Happy Mother’s Day!

May 12th is Mother’s Day – what are your plans to mark the occasion? Flowers? A special meal? A day out with the kids?

Whatever your plans are, take some time this Sunday to celebrate all of the mothers in your life, not just your own.

And if this is your day? The {company} team hopes that it’s a great one!

Happy Mother's Day

Hackers Steal Company Information

 

Cybercriminals have started 2019 off by stealing more than 1.7 billion records. They look for data that is profitable in some way, whether they sell it directly or use it as part of another attack. A successful intrusion attempt comes from various factors, such as an employee downloading a malicious file or the business failing to follow IT security best practices. Here are 10 ways that hackers find a way to get into business networks

 

Tricking Employees into Opening Malicious Files

 

Phishing accounts for 91 percent of successful network intrusions. Employees see an email that looks authentic. The hacker makes it appear like it comes from someone in leadership, an external partner or another significant entity in the organization. The email has a file attached or a link included in the body of the email. If the employee opens the file, it loads malware onto that system or directly to the network. The phishing emails with links work by taking the user to a fake login page or another screen that requests username and password information. The hacker uses this to get into sensitive systems. The URL could also lead directly to malware.

 

Visiting Unsafe Websites

 

You can block suspicious websites and downloads for equipment that connects through your business network, but if someone uses a personal device, they don’t have the same level of protection. The next time they get on the network with the compromised device, the malware has a way to get on your systems and spread throughout your organization.

 

Lack of Control Over Personal Devices

 

If your company doesn’t have “Bring Your Own Device” policies in place, then you could end up with unapproved personal devices using your resources. IT doesn’t have any oversight on these unauthorized devices, so they represent a significant threat.

 

Lack of Cyber Security Awareness

 

IT security measures can only accomplish so much. Cybercriminals know that organizations have people of varying technical proficiencies. When an end user doesn’t have sufficient cybersecurity awareness, they fall victim to phishing and other attacks. Employees need to understand the steps they can take to protect against hackers, and get the training to learn about IT security best practices.

 

Poor Password Management

 

Employees may have weak passwords for their work accounts. In some cases, they may opt for no passwords. Data breaches at other companies could expose common username and password combinations that end up being in place at your business. Password cracking software makes figuring out this information trivial.

 

Insufficient Backups

 

Data backups are critical to helping your business recover from a cyber attack or another disaster. If the backup solution doesn’t work correctly or it fails at creating a complete backup, you could face losing months or years of work. The financial loss would be enormous and puts you in a situation that’s difficult to recover from.

 

Failure to Proactively Monitor and Maintain Infrastructure

 

Hackers look for vulnerabilities in your network that would allow them to launch a successful attack. If you don’t have IT security professionals monitoring your infrastructure and keeping hardware and software up to date, then you’re creating an environment that’s ripe for a data breach.

 

Lack of Cyber Security Measures

 

A failure to follow IT security best practices can lead to a workplace that doesn’t have enough cybersecurity measures in place. Some companies may be misinformed that all they need is perimeter defense to keep hackers out. You may be vulnerable to an intentional or unintentional breach by an internal actor, or be unable to defend against a sophisticated attack.

 

Unprotected Wireless Networks

 

Public wireless networks may be convenient for employees, but anyone within range can connect to them. A hacker can intercept the data traveling on the public Wi-Fi and use that information to get into company resources.

 

Sophisticated Social Engineering Efforts

 

Some hackers have attacks that involve a lot of social engineering. They may be trying to get into the financial accounts of upper management or accounting, or they could want to access trade secrets and insider information. They act like they’re an authorized person with a legitimate need to have the data or access that they’re requesting. Cybercriminals can be very convincing, especially when they have well-funded operations. If your company has a lot of turnover, or departments that don’t interact with each other, it’s difficult for employees to keep track of who actually works there.

 

Lack of Physical Access Control

 

One area that gets overlooked in a cybersecurity strategy is physical access control to data centers and other rooms that contain servers with sensitive data. A hacker could download that data directly from your systems or take the opportunity to load malware onto your infrastructure. If employees write down their account information and post it on their workstations, the hacker could save this information for later use.

 

Hackers have many ways to break into your business infrastructure and compromise your systems. Intrusions can lead to long-term consequences, such as major financial losses and damage to your reputation. Protecting against these common attack methods puts your company in a better position to limit your cybersecurity risk.

Happy Administrative Professionals Day!

 

April 24th is Administrative Professionals Day, which is an occasion worth celebrating. No office can function without hardworking and dedicated administrative staff, so why not take this as an opportunity to remind them how much you value them?

 

Treat your administrative staff to a little something special today, and let them know how important they are to everything that your business does.

Happy Admin Professionals Day

Should Law Firms Start Their Own Podcasts?

 

 

Podcasts are huge these days. Popular podcast Serial has been downloaded millions of times and has become a pop culture phenomenon right alongside other “did they really do it” series like Netflix’s Making a Murderer. Podcasts are also used for informational and educational purposes. NPR offers its programs in podcast form so users can listen at their own pace. They’ve even developed programming that doesn’t broadcast on the radio. It only exists in podcast form.

 

The podcast has arrived, and it doesn’t appear to be going anywhere anytime soon. The question for law firms, as with any new tech innovation, is whether developing a podcast for the firm makes sense. We believe creating a podcast can be a powerful, memorable branding tool. Here are a few reasons why your firm should consider starting one.

 

A Branded Podcast Builds Credibility and Engagement

 

The problem most law firms face isn’t competence. The process of becoming a lawyer usually takes care of this. The problem firms face is getting their name out into the community effectively. You want to communicate that you’re competent and successful but at the same time approachable. Much of law firm advertising veers far in one direction or the other. You see “prestige” billboards that may communicate “you can’t afford me” to a good portion of the community, and you see cheesy TV commercials that communicate “we’re not a serious firm” to another portion of the community.

 

Creating a podcast is a low-cost, low-effort way to engage with your community. You can communicate in a down-to-earth fashion by just being yourself. You can use a podcast to indirectly convince community members of your ability and skill, and you can disarm the negative notions that can come from prestige advertising.

 

It’s an Inexpensive Advertising Tool

 

Another advantage of podcasting is cost. It’s very inexpensive to produce a podcast, and it costs nothing to host it. All you need to produce it is some simple audio recording equipment and a topic that you can discuss. Hosting a podcast is a simple affair using a hosting tool like Libsyn. Hosting tools like this one will automatically publish your podcast to iTunes and all the other major podcast services. Once your content is published, you can promote your podcast using your existing social media channels through both regular and paid posts.

 

Compare this to the costs of producing video for social and the costs of traditional advertising. To produce social video, you’ll have to invest in video recording equipment. If you want a quality product, you’ll probably end up having to hire a video production group to produce them. Then, consider traditional print and TV advertising. The costs are astronomical compared to the costs of producing a podcast.

 

It’s an Attractive Alternative to Video

 

Let’s be honest: we don’t all look like the beautiful pretend lawyers on Suits. Even if you are blessed with great looks, you may not be comfortable in front of the camera. If video makes you look shifty, insecure, or nervous, you’re not helping your firm’s advertising efforts. Focusing your efforts on a podcast avoids the difficulties and aesthetic concerns that come with video.

 

The other issue with video is that they need to be short. Videos, especially in advertising, need to be fairly “snackable.” Podcasts, on the other hand, can take a deeper dive. People often listen on their commute or at the gym, so they are looking for content of a certain length. Going deeper on a given topic is one way to reaffirm your credibility, too.

 

Getting Started

 

If you’re ready to start a podcast for your firm here’s a brief guide to the steps you need to take.

 

Equipment

 

You can record audio using the internal microphone on your laptop, but it won’t sound very good. Invest in a midrange USB microphone, like the Snowball or Yeti from Blue. The difference in sound quality will astound you. You can easily record one or two people around a microphone like those. If you plan to invite more than one guest onto your podcast, you may need an additional microphone.

 

Software

 

If you’re recording only one microphone, your software needs are simple. Free recording and editing programs like Audacity for PC and GarageBand for Mac will do just about everything you need. Call Recorder for Skype is an inexpensive Mac app that will simplify things for you, too. We recommend starting with this simple setup before exploring multi-mic (multi-track) recording. Once you’re familiar with the basic principles, you’ll have an easier time scaling up.

 

Topics and Launch

 

All that’s left is to come up with some topics and get going. Choose topics community members are likely wondering about and answer whatever questions they may have. This is a tool for getting clients in the door. Choose topics that offer as much value as possible, topics people will want to listen to.

 

All that’s left is to launch. Hit record, start talking, and publish!

Password Management: What Lawyers Must Know

 

 

Passwords are a problem. In one sense they are exactly the opposite of what they should be. They’re hard for users to remember but easy for intruders to guess or steal. The user frustrations with the current system make it ripe for abuse, and that’s exactly what’s taking place every day.

 

The best solution for lawyers and law firms alike is to implement a password management utility. We’ll take a look at that solution after exploring the nature of the problem in greater depth.

 

The Problems with Passwords

 

Can you even count how many digital sites and services you’re required to log in to with a username and password? Most people have upwards of one hundred. It’s challenging, if not impossible, to keep them all straight without some kind of assistance. People usually resort to one of several very insecure methods to solve this. One of the most common is reusing the same username and password on multiple sites.

 

Password Reuse Is Easy but Dangerous

 

Security professionals will tell you that reusing passwords is dangerous. This is because when (not if) your credentials are captured or stolen on one site, you become vulnerable on every other site that uses those same credentials. The problem here is that it’s just so easy to reuse passwords, especially on accounts we don’t consider to be sensitive in nature. Nearly half of security professionals themselves admit to reusing passwords, even though they know firsthand the dangers of doing so.

 

Strong, Unique Passwords Are Too Hard to Remember

 

If you’re not supposed to reuse passwords, then what should you do? Ideally, you should create a strong, unique password for every site. Each one should be lengthy (the longer the better) and should contain a mix of lower and uppercase letters, numbers, and symbols. The longer and more complex the password, the harder it is for a computer to crack it. People won’t be able to guess Gbje23+3zp?$T0n very well at all.

 

The problem with a password like Gbje23+3zp?$T0n, though, is obvious. You’ll have a tough time remembering even one of those, let alone a hundred.

 

Experts will suggest other tactics, like turning a familiar phrase into a password. “Four score and seven years ago our fathers brought forth a new nation” could become “4s&7yaoFbfaNN”. This method uses the first letters of each word (along with numbers and symbols where appropriate) to create a passcode that’s nearly inscrutable but that’s easier to remember.

 

This method helps, but it doesn’t scale well. It’s true you’ll have an easier time reproducing that than the previous example, but you’ll still have a tough time replicating that a hundred times over.

 

The Solution: Password Management

 

The best solution to the password conundrum is using a password management utility. Setting up a password management utility isn’t difficult, and putting one in place greatly increases your digital security. Once you’ve set up a password manager, you don’t even need to remember all those passwords. You just have to remember one.

 

How Password Management Tools Work

 

Password managers are programs or apps that function as a digital safe, or a digitally encrypted locker. All your passwords are stored inside the safe. Password management tools will also help you create long, complex, unique passwords for all your accounts. Some can even do this automatically once you supply your existing credentials.

 

With a password manager, it’s easy to maintain a different complex password for every account, because you no longer need to remember those passwords yourself. You just need to create and memorize one very strong password for the password manager itself.

 

Once you’ve set up a password manager, it will autocomplete the login fields on most websites. For the few that don’t auto-populate, you can access a database of your account credentials and copy and paste the proper credentials into the corresponding fields. All the major password managers also offer some degree of integration with both iOS and Android. Your passwords remain accessible, yet secure, on your mobile devices.

 

The Security of Password Management Tools

 

Password management tools stake their reputation on their security. They aren’t perfectly secure—nothing is. The Washington Post notes some of their flaws. They are, however, a vast improvement over most people’s current password practices. No one gets access to your vault without your master password, and hackers won’t get that password from the utility makers since they don’t store your master password anywhere. There’s no database to be hacked.

 

On that note, make sure your master password is itself long and complex. Consider using the “familiar phrase” tactic described earlier.

 

Conclusion

 

Lawyers have an obligation to keep their digital accounts secure. Doing so manually is difficult if not impossible. Implementing a strong password management solution is the answer. If you have more questions about implementing a quality password management system for your law firm, we’re here to help. Contact us today to discuss the options available.

Security Update: What’s PhishPoint?

 

 

The attack dubbed “PhishPoint” is a recent cyber-attack scheme being used by foreign hackers. It demonstrates the craftiness and the extent that cybercriminals will go to in order to harvest your Microsoft Office 365 credentials. It uses several familiar aspects of Office 365 to lull potential victims into an assumption that everything is above board. But it’s not. Here’s what you need to know about PhishPoint and how to protect your organization.

 

How Did The PhishPoint Attack Get Into Office 365?

 

The PhishPoint hackers use Microsoft SharePoint files to host their phishing links. Typically hackers use emails to host malicious links. Now, these crafty hackers have figured out how to bypass Office 365’s built-in security to leverage their attacks. This shows that there’s a critical flaw in Office 365 in this respect.

 

How Does The PhishPoint Attack Work?

 

You can recognize a PhishPoint malicious email by its use of “URGENT” or “ACTION REQUIRED” to urge you to respond. But beware, this email contains a link to a SharePoint Online-based document that you don’t want to click.

 

Here’s how it works:

 

The link will direct you to SharePoint. It will look legitimate and could trick you or your users unless you know what to watch for it.

 

At this point, you’ll be shown a OneDrive prompt –The SharePoint file will impersonate a request to access a OneDrive file with an “Access Document” hyperlink. This is actually a malicious URL, as shown below.

 

Then you’ll see a Microsoft Office 365 logon screen – Don’t enter your information even though it’s very authentic-looking login page. if you do, the hackers can access your user credentials!

 

What Else Should We Watch For?

 

Several things stand out here, and you should watch for them:

1. The email is unsolicited and has a generic subject of “ has sent you a OneDrive for Business file.”

2. Opening the document requires you to take a number of steps.

3. The URL for the logon page isn’t on the office365.com domain.

 

Why Didn’t Microsoft Stop This Scam?

 

Unfortunately, Microsoft didn’t see this coming. They continually scan emails for suspicious links and attachments, but even they were fooled. They didn’t think that a link to their own SharePoint Online would be malicious.

 

Another problem is that Microsoft link-scanning only goes one level down. It scans links in the email body but doesn’t scan files that are hosted on their services like SharePoint. If they did, they would have to scan for malicious links within shared documents.

 

And there’s another problem…they couldn’t blacklist the malicious URL unless they did this for the full URL for the SharePoint file. In this case, the hackers could just make a new URL in an uploaded file that contained content similar to SharePoint.

 

Since Microsoft isn’t scanning files hosted on SharePoint, hackers can easily use the platform to con their users and steal their credentials.

 

This scam exemplifies the risk associated with cloud-based applications. Using context and services that users are familiar with, cybercriminals can take advantage of a lowered level of alertness, and gain access to corporate resources online – all without the user or organization ever knowing it.

 

What Is Microsoft Doing To Prevent Scams Like PhishPoint?

 

Microsoft has been working behind the scenes to stop foreign attackers. Court documents that were unsealed on March 27, 2019 show that they’ve been waging a secret battle against a group of Iranian government-sponsored hackers.

 

Microsoft said it received substantial support from the domain registrars, which transferred the domains over to Microsoft as soon as the company obtained a court order.

 

What Can We Do To Prevent Being Affected By PhishPoint?

 

It’s important that you share this message with all of your users:

Be on alert! The bad guys have a new way of stealing your login credentials. They target you by sending an invite via email to open a SharePoint document.

The link takes you to an actual SharePoint page where you will see a OneDrive prompt. The prompt will have an “Access Document” link in it- don’t click this link!  

This link is malicious and will take you to a fake Office 365 login screen. Any credentials you enter here will be sent to the bad guys. Don’t be tricked!  

Whenever you’re submitting login credentials to any site, make sure to check the URL of the page for accuracy. Also, remember to always hover over links to see where they are taking you. Remember, Think Before You Click.

 

Here are some other things that you and your users should do:

  • Be wary of any email subject line that contains an imminent threat like “URGENT” or “ACTION REQUIRED.”
  • Always suspect URLs in the body of an email. It’s best not to click them. Most legitimate businesses no longer send links in emails.
  • Carefully review any logon page. Check to make sure that the URL is actually hosted by the service that you want to use.
  • If an odd-looking email shows up in your inbox from someone in your organization and you question its authenticity, contact the person by phone to see if they sent the email.
  • Use Multi-Factor Authentication for all of your software platforms and online accounts.
  • You should also sign up your users for Security Awareness Training. When you do, they’ll have a better chance of spotting the telltale signs of a cyber threat.

Why Reusing Passwords Is A Horrible Idea

 

 

No matter your profession, reusing passwords is a horrible idea. It’s dangerous and insecure. Reusing passwords is especially problematic for those working in fields like law, ones that require confidentiality in one form or another.

 

Many people already know that reusing passwords is unsafe, but they do it anyway. One recent survey conducted by Lastline revealed that nearly half (around 45%) of information security professionals polled admit to reusing passwords. These people get paid to work in information security, and yet they don’t follow some of the most basic protocols for keeping information safe.

 

If anyone should understand the dangers here, it would be information security professionals. You’re likely not an information security pro, though, so let’s look in greater detail at why reusing passwords is so bad.

 

A Broken System

 

First, cut yourself a little slack. The internet password system is inherently broken. Most people have well over a hundred digital accounts. These range from the seemingly trivial (paying a utility bill, “store insider” loyalty programs, and the like) to the vitally important (banking, proprietary business accounts, and so on). Each one requires a username and a password. To make things worse, many sites require a mix of characters (capital and lowercase letters, at least one number, and at least one symbol). Some sites won’t accept all the special characters, and various sites won’t even agree about which special characters are acceptable!

 

Cheating Ensues

 

Most people can’t easily memorize one hundred or so unique sets of site plus username plus password, so they cheat. Either they write all their passwords down in a notebook or they reuse the same password across multiple sites. Even worse, they may do both!

 

The Frequency of Reusing Passwords

 

How widespread is reusing passwords, really? A massive study from researchers at Virginia Tech found that the problem is quite severe. They analyzed 61.5 million passwords spread out over 28.8 million users and found that over half (52%) reused passwords wholesale. That doesn’t even account for people reusing the same basic word or phrase and just switching out a few characters or adding a new one to the end.

 

The Problem with Password Reuse

 

Here’s the problem with password reuse: credentials have a habit of being stolen. Companies frequently experience hacks where customer data is exposed. You may not consider it such a big deal if hackers got ahold of your username and password for Bargains ’R’ Us. You don’t shop there often and you don’t have any credit card info stored on their website. Is it really a big deal?

 

On its own, it’s likely not a very big deal. But if you reused the same username and password for, say, your bank or your credit card, it’s suddenly a very big deal!

 

The same goes for the sticky-note users out there. If you’ve ever written down your “go-to” password on a sticky note or in a notebook, consider who all has had access to that information. Family? Friends? Coworkers? The cleaning crew or service technicians? How easy would it be for someone to snag a quick picture of your password list? If you reuse your passwords, this problem escalates quickly.

 

One more problem worth noting is messaging or emailing passwords. Many of us have had the experience of texting, emailing, or messaging a password to a spouse or significant other. Those communications aren’t always secure, though, and often they stick around for a while. If someone gained access to your email, would they also gain access to sensitive passwords?

 

The Ubiquity of Data Breaches

 

Data breaches are happening all over the place, and some of them are huge. Yahoo had every single one of its 3 billion accounts breached. If you had a Yahoo account at the time of the breach, even an old dead one you never check, hackers may now have your sign-in info. If you used your go-to password on that account, then every other account you’re using that password for is now at risk. This is a big deal.

 

Solutions to the Password Problem

 

Passwords are a mess, and not reusing passwords is difficult. Here are some solutions that can help you clean up the mess and reduce frustration.

 

Enable Two-Factor Authentication Wherever Possible

 

Many websites offer two-factor authentication (2FA), which is much more secure. With 2FA, a one-time code is sent in a text message or email after logging in with username and password. Enable 2FA wherever possible.

 

Use a Password Manager

 

Password managers solve the problem of memorizing hundreds of unique passwords. They store all your passwords in an encrypted vault that you secure with one strong master password. We recommend using a good password manager. Doing so makes strong password security easy.

 

Conclusion

 

Understanding the danger behind reusing passwords is an important first step in securing your digital life. For help securing your workplace against digital threats, enlist the help of professionals like us. Contact us today to learn how we can help keep your systems secure.

What Is The Estimated Cost Of Your Next Ransomware Attack?

 

 

Successful businesses require smart leadership. How does a company effectively protect its profits? Planning for profits should also include company-wide management of expenses and security planning is high on the list. If the average ransomware payment has reached close to $15,000, a company’s leaders would want to plan ahead and ensure all security best practices for backups, network systems, cloud storage, and servers. Real profits include all revenues with an understanding of cost allocations for a business. Effective technology solutions can help make sure the right focus is on the products or services with higher profit margins. Security planning fits nicely with successful leadership, along with prevention plans to reduce all risks. Eliminating any unnecessary expenses from ransomware attacks could allow better allocations for salaries, employee satisfaction, company reinvestments, and provide improved planning for sales and profits.

 

How do you put a cost on employee reassurance for successful security planning? Do not allow a ransomware attack to affect your profits, employee satisfaction or customer confidence. How can you improve customer satisfaction with your plans for security? Employees and customers can benefit from understanding the successful planning for eliminating all security risks. Smart leadership with security planning includes documentation for policies, procedures and adequate communication for employees. Employee training should consist of documentation that clearly outlines security requirements. Employee retention and job satisfaction may not seem completely quantifiable but effective leadership is able to provide the best planning for staff morale.

 

Security planning

 

Effective leadership includes communication strengths, simplified technology solutions, employee support, and operational planning for client satisfaction. Marketing, client support, and branding require appropriate security planning and any security issues, such as ransomware attacks, are disallowed. On-demand support is important for employee support and client satisfaction. Security planning should be the focus of any customized IT services and flexible technology solutions. Support plans may include additional hiring and training for technicians. Packaged solutions and IT managed services are easily researched with the correct leadership involved and reviews of the cost-benefit analysis. Effectively managed IT support can help prepare a company for leading-edge technologies, cost savings, and marketing strategies. The improved promotions for profitability are part of the smart leadership of a successful business.

 

Business growth

 

A company’s growth can be comfortable for leadership teams and employees. Appropriate planning would be for new hiring, cost management, accounting and administration, and information security. A company’s asset allocations for new hires are a smart focus for scalable business growth. Support for the human resources departments can help simplify the hiring process, training procedures, and employee effectiveness. The technology staff and any partners for technology solutions should be high on the priority list for smart business growth. Technology teams can be some of the best for effective cost management, profitability, operations planning with sales projections, and marketing priorities. Experienced IT consultants can help with planning and success throughout a company.

 

Expense management

 

Appropriately allocating expenses with accounting and administration is an effective strategy. Technology teams and business executives are able to better focus on profitability and growth strategies. A thorough understanding of staffing needs is improved with effective expense management reviews. Some of the expenses and cost projections to consider include the following:

 

  • Employee expenses including computers, mobile devices, and salaries
  • Administration overhead with product and services support
  • Technology costs with security planning, salaries, commissions, and partnership agreements
  • Asset allocations and maintenance costs
  • Trained technicians and experience with cost cutting are improvements for the business
  • Product development expenses and allocated costs with packaging, distribution, and promotions
  • Sales and marketing costs are monitored continuously for profitability and growth projections
  • Costs for press promotions, media announcements, and public relations
  • Social media support with company messages and communication plans

 

Regular security assessments

 

Reviews can include usability of information systems and an analysis of graphical user interfaces for all technology implementations with user access. Smart leadership could consist of a review of the regular security assessments for planned improvements, user support, and communication enhancements. Confirmation of success is smart for operations and client reassurance. Sales and marketing teams can use healthy reporting to demonstrate successful planning for security procedures and privacy of client information. Looking organized is also part of effective management with security reviews and regular assessments. Security plans should be a part of expense management and corporate planning.

 

Network administration

 

The salary for a network administrator is important to review often for effective leadership and employee planning. “An in-house network administrator can cost your business somewhere around the salary range of $45,000 to $80,000”,  https://www.payscale.com/research/US/Job=Network_Administrator/Salary. Having the right successful leadership in place is a smart way to manage all business expenses and plan for successful growth. Working with the managerial staff, the network administration team can prepare the best documentation for employee training and new hiring processes. As some of the smartest planning for sales and marketing promotions, smart plans for the employees can help improve profitability for a business. Smart priorities can help assure employees are impressed with a company’s plans for success and business growth. Security planning can be improved with communication of the policies for networking, backups, remote access, client information, and employee administration.

 

Employee training

 

Training can be helpful for all employees, including new hires. Plans to prepare training can include impressive presentations or documentation to impress potential or current clients. The best type of training for technology and information systems, such as security plans, can easily be prepared to benefit the entire company. Communication with all levels of employees is friendlier with documentation or reports highlighting prevention plans and confirming the correct policies for security. Risk assessments and security reviews can foster better communication with employees or clients. The focus can benefit plans for profits and sales successes.

 

Successful planning to completely dismiss any risks of ransomware attacks is smart business. Preparing for profits and protecting your business work are good leadership plans. The appropriate planning can be appreciated by business executives, business owners, and managers. Confirmation of the best preparation for salaries and commissions is important for the network administrators and the entire staff for a company. Having the right leadership in place can help reduce all security risks and eliminate unneeded expenses of any cyber attacks or vulnerabilities.

Password Management For Law Firms (Questions/Answers)

 

We can’t function without passwords. So much of the internet is built on the concept of a username plus a password that the concept is core to users’ internet experience. It’s a clever but imperfect system that could certainly be improved upon, but until a game-changing replacement comes along, we have to play the game.

 

 

There’s a lot that doesn’t work very well about this system, and many people have questions about what password management best practices are. To that end, here’s a Q&A about passwords and password management.

 

What’s the biggest problem with how people use passwords?

 

The biggest problem with internet passwords is password management. Users have dozens if not hundreds of username/password combinations that they need for personal and business use. The problem with this is that nearly no one can reliably remember one hundred unique passwords. Many users, then, select overly simple (and easy to guess) passwords, or they reuse passwords across many sites.

 

What’s wrong with reusing passwords?

 

We live in a world of data breaches. When (not if) someone hacks favorite retailer or hotel chain, it’s embarrassing for those companies, but probably doesn’t affect your life too much. If the culprits gain access to your username and password for those sites, it’s a nuisance, but the amount of damage they can do is limited.

 

But when your hotel rewards password is the same as your credit card password and your banking password, you could have a mess on your hands. Scammers know that at least 51% of people reuse passwords, and you can bet they’ll try those stolen passwords on other, more valuable sites.

 

What makes a strong password?

 

A strong password is one that neither human nor machine can guess easily. Forbes compiles an annual list of the worst passwords being widely used, and it’s topped with gems like password123456, and qwerty. These are terrible because they’re just about the first things a human might guess. Other bad choices on the human front are the names of people, pets, or places that everyone knows are meaningful to you.

 

On the machine side, the shorter and simpler the password, the easier to hack. Make your password harder to brute-force by adding length, capital letters, numbers, and symbols. A password of 12 to 16 characters that mixes all these character types is generally considered a strong password.

 

I just keep my passwords on a sticky note. What’s wrong with that?

 

In short, everything. A sticky note hidden under your keyboard isn’t exactly a state secret. Think about who might have momentary access to see that sticky note. Clients? The cleaning crew? Maintenance personnel? Who else? This is especially disconcerting In the legal world, where those passwords could give a bad actor access to confidential materials that are under attorney/client privilege.

 

How can I remember passwords like j#%3M82*mRz!+?

 

Truthfully, you probably can’t. While that’s a tough password to crack, it’s not very useful for you. A better approach is to take a phrase that you can remember (perhaps one that relates in some tangential way to the site you’re on), and then make the phrase longer and more complex.

 

For example, iloveturtles is an easy phrase to remember, but it’s not that challenging to guess or to crack. Mix up the phrase by adding replacement characters, like <3iL0v3TurtleS<3, and neither your office mate nor a computer will easily guess or break your password.

 

Admittedly, this method has limits. Your own memory can be an obstacle, and sites vary with which characters they’ll allow in passwords.

 

I can’t remember 100 unique, complex passwords. What are my options?

 

Passwords need to be complex, and you shouldn’t reuse them from site to site. This creates a problem: Who can remember them all? One option that’s gaining a lot of traction in both the personal and enterprise markets, including in the law and legal tech fields, is using a password management tool. You’ve likely seen these advertised as “the last password you’ll ever need” or “one password to rule them all”; stuff like that. Password management tools are a reliable, secure way to generate and remember unique, complex passwords for all the sites and accounts you have.

 

How does a password management tool work?

 

Password management tools vary a little bit in terms of functionality, but at the core the services are similar.

 

  1. First, you input or import all your existing credentials to the password management tool.
  2. Next, you turn all your current weak passwords into strong ones. Some password management tools can do this automatically for you on many websites.
  3. Last, you create one strong, secure password for your password management tool account.

 

After you’ve completed these steps, you’ll have just one password to remember—the password to your password management tool. It will store the rest of your credentials in a secure, encrypted vault and use them to log you into whatever account you need.

 

Are password management tools secure?

 

Yes. The companies offering these tools would be sued out of existence if not. Don’t believe us? Check out what a panel of experts has to say on the topic.

 

Conclusion

 

If you have additional questions about implementing a password management tool in your law office, contact us today. We’re here to help.