Category: Uncategorized

The Newest Forms Of Ransomware & How To Protect Your Business From Them

The Situation

Ransomware is now one of the top security concerns for businesses and organizations of all sizes. The City of Atlanta was hit with a ransomware attack called SamSam in March, crippling some important departments like their court system, sewer infrastructure requests, and water billing department.

The attackers who deploy SamSam are known for clever, high-yield approaches. This, combined with the City’s lack of preparedness, explains why the infection was so debilitating.

Experts are telling us that SamSam will strike again. Unlike many forms of ransomware that spread via phishing attacks where individuals inadvertently invite the attack, SamSam exploits IT system vulnerabilities and cracks weak passwords. These ransomware attackers have made $1 million in less than six months.

Keeping all your systems patched, storing data in enterprise-based cloud backups, and having a ransomware preparedness plan can offer real protections against SamSam and other ransomware infections.

Unfortunately, ransomware attacks are on the rise, and as hackers use more sophisticated encryption technology, the threat is constantly evolving. According to malware security firm Barkly, a company is hit with a ransomware attack every 40 seconds. They also identified ransomware as the most prevalent form of malware, with “4.3x new ransomware variants in Q1 2017 than in Q1 2016.”

This eBook details how dangerous ransomware is, how it could harm your business, and what you should do to protect your data.

Part 1

What is Ransomware?

Ransomware is a type of malicious software (malware) that blocks access to a computer that infects, locks or takes control of a system and demands a ransom to unlock it. It’s also referred to as a crypto-virus, crypto-Trojan or crypto-worm. It then threatens that your data will be gone forever if you don’t pay using a form of anonymous online currency such as Bitcoin.

Most forms of ransomware are spread via spam using unsolicited phishing email or an attachment. Phishing attacks use emails disguised to look like they’re from someone you know and are more likely to trust.

Some ransomware-based applications disguise themselves as police or a government agency, claiming that your system is being locked down for security reasons and that a fine or fee is required to reactivate it. Then it typically asks you to click on a link or attachment to perform a routine task such as updating records or account details. If you do this, a worm or malware is downloaded, infects your system and locks it by encrypting your files.

Ransomware, like SamSam, can also infect your IT system using vulnerabilities in your computer’s browser. It does this when you click on a malicious code hidden in online ads or free software.

Ransomware targets small to medium-sized businesses because they are particularly vulnerable due to limited IT resources. They are also more likely to pay the ransom in the hopes that they’ll get access to their data, although the FBI warns that this isn’t necessarily so.

“Paying a ransom doesn’t guarantee an organization that it will get its data back—we’ve seen cases where organizations never got a decryption key after having paid the ransom. Paying a ransom not only emboldens current cybercriminals to target more organizations, but it also offers an incentive for other criminals to get involved in this type of illegal activity. And finally, by paying a ransom, an organization might inadvertently be funding other illicit activity associated with criminals.”

Paying the ransom only guarantees that the malicious actors receive your money, and possibly even banking information. Also, decrypting files does not mean the malware infection itself has been removed.

No one is immune.

• Temporary or permanent loss of sensitive or proprietary information,
• Disruption to regular operations,
• Financial losses to restore systems and files, and
• Potential harm to your organization’s reputation.

The lack of awareness and cybersecurity training is a leading cause of ransomware.

Part 2

Ransomware Comes in Many Forms.

Ransomware comes in many different forms, but essentially, it’s a type of malware that denies access to your computer devices unless you pay a ransom. The ransomware malware encrypts your data. Once it does this, it can travel throughout your network and encrypt other mapped and unmapped network drives. Because of this, it can bring your organization to a halt.

The ever-evolving nature of these threats makes ransomware very difficult to keep track of. Ransomware-as-a-Service (RaaS) makes it easy for cybercriminals to set up a lucrative hacking scheme. It is provided as a vendor platform on the Dark Web. Unlawful vendors offer hackers and criminals a tool to use to lock down computer files, information or systems and hold them hostage.

Ransom32 is a type of “Ransomware-as-a-Service” that provides any cybercriminal, even those without technical knowledge, the ability to create their own form of ransomware. What makes Ransom32 so dangerous is that it uses JavaScript, and can be used on computers that run Windows, Mac OS X, and Linux.

Over 2,900 types of ransomware have been reported, and they’re growing. Here are just a few:

Bad Rabbit 

Bad Rabbit has infected organizations in Russia and Eastern Europe and is spreading throughout the world. It does this via a fake Adobe Flash update on compromised websites. When the ransomware infects a machine, users are directed to a payment page demanding .05 bitcoin (about $285).

Cerber

This ransomware encrypts your files using AES encryption and demands a ransom of 1.24 bitcoins (worth $500). It communicates via a text-to-speech voice message, a recording, a web page, or a plain text document. There’s no way to decrypt files that are encrypted by Cerber unless you pay the ransom.

Cryptolocker

CryptoLocker infects computers that run Microsoft Windows. Like other forms of ransomware, you must pay the hackers to decrypt and recover your files. CryptoLocker spreads via fake emails (phishing) designed to mimic legitimate businesses.

CryptoWall

This form of ransomware has been around since 2014, but new variants are still circulating, including CryptoBit, CryptoDefense, CryptoWall 2.0, and CryptoWall 3.0. Like CryptoLocker, CryptoWall is distributed by spam or exploit kits.

CryptXXX

CryptXXX used additional capabilities including network-share encryption. This means that even if you can decrypt your files, it can still cause significant downtime by encrypting files on your network shares.

FakeBsod

FakeBsod uses a malicious piece of JavaScript code to lock your web browser. It displays a fake warning message and tells you to go to a particular webpage (that contains the ransomware). The message says to “contact Microsoft technicians” about an “Error 333 Registry Failure of the operating system – Host: Blue screen Error 0x0000000CE.” When you call the phone number, you’ll be asked to pay a fee to fix the problem.

Lockscreen

This form of ransomware isn’t new and has been in use for quite a while. It attacks Android devices. However, now there’s a new version that is more powerful and much more resilient. It used to lock your screen using a hardcoded passcode, but with the right code, you could unlock your device. Today the new version is impossible to reverse-engineer the passcode since it uses pseudorandom passcodes. Because of this, you can’t unlock your device and must pay the ransom.

Locky

If your computers are infected by Locky, it will rename all of your important files and prevent you from opening them. It does this through encryption and using the file extension–locky. Now, only the cybercriminals have the decryption key, and you must purchase it from them to retrieve your files. To do this, you have to go to the Dark Web and pay $400+ in Bitcoin.

NotPetya

This is a strain of Petya and was first seen in 2016. Today, experts believe NotPetya’s sole purpose is to destroy data instead of obtaining a ransom.

Petya

Petya is especially dangerous because it encrypts entire computer systems, and overwrites the master boot record, so you can’t reboot your operating system.

Spider

Spreads via spam emails. It’s hidden in Microsoft Word documents and installs the ransomware on a computer when it’s downloaded. The Word document (typically disguised as a debt-collection notice) executes macros that encrypt your data.

TeslaCrypta

This uses an AES algorithm to encrypt files and is specifically designed to attack Adobe software vulnerabilities. TeslaCrypta installs itself in the Microsoft temp folder.

TorrentLocker

TorrentLocker spreads via spam email campaigns and targets specific geographic regions. It also uses the AES algorithm to encrypt files. It collects email addresses from your address book to spread malware to your business contacts, friends and family members.

WannaCry

WannaCry has hit over 125,000 organizations in over 150 countries. It currently affects Windows machines through a Microsoft exploit known as EternalBlue.

WannaCrypt

This computer attack began locking down data on May 12, 2017. It affects Microsoft Windows Operating systems. WannaCrypt encrypts all the data in on your computer and holds it hostage.

ZCryptor

This form of ransomware uses a worm-like tactic to self-propagate and encrypt files and external drives so that it can attack other computers.

Part 3

How Ransomware Infects Your Computers

Ransomware attacks are increasing, and so are the ransoms to recover your data.

You’ll know when ransomware infects your computer because the hackers display a message telling you how much to pay to unlock your files. These ransoms typically run in the $300-$500 range. But, some businesses are having to pay upwards of $1,000 per computer. If you have 25 computers that are infected, that’s $25,000.

Hackers primarily use the following attack vectors to infect computers:

Phishing Emails

This is the most common scenario. A realistic-looking email is sent to you with a link or attachment that contains the ransomware. Hackers will often send a number of these links or attachments to hide the one with the malware. Once it’s clicked the malicious software loads itself and the ransomware infection spreads throughout your files, locking them until you pay the ransom.

Drive-by-Downloads

If you unknowingly visit a realistic-looking website containing ransomware, it can load itself onto your computer. If you use an old browser, out-of-date software, or third-party applications, you’ll be most vulnerable. A hacker can detect a vulnerability and exploit it. When a software vendor discovers this, they’ll release a patch to repair the issue, but by this time the criminal has already done their dirty work. Examples include unpatched versions of Adobe Flash, a bug in Java or an old web browser, or an unpatched operating system.

Free Software

A lot of us download free versions of software. Some are legitimate, but others contain ransomware. They are especially prominent in broken versions of expensive games, free games, porn content, screensavers or bogus software. By convincing the user that they should download the software, they can get past firewalls and email filters. You might not even know that you’ve done this until the ransomware activates weeks later.

Unpatched Software

According to the U.S. Computer Readiness Team (CERT) using unpatched and unsupported software may increase the risk of proliferation of cybersecurity threats, such as ransomware. Microsoft provides a guide to help you keep your software up to date. They recommend that you use feed update functionality to stay informed about new ransomware variants and what you should do to protect your data.

Part 4

What to Do If Your Files Get Encrypted.

Tell your employees to let you know if they experience the following:

• They can’t open their files, or they get error messages saying a file is corrupted or contains the wrong extension.
• A window pops up with a ransomware program that they can’t close. This window may contain a message about paying a ransom to unlock files.
• A message says that a countdown has started for a ransom to decrypt files and that it will increase over time.
• They see files in all directories with names like “How to decrypt files.txt or decreypt_instructions.html.”

Ransomware isn’t easy to find while it’s at work encrypting your files. So, you might not know that it’s happening until the hacker sends you a message. By this time, the infection has completed its job. The best thing you can do at this point is to contain the virus from spreading throughout your network.

Unplug the infected computer from your network. You may also need to turn off all network access for all your computers until you know the virus is contained. Set your Basic Input Output System (BIOS) time back if the ransomware has started a countdown. This will hopefully give you more time to recover your critical files and try to eliminate the malware. You can access your BIOS time through the BIOS Setup Utility on the computer.

Restore your files from your last backup. This is why it’s important to regularly backup your files to a safe, offsite cloud location. Just make sure your most recent backup wasn’t infected as well. If you use a Disaster Recovery as a Service (DRaaS) solution, you should be able to do this and quickly “spin up” the DR image on your computer. By spinning up the image in a self-contained virtual machine (VM), you can inspect the DR image without exposing it to your entire network.

Alert the FBI. Don’t pay the ransom. This is a mistake because you still may not get your files back and the criminal will continue to extort you for money.

Unfortunately, recovery from ransomware can be difficult as cybercriminals fine-tune their tactics and become more sophisticated.

Part 5

How to Protect Your Data From Ransomware

ood news is that there are best practices you can adopt to protect your business. The Small Business Administration has these 14 recommendations. Your Technology Solutions Provider can help you with these.

1. Implement an awareness and training program. Because end users are targets, employees should be aware of the threat of ransomware and how it is delivered.
2. Enable strong spam filters to prevent phishing emails (an attempt to obtain sensitive information electronically) from reaching employees and authenticate inbound email using technologies like Sender Policy Framework (SPF), Domain Message Authentication Reporting and Conformance (DMARC), and DomainKeys Identified Mail (DKIM) to prevent email spoofing.
3. Scan all incoming and outgoing emails to detect threats and filter executable files (used to perform computer functions) from reaching employees.
4. Configure firewalls to block access to known malicious IP addresses.
5. Patch operating systems, software, and firmware on devices. Consider using a centralized patch management system.
6. Set anti-virus and anti-malware programs to conduct regular scans automatically.
7. Manage the use of privileged accounts based on the principle of least privilege: no employees should be assigned administrative access unless absolutely needed and those with a need for administrator accounts should only use them when necessary.
8. Configure access controls—including file, directory, and network share permissions— with least privilege in mind. If an employee only needs to read specific files, the employee should not have write access to those files, directories, or shares.
9. Disable macro scripts (toolbar buttons and keyboard shortcut) from office files transmitted via email. Consider using Office Viewer software to open Microsoft Office files transmitted via email instead of full office suite applications.
10. Implement Software Restriction Policies (SRP)s or other controls to prevent programs from executing from common ransomware locations, such as temporary folders supporting popular Internet browsers or compression/decompression programs including the AppData/LocalAppData folder.
11. Consider disabling Remote Desktop Protocol (RDP) if it is not being used.
12. Use application whitelisting, which only allows systems to execute programs known and permitted by security policies.
13. Execute operating system environments or specific programs in a virtualized environment.
14. Categorize data based on organizational value and implement physical and logical separation of networks and data for different organizational units.

In Conclusion

The increased incidence and rapid evolution of ransomware have raised concerns and stakes for both small and large businesses. Of everything we’ve discussed here, the two most important things to do to protect your business is to use a solid enterprise-grade cloud backup solution and to provide professional Cybersecurity Awareness Training for your employees. In both cases, your Technology Solutions Provider is your best friend. They’ll help you fight and prevent ransomware and cybercrime of all kinds. Don’t wait. Contact them today.

End-Of-Life Vs. End-Of-Sale

The end of a product’s lifecycle can mean trouble for companies that haven’t prepared for the inevitable. If your organization uses certain products on a daily basis, you may find it difficult to keep up with the different dates revolving around these products’ unique life cycles. But failing to do so can have negative consequences for your operations if you’re not careful.

Familiarizing yourself with the life cycle of a product can help you make wise decisions about your hardware needs. “End of Life,” “End of Service Life,” and “End of Sale” are just a few terms you may need to know in order to avoid an issue with coverage later down the line. Read on to learn more about some of the similarities and differences between these common product lifecycle terms.

End Of Life Vs. End Of Sale: What Is The Difference?

“End of Life,” or EOL, means that the vendor of a particular product has determined that the product has reached the end of its life or its “useful lifespan.” For products in the EOL stage, the manufacturer will cease to market the product, and in most cases, will stop selling that particular product altogether. Past this date, it may become difficult to access support for the purchased product. In some cases, though, manufacturers may offer extended support, which can ensure you’re covered in increments for a certain period of time.

EOS or “end of sale,” also known as EOA or “end of availability,” is another important term companies dealing with equipment contracts should know. This refers to the date after which a product is no longer available for purchase through its manufacturer. The impact of this can be significant if you haven’t got a game plan. It’s important to be prepared for if and when the product and subsequent support you need for these products, is no longer available. How heavily would something like this affect your everyday operations?

Luckily, there may be a bit of hope, even if a product has been deemed EOS. While not available through its manufacturer, you may still be able to obtain an EOS product from a third-party vendor.

EOSL, known as “End of Service Life” means that a particular manufacturer will cease to provide technical support for a product after a chosen date. Although you might still be able to access some kind of manufacturer support after this time, it will probably cost more.

The 4 Stages Of Product Life Cycles

A product’s life cycle — its birth to its demise — is divided into 4 stages. From the initial introduction stage to the decline stage of the life cycle, understanding this unique sequence will help you further grasp what to expect from your products and what their life cycles may mean for you and your organization.

Introduction Stage 

The introduction stage of a product’s cycle is often the most costly. Launching a new product can entail strong marketing efforts, which can include research and development stages and consumer testing. Things can become even costlier for products in highly competitive industries.

The Growth Stage

The growth stage is an important one for a product, as the company finally begins to see the fruits of its labor. During the growth stage, sales show strong growth, profit margins increase, as does profit. Here, businesses are able to invest more funds into advertising, allowing the product to achieve maximum potential.

Maturity Stage 

Once a product has reached its maturity stage, it’s well established and it’s now the duty of the manufacturer to not only maintain but to further build upon its success. Investing wisely in marketing efforts during this stage is crucial, as it’s often the most competitive time during a product’s cycle, meaning it’s also a good time to evaluate making improvements to the product as a competitive advantage.

Decline Stage

The decline stage of a product happens when the market for that particular product begins to diminish. This can happen for a variety of different reasons, perhaps due to market saturation or because consumers are making the switch to a different product entirely. It’s also common that a large percentage of the target audience already have the product or that of a competitor. While this stage of a product’s lifecycle is inevitable, not all hope is lost. It can still remain profitable by implementing cheaper production costs or making the switch to more affordable markets.

Why It’s Important

Performing an IT upgrade can be difficult enough. Add in the worry of expiring service contracts and this can take things to a new level. Your maintenance contracts are highly important in making sure things are flowing smoothly. Finding out your manufacturer no longer offers support for one of your most-used products can bring on new levels of stress. Familiarizing yourself with the different aspects of your product service contracts can ensure you’re never without coverage when you need it most.

Another good solution is simply to look around and see whether there are newer products on the market that would provide you with even better features. Often when products are phased out and reach the end of their life, it’s because newer and better products have been released that will do a much better job.

They are the next best thing to hauling your laptop around to school and on flights, and they’ve become the weapon of choice for parents with fussy toddlers in public spaces. But while tablets have earned their accolades in recent years, that’s not to say choosing one to take home is an easy task. With endless options to select from, it will take some time and research to determine which tablet is best for your unique needs.

What constitutes a great tablet depends on several factors. Aside from function, things like versatility, user-friendliness, and affordability all play a role in how well a tablet is received by the masses. Versatility carries so much weight, in fact, that many of today’s top tablets come with keyboards to offer an experience similar to that of a desktop. These 2-in-1s are all the rage, and if you’re hoping to pick up a new one, you’ve got your fair share of picks. Here are some of our favorite tablets to help you navigate your options.

Apple iPad

The Apple iPad is one of the most revered tablets to date, and the newest version spares no expense when it comes to cool features. Compatible with the new Apple Pencil, the tablet is easy on the eyes with a 9.7-inch Retina display and a small, but mighty A10 Fusion processor for all the power you could want in a tablet. Plus, Apple now carries plenty of options for immersive AR experiences, and at its most affordable price point yet, you can be sure this tablet is one to covet for business and entertainment alike.

HP Envy x2

HP’s Envy x2 model, hot off the heels of the debut of the Snapdragon 835 processor, allows for stronger performance and a load of other features. Fast-charging capabilities, optional LTE connectivity, and a 15-hour battery life are just a few things users have to look forward to in this tablet. From a digital pen to a sleek backlit keyboard, the Envy x2 is versatile and durable, and definitely not one to be looked over if a solid tablet is on your wish list.

Acer Chromebook Tab 10

Created in collaboration between Acer and Google, the Acer Chromebook Tab 10 is a 9.7-inch slate tablet perfectly fitting of its target K-12 education market. The first tablet to be powered by Chrome OS, it features a 2,048 x 1,536 resolution display, and a textured design for easy handling on-the-go. It also comes complete with an EMR stylus, which fits conveniently in its own slot. This tablet was definitely built for convenience.

Samsung Galaxy Tab S3

With a 2048 x 1536 resolution AMOLED display, the Samsung Galaxy Tab S3 is primed for immersive entertainment. Inside you’ll find a powerful quad-core Snapdragon 820 CPU and a sufficient 4GB of RAM. Its 600mAh battery is good for up to 12 hours of power, whether you’re hoping for gaming or Netflixing. It also comes with a bundle featuring the new S-Pen, which is ideal for creatives hoping to use this tablet for work. All in all, between its power and its potential, the Galaxy Tab S3 is among the best money can buy.

HP Chromebook x2

The HP Chromebook is heavy on both looks and performance. This 12.3-inch tablet is touted as the first detachable Chromebook and comes complete with a base hinge for keyboard attachment. It runs on Google’s Chrome OS and can download apps from Google’s Play Store. Aside from an impressive QHD display, it offers both front and rear facing cameras and includes the new HP Active Pen to make tasks like sketching that much easier.

Dell Latitude 5290 2-in-1

This 2-in-1 is pricey, to be sure, but that’s not to say it isn’t worth the money if power is what you’re after. Weighing in at just 2.64 pounds, the tablet boasts an eighth-gen Intel Core i7 processor and a crisp, clear screen ideal for work or play. Gorilla Glass 4 for durability and an adjustable kickstand are just a couple of the perks you’ll find on this hybrid, and that’s not all. There is also an optional keyboard to make typing a breeze.

Lenovo Miix 630

The Lenovo Miix 630 has a unique advantage over its competitors. It can stay connected all day via LTE, which is enabled by a Qualcomm Snapdragon 835 processor. It’s a fresh option for Windows devices, courtesy of a partnership between Qualcomm and Microsoft. And with this Snapdragon processor also comes an extended battery life, upwards of 20 hours. So if you happen to be looking for a tablet to replace your laptop for business, the Lenovo Miix 630 is a suitable option, indeed.

Surface Pro 4

Equal parts tablet and laptop, the Surface Pro 4 gets right a lot of what the original Surface Pro got wrong. Its 12.3-inch screen offers more than enough space for clear, crisp pictures, and its configuration capabilities are nothing to scoff at. From its dual cameras to its loudspeakers and extraordinary picture quality, the Surface Pro 4 is the best of both worlds.

Xplore XBOOK L10

One thing’s for sure: durability isn’t an issue with the Xplore XBOOK L10. Waterproof, dustproof, and drop proof for up to six feet, this tablet is one with plenty going on. It’s got a plethora of ports, including USB-C, USB-A, and Ethernet, with its powerful performance courtesy of an eighth-gen Intel Core i5/i7 processor. And with an ultra-bright display, there isn’t much this tablet can’t do.

Google Pixel C

The Google Pixel C, which many call a solid alternative to the Apple iPad, has a unique design that sees its optional Bluetooth keyboard double as the tablet’s cover. Its made from durable compact aluminum, and boasts a lightning fast performance plus a bold, bright screen bound to make your favorite games that much more enjoyable. If Android is what you’re after, this is simply one of the best.

An all too common occurrence that takes place in many businesses, organizations, and institutions is the data breach. This is where hackers infiltrate your database and steal all types of information including that of your clients. Just this past month, Algonquin College, located in the National Capital region, released a statement informing the public about a data breach that affected a large number of people and exposed more than 111,000 records.

With the alarming trend of various organizations exposing their customer’s data online due to vulnerabilities, what can you do to keep this from happening to you? More importantly, how can you keep your clients’ and employees’ personal and private records safe? Let’s take a look at what you can do to keep your data secure.

5 Ways To Protect Your Business From A Data Breach

 Keep Business and Individual Accounts Separate

First of all, begin with yourself. It’s important to create separate emails for your business, your personal, and your financial accounts. If someone hacks your personal email and password from a personal site, they should not be able to gain access to your business or banking/credit/PayPal sites. Guard what you allow to be uploaded or attached to your computers, and encrypt as often as you can. Having numerous passwords or passcodes can be confusing and troublesome, but consider the alternative. Having to undo and sort out what has been stolen in a data breach will be more confusing and costly in the long run. There are sites such as Lastpass.com that keep track of your passwords and preserve your information so it’s private and secure.

Create a Culture of Awareness

So often, employees are not well trained to protect against a breach. At the same time, companies do not have a protocol to secure their data. While, some things can be automated like encrypting email, there needs to be a heightened sense of resolve to keep the data safe by establishing the proper procedures and training for your employees.

Communicating with your employees and clients that there is a new attitude in how you think and operate is essential in ensuring they understand the need for a heightened awareness. Most successful hacks use social engineering through email messages and other social passageways.

Create an atmosphere where employees and clients are paying attention to their email inboxes and the links they are asked to click on. This is a fundamental method of fending off cyber-attacks. Because hackers are creative and inventive, informing your group of new tactics that hackers are implementing will keep your crew on their toes.

Teach your people to strengthen their passwords. This one step alone is worth its weight in gold. Many of your employees are no doubt using easy-to-decipher passwords like “abcdefgh” or “password123”. These will not take long for hackers to crack. Require two-step identification and keep a good antivirus program running at all times. Do your part to make sure your work environment is a fortress ready for an attack.

No boss likes to come across as heavy-handed, but limiting employee access to websites outside the scope of their daily duties will go a long way to ensuring your data is safe. An educated workforce is your best defense against cyber-attacks.

Establish Preventive Data Authorizations

As mentioned before, most data breaches are not complex attacks through unidentified backdoors. Most breaches are due to an employee clicking on a bad link in an email or attachment. Businesses should constantly confirm that employees only have access to the information necessary to do their jobs. Restricting data permissions will help ensure that these types of breaches do not occur.

The best cybersecurity comes in layers, making it difficult or frustrating for an intruder to break into the network and gain access to your important data. These preventive layers can sometimes slow down an employee from completing a task or lead to a frustrating work environment. That is why much thought and planning must be given to establishing strong preventive layers in order to keep data safe.

Hire a Cybersecurity Expert

Experts cost money. Bringing one in to educate both yourself and your team may seem expensive until you consider the cost of a data breach. A data breach these days can easily cost a million dollars to mitigate.  Cybersecurity experts can help educate you and your employees on the latest trends in malware and ransomware. It’s so important for you and your team to understand how data breaches occur. Security awareness is key to keeping your data safe.

Follow the FINRA Checklist

The Financial Industry Regulatory Authority (FINRA) has a checklist on cybersecurity you can download for free on its website. Every company should take a thorough look at their security measures and use the FINRA checklist as a definitive guide. The checklist will prepare you to identify cybersecurity threats, protect your data from cyber-attacks, plan for a response if a compromise arises, and implement a plan to recover lost or stolen data.

It’s US-based, but it is a good start, even for Canadian companies.

Conclusion

Each day, hackers find new ways to get past your best cybersecurity programs so they can steal your database. Though it can seem like a constant war to maintain control, the alternative is not pretty. Data breaches diminish your company’s reputation and hurt your ability to compete in the marketplace. Train employees well and regularly. Take advantage of the latest security protocols to protect what’s yours. You can’t let your guard down for even a moment these days.

Phishing is just one of many tools in a hacker’s repertoire and happens to be one of their most effective.  Through phishing, hackers dangle their bait in front of preoccupied employees who would never dream that their PC could provide an open door for a hacker.  That’s why it is so important that employees understand how phishing works, how costly it can be, and what they can do to avoid letting themselves become an unwitting accomplice to a hacker’s attack on their company.

The Nature of Phishing

Phishing involves a malicious entity that sends out emails that look like they are from reputable, well-known companies (maybe even the employee’s own employer) – but these emails are not what they seem.

Sometimes the purpose of a phishing email is to trick the recipient into revealing information such as logins, passwords, or personal information. Other times, phishing emails are used to install malware on the recipient’s computer. Once the hacker behind the phishing attack has succeeded in infiltrating the target system via login information or malware, the damage they cause quickly escalates.

Phishing Can Be Very Costly

So how expensive can phishing be?  Well, consider what happened to a bank in Virginia that fell victim to two phishing attacks in just eight months. Their disaster began when an employee received and opened a phishing email which succeeded in installing malware on company computers.  The malware was able to use the victim’s computer to access the STAR Network, a site used to handle debit card transactions.  Through the STAR Network, the hackers behind the malware were able to steal $569,000 in that one incident alone.

But that wasn’t the end of the matter.  Eight months later, even after hiring a cybersecurity forensics firm and following their advice to better secure their system, the same bank was victimized again through another phishing email.  This time, the hackers again gained access to the STAR Network, but then used the bank’s Navigator system.  Through those systems combined, the hackers were able to credit money to various bank accounts and then withdraw the money using hundreds of different ATMs.  Losses from this incident amounted to almost $2 million.

To make matters even worse, the bank’s cyber insurance provider denied coverage and the bank is now forced to pursue a lawsuit to recover their losses.

The Very Real Dangers Of Phishing Attacks

Phishing wouldn’t be so effective if it wasn’t so easy for busy employees to fall victim to seemingly legitimate emails or innocent-looking attachments.  The malware that was used to initiate the first attack on the bank discussed in this article was embedded in a Microsoft Word document.  Most of us have worked with thousands of Word documents during our careers and have never been victimized by one – but it only takes one time to cost a business millions of dollars.

In this case, once that document was opened, the malware was installed and the group behind it had access to what they needed. The bank in question hired Verizon to investigate both incidents. It was finally determined that the same group of Russian hackers were likely responsible for both attacks.

Common Sense Required

Even the most powerful of cyber security systems is still susceptible to attacks that take the form of phishing or social engineering. As long as people continue to subscribe to the view that firewalls, anti-virus, and anti-malware systems provide all the protection against cyberattacks that a company needs, then successful phishing attacks will continue. Education is one of the forgotten keys to foiling phishing attacks.

Employees need to be taught how to recognize a suspicious email and be given real-world examples of how convincing phishing emails can appear.  They need to be encouraged to view both emails and attachments with a critical eye.  Employees must also understand that, under no circumstances, is there a legitimate reason for someone to ask for their password.

Another aspect of this type of education is making sure that people realize that the targets of phishing are not C-suite executives or IT technicians, but employees from all levels.  Through a connection to the company’s network, any employee’s computer could serve as a launching pad for an industrious hacker’s plan of attack.

Conclusion

Phishing attacks are a reality that must be addressed if a company wants to avoid becoming a victim.  These attacks often result in very expensive losses that may not be covered by insurance.  While the importance of a rigorous cyber security system is never to be overestimated, neither is the importance of employee education.  Too many employees have unwittingly become accomplices in costly cyberattacks because they didn’t recognize a phishing email and never thought they could be the target of one.  The first line of defense against phishing isn’t a network firewall, but a trained employee who knows how to recognize a suspicious email or a questionable attachment.

Choosing a cloud infrastructure can be complex, even for seasoned IT professionals with vast knowledge of the benefits. There are plenty of perks associated with cloud-based infrastructure, and as the popularity of these services grows, so does the need to understand the similarities and difference between two of the industry’s heaviest hitters: Amazon Web Services (AWS) and Microsoft Azure.

Both tech giants in their own right, these two cloud-based offerings are two of the most trusted in the game, but which is best for your organization will depend on several factors, which we’ll discuss below.

But First, What Is Cloud-Based Infrastructure?

Cloud infrastructure is among the basic products offered through the Infrastructure-as-a-Service (IaaS) model. It is intricate and carries a variety of components, including virtual servers, virtual PCs, virtual memory, virtual network switches, and virtual storage clusters.

With cloud infrastructure, users are able to create their own unique IT infrastructure, which comes with processing, storage, and networking fabric resources that are easily configured to a company’s preferences.

What Are The Benefits of Cloud-Based Infrastructure?

There are many benefits of cloud structure versus traditional physical infrastructure. For one, it does away with the frequent procurement, maintenance, and capacity planning that comes with the use of physical servers and storage. In addition to a low barrier to entry, cloud infrastructure also boasts low capital requirements and a low total cost of ownership. Typically, cloud infrastructure offers more flexibility in design with its easy set-up and ability to be replaced or deleted, and it is also highly scalable.

What Are The Primary Differences Between Amazon Web Services (AWS) and Microsoft Azure?

Amazon Web Services made its grand debut more than ten years ago, and it’s gotten progressively better since then. Operating since 2010, Microsoft Azure comes with its own long list of benefits, and while these two both share some similarities in their capabilities, there’s a world of difference between them.

AWS is known for stability, reliability, and an array of solid offerings. It groups IaaS offerings into four categories, which include:

• Compute
• Storage and Content Delivery
• Database
• Networking

With AWS, you can monitor your resource usage with innovative management tools like Amazon CloudWatch, and track API usage and user activity with AWS Cloudtrail. Other tools, like AWS Config, can be used for monitoring resource inventory and other changes.

Azure, on the other hand, is divided into categories such as Compute, Data Management, Performance, and Networking. It secures these services utilizing tools such as:

• Azure Active Directory
• Multi-Factor Authentication
• Active Directory Federation Services
• Others

Azure also boasts service and integrations to help monitor and alert businesses about their performance metrics and logs.

While cloud infrastructure can be of great benefit to a wide variety of organizations across a number of industries, it’s a solid option for government agencies as well. In fact, both Microsoft Azure and AWS have dedicated areas for Government on their clouds, which ensures that their strict needs for compliance are maintained at all times. Both services are said to be compliant with ITAR, HIPAA, DISA, FIPS, CJIS, and other organization standards.

What Is A Hybrid Cloud?

Making the transition from physical servers to the cloud can be an arduous process for businesses. There are many reasons why organizations may choose to forgo cloud infrastructure in lieu of their own data centers for some aspects of the business. With this, Microsoft has created support for unique hybrid cloud configurations.

Hybrid clouds allow businesses to run cloud applications and deploy cloud-model applications and infrastructure, all with the comfort of your own on-premises resources. This seamless transition between the two is allowing a growing number of businesses to explore the benefits of cloud infrastructure without totally abandoning what is tried and true.

Which Service Is More Affordable?

Although there are many factors that make cloud infrastructure more affordable than its predecessor, the savings aren’t always cut and dry. Many of the costs associated with cloud infrastructure are due to user behavior in addition to workloads. While trying to predict the costs can seem futile, both Azure and Amazon have cost calculators to make the process an easier one.

Will I Need Licensing For Cloud Infrastructure?

When it comes to cloud-based infrastructure, many users are drawn to the simplicity of licensing. With the cloud, users are automatically charged for licenses based on usage. If you happen to work for a big company, chances are you already own a number of expensive licenses. Luckily, not all hope is lost. Moving to the cloud won’t result in wasted investments, as Windows offers license mobility for application servers that qualify.

Cloud infrastructure is saving many businesses time, trouble, and money. If you think your organization is ready to make the transition to the cloud, you’d do well to do your research to determine which of these two possess the tools you need to make the most of a new and improved infrastructure.

Google Speed Update Is Now Out.

What Does This Mean for You?

On July 9th, Google began rolling out the Google Speed Update that they first announced in January 2018. So why is Google’s new speed update important for you if you have a business website?

Bounce Rates Affect Search Rankings

According to Google data, a 3-second load time increases the bounce rate by 32%. Bounce rate is an Internet marketing term used to evaluate web traffic. It represents the percentage of visitors who enter the site and then leave (“bounce”) instead of remaining to view other pages on the same site. What’s more startling is that if your site takes 5 seconds to load, it can increase your bounce rates by 90%, according to Google. To put it in laymen’s terms, every bounce could mean a prospective customer lost.

Since 2010, Google has determined that site speed is a direct ranking factor. Google sees a bounce as a strike against the site in their rankings. At the time, in 2010, this was a desktop-only search update, but the new update includes mobile sites as well.

Google now suggests that website creators embrace a mobile first attitude to accommodate a large number of people now using mobile devices to browse the web. This means that pages should load in less than a second, as slow sites will pay the price in terms of lower search rankings.

While this new update only affects a small percentage of queries and has no precise sign of percentages, according to Google, it’s still important to investigate how Google’s speed update affects you.

What Pages Will Google Speed Update Affect?

The speed update will only affect the slowest pages; the ones that Google states, “deliver the slowest experience to users”. If you already have a site with pages well optimized for speed, this update is not exact enough for you to troubleshoot ways to lower your load time by milliseconds.

However, if you do have pages with poor load times, the update should cause you to sit up and take notice. Many companies depend on consistent organic traffic to push their business, so poor load times should be a big concern.

How Can You Determine Your Page Speed?

It’s important to determine how fast your site loads and where the holdups are. There are several tools you can use to do this. Here are some helpful tips you can use to measure and troubleshoot website speed and page load times.

Google Page Speed Insights

A good place to start for measuring website load times is Google Page Speed Insights. On this site, type and enter the URL of the page you want to check. You will get a report evaluating page speed and user experience, as well as tips on ways to make your website faster.

Pingdom

Pingdom has a website speed test tool similar way to Google Page Speed Insights, but it gives you a report divided into several sections. These include page analysis, a performance grade and a waterfall analysis, helping you identify the most vital causes of website slowdown and how to fix them. It also does a great job of explaining its analytics and testing using a color-coded system.

GTMetrix

GTMetrix combines information from other online page speed tools. After you enter your URL into the on-screen box, it generates a report highlighting tons of different aspects of website load times, and it grades each one from A to F. This grading system lets you take a peek at the areas of your site that worked well and the ones that need your help. Also, GTMetrix ranks the serious issues first, in order of importance, so you know what needs the most attention.

Google Analytics

Google Analytics shows you which pages are underperforming and gives tips on how to identify significant trends as to whether things are getting better or worse. It does this by including site speed in its reports, which can be found in the Behavior section. The Page Speed Suggestions link shows how individual pages could be improved, allowing you to focus on the most important pages first.

How Do You Fix Website Page Speed Issues?

Once you have identified the holdups on your site, the next move is to fix them. All of the tools listed above make suggestions.

Here is a list of the most common recommendations you find on these tests:

• Reduce the size of your images
• Refine your hosting
• Optimize your code
• Use a content delivery network
• Compress your site
• Use caching
• Optimize scripts
• Reduce the number of external services you use

After you make the recommended fixes, it’s a good idea to test your site to establish a benchmark and re-test at regular intervals.

Any Other Suggestions?

One last tip that Google gives about the speed update is, “The intent of the search query is still a very strong signal, so a slow page may still rank highly if it has great, relevant content.”

Although speed is important, it should not take precedence over the strength of your site’s content. Bad content that loads fast will not rank well. Good content is always going to make your site stronger.

However, if you have great content that is performing well, but your site speed is slow, you might as well take the steps to improve your speed to ensure the best rankings.

 

10 Effective Ways To Communicate In The Workplace

Communication is a very important aspect of any organization because it forms the basis of any work environment. Whether we’re talking about vertical communications between senior and junior employees or horizontal communication between team players, communicating effectively fosters good relations at the workplace. On the other hand, when there is a lack of good communication, there is often a high turnover of employees. You might also see poor work delivery and generally unsatisfactory results.

Here are a few tips to foster effective communication in the workplace.

Establish An Open Door Policy

This is a situation where team leaders make themselves available for consultations, discussions, inputs, contributions, clarifications, and even suggestions. When employees feel that they are always welcome to share what is on their minds, it helps to clear tension. Tension at the workplace leads to poor work delivery.

Conduct Open Meetings

This is a one-on-one kind of meeting unlike when meetings are held at online platforms or communication is done through email. This way, one is able to use other tools of communication such as gestures, facial expressions, tonal variation, and body language to put emphasis on important issues of discussion.

Use Simple Words

Choosing the right words to express a certain point is also important because the meaning could be lost in between. Some words when used in a certain context can easily come across as being offensive. Words used in communication must be simple and easy to understand. If you use hard and complex language you might need to explain yourself and in the process loose meaning during communication.

Listen

Listening is also a very important aspect when communicating. This is because communication is a two-way street. Encourage the team players to open up and air out their concerns. Ask questions. Ask for clarification if necessary. This way, everyone can offer some guidance and also feedback about whether you are making your point or not.

Use Visual Aids

The human mind is more visual and so things seen are more easily remembered than things said. That’s one reason why PowerPoint presentations are so effective. Add tables, images, charts, and graphs. This way your presentation is not boring and it is broken down into small portions for easy understanding.

Be Articulate

This a very important tool used by speakers. If you are not articulate, you end up losing your audience’s concentration and thus you fail to communicate effectively. Articulate simply means audibility, a good mastery of the language, and even a good understanding of the topic of discussion.

Encourage Modern Forms Of Communication

Depending on the information being presented, modern forms of communications such as the use of the intranet, social media platforms, and video conferencing may prove to be more effective than simple open meetings. Some employees would prefer discussions about certain issues to take place on social media platforms. This is also a way of encouraging interaction between employees, which is very important.

Organize And Participate In Social Events

Celebrate important occasions in the organization once in a while by sponsoring employee retreats, end-year parties, team building, and even employee promotions. This could be a good way to reward all employees across the board and also motivate individual employees to work harder in their stations. It offers a good change of pace and provides valuable time to rest and rejuvenate so as to improve productivity.

Orient New Employees

In order to ensure that new employees fit in properly, it is very important to take them through the basic structures of your organization. Introduce them to the other employees and also ensure that they are aware of the communication channels in place. The first day of work can be hectic for anyone. With effective communication, use of friendly gestures, and hospitality, the employer can make a new employee have an easy time settling into their new position. It’s not possible to take new employees through all there is to know about your organization. Be sure to make all your internal training documents available so they can read through these in their spare time. This will make it easier for them to adopt the organization’s culture and within no time they will become effective team players.

Assess Your Internal Communication Strategy

This can be achieved by seeking feedback from the employees. Ask them to forward their suggestions on how to improve the communication strategies in place. Employees know what’s going on at the grassroots level. They may be able to share a fresh point of view.

Conclusion

It is not possible to achieve 100% efficiency when it comes to communication in the workplace. This is simply because of various barriers such as cultural differences, languages, socio-economic differences, and many other obstacles. However, there are some important ways we can all improve the way we communicate with others.