Blog

The COVID-19 pandemic has been very disruptive to businesses across the globe. Some businesses that rely on store front traffic like restaurants, coffee shops and hair salons are completely closed. Other businesses have shifted to a work from home model in order to stay open during this time of social distancing. It is the latter type of business that is at the most risk.

Why? Maybe as a business owner you have set up some type of remote access so your employees can work. Is that remote access method secure? What type of device is your employee accessing your network from? Is their home network secure?

Chances are that pretty good that your employees are using some type of VPN technology to access their work. Maybe they are logging in and performing their regular functions like payroll or client record management from their home PC. Here is where it gets tricky:

The PC they use in the office is likely managed. You have a policy in place to keep it up to date. Your network is secured by your IT staff. Only legitimate employees are allowed in the building to access the secured computer systems, and the customer records. Great job!

Now they are working from their personal computers at home, that are likely not updated, and could be infected with malware. They are accessing your corporate network and transferring important or business critical data to and from their insecure PC, over their insecure wireless network in their house. How many of your employees changed their wifi configuration password from “admin” to something more secure?

To make matters worse, when employees are working in the office, they are used to a routine. They see people who might say “Hey Jim, did you get my email?” while at the coffee machine. Now everything is a little more disconnected without that conversation. Did this email really come from Jim’s coworker? Are your users more trusting than they should be? Are they aware that phishing scams are more likely while working without personal interactions like that?

User behavior is the number one key to thwarting bad actors. We can provide the training necessary to keep your business running. Contact us to find out more.

There is often a counter balance between security and usability. On one end of the spectrum is a completely secure system, but not usable. To ever be completely secure; to ensure the bad actors can’t access your systems, an organization has to ensure that their own employees can’t be bad actors. A completely secure system is one that isn’t usable. A computer that is powered off inside of a locked safe is secure, but is it usable? No, not really.

If we take that paradigm and apply it to your company, there are ways to ensure that the company is secure, but your system also has to be used. As a real world example, let’s discuss company A, that makes toys. They have several computers that they use for designing the toys, ordering new materials, invoices, billing, email and employee records. To be secure, the company shouldn’t allow any outside communication that can be compromised, but they need those communications for their business. If “secure” meant that they have 100% assurance that no one could access the system, the company can’t do their jobs to make toys. So how much security should be applied to compay A’s computer systems?

The answer is “just enough”. Just enough access to perform the critical task, but not so much access that it could be an avenue for a bad actor to exploit. Each process, application, communication method, employee and login must be checked under the guise of security to ensure that it is necessary for the business, and it is secure enough.

But how much is enough? Well, that depends on the amount of risk that item poses if it were compromised, as compared to the value of that item being examined. This type of Business Impact Analysis is something that each and every business SHOULD conduct to understand their risk posture. The risk around the company’s “secret sauce” is probably more valuable than past material invoices, so the “secret sauce” should receive more scrutiny.

Want to know more? Contact us today!

The key to security in any environment is to know what you have that needs to be secured. Seems simple, right? It’s not.

One of the most common ways that a organization or company is breached is through an unknown configuration. It could be a server that someone brought online for testing and left unpatched and forgotten, or a service account that has local admin rights but neglected and the password age is over a year. Perhaps it is a dual-homed server created to solve a specific problem, but left with little or no configuration.

It is often the case that after a breach detection, someone sees how it occurs and says “oh, gee, I forgot about that!” Or “I didn’t realize that was still online!” The reality is that when you are patching and doing your due diligence to make your organization secure, you can only do that for the assets and configurations you know about.

Enter configuration management. The process of configuration management is to create and maintain detailed documentation for all of your assets and all of their configurations as they currently are. This means an inventory of all of your servers, accounts, services, patch levels, switches, routers, workstations, vendor access etc. The reason you have this is so that when a critical vulnerability like BlueKeep comes out, and you want to apply patches, you can be sure you have patched everything in your environment.

On top of your configuration management system, it is important to internally audit your environment on a regular basis to discover any changes to your infrastructure that you weren’t aware of.

Want to know the most efficient ways to do this? Contact us today!

As a small or medium business, you are concerned with what you need to do, which rightfully so, is all about your business! But while you are managing your employees, customers, products, and bottom line, who is watching the gates? Security starts and ends with everyone in your company being aware of how to behave like they are personally responsible for the company’s security.

Your employees have their own lives; they have Facebook, they watch cat videos on YouTube, they send text messages from their phones, and they email family and friends from their personal accounts, all from company resources. There are inherent dangers to this, perhaps more than you realize.

A single user logs in to a company computer, and opens Chrome or Firefox to their Gmail inbox, and they also open Facebook. While they are working, they are managing their daily lives as well. One of them clicks on an email from what appears to be their email contact to look at a file or click on a link. Wham! That email wasn’t actually from their email contact, it was well-crafted spam. Their company PC is now infected with malware. Behind the scenes, that malware is now collecting other computers their PC connects to, customer databases, moving to other coworker PCs, and collecting their information as well. Within a short amount of time, almost every PC is infected, and the bad actors have a treasure trove of information about you, your employees, their passwords to your internal systems, your customer data, and your company secrets.

The bad actor might try to exploit your business, locking all of your PCs using cryptoware, making all of your data inaccessible unless you pay them a large ransom. Possibly the bad actor will find some of your user’s social data, and start a social engineering campaign to learn their habits, and blackmail them in to divulging company secrets.

Scared? You should be. This type of behavior happens every day.

But what can you do? The front line of cyber security is awareness and education. If your employees practice safe behaviors, know how to spot phony emails, and suspicious phone calls, you can thwart the attacks before they start. This type of training and education should start right NOW before you are in trouble. You shouldn’t decide to go to school only once you apply for a job and turned down due to a lack education. The same applies here. Education and awareness are preventative measures.

As the cyber security industry changes, so should the training. A good practice is to have a solid cyber security training program for all new employees and a refresher program every six months.

A custom tailored program works best to reach your employees and management staff, and should be as important as skills training or HR policy signing. After all, it is the fundamental security of your business that is at risk!

Want to know more? Contact us today!