Category: Blog

Everything You Need to Know About the Dark Web

Posted on by Elevate Services Group

 

What Is the Dark Web and How Can You Stay Off It?

 

Ever heard of the dark web? It’s definitely not a place you want your company’s information to be. Learn everything you need to know about the dark web here.  

Most people have heard about the dark web in one form or another. It’s a place where criminal activity happens — from the purchase of illegal drugs to the hiring of assassins.

Of course, there is a legal side to the dark web as well; though, most people don’t know about. In fact, the origin story of the dark web is entirely legitimate and is even linked to the government.

 

Still, as a business owner or CEO, your relationship with the dark web (should you unfortunately have one) will not likely be good. It’s a bad sign if any of your information is found there. That’s why it’s important to know about what exactly the dark web is: Where it came from, what’s on it, and what you should do to stay as far away from it as possible.

 

What Is the Dark Web?

 

The dark web is essentially one “section” of the Internet. Specifically, it’s a section that isn’t included in mainstream search engines like Google. So, when you search a normal search inquiry, such as, “Where’s the best hamburger joint in downtown Pittsburgh?” you don’t get results from the dark web.

 

Instead, this section includes all sorts of illicit goings-on. Mostly, it’s a marketplace for things you shouldn’t be buying because they’re illegal to sell and/or buy. For instance, you can buy lifelong access to Netflix for a small price (six bucks). You can hire someone to hack into someone else’s computer for you and download their data or track their keystrokes. You can purchase credit card credentials. You can obtain prepaid debit card numbers and security codes.

 

How Does One Access the Dark Web?

 

We’ll reiterate again that the dark web is not a place you want to find yourself (or your information). However, for the sake of knowledge, we’ll explain that in order to access the dark web, you must download what’s called the Tor browser.

 

Tor stands for The Onion Router. This is basically the software that makes the dark web operate in the dark.

 

Where Did the Dark Web Originate?

 

The dark web began in the late 1990s as a way for the United States Naval Research Laboratory (NRL) to better hide their online communications. At this time, The Onion Router or Tor was brand-new.

 

Soon after its initial creation in 2004, the dark web’s Tor software was released for public use. Since that time, it has ceased to be solely a government resource and has turned into the “back alley” of the Internet.

How Can the Dark Web Affect Business Owners?

 

The dark web is a potential danger to all businesses of all sizes and in all industries. In fact, it can be a potential danger to individuals as well. But let’s talk about your business and the dark web.

 

Basically, it has been found that 60% of the web listings on the dark web could harm a business. That’s because, these listings offer individuals searching the dark web ways to obtain things like the following:

  • Customer data
  • Tips for hacking computers
  • Tips for hacking networks
  • Malware
  • Financial data
  • Phishing advice
  • Operational data
  • Intellectual trade secrets
  • Tutorials for cyber crime
  • Remote access Trojans (RATs)
  • Espionage services
  • Credentials access

How Can You Keep Your Business Safe From the Dark Web?

 

The best way to keep your business safe from the dark web is to have the proper cybersecurity measures in place. This means hiring a cybersecurity team or a managed service provider (MSP) to handle your company’s cybersecurity. Even if you’re a small business, hiring an MSP to have on retainer is a good idea.

 

They will make sure that you have firewalls and other detectors of malware in place for adequate security. It’s also essential to back up your data and to make everyone who works for or with your company aware of how to avoid phishing attempts.

 

Lastly, your cybersecurity team should be monitoring the dark web to make sure that none of your information lands there. This goes for personal information for you and your employees, as well as overall company information. Taking these measures is the only surefire way to ensure that your company does not end up on the wrong end of the dark web.

URGENT/11 Zero-Day Vulnerabilities Impacting 2 Billion Devices

Posted on by Elevate Services Group

 

 

Check Your IoT: URGENT/11 Zero-Day Vulnerabilities Impacting 2 Billion Devices

 

It was only a matter of time before connected devices become a target. The current vulnerability allows remote attackers to gain full control over IoT devices.  

 

Security professionals have known that connected devices are a risk, but the latest news around the URGENT/11 vulnerabilities may surprise even the most hardened security professional. Over 2 billion connected devices are thought to be vulnerable, including a range of printers, VOIP phones, routers, medical equipment, firewalls, elevators and industrial controls. Any connected device that is running the VxWorks operating system created by Wind River has the potential to be affected, allowing users to remotely gain control over the device.

 

URGENT/11 Vulnerabilities

 

Dubbed “URGENT/11”, these security risks include six critical vulnerabilities connected with VxWorks 6.5 or higher that includes the IPnet stack. There are a few versions of the OS that may not be affected, according to security research firm Armis, such as their VxWorks Cert Edition and VxWorks 653. Whether devices are within the network perimeter or on the edge, they can still be leveraged for remote access directly into networks. The vast range of manufacturers of the devices at risk means the level of security at the device level is likely to vary dramatically between product types. Fortunately, Wind River Systems provided critical patches during a recent July 19 release, but that may not be enough to reduce the risk for organizations utilizing these connected devices.

 

What is VxWorks?

 

“VxWorks is the most widely used operating system you may never have heard of,” said Ben Seri, vice president of research at Armis. “A wide variety of industries rely on VxWorks to run their critical devices in their daily operations—from healthcare to manufacturing and even security businesses”. As an RTOS, or real-time operating system, VxWorks has generally been considered to be a stable solution for IoT and other interconnected devices with only 13 vulnerabilities reported in over 32 years of operation for the platform. Since it is only older versions of the RTOS that are vulnerable to attack, it’s thought that newer devices should be relatively safe and many affected devices are already reaching end-of-life. These devices are generally ones where chipsets only need to manage a few basic pieces of information, such as input/output operations, where little data processing is required.

 

How to Protect Your Business

 

While officials at VxWorks and Armis note that there are no indications that the URGENT/11 vulnerabilities have been exploited, the extreme disruption that could be caused within an organization is reason enough to warrant a proactive effort to protect your organization. Here are the recommended steps from Wind River security professionals and engineers:

 

 

You can view the full URGENT/11 whitepaper with a breakdown of the vulnerabilities and suggestions for remediation online. Experts note that the level of disruption could be significant, perhaps even rivaling the EternalBlue 2017 vulnerability or the WannaCry ransomware attack. In each of these instances, it was challenging for many small businesses to determine the best steps to move forward and protect their organization.

 

Partnering with an IT services firm helps ensure that your business is alert to this type of critical attack vector. Staying vigilant for vulnerabilities and quickly applying patches may mean the difference between a few hours of work patching devices or servers and months of remediation as you attempt to recover from a major attack.

Companies Held Responsible for Tech Security

Posted on by Elevate Services Group

 

Major Fines for IT Data Breaches

 

Outdated machines, software or employee practices can lead to major security problems. These big companies faced painful fines for their IT mistakes.

 

 

As companies increase their online activity, data collection and eCommerce, the stakes will continue to rise. Companies that are lax, poorly prepared or sloppy are facing disastrous tech breaches. Equifax, Uber, TJX and Visa are just a few of the companies that have had to face hefty payouts for data breaches. The public relies on companies to act professionally and secure their information. Many companies that face a security breach or lost data will not be able to stay in business.

 

With a security breach, the customer’s trust is lost. Not only will the reputation harm business, but fixing the issue will cost more than preventing it. Fines and payouts will also add to that cost. And, the more consumers affected by a major problem in the company’s security, the more painful the clean up. You can’t afford to slack when it comes to IT security.

 

Equifax Data Breach Settlement of $700 Million

 

The infamous Equifax data breach of 2017 has lead to 147 million affected customers. The settlement announced by the credit reporting company included $175 million to 48 states, $300 million towards free credit monitoring services for the impacted customers and $100 million to the Consumer Financial Protection Bureau for civil penalties.

 

Federal Trade Commission (FTC) Chairman Joe Simons said, “Equifax failed to take basic steps that may have prevented the breach that affected approximately 147 million consumers. This settlement requires that the company take steps to improve its data security going forward, and will ensure that consumers harmed by this breach can receive help protecting themselves from identity theft and fraud.”

 

Facebook Faces $5 Billion in Fines for Privacy Violations

 

The FTC smacked Facebook with a $5 billion fine for the Cambridge Analytica incident. This privacy violations fine was in response to personal data taken from over 87 million Facebook users to create more persuasive and personalized ads.

 

Uber Faces $148 Million in Fines for Covering Up Hacked Accounts

 

In 2016, Uber had over 57 million user accounts compromised–and then tried to cover it up by paying the perpetrator $100k. This lead to the largest data-breach payout at the time of $148 million because they broke data breach violation laws.

 

Anthem Faces $131 Million for Data Breach of Customers

 

When the US health insurer Anthem was hacked in 2015, over 79 million customers had their names, birthdates, social security numbers and medical IDs compromised. The company paid out $115 million in a class-action lawsuit in 2017 regarding the breach. The US Department of Health and Human Services fined them an additional $16 million for HIPAA (Health Insurance Portability and Accountability Act) violations.

 

TJX and Visa Pay Out $40.9 for Data Breach

 

When over 96 million credit and debit accounts were hacked in a widely-publicized data breach that lasted from 2003 to 2007, TJX promised pay outs. This came under the terms that 80% of card issuers agreed to the recovery offer and promised not to take further legal action. TJX agreed to fund the settlement as a resolution to those U.S. Visa holders with cards from taking further legal action. This amount was not part of the $256 million the company said it had budgeted to deal with the breach.

 

Texas Cancer Center Fined $4.3 Million for Unencrypted Equipment

 

Between 2012-2013, the University of Texas MD Anderson Cancer Center lost one unencrypted laptop when it was stolen from an employee’s house and two unencrypted USBs that contained sensitive patient data. The health information of over 33,500 individuals was compromised and the center faced a $4.3 million fine for HIPAA violations.

 

FMCNA Fined $3.5 Million for Five Data Breaches

 

In 2012, Fresenius Medical Care North America (FMCNA) was fined $3.5 million for HIPAA violations after five separate breaches in different company locations. The Office for Civil Rights noted that FMCNA could have avoided this with a thorough risk analysis to find the potential risks and vulnerabilities. Many of their breach problems included lacking security policies and failing to encrypt sensitive health data.

 

A good company will take proactive IT security measures with a great tech team. By outsourcing IT security through a managed IT service company, you can get the best security without hiring a team full-time. Your IT team will provide an audit of your company to help you find the places where your security, devices or practices might be a threat to your company. Ensure you are using the right equipment and your employees are trained to meet compliance standards, privacy laws, customer expectations and more so your company can succeed.

Create Your Own Fonts In Windows 10

Posted on by Elevate Services Group

 

Create Your Own Fonts In Windows 10

You may have been using Windows 10 for some time now, but it’s likely that you haven’t mastered all of its features just yet.

Did you know that you can create your own fonts?

In the Windows store, you can get the “Make Your Own Font” app, a great way to add a personal touch to anything you may need to write. For example, you could even send an email in your own handwriting!

All you need to do is fill out the alphabet letter by letter (lower and upper case) as well as numbers and symbols. Then you name it, save it, and upload it via Control Panel > Fonts.

The next time you’re drafting something and find that Times New Roman is too formal, you’ll be able to switch to your personalized font instead.

Let us know what you think about this Windows 10 tech tip.  Just reply to this email.  Over the next few weeks, we’ll have more Windows 10 tips for you.

Why Today’s CEOs are Worried About Cybersecurity

Posted on by Elevate Services Group

The top concern for CEOs today isn’t competitors or a recession — it’s cybersecurity. See why this is becoming the biggest challenge for an organization’s top executive.

 

Why Today’s CEOs are Worried About Cybersecurity

 

A business’s top executive has plenty on their minds: the potential of a major recession, competitors nipping at their heels and a shortage of talent. However, none of these hot topics are the top concern for US CEOs in 2019 — that banner falls to cybersecurity. When there are so many other issues facing organizations, why is cybersecurity the highest business concern for CEOs? Perhaps part of the issue is the continual cycle of mainstream media coverage of the massive breaches such as Equifax in 2017 that affected millions of individuals and can cost billions of dollars to resolve. It could also be the high-profile challenges that Facebook, Yahoo, Under Armour and Marriott have been facing over the past few years. A recent poll of over 1,400 CEOs and senior executives by The Conference Boardpoints to some of the reasons cybersecurity is a top strategic consideration for CEOs in 2019.

 

 

CEOs Struggling to Find the Right Cybersecurity Leaders

 

One of the key threats facing today’s CEOs is the ability to adequately resource their cybersecurity teams. This relatively new need is one that is causing a significant shortage in the hiring market, with organizations wrestling with budget requirements for an increasingly-expensive skill set. Unfortunately, the dearth of talent is not just at the executive leadership level, it is also causing IT departments around the country and the world to flounder as they attempt to staff up to meet the growing needs of cybersecurity as well as data compliance requirements. These individuals will be in high demand for the foreseeable future as gaining knowledge about cybersecurity requires time and investment in education. Savvy CEOs and other technology leaders have been growing these skills internally for the last several years, but having a split focus between cybersecurity requirements and their “day job” can quickly cause individuals to fall behind in the ever-changing security landscape.

 

Keeping Cybersecurity Initiatives in the Limelight

 

It’s relatively easy for CEOs to keep shorter-term strategies top-of-mind for their executive teams, but there are no quick solutions to enhancing your organization’s cybersecurity. This requires a long-term, focused effort — and resisting the siren songs of short-term gains to ensure that your strategic focus on IT security stays in place. Changes in the economy or in the competitive marketplace may tease CEOs to redirect some of the funds or teams to other parts of the organization, but it’s crucial that top executives stay in tune with the benefits that cybersecurity provides to the organization. In many cases, the changes that need to be made to make your organization more secure will also have payoffs in the efficiency of your operations, too.

 

Marketplace Perception of a Data Breach

 

The extremely negative perception and sheer quantity of negative publicity that can come with a data breach are reason enough for CEOs to be overly concerned about the cybersecurity within their organization. It doesn’t take long for smaller, leaner competitors to enter many marketplaces, and these organizations can receive positive publicity if larger organizations are caught up in a breach situation. How the business handles their communication around a massive breach, ransomware or other cybersecurity incidents can be as damaging as the incident itself if the CEO isn’t careful. These situations require a great deal of proactive communication and notification to customers along with the major effort required to evaluate the incident and begin remediation. Without a comprehensive incident response plan in place, the situation becomes that much more difficult for leaders throughout the organization.

 

Creating a proactive field for cybersecurity does start at the top, which makes it encouraging that CEOs are considering cybersecurity their very top initiative for 2019. As long as this focus on IT security and the value for the business continues strong over the next few years, businesses should be able to prepare adequately to weather this type of storm.

Keeping An Eye On The Dark Web?

Posted on by Elevate Services Group

 

Keeping An Eye On The Dark Web?

 

Do you know about the “Dark Web”? It’s the part of the Internet where your private data – passwords, social security, credit card numbers, etc. – could be for sale right now. Do you know how to check if they are?

 

The Internet isn’t all funny videos and social media.

 

Between phishing, malware, and a seemingly never-ending list of scams, there are a number of serious dangers that are important to be aware of.

 

But there’s an even a darker corner of the web where few people dare to venture that can have a wide-reaching and severely damaging effect on your business: the Dark Web.

 

Recently, cyber thieves released a huge list of compromised emails and passwords known as Collection #1. It contains 773 million records, making it one of the largest data breaches to date. If your information has ever been breached, it’s most likely on this new list – and that list is on the Dark Web.

 

Even the federal government has had a hard time locating those responsible and stopping them. The Department of Homeland Security made their first bust involving criminals selling illegal goods on the Dark Web just last year. The arrests were made after a year-long investigation. Though this is good news, it doesn’t even scratch the surface of all the criminal activities taking place on the Dark Web.

 

The bottom line is that you can’t wait around for the government or anyone else to protect your business from cyber thieves. You have to be proactive about securing your database. Your personal and business information should not be for sale on the Dark Web, but how can you stop this?

 

What Is The Dark Web?

 

The Dark Web is a small part of the much larger “deep web” – the common name for an extensive collection of websites that aren’t accessible through normal Internet browsers. These websites are hidden from the everyday Internet — or Clearnet — users through the use of overlay networks.

 

They’re built on the framework of networks that already exist, and there are a lot of them. In fact, the Deep Web makes up the majority of the information online. Which, when you consider how vast the corner of the Internet you frequent is, is nothing short of terrifying.

 

This unseen part of the Internet is a perfect place for less than scrupulous individuals to connect, network, and share tools, tips, and information. And it should go without saying that whatever their up to on these sites is nothing good.

 

Personal information such as school and medical records, bank statements, and private emails are all part of the immense Deep Web. To gain access to this information, you must be able to access an overlay network using specialized software and passwords. This is a good thing, because it keeps sensitive information safe, and prevents search engines from accessing and indexing it.

 

Why Is The Dark Web Used To Sell Private Information?

 

The added security of the Deep Web makes it attractive for those who want their online activities to remain anonymous. Unlike the Deep Web, which prevents outsiders from accessing information, the owners of Dark Websites allow anyone with the right browser to access their sites. One of the most popular of these is The Onion Browser, more commonly known as Tor.

 

The Dark Web is like “The Wild West” of the Internet. It’s an area beyond the reach of law enforcement, hence the complete lack of regulations or protection. Although not everyone who uses the Dark Web engages in illicit activities — it has a history of being a platform for political dissidents and corporate whistleblowers — many visitors are there for less than upstanding reasons.

 

Cybercrime costs US businesses billions of dollars each year. The majority of information hackers steal from businesses ends up on the Dark Web for sale to identity thieves and corporate spies.

 

But, the real danger is that it provides communication and educational training ground for hackers and would-be hackers. Although the competition among different hacking groups is fierce, there’s still a willingness among cyber criminals to share techniques and assist one another.

 

It’s this access to the “tools of the trade” and the guidance required to pull off successful hacks, attacks, and scams that makes the Dark Web so dangerous to your business. Anyone with the time and inclination to learn how to steal valuable data from your business can check out an online tutorial or two, pay for some basic hacking software from one of these marketplaces, and set their sights on you.

 

While they might not be the stories that make national headlines, small and mid-sized businesses are targeted every day by cybercriminals looking to make a fast buck.

 

How can you protect yourself?

 

When a news story comes out about a large corporate hack, businesses often scramble to learn how they can better protect their businesses – but that’s the wrong time to start thinking about it.

 

Don’t wait until a breach occurs – start protecting yourself now. The advice you should follow centers around educating your employees about the dangers of online crime and developing company procedures to prevent it from happening.

 

The first step is to make sure you (and your staff) use stronger passwords…

 

Top 4 Password Mistakes To Avoid

 

Length and Complexity

Keep in mind that the easier it is for you to remember a password, the easier it’ll be for a hacker to figure it out. That’s why short and simple passwords are so common – users worry about forgetting them, so they make them too easy to remember, which presents an easy target for hackers.

 

Numbers, Case, and Symbols

 

Another factor in the password’s complexity is whether or not it incorporates numbers, cases, and symbols. While it may be easier to remember a password that’s all lower-case letters, it’s important to mix in numbers, capitals, and symbols in order to increase the complexity.

 

Personal Information

Many users assume that information specific to them will be more secure – the thinking, for example, is that your birthday is one of a 365 possible options in a calendar year, not to mention your birth year itself. The same methodology applies to your pet’s name, your mother’s maiden name, etc.

 

However, given the ubiquity of social media, it’s not difficult for hackers to research a target through Facebook, LinkedIn, and other sites to determine when they were born, information about their family, personal interests, etc.

 

Pattern and Sequences

Like the other common mistakes, many people use patterns as passwords in order to better remember them, but again, that makes the password really easy to guess. “abc123”, or the first row of letters on the keyboard, “qwerty”, etc., are extremely easy for hackers to guess.

 

Maybe you think your passwords are fine.

 

It’s certainly possible – but it’s one thing to skim over a list of common password mistakes and assume you’re probably still OK.

 

Sure, maybe that one password is based on your pet’s name, or maybe that other password doesn’t have any capitals or numbers – what’s the big deal, really?

 

If you’re so confident, then why not put it to the test?

Click here to test how secure your password is – take a few minutes and try a few.

…

 

How’d you do?

 

Probably not as well as you’d hoped, right? The reality is that truly complex passwords can be difficult to come up with, and even more difficult to remember.

Top 3 Tips To Keep Your Data Off The Dark Web

 

Train staff members on the proper handling of corporate data and procedures to limit data loss, including ways to handle phishing scams.

 

Besides an initial onboarding training session, all employees should attend refresher courses throughout the year. The vast majority of cybercriminals gain access to a company’s network through mistakes made by employees.

 

Require the use of strong passwords and two-factor authorization.

 

It’s advisable that you assign strong passwords to each individual employee to prevent them from using passwords that are easy to guess, as well as implementing two-factor authorization.

 

Consider investing in hacking insurance and conduct penetration testing.

 

The cost of cybercrime will exceed 6 billion dollars by 2021. That’s a lot of money. Investing in cyber attack insurance is a good idea for businesses with a great deal of exposure.

 

Unfortunately, all these tips are meant to be preventative – they’ll increase your security and protect against cybercriminals taking your data in the first place. But what if you’ve already experienced a breach?

 

Even worse, what if you’ve experienced a data breach, but you don’t even know it? Case in point: it takes most businesses up to 6 months to find out that they’ve experienced a data breach.

 

What if you’re one of them?

 

How can you find out if your data is already up for sale?

 

What About Dark Web Scanning?

 

There’s only so much you can do on your own – but there are now more direct ways of checking whether your data has been compromised on the Dark Web. Many security vendors now offer cyber-surveillance monitoring solutions that can scan the dark web for your credentials.

 

One of the most popular of these solutions is Dark Web ID, which is designed to detect compromised credentials that surface on the Dark Web in real-time, offering you a comprehensive level of data theft protection – it’s an enterprise-level service tailored to businesses like yours.

 

This Dark Web monitoring solution keeps tabs on the shadiest corners of the online world 24 hours a day, 7 days a week – no exceptions.

 

Features include:

 

  • Security Awareness to keep your staff prepared to spot and stop hackers from harming your business
  • Password Manager to help you and your staff maintain complex, hard to crack passwords
  • Multifactor Authentication to prevent external parties from accessing your systems with stolen passwords
  • Data Leak Prevention to make sure the integrity of your business data
  • Vulnerability and Patch Management to make sure no weakness in your cybersecurity is overlooked.

 

This isn’t a matter of “what you don’t know won’t hurt you”. In fact, it’s the opposite. You can’t afford to ignore the dark web.

The Top Cyber Security Threats Facing Enterprises and How to Mitigate Them

Posted on by Elevate Services Group

 

 

The Top Cyber Security Threats Facing Enterprises and How to Mitigate Them

 

As cybersecurity threats become more prominent and the Internet of Things (IoT) devices become more essential, the tactics behind the threats are evolving into more sophisticated forms. This can lead to an increase in certain types of cybersecurity attacks and threats that can sometimes catch IT managers off guard. Knowing what types of attacks and tactics are on the rise can help managers plan proper prevention and mitigation strategies. Given that 31 percent of organizations have been subject to cyber-attacks according to United States Cybersecurity Magazine, managers can no longer afford to be lax when it comes to security protocols.

 

What are the Top Threats?

 

Financial fraud through compromised business emails, credential stuffing, web application attacks, data breaches, and malware attacks have made the top list of threats. Compromised business emails come in the form of false requests to employees to pay nonexistent invoices, modify bank accounts, and purchase gift cards. Many of these emails are written using spoofing techniques that make it appear as though the email is coming from a top-level executive or a person of authority within the organization. When employees are misled by the emails and disclose the financial information the attackers are looking for, the company’s financial accounts and resources become compromised.

 

Credential stuffing occurs with unauthorized access to the company’s systems or enterprise-level applications via a legitimate employee’s username and password. With credential stuffing, a large number of employees’ usernames and passwords are either obtained through social engineering, phishing, or random guessing. Since it is natural for most to keep reusing the same usernames and passwords, it can make it easy for attackers to guess credentials that are similar in nature or that are updated in a sequential manner.

 

Web application attacks take advantage of vulnerabilities in the coding of applications and configurations. Common types of attacks include distributed denial of service (DDOS) and bypassing network firewalls to obtain sensitive data. Sometimes web application attacks are used in order to gain access into an organization, including physical access to a company’s servers. Data breaches can occur through web application attacks and unauthorized access to a company’s cloud storage accounts. Weak encryption systems and malware are often to blame with data breaches. Malware can come disguised in the form of freeware or shareware, file-sharing programs, programs or infected files stored on USB drives, and infected files or links shared through email.

 

Mitigating the Risks

 

Guarding an organization against compromised business emails includes enabling two-factor or multi-factor authentication. With two-factor authentication, a person must not only enter in credentials but provide another source of verification. This can be a code that is sent via text message to the person’s cell phone. Secondary means of authentication can also come in the form of a fingerprint or key fob. While it is easier for an attacker to guess a weak password and username, it is not easy to gain access to a code sent to a physical device that is only in the possession of the authorized user or duplicate a means of identification that is unique to the person’s physicality. Other means of guarding against compromised business emails include detection rules, employee education about spoofing, and more stringent policies regarding accounting and appropriate uses of email.

 

Two-factor authentication can also protect an organization against credential stuffing. Additional means include manual checking of passwords against known compromised credentials, enforcing frequent password change policies, employee education about not disclosing credentials, implementing detection rules, and employee education about social engineering and phishing tactics. Web application attacks can be prevented through more stringent firewalls, intrusion detection tools, limiting inbound access requests to server-based applications and systems, stricter scrutiny of cloud service providers and the providers’ security protocols, and the implementation of stricter internal security processes and policies.

 

Cybersecurity threats are unlikely to become a thing of the past as more devices and business processes become network integrated. However, simply having an internal IT security team in place is not enough to guard against attacks and unauthorized access. Developing both a defensive and an offensive game plan for the top threats most organizations face is an important step towards protecting a company’s sensitive data and technology-related resources.

3 Ways to Improve Your Cyber Security Plan

Posted on by Elevate Services Group

 

3 Ways to Improve Your Cyber Security Plan

Cyber attacks cost organizations millions of dollars per incident and often results in system downtime. The average cost of system downtime per cyber attack is as much as $1.25 million, according to Cybersecurity Ventures. System downtime can be costly due to lost sales, frustrated clients, and unfulfilled requests that lead to a significant backlog. Some clients also have long memories that lead to negative word of mouth and a future drop in sales. Despite the real threat of cyber attacks, Cybersecurity Ventures reports that only 28% of firms involved in installing network-dependent technology regard security strategy as highly important. Although completely preventing cyber attacks is often regarded as unrealistic, assessing threats, establishing key performance indicators, and mitigating human factors can help technology leaders improve their security strategies.

Threat Assessment

A proper threat assessment does not involve a single activity or happen once. Threat assessment is an ongoing strategic activity involving research, analysis, simulations, and follow-up. Starting with a series of questions is critical during the start of the research phase, as it helps security teams and technology leaders develop a profile of potential threats to the organization. Some of the questions to ask during this phase include:

 

  • Who is most likely to launch an attack against the organization and its resources?
  • Why is the individual or group of individuals motivated to launch an attack?
  • What data or information is valuable to the potential attacker(s)?
  • How are the potential attacker(s) likely to try to gain unauthorized access to the organization’s systems and data?
  • How has the potential attacker(s) breached other organizations?

 

Once security teams and leaders determine the answers to these questions, an analysis of the firm’s IT systems and infrastructure can occur. Finding vulnerabilities and ways to detect intrusions and other types of cyberattacks is as much about thinking like the potential attacker(s) as it is about discovering ways to stay a few steps ahead. This means setting up preventative measures and also conducting exercises to try to get around those preventative measures. By trying to accomplish a mock cyberattack, internal security teams can better identify previously unseen vulnerabilities in the organization’s infrastructure, processes, and security strategy. Follow-up activities involve analyzing system logs to determine if past indications of common or known attack methods exist.

Key Performance Indicators

Assessing vulnerabilities and developing a profile of high probability threats is important, but even the most sound threat assessment will be ineffective if performance measurements are not established. A sound cybersecurity plan contains ways to measure whether the organization’s strategy is working and identify areas for continued improvement. Common key performance indicators include:

  • Average detection time
  • Average time to mitigate detected threats
  • Number of identified vulnerabilities
  • Ability to control and prevent threats
  • Ability to meet and comply with the plan’s objectives
  • Whether key objectives or milestones were accomplished

Human Factors

Securing an organization’s systems and IT infrastructure against external threats is only part of a thorough cybersecurity strategy. Planning for the internal threats related to human error and inappropriate system access is even more crucial. Employees and vendors that have access to an organization’s systems should be subjected to security policies, including controlled access, account-level privileges, several layers of authentication, and awareness of social engineering and phishing techniques.

 

Education that includes security policies and training related to scenarios depicting potential threats is the cornerstone of a sound mitigation plan. Employees who understand what phishing attempts look like will be less likely to click on suspicious email links and less likely to download files that contain malware. Good communication, interactive training sessions, tests that simulate phishing and social engineering attempts, raising awareness about best practices, and implementing metrics can go a long way towards mitigating vulnerabilities related to human error. Implementing access policies that only give employees the system access they need to effectively perform their jobs is a secondary factor involved in mitigating internal threats.

 

The possibility of an organization becoming a target of a cyber attack is high if not a guarantee. Technology leaders and IT security teams cannot afford to not take cybersecurity strategy seriously. Conducting constant threat assessments, developing and refining key performance indicators, and finding effective ways to stress the importance of security protocols to employees and vendors are three foundations of a sound cybersecurity plan. Preventing cyber attacks from becoming serious incidents is important to an organization’s sustainability but learning how to make improvements based on existing vulnerabilities is even more critical to continued success.

How To Send Large Attachments Over Email

Posted on by Elevate Services Group

 

 

How To Send Large Attachments Over Email

 

When you’re trying to send large files to colleagues, customers or partners, you often can run up against issues that make transmission difficult.

 

Many commercial email programs put size limits on files transmitted over their networks. For example, attachments sent via AOL, Gmail or Yahoo are limited to 25 Mb per email and Outlook.com puts a 10 Mb limit.

 

In addition to the limits set by email providers, the email accounts to which you’re sending the attachments may also limit size.

 

So, what are you supposed to do when wanting to send large files? Here are a few ways to deliver what’s needed.

 

Can I Use a Cloud Storage Service?

 

There are plenty of commercially available cloud storage services, many of which are free. Among the most well known are Dropbox, Google Drive and OneDrive, the latter two of which are tied to email services (Gmail and Outlook, respectively). After you’ve uploaded your large files to these services, you can provide a link to those you want to see it and determine if they have editing capabilities.

 

What Is Compression Software?

 

Compression is a process that shrinks the size of each file considerably, up to 75 percent in some cases, without disrupting the integrity of the files themselves. The compressed files will be placed in a ZIP file. If the compressed ZIP file is now below the size limit for your email provider, you’ll be able to send it with no problem.

 

The recipient of your email can then unzip the file, where your files will be available for use.

 

Is Archiving an Option?

 

File compression into a ZIP file is one form of archiving, a process that collects multiple files into a single file. Archiving files is a good way to send large numbers of files at once. However, even this process can be problematic, with archived files themselves exceeding email provider limits.

 

If your files are already archived, you can extract all the files, split them into their own archives and send away.

 

What Is the Sharing Option About?

 

Many cloud storage sites include sharing shortcuts to allow for even faster collaboration. With OneDrive, for example, you can right-click on a file (in Windows) and select the Share feature. Click on the Send Link option and you’ll be able to enter an email address and message.

 

Are There Other Online File Sharing Options?

 

There are several online services available that are designed expressly to help with uploading and sharing large files. In most cases, you can upload your large files to the site. Then you can send a link to the files. Some sites require those accessing the files to have an account with the site; others allow anyone to whom you send a link to access the files. In some cases, there’s a free option for file sharing (but the allowed sizes are usually pretty small) and tiered account options.

 

Are There Any Other Solutions?

 

Depending on your internet service provider, you may be able to set up a Virtual Private Network (VPN) that would allow you to keep your files highly secure and sendable. However, a VPN transmission of large files could slow down your VPN and the files may not be intact upon arrival.

 

If you have a web hosting account, you can use its File Transfer Protocol (FTP) service to upload the files to your anonymous folder. Share the folder name and have the recipient access the folder via their own FTP features. This option takes some technical expertise, however, and can lead to a long upload process.

 

Finally, there is an old-school option. You could purchase a USB drive or an external hard drive, transfer the files to the device, and physically deliver them to the recipient.

Large files a reality for many businesses, freelancers and individuals. However, there are multiple options for transferring those files safely and affordably.