,

How to spot ‘spear phishing’, an insidious cybercrime trend

True story: At a company I once worked for, employees received an email about an unexpected bonus. In private Slack channels, we wondered whether it was a well-played phishing attempt. Turns out, the bonus was legit, but so was our inclination to question it. Phishing—when cybercriminals pose as legitimate institutions to get info or money from you—is the origin of up to 90 percent of breaches and hacking incidents, says Frank Cilluffo, director of Auburn University’s McCrary Institute for Cyber and Critical Infrastructure Security in Alabama.

These cyber bad guys have even taken it to the next level with “spear phishing,” a practice of sending emails that appear to be from someone you personally know. “This happened to me once and it was a humbling experience,” says Adam Doupé, director of the Center for Cybersecurity and Digital Forensics at Arizona State University in Tempe. Turns out, the email seemed to be coming from a colleague, and Doupé was boarding a plane when he got it so he wasn’t as careful as he would normally be. “I ended up replying with my cell phone number,” recalls Doupé. “When the phisher responded with a request to send gift cards, the alarm bells went off.”

Knowing that a cybersecurity expert got played, an average person has to be hypervigilant. But could you be missing out on legit offers and emails because you’re being too cautious? Your first line of defense: install a protection software (like Malwarebytes). This sort of protection that lives on your computer, coupled with our expert tips below, will stop phishers in their tracks.

3 Ways To Tell If It’s Phishing Or Not

Experts say there are a few things you can do if you’re unsure whether an email is a phishing attempt.

1. Check the email address carefully.

Hover your cursor over the full email—not just the sender’s name—to see if anything looks off. “For instance, instead of .com, the address may contain .ru,” says Cilluffo. (.Ru indicates that it’s from a Russian server.) Compare the address on a recent email to one that you’ve responded to previously.

2. Call or text the person you think may have sent the email.

Ever receive an email from a friend or colleague and it seems off? Maybe it’s much briefer than usual or perhaps they addressed you by your full name rather than a nickname. Trust your gut, and don’t respond or click on any links or attachments until you’ve verified the email. While it truly may just be a link to their kids’ fundraiser, it could be the work of a cyber criminal trying to get you to download malware—aka malicious software.

3. Verify through an independent news source.

Sometimes you may receive an email about an important recall notice or info about a class-action lawsuit. Search on a trustworthy news site whether the link contained in your email appears in any news articles, suggests Doupé.

Bottom line?

Cyber criminals are getting more and more creative at making their phishing attempts appear legitimate. Go with your gut, slow down to verify the validity of messages you receive and install a protection software (like Malwarebytes) to stop phishers before they start.

Are you interested in learning more about cybersecurity? Call us today and discover how our wide array of tech services can safeguard your business.

If you are looking for an expert to help you find the best solutions for your business talk to GCInfotech about a free technology assessment

Published with consideration from yahoo.com SOURCE

/by
,

Are Password Managers Safe?

If you’re struggling to juggle your passwords, the solution to your woes is a password manager. See our recommendations.

Password managers are a safe, secure way of logging into your various online accounts. In fact, they’re vastly preferable to the alternatives of either trying to remember multiple unique passwords or re-using the same password over and over.

According to Pew Research Centre, half of users have up to 25 password-protected accounts online. That’s far too many for the average person to remember, making it hard to stay secure. A secure password manager will automatically store all your logins, meaning that you’ll never have to remember one ever again, and can even generate passwords for you.

Given that even industry-leader LastPass was once the victim of a hack, concerns remain over using password managers. Besides, you may be questioning the wisdom of storing all your passwords in one place. These are legitimate concerns, but research has shown that using a password manager is far more secure than not using one. The risk of your business getting hacked is high, particularly during the pandemic, so we’d strongly recommend getting one yourself.

As for which password manager you should choose? We’ve tested some of the best password managers around, and while they’re all safe and secure, the best on test was LastPass. This stands out thanks to a simple interface, secure setup, and brilliant family-sharing options. Plus, you can try LastPass for free to see if you like it.

Is it Safe to Use a Password Manager?

Yes – a good quality password manager is a safe, trustworthy and highly recommended security tool. In fact, security experts almost uniformly believe that password managers are infinitely safer than virtually every alternative there is, for businesses and individuals alike.

Top password managers, such as 1Password, Dashlane or LastPass, can be trusted to protect your account logins thanks to secure encryption that keeps your passwords secret.

Here’s how it works in practice. You create an account with a password manager, then create a single “master password” to log into it. To keep your password manager safe to use, it’s essential that your master password isn’t anything obvious. So that’s no to “12345,” “qwerty,” or “passwd.” Instead, pick a longer phrase or mix and match cases and special characters – just ensure it’s unique and memorable.

Then, the password manager can get to work automatically generating complex, unique passwords for every service you log into online – one for your Amazon account, email account, Facebook account and so on. You won’t need to memorize these – whenever you login in, the password manager will automatically apply the password (and you enable the password manager via that single master password).

This entire process is far more secure than re-using the same password over and over on multiple sites – the single biggest risk you can take with you and your business’ online security. It’s also far easier than attempting to remember multiple unique passwords.

So, if it’s all win, why are there any questions around password manager safety? Largely, these come down to an understandable concern over the security of handing over your logins to a third-party service. That’s why we’d recommend only using a trustworthy, well-rated password manager. So which ones would we recommend?

Most Secure Password Manager

If you want a secure password manager, you should opt for a paid one. Free password managers tend to be restricted in some way, and are usually supported with adverts. Additionally, free password managers are simply not set up to handle a full business’ security needs, which means paid for is always the way to go.

In our testing, we found LastPass to be the most secure password manager. For a few dollars a month, it could save you a lot of headaches, as well as time spent waiting for password reminder emails to drop into your inbox.

Do Password Managers Get Hacked?

No online system is infallible. Password managers – just like any other online service you use, such as Amazon, Twitter or Facebook – run the risk of being hacked. In fact, some have been.

The best password managers, however, will take your security very seriously – after all, you’re paying for the service. If you lose trust in them, they lose your patronage, and with it, your payment.

When LastPass was hacked in 2015, users were right to be concerned – after all, if a hacker could get into the system, they could, in theory, have access to every password that LastPass users had stored there. However, even though its security was breached, hackers were unable to steal any information – all of the passwords were protected by the users’ Master Password, which is not stored on the LastPass servers. This meant that the encryption on the passwords stored by LastPass was unable to be cracked. And that is why you should pay for a password manager.

Password managers are also a common target for ‘ethical hackers’ — those who like to test the security of online systems to flex their coding muscles. Password managers are their white whale – crack one of these open, and they’ll win the acclaim of the industry.

This isn’t as scary as it sounds though. In fact, ethical hackers are offering a great service, finding exploits in online systems before more nefarious people do. Once they’ve found a vulnerability, these hacklers will make contact with the service and let them know, allowing the provider to then fix the issue.

Verdict – Should You Use a Password Manager?

We can’t state this clearly enough – a password manager is a safe, recommended way to secure your online logins. The alternatives are far, far riskier – in particular, that old habit of re-using the same old password again and again across multiple websites (please, just don’t).

No system is guaranteed bullet-proof, and as the LastPass hack showed, even password managers can be vulnerable. However, as that very incident showed, there are serious protections in place, and these prevented the LastPass hack from being a disaster for any customers.

In the age of hybrid work and vast security breaches, we’d strongly recommend getting up and running with a password manager for proper online peace of mind.

If you are looking for an expert to help you find the best solutions for your business talk to GCInfotech about a free technology assessment

Published with consideration from Tech.co SOURCE

/by
,

HTML attachments remain popular among phishing actors in 2022

HTML files remain one of the most popular attachments used in phishing attacks for the first four months of 2022, showing that the technique remains effective against antispam engines and works well on the victims themselves.

HTML (HyperText Markup Language) is a language that defines the meaning and structure of web content. HTML files are interactive content documents designed specifically for digital viewing within web browsers.

In phishing emails, HTML files are commonly used to redirect users to malicious sites, download files, or to even display phishing forms locally within the browser.

As HTML is not malicious, attachments tend not to be detected by email security products, thus doing a good landing in recipients’ inboxes.

Statistical data from Kaspersky indicates that the trend of using HTML attachments in malicious emails is still going strong, as the security company detected 2 million emails of this kind targeting its customers in the first four months of the year.

The numbers culminated in March 2022, when Kaspersky’s telemetry data counted 851,000 detections, while a drop to 387,000 in April could be just a momentary shift.

How HTML evades detection

The phishing forms, redirection mechanisms, and data-stealing elements in HTML attachments are typically implemented using various methods, ranging from simple redirects to obfuscating JavaScript to hide phishing forms.

Attachments are base64 encoded when present in email messages, allowing secure email gateways and antivirus software to easily scan attachments for malicious URLs, scripts, or other behavior.

To evade detection, threat actors commonly use JavaScript in the HTML attachments that will be used to generate the malicious phishing form or redirect.

The use of JavaScript in HTML attachments to hide malicious URLs and behavior is called HTML smuggling and has become a very popular technique over the past few years.

To make it even harder to detect malicious scripts, threat actors obfuscate them using freely-available tools that can accept custom configuration for a unique, and thus less likely to be detected, result and thus evade detection.

For example, in November, we reported that threat actors used morse code in their HTML attachment to obfuscate a phishing form that the HTML attachment would display when opened.

Kaspersky notes that in some cases, the threat actors use encoding methods involving deprecated functions like the “unescape()”, which substitutes “%xx” character sequences in the string with their ASCII equivalents.

While this function has been replaced by decodeURI() and decodeURIComponent() today, most modern browsers still support it. Still, it might be ignored by security tools and antispam engines that focus more on current methods.

Conclusion

HTML attachment distribution was first seen spiking in 2019, but they remain a common technique in 2022 phishing campaigns, so they should be seen as red flags.

Remember, merely opening these files is often enough to have JavaScript run on your system, which may lead to automatic malware assembly on the disk and the bypassing of security software.

As the security software doesn’t detect an attachment as malicious, recipients may be more likely to open them and become infected.

Even if your email security solution doesn’t generate any warnings, you should always treat HTML attachments as highly suspicious.

Are you interested in learning more about cybersecurity? Call us today and discover how our wide array of tech services can safeguard your business.

If you are looking for an expert to help you find the best solutions for your business talk to GCInfotech about a free technology assessment

Published with consideration from bleepingcomputer.com SOURCE

/by

Should employers monitor remote employees?

With remote work becoming the new normal for many businesses, employers can’t help but worry about how much work their employees are getting done. One way to determine this is by monitoring employees online. However, this practice can raise privacy concerns. This article will shed light on what employee monitoring is and how it can help your business.

What is employee monitoring?

Employee monitoring is the practice of using digital tools to track employee activity and performance, and the progress of their tasks. The data collected can be used to identify patterns, trends, and correlations across different teams allowing managers to gain insight into various work processes, and how they can be improved.

What are the benefits of employee monitoring?

Here are the key benefits of monitoring your employees online:

1. Improved productivity
Using employee monitoring tools can help you track how much time employees spend visiting non-work-related websites or chatting with friends. If an employee’s productivity goes down significantly because of these activities, you can address the issue by reminding that specific employee about the company’s policy regarding visiting non-work-related websites and/or limiting his/her internet access.

When employees know that their activities are being monitored, they’re more likely to focus on their tasks and avoid inappropriate internet use.

2. Better security
According to Verizon’s 2021 Data Breach Investigations Report, 85% of breaches reported in 2020 were due to human error. Monitoring the online habits of employees can help employers track and flag instant messages and emails containing sensitive and private information. In addition, managers can block employees from visiting phishing sites or websites that automatically download malware onto unprotected computers and mobile devices.

3. More efficient project management
Monitoring employee activity provides managers with continuous reports on workers’ progress, allowing them to stay on top of multiple projects. These reports can help managers delegate tasks and adjust schedules to meet deadlines.

What are the disadvantages of monitoring your employees online?

Despite its benefits, employee monitoring also comes with some drawbacks, such as:

1. Trust issues
Employees may feel that their privacy is being violated. This can lead to low employee morale and reduced productivity, as well as distrust between and among colleagues.

2. Legal issues
States and countries may have varying policies on employee monitoring, but one thing is constant ⁠— an employee’s consent is needed before any type of monitoring can be done.Without the consent of an employee, an employer can be charged with privacy violations and discrimination if the information collected is used to harm that employee.

To avoid potential problems that can arise from employee monitoring, employers should explain why monitoring is needed. A written policy should be created explaining how employees will be monitored, what information will be collected, and how that information will be protected.

If you want to learn more about employee monitoring, give us a call today.

If you are looking for an expert to help you find the best solutions for your business talk to GCInfotech about a free technology assessment

Published with consideration from TechAdvisory.org SOURCE

/by
,

FBI says business email compromise is a $43 billion scam

The Federal Bureau of Investigation (FBI) said today that the amount of money lost to business email compromise (BEC) scams continues to grow each year, with a 65% increase in the identified global exposed losses between July 2019 and December 2021.

From June 2016 until July 2019, IC3 received victim complaints regarding 241,206 domestic and international incidents, with a total exposed dollar loss of $43,312,749,946.

“Based on the financial data reported to the IC3 for 2021, banks located in Thailand and Hong Kong were the primary international destinations of fraudulent funds,” the FBI said.

“China, which ranked in the top two destinations in previous years, ranked third in 2021 followed by Mexico and Singapore.”

This was revealed in a new public service announcement published on the Internet Crime Complaint Center (IC3) site as an update to a previous PSA from September 2019, when the FBI said losses to BEC attacks reported by victims between June 2016 and July 2019 reached a total of over $26 billion.

According to the IC3 2021 Internet Crime Report [PDF], BEC scams were the cybercrime type with the highest reported total victim losses last year.

Victims reported losses of almost $2.4 billion in 2021, based on 19,954 recorded complaints linked to BEC attacks targeting individuals and businesses.

BEC scam?

BEC scammers are employing various tactics — including social engineering, phishing, and hacking — to compromise business email accounts which will get used to redirect payments to attacker-controlled bank accounts.

In this type of scam (also known as EAC or Email Account Compromise), the crooks will commonly target small, medium, and large businesses. Still, they’re also attacking individuals if the payout is worth it.

Their success rate is also very high, given that they generally impersonate someone who has the target’s trust, such as business partners or company executives.

However, “the scam is not always associated with a transfer-of-funds request,” as the FBI explained in the PSA alert.

“One variation involves compromising legitimate business email accounts and requesting employees’ Personally Identifiable Information, Wage and Tax Statement (W-2) forms, or even crypto currency wallets.”

BEC defense guidance

The FBI also provided guidance on how to defend against BEC scam attempts:

  • Use secondary channels or two-factor authentication to verify requests for changes in account information.
  • Ensure the URL in emails is associated with the business/individual it claims to be from.
  • Be alert to hyperlinks that may contain misspellings of the actual domain name.
  • Refrain from supplying login credentials or PII of any sort via email. Be aware that many emails requesting your personal information may appear to be legitimate.
  • Verify the email address used to send emails, especially when using a mobile or handheld device, by ensuring the sender’s address appears to match who it is coming from.
  • Ensure the settings in employees’ computers are enabled to allow full email extensions to be viewed.
  • Monitor your personal financial accounts on a regular basis for irregularities, such as missing deposits.

The federal law enforcement agency advises those who fall victim to BEC fraud to immediately reach out to their bank to request a recall of funds.

They’re also urged to file a complaint with the FBI at BEC.ic3.gov, regardless of the lost amount, and as soon as possible.

Published with consideration from BleepingComputer  SOURCE

/by

The differences and benefits of two-factor and two-step authentication protocols

Both two-factor authentication and two-step authentication are processes that can help keep your business safe from data breaches. But while they serve the same purpose, these two methods are vastly different. In this blog post, we will discuss the differences between two-factor authentication and two-step authentication, as well as the benefits of each process.

According to the Allianz Risk Barometer, businesses are more worried about cybersecurity threats compared to other business disruptions like supply chain issues, natural disasters, or even the COVID-19 pandemic. This is why business owners are ramping up data security measures. One way they do this is by implementing two-factor and two-step authentication. Many businesses use the two terms interchangeably, but these processes are quite different.

Two-factor authentication

Two-factor authentication (2FA) is a security measure used to ensure that people trying to access a system are who they say they are. 2FA requires users to provide two pieces of information before being granted access.

When you try to log in to a system that uses 2FA, you’ll be asked to provide not only your password but also another piece of information or form of identification. This second factor can be something you know, like a PIN or a security question, or something you have, like a physical token or key fob. If you have the correct password and the second piece of information, then you’ll be granted access to the system. Because of the additional authentication information required, hackers would have great difficulty breaking into a network using a 2FA system.

Two-step authentication

Two-step authentication (2SA) is an extra layer of security that can be added to your online accounts. 2SA requires you to enter both your password and a code that is sent to your phone or email before you can log in.

Adding 2SA to your online accounts can help protect your information from being hacked. Even if a hacker knows your username and password, they will still need the code that is sent to your phone or email before they can log in to your account.

There are a few different ways to set up 2SA. Some websites, like Google and Facebook, offer 2SA as an additional security measure that is especially useful when you or someone else is trying to log in using a new or different device. Others, like Dropbox and Twitter, require you to set up your authentication profile in the settings page before you can use their app. A 2SA setup is typically quick and easy, and only requires you to have your phone or email immediately accessible when you log in.

Which one is better?

Relying on a single-factor authentication process is no longer sufficient in ensuring the safety of your network. Securing the authentication process and making it difficult for cybercriminals to access your network should be on top of your priorities. Deciding whether to use two-step or two-factor authentication largely depends on your business’s specific security requirements. To take the stress out of choosing which between the two methods better suits your needs, call us today for expert cybersecurity advice.

Are you interested in learning more about cybersecurity? Call us today and discover how our wide array of tech services can safeguard your business.

If you are looking for an expert to help you find the best solutions for your business talk to GCInfotech about a free technology assessment

Published with consideration from TechAdvisory.org SOURCE

/by
,

Microsoft Teams for dummies: A simple tutorial for beginners

This guide will take you through the essential Microsoft Teams features

Following the rapid shift to remote or hybrid working, many employees were simply expected to know how to use video conferencing tools like Microsoft Teams. However, for the majority of the workforce, a day spent in the office meant little more than responding to emails. The sudden adoption of Microsoft Teams for long-distance meetings and remote collaboration took some getting used to.

Given the pace at which the Covid-19 pandemic spread, the usual adjustment period and training to accommodate the use of Teams simply didn’t take place. Fortunately, Microsoft has tried to make the transition as streamlined as possible by providing an intuitive platform that is full of easy-to-use features for even the most inexperienced IT user.

However, if you’re still unsure about using Teams, we’ve come up with a handy guide that goes over some of the most important features below:

Signing up

Perhaps the most important step to using Teams is the first one: signing up. This is easily achieved by visiting https://products.office.com/microsoft-teams. Then simply enter the email address associated with your Microsoft account and select “Next”. Then enter your password and select “Sign in”. There may be a few more details to enter but then you should select “Set up Teams.”

After that is complete, it’s time to choose how you want to open and use Teams. Microsoft Teams is available in several different versions – with Windows, Mac, mobile, and web options all available. Download or access your chosen version of Teams and the signup process is complete. If you want to know more about logging in, this guide will show you how.

Exploring the Teams interface

The best way to understand how to use Microsoft Teams is to explore its user interface. On the left, you’ll see the App bar, where you’ll find a whole host of different icons. These include “Activity,” which displays mentions, replies, and other notifications, as well as “Meetings” or “Calendar,” either of which is synced with your Outlook calendar and provides a quick way of viewing all your upcoming meetings. There’s also “Chat,” “Files,” “Calls,” “Store,” and “Feedback.”

Aside from the App bar, the interface also boasts the “Teams” section, which displays a list of the user’s teams, “Channel,” the “Command Bar,” and various “Tabs” that allow you to move between different Teams pages. There are lots of additional features to get to grips with as well, so it’s a good idea to start investigating the interface to see what’s on offer.

Collaborate in a Microsoft Teams hub

In order to collaborate with others in Teams, you first need to join or create a Teams hub. To do so, select “Teams” from the App bar, followed by “Join” or “Create a Team.” If you’re creating a team, enter your chosen name and description, select your privacy settings and add your members.

A team can have a maximum of 2,500 members – so the opportunities for collaboration are pretty vast. You can also assign roles to each individual, such as “Owner” or “Member.” If you’re finished with a particular Teams hub, you can always choose to “Delete the team.”

Setting up a Teams call

Another of the most important actions to understand on Teams is how to set up a call. One of the ways is to select the “Schedule a meeting” button during a chat to set up a call with all the people involved in the chat. Alternatively, you can select the “Calendar Meetings” button followed by “New meeting.” Then if you select a time in the calendar, a scheduling form will appear for you to finish setting up the meeting. Once you’re happy with the meeting details, click “Save” and the relevant individuals will be sent a meeting invitation.

Don’t worry if you want to invite someone that doesn’t have Teams to a meeting either. As long you have their full email address, you can invite them. They’ll receive an email with a link to the meeting so they can join just like any other attendee that has a Teams license.

Take part in chat

Sometimes a full-blown video call may not be necessary, so Teams enables

collaboration to occur through its chat function. In order to start a new chat, click on the “Compose Box” and begin typing. Click “Send” to deliver your message to any individual in the team or channel that you’re working in.

One of the best aspects of the chat function is that any new member that is added can look back at all the previous messages – even those that were posted before they joined. This means it is easy for them to get up to speed with a new project.

Sharing files

Following the creation of a Teams hub, a SharePoint site is automatically set up, complete with a document library for each channel. Any file uploaded to Teams will be visible from the Files tab and simultaneously stored in SharePoint. If you want to open the file directly from SharePoint, you can click on the three dots located after the file name and select “Open in SharePoint.”

Accessing help

If you feel like you’ve exhausted all the assistance you can find from third parties, you can always try Teams’ built-in help feature. Towards the left-hand side of the app, you’ll find the “Help” button, where Teams provides localized advice on a host of topics. These are organized by feature, but there is also a “Videos” section displaying visual content on how to use the app.

Teams also has its own dedicated support webpage, which provides guidance, training, and tips so you can discover how any aspect of the platform works. With all that and the above guide, you’ll go from dummy to Teams expert in no time.

Fortunately, there’s another way to find the right app for your business: ask the experts. Contact us today for an IT assessment!

If you are looking for an expert to help you find the best solutions for your business talk to GCInfotech about a free technology assessment

Published with consideration from TechRadar.com SOURCE

/by
,

Is Cloud Computing Safe for Small Businesses?

You might wonder if now is the right time for your small business to turn to cloud computing for all your data storage needs.

While you’ll find many benefits with cloud computing, you might also have concerns over potential security issues. Fortunately, you can embrace the advantages of cloud computing while still keeping your small business and your customers’ private information safe.

Look into ideas such as hybrid cloud computing, which costs less money and gives similar advantages to companies. You’ll still gain the safety net of a third-party provider, but for a fraction of the cost.

Here are some things to keep in mind when considering whether cloud computing is a secure option for your small business.

1. Train your workers to identify attacks.

Phishing usually starts with an email made to look as though it’s from an official source.

Teach your staff to go directly to a website and never click on links within an email. You can significantly reduce social engineering attacks by training your workers to recognize them.

Phishing can also look like an email from someone higher up in a company, but will actually be from someone trying to gain access to accounts. It’s always best to double-check requests for passwords or personal information by calling the other employee directly.

According to Verizon’s 2021 Data Breach Investigations Report, approximately 36% of breaches come from phishing attacks. Phishing is quite avoidable if you train your workers to recognize and avoid it.

2. Install virus and malware protection.

Make sure every device used by your company or its employees – even remote workers – has the latest virus and malware protection installed.

One of the biggest threats to the computing safety of your small business is workers not protecting their accounts. Hackers can do a lot of mischief if they get their hands on login credentials.

Make sure any device used to access accounts has protection installed. Remote workers may need to go through IT to ensure they add two-factor authentication and install all available software.

Companies should provide protection and follow up frequently to be sure it gets installed and updated properly.

3. Insist on strong passwords.

One way people allow hackers into their accounts is by reusing passwords, not changing them frequently, or using easy-to-guess combinations.

At a minimum, you should change all your business passwords every few months, including any passwords to cloud computing software.

Encourage employees to use passwords that aren’t easy to guess and contain lowercase letters, capitals, numbers, and characters.

Don’t forget to watch the passwords you use for software as a service (SaaS) applications. A company with under 500 employees uses as many as 123 different SaaS apps.

For example, if you use several different websites for various tasks, make sure you change passwords when an employee leaves or you terminate them. Not keeping up with passwords opens your business to vulnerabilities.

4. Set clear security policies.

Avoid confusion over security protocols by setting some policies.

What happens to customer data when you no longer need it? How often do you change passwords? Are there tiers to data access?

Figure out what works best for your organization and set the rules. This helps current and future employees know what’s expected of them.

5. Comply with all applicable laws.

Know the rules surrounding data protection.

For example, if some of your customers reside in the European Union (EU), you fall under the General Data Protection Regulation (GDPR) and must comply with the rules or face fines.

States such as California have similar standards. Your state and local governments may vary, so be sure to check any applicable laws.

You also must comply with laws in areas where your out-of-state customers reside.

6. Set a budget.

McKinsey & Company recently noted most companies plan to have $8 of every $10 in their IT hosting budget go toward cloud hosting by 2024.

The pandemic brought many companies online with cloud access for remote workers they weren’t planning to implement yet.

The increase in data means an increase in online criminal activity.

So, is cloud computing safe for your small business? The answer isn’t always the same, but most cloud hosting providers invest quite a bit of money into the most recent security measures possible.

It’s likely as safe as any other method of storing data, short of keeping information only on paper, which isn’t practical. Set a budget that meets your company’s goals. You can always increase it if you feel your data isn’t safe enough.

Is cloud computing safe or not?

Cloud computing is as safe as any other form of digital data storage.

You should ensure any companies you hire have the latest in safety standards and security. Take steps to protect your information, such as training employees and frequently changing passwords.

With some good security practices and awareness, it’s much less likely that you’ll face a data breach.

While the cloud offers a wide variety of benefits and solutions, choosing the service which is best for your company’s needs can be tedious. To ease this burden, we can help you find the best solutions for your business. by talking to GCInfotech about a free technology assessment. We’ll you find the best solution your business needs, ensure proper migration and implementation allowing you to focus on running your business.

Published with consideration from SmallBiz Technology SOURCE

/by
,

Why managed IT services is best for SMB cybersecurity

Without technology, businesses cannot compete and succeed. But with the advancement in technology comes the ever-constant threat of hackers and cybercriminals. That’s why small- and mid-sized businesses (SMBs) need to protect themselves with robust cybersecurity solutions managed by reputable managed IT services providers (MSPs).

The numbers

Through the years, the number of SMBs falling victim to cyberattacks has drastically increased. Ransomware attacks, misconfigured systems, credential stuffing, and social engineering are among the many cyberthreats that SMBs face. Also, according to Verizon’s 2021 Data Breach Investigations Report, one in every five data breach victims was an SMB. What’s more, only 47% of SMBs are able to detect breaches within days.

The financial consequences have also considerably increased. IBM’s Cost of a Data Breach Report 2021 shows that “data breach costs rose from USD 3.86 million to USD 4.24 million.”

The numbers don’t lie, so it’s only about time SMBs take cybersecurity seriously. You can safeguard your business from cyberattacks and provide a more secure customer experience by working with a trusted MSP.

Why managed services?

Partnering with MSPs is the most effective way to prevent attacks and defend against malicious threats. MSPs offer a full range of proactive IT support that focuses on advanced security, such as around-the-clock monitoring, data encryption and backup, real-time threat prevention and elimination, network and firewall protection, security awareness training, and more. Here are some of the services an MSP can offer:

    • Around-the-clock monitoring – A cyberattack can happen at any moment. By having someone watching your networks and systems 24/7, MSPs ensure that any potential threats are identified and dealt with quickly.
    • Data encryption and backup – Data encryption transforms readable data into an unreadable format. This can be done through the use of a key, which is only accessible to authorized users. This way, even if the data is compromised, it can’t be read without the key. Meanwhile, data backup is the process of creating and preserving copies of data so that it can be restored in the event of data loss.
    • Real-time threat prevention and elimination – By using technology that can detect and stop threats as they happen, this security solution can minimize the impact of an attack and keep your business data safe.
    • Network and firewall protection – Networks and firewalls create a barrier between the business network and the internet, securing confidential data, such as customer information, employee records, and trade secrets. Networks can be configured to allow certain types of traffic through while blocking others, so that only authorized users can access specific resources.
    • Security awareness training – Now, more than ever, SMBs need to be aware of cybersecurity threats and how to protect themselves. MSPs can facilitate security awareness training that can help employees spot red flags and know what to do (and not do) to keep company data safe.

Managed IT services are designed to identify and fix weak spots in your IT infrastructure, enabling you to optimize the digital backbone of your business processes. With managed IT, you’ll also have faster network performance, a solid business continuity and disaster recovery strategy, and minimal downtime. You’ll also get a dedicated team of IT professionals ready to assist you with any technology-related problems. This is much more effective and budget-friendly than having in-house personnel juggling all of your business IT needs.

Being proactive when it comes to cybersecurity is the only way to protect what you’ve worked hard to build. If you’d like to know more about how managed services can benefit your business, just give us a call — we’re sure to help.

Are you interested in learning more about cybersecurity? Call us today and discover how our wide array of tech services can safeguard your business.

If you are looking for an expert to help you find the best solutions for your business talk to GCInfotech about a free technology assessment

Published with consideration from techadvisory.org SOURCE

/by
,

5 Cybersecurity Tips That Small Business Owners Should Know

Small businesses aren’t exempt from Russian cyberthreats, according to US officials. Here’s what to know.

In the wake of Russia’s invasion of Ukraine, cybersecurity concerns in the US are mounting for small businesses, home offices and larger enterprises, according to national security alerts issued by the FBI, DHS and CISA.

Even though government-sponsored attacks are gaining public attention, cyberattacks from independent actors or groups are always a concern for small to midsize businesses. Factors like budget and IT staff limitations can leave small businesses more vulnerable to cyberattacks. The Small Business Administration reported there were 32.5 million small businesses in the US as of 2021.

There’s no foolproof way to completely protect yourself from online attacks, but the first step is to understand what the threat is, where your business may be at risk and which proactive steps you can take. To that end, we’ve compiled a list of cybersecurity tips for small business owners.

Know the most common cyberattacks

Cyberattacks can take many forms and are constantly evolving, according to the US Small Business Administration, but the best defense is knowing the most common cyberattack forms like malware, viruses, ransomware and phishing.

Malware is an umbrella term for malicious software that aims to damage your computer, server, network or client.

Viruses and ransomware are also considered as types of malware. Viruses mean to infect your computer as well as other devices, leaving your system vulnerable. Ransomware, which has been on the rise in the US, works like a virus, but is usually delivered through a phishing email and essentially holds your system hostage until a sum is paid.

Phishing is a type of scam that tricks people into clicking links that appear legitimate, but are actually malicious. Clicking the link infects your device with malware. Once your system is infected, cybercriminals can attempt to steal sensitive information. Phishing falls in a wider category of social engineering, a tactic meant to deceive individuals into disclosing sensitive information or clicking a malicious link.

Train employees to be security-conscious

Cybersecurity is a team effort. Make sure your employees create strong passwords and reset them on a regular schedule. Employees should be aware of red flags that indicate phishing emails and malicious files, as well as have an action plan in the event that an attack happens. It’s also important to keep devices, software and browsers up to date. The FCC suggests establishing clear guidelines for internet use, how to best handle customer data, as well as penalties for violating those policies.

Secure your Wi-Fi networks

Your business’ Wi-Fi should be secure, encrypted and hidden, according to the FCC. Your business’ router needs to be password protected, and it shouldn’t broadcast the network name.

If your small business is operated out of your home, consider whether it’s time to upgrade your router to handle modern security threats. If you’re new to Wi-Fi networking, CNET has a handy FAQ that covers the basics.

Back up your files

Cyberattacks often mean to compromise, delete or steal your data. Backup programs can help mitigate this risk. It’s even better if the backup software you’re using lets you set up a schedule or automate backups, according to cybersecurity firm Kaspersky. Keep a copy of your backups offline in case of a cyberattack.

Use antivirus software

Finding the right antivirus software is an important weapon in your small business’ arsenal against cybercrime. Antivirus software doesn’t have to break your bank either — Microsoft Defender is free for Windows, for example. Check out CNET’s guide for the best antivirus software for more information.

For more information, check out big tech’s efforts to support Ukraine shift the industry’s role and how you can help Ukraine refugees and those affected by Russia’s invasion.

Are you interested in learning more about cybersecurity? Call us today and discover how our wide array of tech services can safeguard your business.

If you are looking for an expert to help you find the best solutions for your business talk to GCInfotech about a free technology assessment

Published with consideration from cnet.com SOURCE

/by