloaded.

This can be convenient if you frequently visit certain pages, can’t remember your login details, or if you’re trying to recall a website you visited a few days ago. But if someone else uses or gains access to your computer, your most private (and embarrassing) internet activities are exposed for anyone to see.

With private browsing — also called Incognito Mode in Chrome and InPrivate Browsing in Edge — all the information listed above does not get recorded. In fact, all the websites and information you accessed during a private browsing session is discarded without a trace as soon as you close the browser. This can come in handy when you’re using a public computer because you’re instantly logged out of all the accounts after closing the window.

Private browsing also prevents cookies from being stored on your computer. In a normal browsing session, sites like Facebook will inundate you with highly targeted ads based on the sites and pages you’ve visited. But in private browsing mode, your internet activity won’t be used against you by marketing companies.

Another benefit of private browsing is you can use it to log in to several accounts on the same site, which is useful if you need to log in to two different Google accounts at the same time.

Limitations of private browsing

Although private browsing does prevent your web browser from storing your data, it doesn’t keep your online activities 100% private. If your computer is connected to the company network, system administrators can still keep track of what you’re browsing, even if you’re in Incognito Mode. Also, if spyware or keylogger malware is installed on your computer, hackers will still be able to see what you’re doing online.

A keylogger malware records every key you punched in and may send this information to a predefined email address without you knowing. This means passwords, answers to verification questions, account numbers, credit card details, or even the words you type in a chat can be emailed to someone spying on your online activities.

Even though private browsing has quite a few benefits, you shouldn’t solely depend on it for online privacy. Your computers and mobile devices must be equipped with Virtual Private Networks that encrypt your internet connection and prevent anyone from intercepting your data. And don’t forget to scan your computer for viruses with a strong anti-malware program to keep spyware and other malicious web monitoring software at bay.

If you want to know where you can get these solutions or learn more about web browser security, call us today. We have the tools and expert advice you need to prevent anyone from snooping on your internet browsing.

To learn more about how to safeguard your business, or if you are looking for an expert to help you find the best solutions for your business talk to GCInfotech about a free technology assessment.

 

Published with consideration from TechAdvisory.org SOURCE

/by

It’s time to rethink your password

In 2003, a manager at the National Institute of Standards and Technology (NIST) authored a document on password best practices for businesses, federal agencies, and academic institutions. More recently, however, the institute has reversed its stance. Find out why and what great passwords are made of.

The problem

The issue isn’t necessarily that the NIST advised people to create passwords that are easy to crack, but it steered people into creating lazy passwords, using capitalization, special characters, and numbers that are easy to predict, like “P@ssW0rd1.”

This may seem secure, but in reality, these strings of characters and numbers could easily be compromised by hackers using common algorithms.

To make matters worse, NIST also recommended that people change their passwords regularly, but did not define what it actually means to “change” them. Since people thought their passwords were already secure with special characters, most only added one number or symbol.

NIST essentially forced everyone to use passwords that are hard for humans to remember but easy for computers to guess.

Recently, the institution admitted that this scheme can cause more problems than solutions. It has reversed its stance on organizational password management requirements, and is now recommending banishing forced periodic password changes and getting rid of complexity requirements.

The solution

Security consultant Frank Abagnale and Chief hacking officer for KnowBe4 Kevin Mitnick both see a future without passwords. Both security experts advise enterprises to utilize multifactor authentication (MFA) in login policies.

This requires users to present two valid credentials to gain access to their data. For instance, a code texted to an employee’s smartphone can serve as an added security measure to thwart hackers.

Moreover, Mitnick recommended implementing long passphrases of 25 characters or more, such as “correcthorsebatterystaple” or “iknewweretroublewhenwalkedin5623”. These are much more difficult to guess and less prone to hacking. As for the frequency of changing passphrases, it will depend on a company’s risk tolerance.

Simply put, passwords should be longer and include nonsensical phrases and English words that make it almost impossible for an automated system to make sense of.

Even better, you should enforce the following security solutions within your company:

  • Single sign-on– allows users to securely access multiple accounts with one set of credentials
  • Account monitoring tools– recognizes suspicious activity and locks out hackers

 

When it comes to security, ignorance is the biggest threat. If you’d like to learn about what else you can do, just give us a call.

Published with consideration from TechAdvisory.org SOURCE

/by

Autocomplete password risks

Advertisements and “helpful” suggestions based on your internet browsing habits can be troubling. But what’s even more alarming is that hackers have found another way of tracking you via seemingly harmless autocomplete passwords. Here’s what you need to know.

Why auto-fill passwords are so dangerous

As of December 2018, there are 4.1 billion internet users in the world. This means users have to create dozens of passwords, either to protect their account or simply to meet the password-creation requirements of the platform they’re using. Unfortunately, only 20% of US internet users have different passwords for their multiple online accounts.

Certain web browsers have integrated a mechanism that enables usernames and passwords to be automatically entered into a web form. On the other hand, password manager applications have made it easy to access login credentials. But these aren’t completely safe.
Tricking a browser or password manager into giving up this saved information is incredibly simple. All a hacker needs to do is place an invisible form on a compromised webpage to collect users’ login information.

Using auto-fill to track users

For over a decade, there’s been a password security tug-of-war between hackers and cybersecurity professionals. Little do many people know that shrewd digital marketers also use password auto-fill to track user activity.

Digital marketing groups AdThink and OnAudience have been placing these invisible login forms on websites to track the sites that users visit. They’ve made no attempts to steal passwords, but security professionals said it wouldn’t have been hard for them to do. AdThink and OnAudience simply tracked people based on the usernames in hidden auto-fill forms and sold the information they gathered to advertisers.

One simple security tip for today

A quick and effective way to improve your account security is to turn off auto-fill in your web browser. Here’s how to do it:

  • If you’re using Chrome– Open the Settings window, click Advanced, and select the appropriate settings under Manage Passwords.
  • If you’re using Firefox– Open the Options window, click Privacy, and under the History heading, select “Firefox will: Use custom settings for history.” In the new window, disable “Remember search and form history.”
  • If you’re using Safari– Open the Preferences window, select the Auto-fill tab, and turn off all the features related to usernames and passwords.

 

This is just one small thing you can do to keep your accounts and the information they contain safe. For managed, 24×7 cybersecurity assistance that goes far beyond protecting your privacy, call us today.

To learn more about how to safeguard your business, or if you are looking for an expert to help you find the best solutions for your business talk to GCInfotech about a free technology assessment.

 

Published with consideration from TechAdvisory.org SOURCE

/by

5 Easy tips for preventing data breaches

Keeping your personal and professional information safe from cybercriminals is not easy. It takes constant vigilance and frequent training. There are dozens of simple tools and tips to help people with almost zero expertise stay safe online, but these five are our favorites.

1. Multi-factor authentication (MFA)

This tool earns the number one spot on our list because it can keep you safe even after a hacker has stolen one of your passwords. That’s because MFA requires more than one form of identification to grant access to an account.

The most common example is a temporary code that is sent to your mobile device. Only someone with both the password and access to your smartphone will be able to log in. Almost any online account provider offers this service, and some let you require additional types of verification, such as a fingerprint or facial scan.

2. Password managers

Every online account linked to your name should have a unique password with at least 12 characters that doesn’t contain facts about you (avoid anniversary dates, pet names, etc.). Hackers have tools to guess thousands of passwords per second based on your personal details, and the first thing they do after cracking a password is to try it on other accounts.

Password manager apps create random strings of characters and let you save them in an encrypted list. You only need one complex password to log into the manager, and you’ll have easy access to all your credentials. No more memorizing long phrases, or reusing passwords!

3. Software updates

Software developers and hackers are constantly searching for vulnerabilities that can be exploited. Sometimes, a developer will find one before hackers and release a proactive update to fix it. Other times, hackers find the vulnerability first and release malware to exploit it, forcing the developer to issue a reactive update as quickly as possible.

Either way, you must update all your applications as often as possible. If you are too busy, check the software settings for an automatic update option. The inconvenience of updating when you aren’t prepared to is nothing compared to the pain of a data breach.

4. Disable flash player

Adobe Flash Player is one of the most popular ways to stream media on the web, but it has such a poor security record that most experts recommend that users block the plugin on all their devices. Flash Player has been hacked thousands of times, and products from companies like Microsoft, Apple, and Google regularly display reminders to turn it off. Open your web browser’s settings and look for the Plugins or Content Settings menu, then disable Adobe Flash Player.

 

5. HTTPS Everywhere

Just a few years ago, most websites used unencrypted connections, which meant anything you typed into a form on that site would be sent in plain text and could be intercepted with little effort. HTTPS was created to facilitate safer connections, but many sites were slow to adopt it or didn’t make it the default option.

HTTPS Everywhere is a browser extension that ensures you use an encrypted connection whenever possible and are alerted when one isn’t available on a page that requests sensitive information. It takes less than one minute and a few clicks to install it.

If you run a business with 10 or more employees, these simple tips won’t be enough to keep you safe. You’ll need a team of certified professionals that can install and manage several security solutions that work in unison. If you don’t have access to that level of expertise, our team is available to help. Give us a call today to learn more.

To learn more about how to safeguard your business, or if you are looking for an expert to help you find the best solutions for your business talk to GCInfotech about a free technology assessment.

 

Published with consideration from TechAdvisory.org SOURCE

/by