Category: IT How To

Posted on

Top Tips for Improving Data Analysis with the IF Function in Microsoft Excel

Microsoft Excel Training

Improving Data Analysis with the IF Function in Microsoft Excel

Have you ever wondered what the IF Function in Microsoft Excel actually does?  Here we explore a few top tips for making it save you time while evaluating data. 

 

There’s no doubt that Microsoft Excel is a robust program. Companies all over the globe utilize this application to analyze, track, and otherwise organize data in an easy-to-read format. But how much do you know about it and the various features that are available? And are you taking the right steps to ensure you’re looking at your spreadsheets in the most efficient manner possible? Here are a few of our tips and techniques to help you save time and improve your data analysis by using the IF Function in Microsoft Excel.

Tip #1: Understand What the IF Function Actually Does to Help Your Workflow

The first real step in making sure you’re using Microsoft Excel’s IF Function appropriately is to understand what it actually does. The IF Function tests whether a condition is true or false, and then performs an action. These actions can be calculations, data entry, or something closely related. The function is incredibly useful if you have large data sets or need to make significant changes, as it is a great way to save time in your workflow.

Tip #2: Creating the IF Function is Incredibly Easy

Creating the IF Function effectively starts with knowing the three parts: the logical test and then a value if true and a value if false. From there, all you have to do to make it work with your spreadsheet is to choose the data sets that you want to evaluate and determine what you want the true and false results to be. To do this, use the IF Function on the Insert a Function menu. Click okay and enter the conditions as you are prompted to do so on the screen.

Tip #3: Knowing How to Nest Functions

It is possible to use multiple IF Function formulas at the same time. In some cases, you might have multiple different possibilities or different levels of data that you want to compare. That’s when knowing how to nest multiple IF Functions becomes important. Nesting functions adds the ability to build more comparisons within your formulas instead of having to complete them separately.

Tip #4: Adding AND and OR to Your Functions

You can also add AND and OR to your IF Functions to make the results much more specific. While this is technically part of understanding how to nest functions, knowing how to do this is an effective way of utilizing the IF Function in a more efficient manner. An example of this is comparing two columns of data: one showing the amount of sales and one determining if an employee has completed training. By adding AND or OR to your IF Function, you can show a specific result, such as those employees that hit a specific sales goal and finished the training program you provided. As you can see, this can be a really easy way to get the information you need without having to spend a ton of time scouring through your entire spreadsheet.

Tip #5: Using Range Names to Make Data Easier to Sort

Range names are essentially a stored label that allows you to identify a range of one or more cells. They are incredibly useful for navigation, formulas, and even printing off specific parts of your spreadsheets. For use with the IF Function, you can utilize data ranges to save time when you’re working on a specific block of values as it allows you to use that range name instead of specific cell names. Range names can have letters, numbers, or an underscore, but cannot have spaces. And they are not case-sensitive, but title case is recommended for ease of viewing.

Tip #6: Remembering to Use Quotations with Text Strings in Your IF Function

Using the IF Function is an incredibly easy way to add text to a specific cell when certain criteria are present. However, you do need to remember to use quotations around your text strings in your IF Function formula. Failure to do this can really mess up your data set and make the formula not work correctly. Should you have a problem getting the IF Function to work for you, this is one of the first things you need to check.

Tip #7: Changing Text with Conditional Formatting Based on Your Result

Not only can you add text or insert a formula with the IF Function, but you can also change text visually with conditional formatting based on your result. It can be done automatically and setup within Excel under the Home tab. Examples of this option in use include turning a specific number bold and red if it does not meet the criteria of your IF Function, or highlighting it in yellow if it does meet certain requirements.

Conclusion
Microsoft Excel is a great way to analyze and interpret datasets. The IF Function allows you to do this in an easy-to-read and simple manner while saving you tons of time in the long run. These quick tips are a great way to skip complicated formulas and really make your spreadsheets work for you.

Microsoft Excel Training

Posted on

What Is Two Factor Authentication?

Two Factor Authentication

Protect Yourself – Use Two-Factor Authentication for Your Business

Learn about what two-factor authentication is and how it works. Once you understand its benefits you will see how helpful it could be for your business.  

 

Two-factor authentication is something every business should be using to protect themselves and their customers. You know the value of adding layers of security to your business. If you have a brick and mortar operation, you probably have a lot more than a simple lock on your front door. Security cameras, alarms, barriers and more are common for most businesses because one layer of security is never enough. The same is true for online security. Two-factor authentication gives your business and customer another layer of protection beyond the standard password – so why not use it to improve your security?

What is Two-Factor Authentication?

You have probably already encountered two-factor authentication as you navigate the internet for personal or business reasons. All the major tech companies like Google and Facebook are using it because it makes sense to do so. The process of two-factor authentication goes something like this:

  1. Input your username and password. Two-factor authentication starts off just like your standard security measures. You input your username and password for the site you are trying to access or the app you are trying to use. This is the first step of the authentication process, the first factor.
  2. Provide a second factor to authenticate yourself. Here is where two-factor authentication becomes special. It asks for you to provide a second factor that is much harder for hackers to mimic. For example, it might ask to send an authorization code to your smartphone or ask for your fingerprint to verify your identity. Hackers are much less likely to have these available to mimic you and try to access your account.

You have definitely encountered the older way to verify your identity – security questions. But security questions have become less and less effective at protecting your information than they used to be. Most security question answers can be found on your social media account, after all. Hackers can spend just a little time doing some research to find all the answers they need, particularly if they have already stolen your password from another site through their cybercrime efforts.

How to Use 2FA in Your Business

You can easily implement two-factor authentication or 2FA into your current business security efforts – both for your employees and your customers. There are multiple ways you can use two-factor authentication, including:

  • Text Messages (SMS). Most people prefer to use SMS to verify their identities over the other methods listed below because it is so easy to check your text messages and access the authorization code. All the user needs to do is log in with their username and password, then receive the code through SMS and type the code into the verification box. The only drawback to this method is that if the user loses their phone they can’t authenticate.
  • Email. You can also allow users to send their verification code to their email. They need to be able to access their email – which usually isn’t a problem – but if they can’t this method would not work. The other problem that can come up with emails is that they can sometimes get caught in spam filters and never arrive at the person’s inbox.
  • Phone Call. While this option is not used nearly as often as the two above, it is a possibility depending on the system you are using. The user can choose to get a phone call which will use text to speech to deliver the code they need to log in.
  • Tokens. Some companies find it easiest to give employees tokens, either hardware tokens like key fobs or software tokens through apps, that can then be used to provide the second factor in the authentication process.
  • Push Notifications. It is possible to get an app that will allow users to receive push notifications so that they can authenticate their accounts. They get the notification and then click yes or no to authenticate.

2FA is possible using a variety of methods – the most important thing is that you start using it to begin with. Whichever authentication method you choose, your business and your customers will be more secure as a result.

Two Factor Authentication

Posted on

Does Your Cybersecurity Plan Include Incident Response Measures?

Incident Response Planning

Has Your Business Fallen Behind In Its Incident Response Strategy?

Incident Response plans are proving to be a key element in data breach recovery. That’s why proactive industry leaders are adding and updating these strategies.  

Incident Response Planning

Entrepreneurs and other decision-makers are acutely aware that doing business in the digital age requires robust cybersecurity. Most companies employ standard anti-virus scans, firewalls, and other commonplace measures to protect valuable data. But we are all just as keenly aware that the number of debilitating data breaches suffered continues to uptick despite business leaders’ best efforts.

From 2017 to 2018, the number of exposed records increased from 197 million to more than 446 million, according to reports. Cybercriminals will ultimately continue their efforts to come up with increasingly deceptive ways to penetrate business networks and leverage personal identity files, financial records, and other information that can be ransomed or sold on the dark web. How your organization responds to a breach could have lasting implications about business sustainability. That’s why companies now need an Incident Response plan embedded into their cybersecurity strategy.

What Does An Incident Response Plan Entail?

Proactive business leaders are enlisting the help of cybersecurity experts to create a viable response to an otherwise debilitating breach. These plans are crafted with input from key stakeholders to be ready to identify, contain, mitigate, and make a full recovery from a cyber-attack.

What many industry professionals may not realize — until it’s too late — is that recovery from data and financial loss could be the least of your problems. When employees, shareholders, and other businesses are impacted due to a hack of your network, you could be facing civil litigation. With that goes the industry reputation you worked so hard to develop. To truly recover from a systems hack, industry leaders are pulling together their resources to implement a six-phase Incident Response plan.

How To Develop A 6-Phase Incident Response Plan

It’s imperative that decision-makers understand that a robust Incident Response plan is not a set-it-and-forget-it endeavor. As part of your overarching cybersecurity strategy, it will need to be revisited regularly. That’s mostly because digital bandits are ceaselessly finding innovative ways to penetrate business defenses. Regardless of their criminal activity, a deftly implemented Incident Response plan delivers results. These are the six necessary phases.

  • Preparedness: This phase calls for your valued team members to be trained to manage their clearly outlined responsibilities in the event of a cyber-attack. Common strategies for readiness include running mock breaches and ongoing education.
  • Threat Identification: A hacker can attempt to breach your system in a variety of ways. Targeting endpoint devices and convincing an unsuspecting employee to log in or click on a malicious link is among the most prevalent. Having the ability to identify threats and breach entry points promptly reduces response time.
  • Damage Containment: From the moment a breach or cybersecurity incident occurs, your ability to deter the spread of malicious software or the removal of data ranks among the most crucial ways to control the damage. Hackers may decide to destroy files after their theft to erase digital fingerprints. It’s in your best interest to have methods in place to swiftly regain control.
  • Eliminate Threat: Once you have secured control over your data, eliminating the threat must be decisive. The cause may be malicious software or login and password penetration. Whatever allowed the cybercriminal into your business system, it must be stamped out immediately.
  • Begin Recovery: Once you are satisfied that the threat has been eliminated, the team members tasked with restoring systems and data can do their job. Having an actionable Incident Response plan likely helped save essential data and shortened the time your operation was offline. If you believe other parties could be impacted, notify them promptly.
  • Post-Mortem Analysis: In the aftermath of a cyber-attack, specific team members should be designated to gather information and create a report to share with key stakeholders. There are valuable lessons to be learned that can make your organization better prepared the next time.

Although every business wants to be ready to defend against a cyberthreat, The Third Annual Study on the Cyber Resilient Organization indicates that upwards of 77 percent do not have a clearly articulated Incident Response plan in place. If your organization has not implemented an Incident Response strategy, we would like input about enhancing an existing one. It may be in your best interest to enlist a third-party cybersecurity consultant.

Posted on

Is Your IT Company Doing These Bad Cybersecurity Practices?

Managed Services Security Issues

Watch Out for These Bad Cybersecurity Practices in Your MSP

How good is your MSP at providing security for your business? Watch out for these potentially harmful cybersecurity practices in your managed service provider.   

Managed Services Security Issues

In a recent speech, Kyle Ardoin, the Louisiana Secretary of State, railed against managed service providers in the state for not doing enough to prevent cybercrimes such as ransomware attacks.

Like many other states in the Union, Louisiana has been walloped with such crimes. Numerous government offices and school districts have been affected, as have businesses and organizations in a breadth of industries. Ardoin stressed the fact that times are certainly changing where cybersecurity is concerned, and new types of crimes pop up every day. Still, he said, MSPs are the main party to blame, and he listed several bad MSP practices that have ultimately led to the recent rash of hacks and data breaches.

Whether you own a small business, manage a large enterprise, or work in a government office, it’s vital that your managed service provider not be doing any of these practices. As Ardoin appropriately stressed, “As attacks grow more sophisticated, many MSPs have not been upfront with their clients about the need to invest more in security. This leads to serious problems for their clients, and the MSPs themselves.”

Think about the managed service provider that you are currently working with. If they are doing any of the following, speak to them about remedying the issue, or seriously consider looking for a new MSP to work with.

What Are the Top Bad Practices MSPs Do?

1. Using outdated technology

While system patching, firewalls, and antivirus software were enough to protect most businesses in the past, today, these preventive measures simply don’t cut it. Newer, better solutions are out there.

2. Not implementing enough authentication features

Password and credential leaks are the number one way that hackers infiltrate systems. Ensure your MSP is enforcing two-step authentication and password-free authentication (biometric verifications, such as face recognition or fingerprinting) wherever possible.

3. Not staying up-to-date on the latest types of attacks

MSPs need to keep current with the increasingly sophisticated attacks that hackers are fighting with. Their techniques and goals are ever-changing, and it’s not up to you, the client, to know how these criminals are attempting to infiltrate your systems. That’s what you pay your MSP to do.

4. Not providing security training for your employees

Again, employee password and credential hacking is a top way that hackers infiltrate their targets. Likewise, phishing scams are another type of attack that directly affects employees. For this reason, it only makes sense that much of your cybersecurity plan needs to include training your employees. This is a service that your MSP should provide.

5. Not being upfront with you about cybersecurity dangers

It’s not uncommon for an MSP to understand the threats to their clients (you), but to be afraid or timid about asking you to invest more in your protection. This shouldn’t be a factor in their service. Instead, they must be upfront with you about the threats you’re up against and what you must do together to prevent a breach.

Should You Consider Working With an MSSP Over an MSP?

Ardoin was serious about the problems plaguing current MSP practices around Louisiana and the rest of the country. His solution was to recommend that more businesses, organizations, and government offices turn to MSSPs over MSPs.

The core difference between the two is that MSSPs are primarily focused on security instead of being an overarching provider of all things IT as MSPs are. MSSP stands for managed security service provider while MSP stands only for managed service provider.

If you are unhappy with your current managed services, speak with your MSP about the issue, or begin looking for either an MSSP or another MSP who will be better equipped to handle the cybersecurity challenges of today.

Posted on

7 Myths Small Businesses Still Believe About PC Technology

Slow Computers

The 7 PC Myths Draining Your Business Technology Budget

Evaluating your business technology budget? These 7 PC myths could be costing you a lot of money. From slow computers to hacker vulnerability, see how to fix it.  

Slow Computers

Think you’re saving money by keeping those old PCs running in the office? Think again. An Intel study found that using a business PC that’s older than five years costs the business nearly $700 a year in repair and maintenance costs alone. What other costly PC myths are draining your technology budget?

Myth #1: A Slow Computer Has a Virus

Slow computers are productivity killers. If you have slow PCs, studies show that the average employee loses 40 min/day due to downtime.

That’s on top of 29% reduced productivity due to slower processing.

For many years, office workers have proclaimed, “it’s got a virus”. But the truth is there are many reasons that computers slow down over time. And your technology solutions partner will have many troubleshooting techniques in their tool belt to speed up slow work stations.

So if the virus scanner turns up nothing, know that you have options. Here are just a few things you can try:

  • Clearing caches and history
  • Rebooting if you haven’t rebooted for a few days
  • Closing programs and re-opening (not a good long-term solution)
  • Reducing the number of start-up programs
  • Checking for conflicting malware protectors

Myth #2: Macs Don’t Get Viruses

Who knows where this one started? Probably Apple or Apple enthusiasts trying to get a foothold in the business computer market. Truth, Macs are just as susceptible to malware. Whether you’re a Mac business or a PC business, you need a comprehensive cybersecurity strategy.

Myth #3: Letting Your Battery Run Down Before Charging to Extend Battery Life

This was true on older devices. Leaving a laptop docked on a charger would kill the battery life.

But if you have business laptops, tablets and phones that are less than five years old, this is no longer the case. Devices with lithium-ion batteries do not suffer this fate. On top of that, Microsoft, Apple and Android now use machine learning to track your charging habits and avoid straining the battery.

Myth #4: Our Business Is Too Small to Be Targeted by Hackers

Actually, over 50% of cyberattacks happen to small businesses. They’re often less prepared. And they may be complacent, thinking what are the chances they’d attack us?

Most cyber attackers don’t go for the big score. Instead, it’s more efficient to go for the least protected. Attacking 10 poorly protected small businesses versus one better protected medium-sized business will yield a higher ROI for the hackers.

That’s smart business!

Myth #5: Consumer PCs and Business PCs Are Interchangeable

This is especially untrue now. With so many people doing most of their computing on their phones, home computers haven’t needed to advance much beyond the technology of 10-15 years ago.

Instead, manufacturers have focused on the business market, where businesses demand faster processing and greater capabilities. For this reason, the fact is, if you’re buying PCs for business, make sure they can handle business computing.

Myth #6: RAM Is All That Matters

RAM, random access memory, is important for speed. More RAM means less buffering (traffic jams). But a computer is a lot more than RAM. It has an advanced CPU (processor) that uses that RAM most efficiently.

Otherwise, your computer is just a lot of muscle without the brains to use that muscle wisely.

Myth #7: No Need to Replace Computers that Still Work

We already mentioned how much time employees waste on slow computers. That payroll waste and downtime isn’t the only thing you need to worry about when trying to use computers beyond their shelf life of up to five years.

Older computers are also more susceptible to viruses. Eventually, they can’t support current operating systems. Microsoft stops supporting older OS after a while, leaving them open to attacks.

Newer operating systems often also have better productivity tools that streamline business operations. And they’ll work more effectively with new programs you want to install. A technology solutions professional can help you weigh the cost-benefits of getting new PCs.

And for more business technology management tips, follow our blog.

Posted on

Bolster Cybersecurity Readiness with Strategic Investments

Cybersecurity Defenses

Bolster Cybersecurity Readiness with Strategic Investments

Protecting your organization from cybercriminals is gaining complexity and requiring more resources than ever before. Do your leaders understand the implications of a lack of cybersecurity funding?  

Every day, your organization’s digital assets are under attack from cyber criminals around the world. Many of these individuals will never even know the name of your corporation — they are simply attacking at random and hoping that their wide net will haul in big treasure. Other hackers are laser-focused on bringing down your company, looking up unique details about your officers on LinkedIn and other social media platforms while testing the waters with small breaches to determine access available access levels. Safeguarding your innovation and valuable customer data may come down to your organization’s ability to strategically invest in the right cybersecurity tools . . . and gaining the support of knowledgeable individuals that are continually enhancing their knowledge of security procedures. See how these strategic investments in the future may be all that stands between your business and the devastation that can occur during and after a cyberattack.

Cybersecurity Defenses

Helping Executives Navigate the Cybersecurity Landscape

Perhaps one of the largest challenges facing IT leaders is helping executives across the organization understand the dangers inherent with a lack of cybersecurity without requiring deep levels of technical knowledge. When technical professionals become passionate about a particular topic, bringing the focus back to the business impact can be difficult. Creating a direct correlation between specific cybersecurity incidents and corporate results provides a method of framing the conversation that helps ensure IT receives the necessary funding for strategic investments in cybersecurity. Helping translate the results of cybersecurity spending into real terms allows this type of project to be weighed objectively against other strategic initiatives under consideration for the same budget dollars.

Aligning Resource Allocation with Cybersecurity Realities

How many individuals do you have focused solely on cybersecurity within your organization? One? Ten? None? Whatever the number, it is unlikely to be enough to handle the response needed in the event of an attack. Even an all-hands-on-deck effort by all your technicians and engineers will require scaling up and education before these individuals can be effective at staving off the aftereffects of a massive attack. Working with IT managed services providers to create a holistic approach to cybersecurity not only provides access to advanced tools but also offers a more expansive skill set in terms of cybersecurity. Making an early investment in prevention includes everything from active monitoring to web-based content filtering, all activities aimed at reducing the possibility of an attack — and limiting the negative impact to your organization in the event of an incident. When you align internal resources around managing external cybersecurity assets as opposed to attempting to build that internal infrastructure, you are gaining flexibility and scalability that would be extremely difficult to grow organically in an affordable fashion.

Creating a Culture of Cybersecurity Awareness

As you’re sharing this information with senior leadership, one important topic to consider is how to create a culture of cybersecurity awareness. Each time your employees open an email, navigate to a website or fill out a form online is a potential danger to your organization, but are staff aware of the risks they are taking on a daily basis? A strategic investment in training and ongoing education could be the detail that stops a wayward employee from inadvertently providing information to hackers, allowing them to infiltrate your cybersecurity net. A recent study by The Aberdeen Group found that you can reduce the risk of socially engineered cyber threats by up to 70% when you launch an aggressive cybersecurity awareness training that includes a component of ongoing education.

Investing in cybersecurity protection requires an ongoing commitment from senior leadership and a firm focus on the benefits of this investment from technology directors without bogging executives down with the technical details of individual tactics. From advanced cybersecurity tools to active defense and training solutions, finding partners that are able to provide cohesive strategies to protect your organization is going to be an integral component of your success in the security realm.

Posted on

These Phishing Headlines End Up Fooling The Smartest IT Professionals. 

Modern Phishing Email and Article Headlines That Even Fool Savvy Tech Professionals

Learn more about the kind of email phishing headlines that end up fooling the smartest tech professionals, and how you can better protect your business.  

Phishing Headlines

Any tech professional worth their salt understands the damage wrought by unsuspecting users clicking on links inside “phishing” emails. It’s not surprising when tech-challenged individuals end up getting sucked in by today’s social engineering attempts. However, some of the headlines used by hackers manage to fool a lot of experienced IT pros.

Emails aren’t the only place where tech professionals show their vulnerability. Messaging portals in spaces like Facebook and LinkedIn have become prime targets for scammers, especially as traditional email providers step up their protections. In fact, both platforms had the highest success rate for phishing scams when they were included in an email subject line at 28 percent and 55 percent, respectively.

How Do Experienced Tech Professionals End Up Getting Fooled?

It’s hard to imagine how the people charged with keeping company systems safe end up ensnared in these schemes. Security-minded individuals become so comfortable in their knowledge of suspicious emails and technology in general that it makes them less careful. They’re prone to quickly scanning and clicking emails and messages without absorbing the information. It’s already too late by the time they realize their error in judgment.

What Makes a Phishing Headline Successful?

Phishing email headers that include words like “Request,” “Follow-Up,” and “Urgent/Important” tend to have a higher click rate, especially if it seems they come from a colleague or high-level executive. Victims often feel compelled to respond quickly out of fear of not delivering on job expectations. They also worry about costing the company money by failing to follow through on requests related to finance and payments.

The manipulation of that social element can have the same effect on tech workers. They’re more likely to respond quickly to a request that seems to come from a company vice-president. No one wants to be the person preventing them from getting back to company business.

Let’s look at some of the headlines used to fool regular users and IT professionals.

  1. Requests for password changes
  2. Deactivation of Microsoft Office email service
  3. Setting up employee raises for HR
  4. Document sharing using a secure server
  5. Lack of internet service due to scheduled server maintenance.
  6. Address needed for FedEx delivery
  7. Locked company twitter account
  8. Complete steps for Google service
  9. Error with Coinbase
  10. Closed company bank account

How Can Businesses Upgrade Their Current Phishing Protections?

There’s no one step a business can take to prevent someone from falling for a phishing scam. It pays to use a multi-pronged approach to blocking and dealing with suspicious emails and websites targeting company workers.

Tools like SPAM filters, mock phishing practice scenarios, and web filters to block malicious websites should be a priority. It also pays to encrypt sensitive company information, making it harder for employees to share the data with anyone. That goes double for telecommuters who must log into company systems remotely from different devices.

Businesses should initiate company-wide security initiatives and enforce them consistently. Make sure IT employees understand that their knowledge doesn’t leave them immune to these types of attacks.

Posted on

Hackers Increasingly Targeting Business Conversations

Conversation Jacking

‘Conversation hijacking’ Seeks Sensitive Business Intelligence

Your employees probably know not to open unexpected file attachments or click on random links, but what if an attachment arrives as part of an email conversation with trusted colleagues?

Sophisticated hackers are using a technique known as “conversation hijacking” to insert themselves into business operations, gain insight into sensitive details, and exploit the information for financial gain. What should you know about this insidious form of cyberattack on businesses?

Conversation Jacking

Conversation Hijacking: Infiltrating Business Communications

New research indicates that the incidence of conversation hijacking increased by more than 400 percent in the second half of 2019 alone.

In a conversation hijacking attack, a hacker uses various methods for gaining access to business credentials — for instance, an email login. By using the phished information, the hacker then may join an existing email conversation by posing as someone already involved in the conversation.

Conversation hijacking attacks are mounted by hackers willing to invest significant time to gain access to sensitive information. The hacker may read through numerous emails and conduct research online to learn about business deals in progress or other potentially valuable information.

By gaining the trust of other people in the email thread, the hacker then can use a variety of techniques for gaining access to banking information and financial assets.

Forms of Conversation Hijacking

Conversation hijacking can take a number of different forms, with information coming from a range of different sources. Hackers may compromise email accounts through phishing or data breaches and use the stolen account information to stage account-takeover attacks.

A hacker then may spend time monitoring an email account — including ongoing message threads — to gain information about sensitive business details or financial arrangements. An attack may involve a hacker creating a fake domain similar to the real domains used by a company. In the case of domain impersonation, the goal is to create a domain similar enough to the real domain that unsuspecting employees click or download files without realizing the error.

Hackers also may impersonate the domain of a client, vendor or business partner to gain the trust of employees for the ultimate purpose of accessing financial accounts and information.

Protecting Your Business

Conversation hijacking can be more difficult to detect than other types of hacking, but you can take steps to protect your business, your employees and your clients and partners.

The most important step you can take is ensuring that your team members understand how conversation hijacking attacks work. They should always use caution when downloading files or clicking on links and take time to ensure that all information — including domain names — matches their expectations.

In addition, any requests for financial information or immediate payment should raise red flags and should be reported to your company’s accounting department. If an employee doubts the authenticity of an email, they can contact the sender by phone or by starting a new email thread with an email address known to be accurate. Employees also should report to your IT team any email conversations or other incidents that seem suspicious.

Additional security measures — including robust email filtering and inbox rules — also can help, and restricting macros within documents can limit the means for hackers to gain access to account information. Multi-factor authentication also can provide extra protection against sophisticated conversation hijacking attacks.

Posted on

Keeping You Safe from Juice Jacking

Juice Jacking

Learn about juice jacking and how to prevent you or employees from becoming a victim. 

Here’s a new cyber threat to worry about: Juice Jacking. Read on to learn what about juice jacking and how to prevent yourself or employees from becoming a victim.

Juice Jacking

What Is Juice Jacking?

One common feature of modern smartphones is that the power supply and data stream pass through the same cable. When you plug your phone in to charge, hackers could theoretically access your phone through the same cable and inject malicious code or steal your personal information.

Your USB connector has five pins. However, it only uses one of those five pins to pass-through power for charging. Two additional pins are used for transferring data. So, when you charge, you could also be opening a port for passing data between devices.

We have only seen unconfirmed reports of juice jacking happening in the real world, but engineers have demonstrated how it is possible. In theory, threat actors might hide a device in a public charging station at airports or hotels. It’s a big enough concern that the District Attorney’s office in Los Angeles recently put out a warning to travels to avoid using public USB charging stations.

The FBI put out a warning about a device that’s small enough to fit inside a USB charger that can steal keystrokes from wireless keyboards. Another device hidden inside a USB charging station accesses your video display. It then records a video of everything you do, which might include passwords, accounts numbers, or PINs.

How To Prevent Juice Jacking From Happening to You or Your Employees

We’ve been warning people about the potential danger of using public Wi-Fi stations for years. Hackers can set up Wi-Fi hotspots in coffee shops and other public places then intercept data as it’s sent back and forth to your device. Now you can add public charging stations to the list of potential problems.

This doesn’t mean you shouldn’t use them. You just need to take basic security precautions to stay safe.

  • Avoid using public USB charging stations or plugging into computers that you aren’t familiar with.
  • Instead, use an AC power outlet and your own charging device. No data transfer is going to take place when you’re using an AC outlet and your charger.
  • Consider external batteries, power banks, or wireless charges if you need a charge on the go.

You should also avoid the temptation to plug into a USB charger you find left plugged in somewhere. It may be waiting for you to plug in and infect your device.

For iOS users, you can also use USB Restricted Mode which allows charging but prevents data transfers under certain circumstances. You’ll find it by going to Settings > Face ID & Passcodes (or Touch ID & Passcode) > USB Accessories. For Android users, USB data transfer should be disabled by default. If you want to check to make sure that’s the case, plug in your phone in a safe place, click on the notification and check USB Configuration options.