Simulated Attacks Reveal How Easily Corporate Networks Fall Prey to Hackers

Cyber Hackers

Cyber attacks have become an issue of growing concern for institutions across a variety of industries. With so much of everyday life conducted online, it’s no wonder a new breed of hackers is intent on stealing information. How can you be sure your business is protected?

Cyber Hackers

In 2018, a number of high-profile companies have already experienced data breaches. Now they are left to deal with the repercussions of a dip in consumer trust, along with penalties, fines and perhaps even lawsuits.

The Meltdown, Spectre, Heartbleed, and ShellShock cyber breaches in recent years have proven that there is no one-size-fits-all solution to this growing problem. The time for businesses to act is now. Man-in-the-middle attacks, distributed denial of service attacks, and session cookie tampering all played a role in these data breaches, leading to the conclusion that businesses must do more to prepare themselves against a range of attacks.

According to CSO, cybercrime damage is expected to cost over $6 trillion annually by the year 2021. Software firm Rapid7, intent on cracking down on cyber attacks, conducted hundreds of penetration tests over the past 10 months to determine how well networks can combat cyber threats. The study, named “Under the Hoodie 2018” is filled with interesting data that sheds light on some of the most common cyber targets and what businesses can do to arm themselves.

What Is A Penetration Test?

A penetration test, or pentest, is a simulated cyber attack conducted to determine exploitable vulnerabilities in any given computer system. Pen tests can involve the attempted breach of a variety of application systems, including APIs, front and backend servers, and others. These tests are designed to uncover network vulnerabilities that may make a company susceptible to breaches.

Studies of this nature are vital for pinpointing which type of network misconfigurations are liable for hacker access, and how user credentials are being used. The insights provided by pen tests can help businesses create a plan of action against attacks, allowing them to fine-tune their security policies and find solutions to fix vulnerabilities before they’re impacted.

What Are The Stages Of Pen Testing?

Pen testing is typically divided into five stages. The first involves planning and reconnaissance, which means defining the goals of a test and clearly outlining the systems and testing methods that will be addressed. Gathering data is another important part of this stage, as it allows the test conductors to more clearly understand a target and the potential vulnerabilities to be encountered.

The second stage involves scanning and static analysis, which means inspecting an application’s code to determine its behaviors. Dynamic analysis, also part of the second stage, involves inspecting this code in a running state, offering a real-time view into its performance.

A pen test’s third phase most often includes gaining access to a network by way of web application attacks to uncover a specific target’s vulnerabilities. It is then the duty of the tester to attempt to exploit these by escalating privileges, intercepting traffic, stealing data, or doing other damage.

Maintaining access, the fourth stage of a pen test, involves determining how a specific vulnerability can be used to present a persistent threat. Often, persistent threats are used to steal sensitive data from an organization over a period of months.

Finally, comes the analysis of collected data. The tester will compile a report that details which specific vulnerabilities were exploited, what type of data was accessed, and the amount of time the tester was able to maintain access to the system while remaining undetected. All of this information combined paints a clear picture of what a business can do to protect itself against similar attacks in the future.

What Were The Results?

Rapid7 conducted more than 268 pen tests across a wide range of industries, 251 of which involved live production networks likely to hold real and confidential data. Of these 268 tests, 59% of the simulated hackers attacked from outside the target network, which would most likely be the case for the majority of today’s businesses.

The study helped gather a world of insight into the everyday user’s online security habits, or lack thereof. One interesting finding was that of password patterns. The findings suggest that the majority of users choose passwords of the minimum required length, and tend to use numbers at the end of the password.

The most common password used?  “Password1.” According to a popular password hacking website, it would take hackers .29 milliseconds to crack this password.

Overall, the study concluded that Rapid7 testers exploited at least one in-production vulnerability in nearly 85% of all engagements. For internally-based penetration tests in which the pen tester had local network access, that number rose to 96%. This means that success rates are significantly higher for penetration testers when they have access to internal LAN or WLANs.

This type of information is imperative in giving businesses a leg up in preparing their defense against cyber attacks.

What Is The Microsoft Government Cloud?

Microsoft Government Cloud

The Microsoft Cloud for Government is a comprehensive cloud platform designed expressly for U.S. Federal, State, and Local Governments to meet the U.S. Government’s thorough security and compliance regulations. Microsoft Cloud for Government meets the standards of many government agencies, including FedRAMP, HIPAA, and CJIS, to name a few. It has the flexibility to run in government, public, or private clouds with an integrated open platform. Microsoft Government Cloud was designed to meet the precise requirements of GovCloud.

Microsoft Government Cloud

What does GovCloud mean?

GovCloud denotes all the virtualization products and cloud computing solutions that are established expressly for government agencies, institutions, and organizations.

GovCloud was created to address and administer cloud solutions that meet the needs of IT as well as the operational, financial, and strategic objectives of the United States government.

What Can Microsoft Government Cloud Do for You?

Depending on the type of work you do – and who you work with – Microsoft has a wide range of cloud environments to meet your specific needs. Microsoft provides these three types of government clouds:

1.     Government Community Cloud (GCC) for local, civilian, and federal government agencies.

2.     GCC High for highly classified government users and those doing business with them.

3.     DoD cloud for intelligence agencies.

Let’s take a closer look at Microsoft cloud services and solutions for government.

1.     Microsoft Azure Government

For businesses, organizations, and agencies looking for cloud computing services, Microsoft Azure provides a directory of hundreds of different services you can use, including:

·       Databases

·       Full virtual machines

·       File storage

·       Services for mobile & web apps

·       Backups

In the past, an organization would host their own infrastructure using their own hardware. If more power was needed, they would have to purchase more server hardware. They would also have to pay someone to manage the hardware and pay for the Internet link to serve its customers or users.

Microsoft Azure gives you the advantage of paying for access to a massive pool of computing resources provided by Microsoft instead of running your own hardware or paying for the use of some someone else’s data center. Azure allows you to host email servers, user directories, web servers, databases, virtual machines, file storage servers, and much more.

Microsoft Azure features smaller upfront costs. Creating your own data center can be expensive and requires hardware, software, maintenance, and skilled workers to run everything. The risk of paying too much for hardware and software, or not having enough IT resources for your business is eliminated.

2. Office 365 U.S. Government

Microsoft 365 for US Government Cloud provides a package that includes Windows 10, Office 365, and Enterprise Mobility + Security features for U.S. Government customers. This service also includes versions for SMBs, educational institutions, customer service employees, nonprofits and more.

These services are designed to meet the security and compliance requirements of the United States government. Many agencies and organizations can benefit from using Office 365 for U.S. Government including local, state, and federal governments, as well as Tribal entities. This product will also work well for the defense industry and their contractors.

3. Dynamics 365 Government

Since the U.S. government has unique and ever-evolving requirements of the public sector, Microsoft created Microsoft Dynamics 365 Government that is available to qualified government entities in the United States. Microsoft Dynamics 365 Government involves the protections provided to the government community cloud aimed at four distinct functions: Customer Service, Sales, Project Service Automation, and Field Service.

Dynamics 365 Government offers a number of excellent features to allow users to interact using Skype for Business. It integrates well with other Microsoft enterprise service offerings such as Office 365 for Government.

Microsoft Dynamics 365 Government plans are available for the following types of government and private entities:

·       United States federal, state, local, tribal, and territorial government entities.

·       Private entities using Dynamics 365 Government to provide solutions or services to a government entity.

·       Private entities with customer data using Dynamics 365 Government to meet the government’s regulatory requirements.

Why Is Microsoft Government Cloud Important?

Organizations who provide services for any type of U.S. government entity, whether it be local, state or federal, need to meet the criteria of The National Institute of Standards and Technology (NIST) Special Publication 800-145. These stringent standards have been put in place to secure both “customer data” and “customer content.”

Customer data refers to all data, including text, sound, video, or image files, that are provided by a customer through the use of the Online Service.

Customer content denotes a specific subset of customer data that has been specifically created by users, such as content stored in databases. This includes, but is not limited to a customer’s private contact information. Content is commonly considered confidential and should not be shared over the Internet without encryption.

Conclusion

 

Microsoft Government Cloud gives organizations and government entities the security, power, and peace of mind knowing that they are meeting the strict standards required by the NIST. This, in turn, can prevent hefty fines and penalties, plus it protects consumers and others from global hacking scams.

What Employees Need To Know About Phishing Attacks

Phishing is just one of many tools in a hacker’s repertoire and happens to be one of their most effective.  Through phishing, hackers dangle their bait in front of preoccupied employees who would never dream that their PC could provide an open door for a hacker.  That’s why it is so important that employees understand how phishing works, how costly it can be, and what they can do to avoid letting themselves become an unwitting accomplice to a hacker’s attack on their company.

Phishing

The Nature of Phishing

Phishing involves a malicious entity that sends out emails that look like they are from reputable, well-known companies (maybe even the employee’s own employer) – but these emails are not what they seem.

Sometimes the purpose of a phishing email is to trick the recipient into revealing information such as logins, passwords, or personal information. Other times, phishing emails are used to install malware on the recipient’s computer. Once the hacker behind the phishing attack has succeeded in infiltrating the target system via login information or malware, the damage they cause quickly escalates.

Phishing Can Be Very Costly

So how expensive can phishing be?  Well, consider what happened to a bank in Virginia that fell victim to two phishing attacks in just eight months. Their disaster began when an employee received and opened a phishing email which succeeded in installing malware on company computers.  The malware was able to use the victim’s computer to access the STAR Network, a site used to handle debit card transactions.  Through the STAR Network, the hackers behind the malware were able to steal $569,000 in that one incident alone.

But that wasn’t the end of the matter.  Eight months later, even after hiring a cybersecurity forensics firm and following their advice to better secure their system, the same bank was victimized again through another phishing email.  This time, the hackers again gained access to the STAR Network, but then used the bank’s Navigator system.  Through those systems combined, the hackers were able to credit money to various bank accounts and then withdraw the money using hundreds of different ATMs.  Losses from this incident amounted to almost $2 million.

To make matters even worse, the bank’s cyber insurance provider denied coverage and the bank is now forced to pursue a lawsuit to recover their losses.

The Very Real Dangers Of Phishing Attacks

Phishing wouldn’t be so effective if it wasn’t so easy for busy employees to fall victim to seemingly legitimate emails or innocent-looking attachments.  The malware that was used to initiate the first attack on the bank discussed in this article was embedded in a Microsoft Word document.  Most of us have worked with thousands of Word documents during our careers and have never been victimized by one – but it only takes one time to cost a business millions of dollars.

In this case, once that document was opened, the malware was installed and the group behind it had access to what they needed. The bank in question hired Verizon to investigate both incidents. It was finally determined that the same group of Russian hackers were likely responsible for both attacks.

Common Sense Required

Even the most powerful of cyber security systems is still susceptible to attacks that take the form of phishing or social engineering. As long as people continue to subscribe to the view that firewalls, anti-virus, and anti-malware systems provide all the protection against cyberattacks that a company needs, then successful phishing attacks will continue. Education is one of the forgotten keys to foiling phishing attacks.

Employees need to be taught how to recognize a suspicious email and be given real-world examples of how convincing phishing emails can appear.  They need to be encouraged to view both emails and attachments with a critical eye.  Employees must also understand that, under no circumstances, is there a legitimate reason for someone to ask for their password.

Another aspect of this type of education is making sure that people realize that the targets of phishing are not C-suite executives or IT technicians, but employees from all levels.  Through a connection to the company’s network, any employee’s computer could serve as a launching pad for an industrious hacker’s plan of attack.

Conclusion

Phishing attacks are a reality that must be addressed if a company wants to avoid becoming a victim.  These attacks often result in very expensive losses that may not be covered by insurance.  While the importance of a rigorous cyber security system is never to be overestimated, neither is the importance of employee education.  Too many employees have unwittingly become accomplices in costly cyberattacks because they didn’t recognize a phishing email and never thought they could be the target of one.  The first line of defense against phishing isn’t a network firewall, but a trained employee who knows how to recognize a suspicious email or a questionable attachment.

Amazon AWS Vs Microsoft Azure: Which Cloud-Based Infrastructure Reigns Supreme?

Choosing a cloud infrastructure can be complex, even for seasoned IT professionals with vast knowledge of the benefits. There are plenty of perks associated with cloud-based infrastructure, and as the popularity of these services grows, so does the need to understand the similarities and difference between two of the industry’s heaviest hitters: Amazon Web Services (AWS) and Microsoft Azure.

Both tech giants in their own right, these two cloud-based offerings are two of the most trusted in the game, but which is best for your organization will depend on several factors, which we’ll discuss below.

Amazon AWS vs. Microsoft Azure

But First, What Is Cloud-Based Infrastructure?

Cloud infrastructure is among the basic products offered through the Infrastructure-as-a-Service (IaaS) model. It is intricate and carries a variety of components, including virtual servers, virtual PCs, virtual memory, virtual network switches, and virtual storage clusters.

With cloud infrastructure, users are able to create their own unique IT infrastructure, which comes with processing, storage, and networking fabric resources that are easily configured to a company’s preferences.

What Are The Benefits of Cloud-Based Infrastructure?

There are many benefits of cloud structure versus traditional physical infrastructure. For one, it does away with the frequent procurement, maintenance, and capacity planning that comes with the use of physical servers and storage. In addition to a low barrier to entry, cloud infrastructure also boasts low capital requirements and a low total cost of ownership. Typically, cloud infrastructure offers more flexibility in design with its easy set-up and ability to be replaced or deleted, and it is also highly scalable.

What Are The Primary Differences Between Amazon Web Services (AWS) and Microsoft Azure?

Amazon Web Services made its grand debut more than ten years ago, and it’s gotten progressively better since then. Operating since 2010, Microsoft Azure comes with its own long list of benefits, and while these two both share some similarities in their capabilities, there’s a world of difference between them.

AWS is known for stability, reliability, and an array of solid offerings. It groups IaaS offerings into four categories, which include:

  • Compute
  • Storage and Content Delivery
  • Database
  • Networking

With AWS, you can monitor your resource usage with innovative management tools like Amazon CloudWatch, and track API usage and user activity with AWS Cloudtrail. Other tools, like AWS Config, can be used for monitoring resource inventory and other changes.

Azure, on the other hand, is divided into categories such as Compute, Data Management, Performance, and Networking. It secures these services utilizing tools such as:

  • Azure Active Directory
  • Multi-Factor Authentication
  • Active Directory Federation Services
  • Others

Azure also boasts service and integrations to help monitor and alert businesses about their performance metrics and logs.

While cloud infrastructure can be of great benefit to a wide variety of organizations across a number of industries, it’s a solid option for government agencies as well. In fact, both Microsoft Azure and AWS have dedicated areas for Government on their clouds, which ensures that their strict needs for compliance are maintained at all times. Both services are said to be compliant with ITAR, HIPAA, DISA, FIPS, CJIS, and other organization standards.

What Is A Hybrid Cloud?

Making the transition from physical servers to the cloud can be an arduous process for businesses. There are many reasons why organizations may choose to forgo cloud infrastructure in lieu of their own data centers for some aspects of the business. With this, Microsoft has created support for unique hybrid cloud configurations.

Hybrid clouds allow businesses to run cloud applications and deploy cloud-model applications and infrastructure, all with the comfort of your own on-premises resources. This seamless transition between the two is allowing a growing number of businesses to explore the benefits of cloud infrastructure without totally abandoning what is tried and true.

Which Service Is More Affordable?

Although there are many factors that make cloud infrastructure more affordable than its predecessor, the savings aren’t always cut and dry. Many of the costs associated with cloud infrastructure are due to user behavior in addition to workloads. While trying to predict the costs can seem futile, both Azure and Amazon have cost calculators to make the process an easier one.

Will I Need Licensing For Cloud Infrastructure?

When it comes to cloud-based infrastructure, many users are drawn to the simplicity of licensing. With the cloud, users are automatically charged for licenses based on usage. If you happen to work for a big company, chances are you already own a number of expensive licenses. Luckily, not all hope is lost. Moving to the cloud won’t result in wasted investments, as Windows offers license mobility for application servers that qualify.

Cloud infrastructure is saving many businesses time, trouble, and money. If you think your organization is ready to make the transition to the cloud, you’d do well to do your research to determine which of these two possess the tools you need to make the most of a new and improved infrastructure.

Google’s Recent Speed Update (Questions/Answers)

Google Speed Update Is Now Out.

What Does This Mean for You?

On July 9th, Google began rolling out the Google Speed Update that they first announced in January 2018. So why is Google’s new speed update important for you if you have a business website?

Bounce Rates Affect Search Rankings

According to Google data, a 3-second load time increases the bounce rate by 32%. Bounce rate is an Internet marketing term used to evaluate web traffic. It represents the percentage of visitors who enter the site and then leave (“bounce”) instead of remaining to view other pages on the same site. What’s more startling is that if your site takes 5 seconds to load, it can increase your bounce rates by 90%, according to Google. To put it in laymen’s terms, every bounce could mean a prospective customer lost.

Since 2010, Google has determined that site speed is a direct ranking factor. Google sees a bounce as a strike against the site in their rankings. At the time, in 2010, this was a desktop-only search update, but the new update includes mobile sites as well.

Google now suggests that website creators embrace a mobile first attitude to accommodate a large number of people now using mobile devices to browse the web. This means that pages should load in less than a second, as slow sites will pay the price in terms of lower search rankings.

While this new update only affects a small percentage of queries and has no precise sign of percentages, according to Google, it’s still important to investigate how Google’s speed update affects you.

What Pages Will Google Speed Update Affect?

The speed update will only affect the slowest pages; the ones that Google states, “deliver the slowest experience to users”. If you already have a site with pages well optimized for speed, this update is not exact enough for you to troubleshoot ways to lower your load time by milliseconds.

However, if you do have pages with poor load times, the update should cause you to sit up and take notice. Many companies depend on consistent organic traffic to push their business, so poor load times should be a big concern.

How Can You Determine Your Page Speed?

It’s important to determine how fast your site loads and where the holdups are. There are several tools you can use to do this. Here are some helpful tips you can use to measure and troubleshoot website speed and page load times.

Google Page Speed Insights

A good place to start for measuring website load times is Google Page Speed Insights. On this site, type and enter the URL of the page you want to check. You will get a report evaluating page speed and user experience, as well as tips on ways to make your website faster.

Pingdom

Pingdom has a website speed test tool similar way to Google Page Speed Insights, but it gives you a report divided into several sections. These include page analysis, a performance grade and a waterfall analysis, helping you identify the most vital causes of website slowdown and how to fix them. It also does a great job of explaining its analytics and testing using a color-coded system.

GTMetrix

GTMetrix combines information from other online page speed tools. After you enter your URL into the on-screen box, it generates a report highlighting tons of different aspects of website load times, and it grades each one from A to F. This grading system lets you take a peek at the areas of your site that worked well and the ones that need your help. Also, GTMetrix ranks the serious issues first, in order of importance, so you know what needs the most attention.

Google Analytics

Google Analytics shows you which pages are underperforming and gives tips on how to identify significant trends as to whether things are getting better or worse. It does this by including site speed in its reports, which can be found in the Behavior section. The Page Speed Suggestions link shows how individual pages could be improved, allowing you to focus on the most important pages first.

How Do You Fix Website Page Speed Issues?

Once you have identified the holdups on your site, the next move is to fix them. All of the tools listed above make suggestions.

Here is a list of the most common recommendations you find on these tests:

  • Reduce the size of your images
  • Refine your hosting
  • Optimize your code
  • Use a content delivery network
  • Compress your site
  • Use caching
  • Optimize scripts
  • Reduce the number of external services you use

After you make the recommended fixes, it’s a good idea to test your site to establish a benchmark and re-test at regular intervals.

Any Other Suggestions?

One last tip that Google gives about the speed update is, “The intent of the search query is still a very strong signal, so a slow page may still rank highly if it has great, relevant content.”

Although speed is important, it should not take precedence over the strength of your site’s content. Bad content that loads fast will not rank well. Good content is always going to make your site stronger.

However, if you have great content that is performing well, but your site speed is slow, you might as well take the steps to improve your speed to ensure the best rankings.

 

Can My IT Company Help Us Communicate Efficiently?

10 Effective Ways To Communicate In The Workplace

IT Company Communication

Communication is a very important aspect of any organization because it forms the basis of any work environment. Whether we’re talking about vertical communications between senior and junior employees or horizontal communication between team players, communicating effectively fosters good relations at the workplace. On the other hand, when there is a lack of good communication, there is often a high turnover of employees. You might also see poor work delivery and generally unsatisfactory results.

Here are a few tips to foster effective communication in the workplace.

Establish An Open Door Policy

This is a situation where team leaders make themselves available for consultations, discussions, inputs, contributions, clarifications, and even suggestions. When employees feel that they are always welcome to share what is on their minds, it helps to clear tension. Tension at the workplace leads to poor work delivery.

Conduct Open Meetings

This is a one-on-one kind of meeting unlike when meetings are held at online platforms or communication is done through email. This way, one is able to use other tools of communication such as gestures, facial expressions, tonal variation, and body language to put emphasis on important issues of discussion.

Use Simple Words

Choosing the right words to express a certain point is also important because the meaning could be lost in between. Some words when used in a certain context can easily come across as being offensive. Words used in communication must be simple and easy to understand. If you use hard and complex language you might need to explain yourself and in the process loose meaning during communication.

Listen

Listening is also a very important aspect when communicating. This is because communication is a two-way street. Encourage the team players to open up and air out their concerns. Ask questions. Ask for clarification if necessary. This way, everyone can offer some guidance and also feedback about whether you are making your point or not.

Use Visual Aids

The human mind is more visual and so things seen are more easily remembered than things said. That’s one reason why PowerPoint presentations are so effective. Add tables, images, charts, and graphs. This way your presentation is not boring and it is broken down into small portions for easy understanding.

Be Articulate

This a very important tool used by speakers. If you are not articulate, you end up losing your audience’s concentration and thus you fail to communicate effectively. Articulate simply means audibility, a good mastery of the language, and even a good understanding of the topic of discussion.

Encourage Modern Forms Of Communication

Depending on the information being presented, modern forms of communications such as the use of the intranet, social media platforms, and video conferencing may prove to be more effective than simple open meetings. Some employees would prefer discussions about certain issues to take place on social media platforms. This is also a way of encouraging interaction between employees, which is very important.

Organize And Participate In Social Events

Celebrate important occasions in the organization once in a while by sponsoring employee retreats, end-year parties, team building, and even employee promotions. This could be a good way to reward all employees across the board and also motivate individual employees to work harder in their stations. It offers a good change of pace and provides valuable time to rest and rejuvenate so as to improve productivity.

Orient New Employees

In order to ensure that new employees fit in properly, it is very important to take them through the basic structures of your organization. Introduce them to the other employees and also ensure that they are aware of the communication channels in place. The first day of work can be hectic for anyone. With effective communication, use of friendly gestures, and hospitality, the employer can make a new employee have an easy time settling into their new position. It’s not possible to take new employees through all there is to know about your organization. Be sure to make all your internal training documents available so they can read through these in their spare time. This will make it easier for them to adopt the organization’s culture and within no time they will become effective team players.

Assess Your Internal Communication Strategy

This can be achieved by seeking feedback from the employees. Ask them to forward their suggestions on how to improve the communication strategies in place. Employees know what’s going on at the grassroots level. They may be able to share a fresh point of view.

Conclusion

It is not possible to achieve 100% efficiency when it comes to communication in the workplace. This is simply because of various barriers such as cultural differences, languages, socio-economic differences, and many other obstacles. However, there are some important ways we can all improve the way we communicate with others.

Are You Safe From A Cyber Attack? (Business Owner Information)

5 Security Questions You Should Be Asking Your Team

Cyber threats are continuously advancing with new and more complex threats rising to the surface around the globe. In order for a business to meet its objectives and deliver its product and services, it has to be increasingly dependent on technology, including the Internet. While this increases cyber risks that could cause a disruption to your company, it is a manageable risk with the right cyber security solutions in place.

Cyber Attacks

Businesses face a multitude of cyber threats, some with severe effects that will require strict security measures. As a business leader, you may not need a clear understanding of the technical details, but in this new age, you should know exactly what your IT team is doing to protect your company from cyber threats.

Your team may have security protocols in place, but have you looked deeper into your cybersecurity lately? Where are your biggest weaknesses?

This article provides key questions to guide you in your discussions about cybersecurity risk management with your team.

5 Questions Leaders Should Ask About Cyber Threats

How Is Our Top Leadership Informed About Cyber Risks to Our Company?

Consistent communication between the company head and those responsible for

managing cyber risks provides constant awareness of current risks affecting the company and the impact it can have on a business. Since the buck stops with you, the CEO is responsible to manage and oversee the business’ risk management. This

oversight includes the on-going evaluation of cybersecurity budgets, incident reports, risk assessment scores, and policy improvements.

What Is the Present Business Impact of Cyber Risks to Our Company, and What Is Our Plan to Address These Known Risks?

Cybersecurity does not necessarily mean applying a checklist of requirements.  It is ensuring that your company is managing cyber risks to a satisfactory level. Managing cybersecurity risks keeps a strategic framework in place for your team that evaluates and manages cybersecurity risk throughout the company.

Identifying critical data and its impacts from cyber threats are crucial to understanding a company’s risk to exposure of a cyber-attack.  Whether you look at it from a financial, competitive, reputational, or regulatory point of view, risk assessment outcomes and team feedback is important to identify.

Is Our Cybersecurity Program Applying Best Practices and Industry Standards?

An across-the-board cybersecurity plan leverages industry standards and best practices

to protect systems that house your company’s important data. Your plan should uncover impending problems before they arise. This proactive strategy enables your team to initiate a timely response if an attack were to occur. Keep a strong recovery plan in place that prevents you from making rash decisions due to panic.

Establishing a good baseline for compliance requirements helps to address specific vulnerabilities, but they do not sufficiently speak to new and active threats or sophisticated attacks. Using a risk-based approach to apply cybersecurity standards and practices will result in much more cost-effective and comprehensive management of these risks than simple compliance activities alone. Consistently asking “what if” questions will help you stay ahead of the attack.

What Types of Cyber Threats Does Your Security Team Identify Each Week?

Your IT department should be able to calculate how much malicious traffic is being stopped by your current security protocols. Awareness of your business’ cyber risk situation needs to involve the timely detection of data breaches, and an awareness of current threats and vulnerabilities to your company. Your IT staff should be consistently analyzing, gathering, and integrating risk data from different sources and participating in threat information sharing with your team.  This will help you identify and respond to threats rapidly. The best scenario is to safeguard your network from attack in the first place.

How Far-reaching Is Our Cyber Incident Response Plan? How Often Do We Test It?

Do you have a network operations center reporting to you? They can provide real-time and trending data on current cyber threats. What about a manager who can identify deliberate risks, such as risks to the supply chain generated by third-party vendors? A high number of cyber-attacks involve third-party vendors who get careless.

An early response can constrain or even prevent an attack on your network. A significant piece of the puzzle includes your company’s cyber incident response preparation. Planning should be carried out in conjunction with other important entities that you interact with day-to-day.  This includes incorporating cyber event response procedures with your current policies. A strong disaster recovery and business continuity plan should already be in place.

Some key players in this security planning could include the following:

  • Chief Information Officer
  • Chief Information Security Officer
  • Business Partners
  • System Operator Partners
  • General Counsel
  • Public Affairs

Wrap Up

When you go through these 5 questions with your team, you will be able to better measure the condition of your current security and ensure you have a plan to proactively manage cyber security for the future. Revisit these questions often to accurately address new cyber threats. Cyber security is a dynamic, ever-changing field that requires vigilance.

What The Sunset Of Windows 7 Means To Its Users

Windows 7 is being “put out to pasture” by Microsoft at the beginning of 2020.  Not all Windows 7 users are aware of precisely what this means and how it can affect their day-to-day business.  Because of impending issues, such as steadily degrading usability and increasing security vulnerabilities, Windows 7 users need to know what to expect and what their options are.

Quick Background On Windows 7

Windows 7 was released in October of 2009.  Its purpose was to serve as an incremental upgrade to the not-so-well-received Windows Vista operating system. Windows 7 included some much-needed improvements to Windows Aero, the new user interface that Microsoft introduced with Vista, and with improved performance.  Users responded far more positively to Windows 7 than they did Vista, primarily because it addressed so many of Vista’s deficiencies.  The Windows 7 Service Pack 1 came out in 2011, and a platform update was released a few years later in 2013.

By 2014, however, Microsoft began preparations for the retirement of Windows 7 as they began stopping its retail sales.  Next, mainstream support for the operating system came to a halt.  In 2016, PCs were no longer shipped with Windows 7 pre-installed.  Microsoft then announced that on January 14, 2020, extended support for Windows 7 would end.  That was the official sunset announcement.

What Sunset Means

Sunset begins with Microsoft no longer offering extended support for Windows 7.  It also means no more security updates, bug fixes, or service packs.  That, in turn, means the usability, security, and performance of Windows 7 will begin to degrade with time.  On the surface, applications and the operating system will generally perform all right, but there will always be exceptions.  Over time, however, there will be a definite trend toward more issues, steadily poorer performance, and serious security vulnerabilities.

Why This Important to Windows 7 Users
Here is what a Windows 7 user can expect to see after sunset begins:

  • Software, utilities, and features may become incompatible
  • Applications no longer receive updates that apply to Windows 7
  • New devices (g., printers or webcams) may not be able to connect with Windows 7
  • Antivirus will not be updated, and third-party virus protection software will eventually stop supporting Windows 7
  • Software bug fixes are no longer patched, leaving the system open to exploitation
  • Online banking transaction systems may expire if their authentication and encryption methods cannot be supported by Windows 7

Also, incompatibility can quickly become a problem for companies whose customers or partners need them to use or interface with software that simply will not run correctly on Windows 7.  Running a sunset operating system can also cause problems when attempts are made to add devices or install new software.

The most serious issues with sunsetting are those involving security.  Hackers will know that Windows 7 has become vulnerable and will seek out ways to exploit those weaknesses.  This leaves a system susceptible to malware, ransomware, and viruses.  The probability of suffering from an attack that renders your computers unusable will continue to increase with time.

Windows 7 Sunset

Options Available to Windows 7 Users

If you are running Windows 7, then now is the time to start migrating to a new operating system.  The most straightforward upgrade path would be Windows 10, which still has some of the look and feel of Windows 7 with a plethora of new features and even better usability.

The other option for most businesses is switching to Mac OS.  This means an entirely new work environment for traditional Microsoft users. This option can involve a steep learning curve.  While some Microsoft packages, such as Office, are available for Mac OS, they work a bit differently and it will take some time for new users to become proficient. Macs can also be more expensive than a Windows-based computer system, but have a reputation for being more reliable.

Unless a business is heavily involved in video production or graphic design, Windows 10 is probably the best option.

Getting Ready to Migrate

Before migrating, perform an inventory of software and group each application into one of three groups: unwanted, optional, or required.  Some software may require an upgrade to run on a newer operating system.  Next, prepare a similar inventory of hardware.  As with the software, some hardware may need to be updated or replaced to remain compatible with the new operating system. Also, check the requirements of the replacement operating system, paying special attention to available hard drive space, physical memory, and processor or CPU needs.

Please note that if a machine is already getting a bit outdated (e.g., 7 or more years old), it might make sense to purchase a new machine with Windows 10 pre-installed. The Trump tariffs will cause an increase in the price of computers, scanners, printers, servers and even their components. So now is definitely the best time to buy!

Conclusion

With the sunset of Windows 7 impending, now is the time to start the process of migrating to a new operating system, whether it be Windows 10 or Mac OS.  Failure to upgrade will not only lead to issues with compatibility and performance, but will involve serious security risks.

Controversy Concerning Australia’s My Health Record

My Health Record is Australia’s approach to centralising the digital health records of its citizens. It provides an online-accessible summary of a person’s key medical information, including data such as medical histories, prescriptions, and known allergies. While this type of program isn’t anything new to Americans, My Health Record has only been in use for six years in Australia. Today, almost 6 million citizens are included in the system. The opportunity to opt-out is ending on October 15, 2018. Many Australians are not pleased about its implementation, beginning with the opt-out situation.

Australia's My Health Record

Opt-Out or Opt-In?

Currently, Australia’s My Health Record gives people the opportunity to opt-out. This means that unless someone chooses to take the necessary steps to opt-out, then a digital health record will be established for them. While many supported digitising and centralising health records when it was proposed as an opt-in situation, more and more people are distressed about its implementation using opt-out. They feel that the default for an individual should not be the creation of a digital health record; it should be just the opposite.

Benefits Of My Health Record

Many individuals that struggle with chronic medical conditions could benefit from digitalising health records. These citizens require multiple medications and many have life-threatening allergies (especially medicinal allergies). The general feeling about having all medical records centralised is positive, regardless of this odd opt-in/opt-out situation.

Australians who travel a great deal view this as a good thing because, no matter where they go, their medical records will follow them. Individuals living in more rural areas are also expected to reap the benefits of centralised digital health records.

Many argue that access to records will improve the healthcare that individuals receive, especially in emergency situations. Better access to health records will help to eliminate dangerous medical mistakes that come from a lack of information about a patient. This can help medical professionals make more informed decisions on behalf of the patient. Healthcare groups and leaders also point to a better coordination of care and a significant reduction in duplicate testing.

Potential Issues

Privacy is a major concern for most Australians that are opposed to digital health records. Health records are a big target for hackers, and such records contain some of the most private information about an individual. There are concerns about exactly who has access to medical information and whether access might be overridden in the case of an emergency. Also, health professionals do not have to explicitly request patient information in order to upload it to the record system as long as the patient has not opted-out.

Children and babies are automatically being assigned digital health records unless the parents take the appropriate steps to opt-out. Even when parents opt-out, mistakes are being made as digital records are still being created for children in some instances. The digital file created for a child can be canceled later on, but in the original plan, it would not be deleted. All files are to be kept on hand for thirty years after a person’s death, and then they will be archived for an additional 100 years. Recent changes have been made regarding concerns about this.

Another issue that arises with regard to children is the use of a shared Medicare card for families. This can prove especially problematic for non-traditional families or parents that are in situations where they share custody of their children.

Responding To The Objections

According to the Australian government, these digital health records are very secure and safely backed up. There have been only 35 breaches in the past financial year, which is a tiny fraction of the almost 6 million users already contained in the system. However, in response to citizen concerns regarding privacy, the Australian government has agreed to allow records to be permanently deleted, even after the deadline for opting-out.

In addition, it has been clearly stated that government and police agencies will not have access to records without the person’s consent unless they have a court order. Finally, leaders insist that no one is being signed up without their consent (not even children) although it is possible that they (or their parents) may not have recognised that they were giving consent.

Conclusion

Many see the recent government response to user concerns as a positive thing. But other Australian leaders insist that the system is still evolving. While providing critical medical information for those suffering from chronic illness, serious allergies, or victims in emergency situations, Australian citizens still see My Health Record as a potential invasion of privacy and a target for hackers. It is hoped that this program will evolve to better address issues where parents share custody of children. Generally speaking, most Australians believe that children’s rights to privacy should be respected regardless of what happens.

How to Record the Screen on Your iPhone or iPad

There’s no shortage of useful features on your iPhone, but just because there are so many doesn’t mean you’re utilizing your smartphone to its fullest. The iPhones and iPads of yore were good for little more than making calls, taking photos, and browsing the internet. However, today’s iOS capabilities have improved over time. With each new iPhone model comes a range of cool new features to play with. Since last year, these new features include the ability to record your screen, leaving many iPhone users to wonder how they ever did without.

Record Screen iPhone

Tell A Story with Smartphone Video

The Screen Record feature is improving the iPhone experience for users everywhere, especially in a world where a video is the weapon of choice for storytelling. There are a number of reasons why you may want to capture what’s going on with your screen. These reasons range from social and fun to professional.

Many people are visual learners, and explaining step-by-step instructions to someone is much more difficult than just showing them. From sharing footage of your own gameplay, to walking a friend through the steps of how to use certain features on their own phone, the ability to easily capture and share video on your screen is one you don’t want to skip out on, especially if you’re hoping to squeeze every ounce of use out of your iPhone.

Screen Recording, in a nutshell, allows you to capture what’s happening on your screen at any given time. The best part? You don’t even need a third-party app to make it happen. While, technically, the ability to record what’s on your screen has long been available to iPhone users, to do so was no easy feat.

Before the screen record feature made its way into iPhones, users were forced to go through the motions of opening up QuickTime Player and performing several steps to get the goods. Quick and efficient the process was not. Now the screen recording feature is built right into your iOS, allowing you to record your screen or capture individual screenshots with just a few taps.

How To Access Your Phone’s Screen Recording Feature

Your recent model iPhone’s screen recording feature is relatively simple to operate, but there are a few things you may need to do in order to activate it. Devices like the iPhone 8, 8 Plus and, X should already contain the screen recording feature in your control center, but if not, you can easily make it so. To quickly access the tool on one of the aforementioned devices, swipe up from your phone’s home screen and press the bottom-left button.

If your screen recording tool isn’t already in your Control Center, then before you can begin screen recording, you’ll need to fix that in your settings. Go to your iPhone’s Control Center settings and turn on “Access Within Apps.” Go to Customize Controls, and in the More Controls section, add Screen Recording to your Control Center by tapping the green button. This will ensure the feature is ready to go to your Control Center for easy access.

Once your screen shows what you want to start recording, bring up the Control Center using 3D Touch and hit the Screen Recording icon. With this, you’ll be able to manage your audio with the Microphone icon. Once you’re ready to start recording, tap the Start Recording option, which will prompt a countdown. You’re now set to record, and even narrate if you wish, which comes in particularly handy for guides and tutorials. While you’re recording, you’ll see a blue bar at the top.

If you’re ready to stop recording, tap the red icon on your upper-left corner. Once you’re ready to view your screen recording, simply go to the correct folder, locate the file, and hit Play. It’s really that easy.

Editing Your New Video

Recording and sharing your video is simple enough, but you may need to make a few edits, depending on what your video will be used for. After you’re done recording, you’ll be able to do cool things like edit and make annotations when you download a free app, like Record It.

Initially, your video will show any and all actions you take once you hit record, such as starting and stopping the recording. To edit these out, simply click the top right button to edit your video, then trim out the extras by dragging the handles at the bottom of your screen and creating new start and end points for your video. Click done, and that’s all there is to it.

Wrap Up

It’s no surprise that your iPhone and iPad are full of potential. The Screen Record option is just one of the many tools at your disposal. Learning to use its wide range of features will help you get the most bang for your buck, and simplify your life just the way Apple intended.