Fishing, Phishing and Network Security: It’s all connected

IT & SECURITY

It’s been said if you give a man a fish, you feed him for a day, but if teach him to fish, you feed him for a lifetime.

In a kind of a corollary to that, Bob Black, the founder of RK Black, is said to have told our copier technicians that fixing copiers was only doing half of the job. The other half of the job is to teach our clients on the proper use of their copiers — thereby helping clients to possibly avoid or reduce downtimes in the future.

In both of these scenarios, whether it is fishing or using a copier, the education of the user is critical to maintaining life, be that for a person or for a copier.

Fishing, Fixing and Network Security

The same is true in network security. You can implement all kinds of network security measures — firewalls, VPNs, antivirus software, email filters and so on — for your organization’s network, but if you don’t teach your users how to recognize and avoid cybersecurity threats, you’re only doing half the job. You’re only throwing your users a fish.

Many organizations daily receive hundreds of emails bearing viruses and other forms of malware, many sent directly to user inboxes and others sent to group email addresses. But no matter how small or large your organization, whether you have two users or 200, all it takes is one click on a malicious link or one opening of a virus-laden attachment, and your network is compromised.

With one push of the index finger on the mouse, your user has effectively ushered the enemy into your network bypassing all of your network security measures. For many businesses, such an intrusion could mean thousands of dollars in loss due to downtime and maybe even fines.

Teach your users to fish and not be caught

That is why it’s so important, for the sake of your organization’s network security, to teach your users how to recognize potentially dangerous links and attachments, as well as other social engineering schemes — also known as phishing — and to avoid them. This way, they can join your organization’s network defense efforts and not unknowingly compromise them.

If you don’t know where to start on educating your users, read this and share: How to spot a phishing email.

But as another option, as part of our managed network services, we offer our clients a user-friendly training tool that can drastically help to improve your network security by training your users how to recognize and avoid social engineering schemes.

The tool not only comes with engaging, short, easy-to-understand videos followed by online quizzes, it also provides you with the ability to launch fake schedulable phishing campaigns to test your users and reporting to help you determine which users may need more training.

Conclusion

Educating your users is necessary for a secure network, but it doesn’t have to be difficult. If you’re interested in using this tool for your organization, give us a call. We’ll help you teach your users to fish.

6 tips for gaining and retaining organizational data privacy

IT & SECURITY

Keeping your organization’s data secure and private should be a top priority. Why? Because data breaches are becoming increasingly common, destructive, sophisticated and expensive.

According to Inc. magazine, for U.S. companies in 2019, the average breach cost $73,000. Furthermore, 8 percent of respondents to a survey of senior executives the same year said their organization had experienced a breach within the last two years and 12 percent, within the last 5. The same article said half of the breaches were not conducted through the use of malware, but rather using existing systems and stolen credentials.

So then how does one prevent their organization from falling victim to a data breach and private information accessed?

Here are some tips:

Shred confidential records

When it comes to moves, spring cleanings, organizational downsizings and old records, it’s easy to throw away the items you don’t need. It would seem like once they are in the trash bin, they are out of sight and out of mind. The trouble is, they’re not. Not only can dumping records bearing personal or confidential information bring hefty fines, it can open your organization to identity theft, corporate espionage, data breaches and so on.

The best thing to do is with any records holding any identifying information — such as names, addresses, account numbers and other information best kept private— is to shred them. Better yet, hire a mobile shredding company to come to your location and shred those documents in front of your very eyes. That way, these records can truly be out of sight and out of mind.

Use passwords and use them responsibly

Admittedly, passwords are annoying. However, they are increasingly necessary to protect you, those you work with, your networks, connected devices and data.

Here are some tips to make your passwords easy to use, yet effective:
Keep your password private. That means don’t leave it on a sticky note and attached to your monitor and don’t share passwords. Sharing your password takes down your first line of defense. All it takes is for the wrong person to get your password, and the sky is the limit for how much damage they can do.
Use a minimum of fourteen characters — a combination of symbols, numbers and upper and lowercase letters, making the password more difficult to guess. You can change out letters with numbers and vice-versa, like substitute “s” with “5” or “$”, “e” with “3”, or “a” with “4” or “@”, as examples — but make sure it’s not 2Pr3d1ct@ble.
Don’t use personal information. You don’t want your password easily guessed, so don’t use information such as your name, your username, your company’s name or such.
Make each password unique. By only using unique passwords for each login, you effectively protect your other accounts should one become compromised.
Use an easy-to-remember phrase for your password. For example, think of a hobby, a favorite activity, maybe a favorite vacation spot or a bucket list item or such. Once you have it in mind, transform it into a series of upper and lowercase letters, numbers and symbols. For example, “I want to hang glide” becomes “IW@nt2HangGl!de”. See? It’s strong, secure and relatively easy to remember.
… Or use a password manager. There are many options out there like LastPass, 1Password or Bitwarden that will generate secure passwords, remember them and populate them for you, but for business, you need something with a bit more power and more usability.

We have just the thing a password manager that not only, well, manages your passwords, but gives your team private vaults, secure shared folders, an administrative console, role-based permissions and more.

Use two-factor authentication

With two-factor authentication, should someone have hacking “skilz” and get your password, they still will not be able to get into your account.

Under such protection, when a login is attempted, the proper user will receive a notification on their mobile device requiring either a passcode or login acceptance. This way, if someone doesn’t belong accessing your workstation or account, you’ll be able to deny them access.

Regularly update your software

Just like passwords, software updates are annoying but necessary. Many updates carry patches or security fixes for known vulnerabilities and work to plug holes where bad guys can come in. We also recommend daily restarting your computer daily as doing so allows your workstation to receive and install updates, making it less vulnerable to cyber threats.

Educate network users

It’s been said that if you don’t know what the problem is, you can’t fix it. The same is true when it comes to your network and its users. Often the greatest vulnerability in a given network is its users, especially if they don’t know what a security threat looks like.

That is why it’s important to teach your users to recognize social engineering (otherwise known as phishing) when they see it. It’s likely every day they receive emails bearing malicious links enticing them to click them, only to download a nasty virus or ransomware package — potentially costing your organization thousands of dollars in damage and potential fines. Teaching your users to identify and avoid such threats can save you lots of pain and heartache.

If you don’t know where to start on education, read this and share: How to spot a phishing email.

Utilize VPNs

Sadly, Wi-Fi networks and especially public ones can be hacked. If a user gets onto a compromised network, bad guys can capture any and all information exchanged on the network.

That is why there is such a thing as VPN — virtual private-area network.

With a VPN, you can connect to the internet via a public hotspot, but then immediately access your organization’s VPN typically via a desktop icon. This then launches an encryption program that directs your online activity under the protection of your organization’s connection, blocking bad actors from viewing and collect your data or work.

If your organization does not have a VPN, we might know a certain managed IT services team (our own, actually) that can help you out.

Hopefully, these tips help you better protect your business and keep your private data private.

If you need help on implementing any or all of these strategies, give us a call. We provide office technology solutions to businesses of all sizes and we are here to help you.

If you would like any information on how to secure your network and data as described above let us know. We’d be glad to help in any way we can.

6 tips for strong, easy passwords to keep your business secure

IT & SECURITY

Anybody using computers or any networked devices these days would likely agree — passwords can be cumbersome.

They’re annoying to generate, difficult to remember and often frustrating to populate. To make them worse, they are required seemingly everywhere — even for booking your hair appointment.

But as you know, passwords are necessary. They are the first line of defense against unauthorized access to your devices, accounts and networks. They are like locks on doors, meant to protect you and those around you from the outside and to keep your business your business.

But passwords, as annoying as they are, are better than their alternative — breached networks, infected systems, stolen identities, lost data, expensive fines and damaged reputations. That is what makes them necessary.

Until advances in biometric or other technology make them obsolete, passwords are here to stay, so it’s best to use them properly and make them less cumbersome.

6 tips for stronger yet easier passwords

Here are some tips to make your passwords easy to use, yet effective:

Keep your password private. When it comes to passwords, contrary to the popular saying, sharing isn’t caring. Whether by leaving your password on a sticky note on your monitor or attached underneath your keyboard or by telling it to a co-worker, sharing your password takes down your first line of defense.

Also, don’t let everybody in your office use the same password. If the wrong person gets the password, they will be able to access everything.

Use a minimum of fourteen characters. This should be a combination of symbols, numbers and upper and lowercase letters, making the password more difficult to guess. You can change out letters with numbers and vice-versa, like substitute “s” with “5” or “$”, “e” with “3”, or “a” with “4” or “@”, as examples — but make sure it’s not 2Pr3d1ct@ble.

Don’t use personal information. In the same vein as keeping your password from being easily guessed, don’t use information such as your name, your username, your company’s name or such as these can be easily guessed.

Make each password unique. If you use one password for everything, if ever your one password is discovered, everything will be accessible and at risk. By using unique passwords for each login, you effectively silo each account, protecting your other accounts should one become compromised.

Use an easy to remember phrase for your password. For example, think of a hobby, a favorite activity, maybe a favorite vacation spot or a bucket list item or such. Once you have it in mind, transform it into a series of upper and lowercase letters, numbers and symbols. For example, “I want to learn Hungarian” becomes “IW@nt2L3arnHung@r!an”. See? It’s strong, secure and relatively easy to remember.

… Or use a password manager. There are many options out there like LastPass, 1Password or Bitwarden that will generate secure passwords, remember them and populate them for you, but for business, you need something with a bit more power and more usability.

Introducing a business-grade password manager

After months of research and trying multiple password managers, ones suited for business use, we choose one we liked the best and now offer it as one of our technology solutions for businesses.

The password manager we selected provides:

private vaults for each team member, allowing them to store and manage passwords, files and private data
secure shared folders, subfolders, passwords and special encrypted folders for individual or team use
an administrative console allowing designated administrators to share, manage and monitor password and data security across your entire organization
role-based permissions giving you the ability to customize access to certain tools and networks to specific individuals and team members based on their duties.
password security analysis and reporting giving you insight into your organization’s password security and associated controls and compliance standards.
version management and record history where employees can view their records, any prior versions and any changes made of time.

With all of that power in a password manager, it’s no wonder we chose it, right?

Summary

As with anything in life, if a certain activity is cumbersome but necessary, keep the process but make it easier. Passwords are a pain, but they don’t have to be. Just keep them private, non-personal and memorable using multiple letters, numbers and symbols in a 14-character-long phrase, making sure they are unique to each utility or use a password manager. Using a password manager for your business is a powerful, robust and easy way to make using passwords easier. We have one available with your business in mind.

Sounds interesting? Reach out to us and we’ll show you more about it and help you get on board. In any case, protect yourself, use stronger passwords and use them properly.