This HUGE And Recent Data Breach Practically Guarantees YOUR Personal Information Was Stolen

Ransomware Data Breach

Back in May, the company MOVEit, a file transfer platform made by Progress Software, was compromised by a Russian ransomware operation called Cl0p. They used a vulnerability in Progress’s software that was unknown to exist at the time. Shortly after the attack was noticed, a patch was issued. However, some users continued to be attacked because they didn’t install it.

The software is used by thousands of governments and financial institutions and hundreds of other public and private companies from around the world, and it’s been estimated that at least 455 organizations and over 23 MILLION individuals who were customers of MOVEit have had their information stolen.

Some of the organizations compromised include:

  • The US Department of Energy
  • New York City Department of Education
  • UCLA
  • Shell
  • Ernst & Young
  • Northwest Mutual
  • Pacific Premier Bank
  • TransAmerica Life Insurance
  • Honeywell
  • Bristol Myers Squibb
  • Gen/Norton LifeLock
  • Radisson Hotel
  • BBC
  • British Airways

The majority of those organizations (73%) are based in the US, while the rest are international, with the most heavily impacted sectors being finance, professional services and educational institutions.

Cl0p is a type of ransomware that has been used in cyber-attacks since 2019. Data stolen is published to a site on the dark web – a section of the worldwide web where cybercriminals sell and trade information without having to reveal themselves. The ransomware and website have been linked to FIN11, a financially motivated cybercrime operation that has been connected to both Russia and Ukraine and is believed to be part of a larger umbrella operation known as TA505.

What makes this attack so terrible is that many of the organizations compromised provide services to many other companies and government entities, which means it’s very likely their customers, patients, taxpayers and students were compromised by association. And yes, you’re probably one of them.

The big question is, were you notified?

For some reason, this breach didn’t make mainstream headlines, but when a company is compromised, they are obligated to tell you if your data was stolen. This can come in the form of an e-mail or snail mail letter. However, due to spam filters, e-mail delivery is clearly not a reliable way to ensure an important message is received, and organizing a letter for over 36 million people can take time.

If you use the software, you need to ensure that all your passwords and PINs are changed ASAP and you must be on the lookout for any strange activity. Don’t use the same passwords and make sure they are at least 12 characters long, using uppercase and lowercase letters, as well as special characters and numbers.

You should also ensure that MFA, or multifactor authentication, is turned on for all critical software applications and websites you use, such as Microsoft Office, QuickBooks, banking and payroll software, your credit card processor, etc.

Want to know if your company’s information is on the dark web? Click here to request a free Dark Web Vulnerability Scan for your organization (sorry, we don’t offer this for individuals). Simply let us know your domain name and we’ll conduct the search for free and contact you to discuss what was found via a confidential review (NOT via e-mail). Questions? Call us at 252-329-1382, press 2.

Increased Connectivity Means More Cyber Risks

Why Increased Connectivity Means More Cyber Risks
Why Increased Connectivity Means More Cyber Risks

Why Increased Connectivity Means More Cyber Risks

In an increasingly connected world, it’s only natural that there will also be a significant increase in cyber risks. With each day that passes, we get more and more reliant on social media and messaging platforms for both social and professional functions. And our smartphones are not the only smart devices that are taking over our lives. Today, an estimated 10.07 billion connected or smart devices are in use across the planet. And by the end of the decade, Statista expects this to rise to 25.44 billion devices. And while this will greatly improve how people across the world communicate with each other, there is also the increased risk of cyberthreats.

Why Increased Connectivity Means More Cyber Risks

The Connected Planet

Today, platforms like Facebook and LinkedIn have become part and parcel of life and business. The 2020 lockdown orders which forced people to stay at home across the country further increased our reliance not just on social media, but other connected technologies.

For modern and digitizing enterprises, it’s become crucial to have an IT support staff that can facilitate the creation and development of safe, connected, and streamlined platforms for online work.

This rapid rise in connectivity is even more apparent in the latest industrial smart tech applications.

Today, connected technologies are revolutionizing operations across the global supply chain. Verizon Connect details how modern cargo fleets are increasingly utilizing vehicle-to-vehicle (V2V) and other smart technologies to address pain points and streamline productivity.

Through wireless protocols similar to Wi-Fi, the wealth of data from V2V technologies is now being leveraged to improve a host of smart logistics tech.

This includes semi-autonomous fleets, smart fuel optimization systems, and vehicle-to-network (V2N) technology, which expands V2V applications to include traffic systems and other transport infrastructure.

Why Increased Connectivity Means More Cyber Risks

The Risks of Global Connectivity

While these advances in connectivity certainly make our lives easier, they also exponentially increase cyber risks. Every new digital connection enabled by any of the above-mentioned technologies could be leveraged by hackers in an attempt to take money from your bank account, compromise your organization’s network, or use stolen data to take down the systems of large government or corporate entities.

While V2N technologies are enabling the creation of efficient and intelligent transport systems (ITS), they’re also exposing global logistics to potential distributed denial-of-service (DDoS) attacks – a strategy in which hackers overwhelm a system with more actions than it can process.

DDoS attacks can be particularly effective at not only shutting down but controlling the world’s emerging ITS. Cybersecurity firm Trend Micro Incorporated estimates that over 125 million vehicles with V2N connectivity will ship across the world from 2018 to 2022. This is creating an increasingly complex ecosystem of connected devices – each of which is a potential vulnerability for hackers to exploit.

With the arrival and continued evolution of 5G, there will be exponential increases in both connectivity and cyber risks. These developments can already be observed in the cargo fleets and logistics systems that run the global supply chain – on which food, health, retail, and other major global industries depend.

Why Increased Connectivity Means More Cyber Risks

The Modern Hacker

This underscores a crucial aspect of examining and responding to cyber risks. Every smart object or device has the potential to become the perfect tool for persistent hackers. In fact, even basic cybersecurity protocols designed to reduce connectivity risks can be leveraged for attacks.

Business software integration company SolarWinds learned this the hard way when its network, which was built to create and protect the networks of other enterprises, was used to hack its clients. The attack happened on the tail end of 2020.

Malicious code was disguised as a regular software update from SolarWinds. As any IT support staff can attest to, making sure that your software is constantly updated significantly decreases cyber risks. In this case, however, the exact opposite occurred.

Before the attack was discovered and ended, large amounts of sensitive data had already been stolen from every company diligent enough to quickly update their SolarWinds software.

Following the combined and months-long investigations of private and government entities, Deputy National Security Advisor Anne Neuberger said that “9 federal agencies and about 100 private sector companies were compromised,” including several national U.S. departments such as the Treasury, Commerce, Energy, State, and even Homeland Security.

Alarmingly, it also pierced the defenses of several tech giants and Fortune 500 companies, including Intel, Cisco, Nvidia, and VMWare.

Why Increased Connectivity Means More Cyber Risks

Final Thoughts

The SolarWinds attack was ultimately traced back to a criminal group originating in Russia, according to the FBI. According to Microsoft, the same group may have struck again. The software giant identifies the attacker as an entity called “Nobelium.” After examining patterns of attack and entryways which again were traced back to connected technology, Microsoft says that Nobelium’s more recent attacks were focused on gathering intelligence from 3,000 individuals and 150 companies. 

Alongside malicious updates, the attacks now include customized emails and diplomatic invitations for each target – all of which are involved in a variety of international development, human rights, and humanitarian work in 24 different countries. Microsoft explains that “when coupled with the attack on SolarWinds, it’s clear that part of Nobelium’s playbook is to gain access to trusted technology providers and infect their customers.”

With stellar connectivity comes greater risk. In an increasingly connected world, there is an even more pressing need to focus on reducing cyber risks and strengthening IT security. This is as true for technology providers and enterprises as it is for individuals who go online on a daily basis. While defending networks is a task that’s best left to the experts, in the age of exponentially increasing connectivity, managing the cyber risk is everyone’s job.

At DataGroup Technologies, Inc. (DTI), we offer a wide variety of cybersecurity services to help protect your business from cyberthreats, including security risk assessments, email security solutions, web and DNS filtering, next-generation firewalls, network security monitoring, operating system and application security patches, antivirus software, and security awareness training. If you’re interested in learning more about your cybersecurity services, please call 252.329.1382 today or contact us here.

***************

This article was written exclusively for dtinetworks.com by Alicia Rupert.

Related Posts

Related Posts

Post Tags

Everything You Always Wanted To Know About VPNs (But Were Afraid To Ask)

Everything You Always Wanted To Know About VPNs (But Were Afraid To Ask)
Everything You Always Wanted To Know About VPNs (But Were Afraid To Ask)

What You Need to Know About VPNs

Everything You Always Wanted To Know About VPNs (But Were Afraid To Ask)

What Is a VPN?

A virtual private network, or VPN for short, is best defined as “an encrypted connection over the internet from a device to a network.” Think of this connection as a protected “tunnel” through which you can access everything online while appearing to be in the location of the VPN server you’re connected to. This provides you with a high level of online anonymity, offers an added layer of security, and allows you to access the entire internet without restrictions.

VPN technology is a must for anyone who’s concerned about protecting not just their data, but their identity and location as well. A reputable VPN will secure your internet connection, safeguard your privacy, and keep you protected from hackers or anyone else who might be trying to spy on your online activity.

Initially, VPNs were developed to give businesses a way to connect employees who aren’t physically at the workplace to the company’s network. Connecting remote employees to a central work server allows them to access files and other resources, as well as any confidential information that they may need in a safe, secure environment.

In response to widespread data breaches and other cyber-threats, individuals are increasingly using VPNs to create a secure path as they browse the internet.

Everything You Always Wanted To Know About VPNs (But Were Afraid To Ask)

How Does a VPN Work?

Before we delve into how VPNs function, it’s important to explain what the term “internet traffic” means. Internet traffic is the flow of data between your computer and the internet – this applies whether you’re using a desktop, laptop, smartphone, or tablet.

When you access the internet without a VPN, all of your internet activity – including browsing history, downloaded files, online banking details, and passwords – can easily be intercepted by other people. This could include your internet service provider (ISP), government agencies, your employer, or even cybercriminals.

When you connect through a VPN, your data is safely encrypted as it travels wherever it needs to go. This means that the data is protected when it goes from your computer to the VPN server, and then to your final destination (whether that’s a website or the server of any app you’re serving). As a result, websites only “see” the VPN’s IP address and not yours. Additionally, your ISP only recognizes that you’re using a VPN but doesn’t get to tag along and keep tabs on where you go or what you do.

Everything You Always Wanted To Know About VPNs (But Were Afraid To Ask)

The Future of VPN's

As the world adapts to the “new normal” prompted by the COVID-19 pandemic, organizations worldwide have been scrambling to safeguard their remote employees. Not surprisingly, VPN software usage has escalated dramatically as the need for remote working rises.

Mass surveillance, corporate tracking, and internet censorship are three other driving forces that will continue to push VPN software usage even higher. ISPs are increasingly restricting access to various websites – from adult content to torrenting sites. As people are enlightened to the growing risks regarding data collection and security threats, VPN usage will continue to expand.

Why Should You Use a VPN?

We’ve touched on most of these points already, but a deeper dive will be beneficial to truly demonstrate the benefits of VPNs:

Everything You Always Wanted To Know About VPNs (But Were Afraid To Ask)

Bypass Online Censorship and Geo-Restrictions

Many countries worldwide censor the internet (or specific websites) because certain content doesn’t align with their government’s political or religious beliefs. If you’re living in or traveling to a country with internet restrictions, you’ll need a VPN to be able to freely and securely browse online. In some areas of the world, basic tasks like Googling or updating your Facebook status are impossible without a VPN. Because your actual location is being “spoofed” when you connect to the internet with a VPN, you can bypass geographical restrictions and gain access to online content that’s otherwise unavailable in your region.

Everything You Always Wanted To Know About VPNs (But Were Afraid To Ask)

Increased Privacy and Greater Anonymity

Nearly every website you visit tracks your online activity and harvests your data. Advertising networks such as Facebook, Google, and Twitter constantly collect information about you through your internet traffic in order to show you targeted ads. However, it’s important to know that these entities are also free to sell your info to interested third parties. By encrypting your data, these networks will be unable to collect info on you, which gives them less influence over what kind of content you see online.

Your internet protocol (IP) address is a personal identification code that’s unique to your internet connection. It reveals your physical location and is tied to the individual who pays your internet service provider. With your IP address, you’re both recognizable and traceable online, no matter what you’re doing.

The instant you connect with the VPN server, your personal IP address and location are hidden from view. Websites and other parties will only be able to trace your online activities back to the VPN server, not to you personally and not to your actual location. This allows you to surf the web with greater anonymity.

Everything You Always Wanted To Know About VPNs (But Were Afraid To Ask)

Improved Security Against Cyberattacks and Data Breaches

Hackers and other cybercriminals use a variety of techniques to detect web traffic. They’re even able to hijack users’ accounts on websites that don’t use the HTTPS security protocol.

Public Wi-Fi networks can pose a particular threat to internet users. Individuals connected to the same network can easily tap into your devices, access your data, and steal your personal information while you browse the web obliviously.

When you use a VPN to connect to a public Wi-Fi network, any data you send, receive, or access online is automatically encrypted, rendering it much more difficult to intercept and view.

Knowing that your confidential data – such as email logins, bank passwords, credit card info, and images or other files – is potentially exposed to hackers and other malicious denizens of the internet should certainly give you pause. A VPN provides an added line of defense against cyberattacks of all kinds – so why wouldn’t you take advantage of its capabilities?

Facilitates Remote Work

By necessity, practicality, or some combination of the two, more and more businesses these days are enabling their employees to work from home or abroad. VPNs are often used to securely connect remote workers – and vendors, as necessary – to the requisite resources, files, and networks that they need. Encrypted connections allow users to interact on the network while ensuring that the company’s data remains private.

A natural byproduct of remote accessibility is an increase in overall productivity for the business. When employees have access to your network 24/7, they’re able to work outside the typical 9 to 5 business hours, from wherever they choose

What a VPN Can’t Do

Everything You Always Wanted To Know About VPNs (But Were Afraid To Ask)

Prevent Cookies

Ad companies can still use browser cookies to track your path across the internet, even after you’ve left their sites. If this is a concern for you, there are ways to block third-party cookies in every web browser.

Everything You Always Wanted To Know About VPNs (But Were Afraid To Ask)

Keep You Out of Jail

VPN services are obligated to abide by the laws of the country in which they are officially based. As such, they’re legally bound to respond to subpoenas and warrants from law enforcement when requested.

Everything You Always Wanted To Know About VPNs (But Were Afraid To Ask)

Dedicated Cyberattacks

If someone targets you specifically and is willing to put forth the effort, they’ll eventually get what they’re after. Having a solid cybersecurity plan in place can help.

Everything You Always Wanted To Know About VPNs (But Were Afraid To Ask)

Stop Malware or Ransomware

A VPN is designed to secure your online connections and data. It’s not engineered to protect your system from malicious software. Using antivirus and antimalware programs is always a smart move.

Everything You Always Wanted To Know About VPNs (But Were Afraid To Ask)

Provide 100% Anonymity

Given all the different ways someone can be identified online, a VPN alone won’t render you completely anonymous. With the vast resources of surveillance agencies such as the NSA, it’s likely quite difficult to ever achieve 100% online anonymity. Other methods could result in uncovering your online identity, but a VPN will protect your privacy very well, in most cases.

Everything You Always Wanted To Know About VPNs (But Were Afraid To Ask)

Speed Up Your Connection

When you’re using a VPN, a lot is going on in the background. Your computer is encrypting and decrypting packets of data, which are being routed through a remote server. All of this takes more time and processing power, which will ultimately affect your internet speed. Because your latency (or “ping”) is increasing, the speed at which you upload or download data will decrease. With higher-quality VPNs, the lag is barely noticeable, whereas others can cause a considerable slowdown. VPN speeds may also be limited by the type of device you’re using, your network, or due to your internet provider “throttling” VPN connections.

Everything You Always Wanted To Know About VPNs (But Were Afraid To Ask)

Final Thoughts

When the internet was first constructed, not a lot of thought was given to security or privacy. At first, it was merely a cluster of shared computers at research institutions. Computing power was so limited that any encryption could have made functionality extremely difficult, if not impossible. On the contrary, the primary focus was on openness, not on defense.

Today, most of us have a number of devices that connect to the web which are vastly more powerful than the top computers of the early days. But the internet hasn’t implemented many fundamental improvements. Only in the past few years has HTTPS become widespread, for example.

By and large, the responsibility lies on individuals to protect themselves. Antivirus apps and password managers can go a long way toward keeping you safer, but a VPN is a uniquely powerful tool that you should absolutely have in your personal security toolkit, especially in today’s connected world.

While a VPN isn’t an absolute necessity for using the web, it will provide you with better overall security, improved performance, remote access, and greater anonymity.

Cybersecurity has never been more important. We live in an increasingly connected world, which enables cyberattackers to constantly find new ways to carry out digital attacks. Even the most vigilant business owners and IT managers can become overwhelmed with the stress of maintaining network security and protecting their data.

DataGroup Technologies offers a wide variety of cybersecurity services to help protect your business from cyberthreats, including security risk assessments, email security solutions, web & DNS filtering, and next-generation firewalls. Call us today at 252.329.1382 to find out more about how we can help you #SimplifyIT!

Related Posts

Related Posts

Post Tags

Protect Your Business From Spear-Phishing Attacks With These 4 Helpful Hints

10 Advantages of Moving to The Cloud / How to Protect Against Spear-Phishing Attacks
10 Advantages of Moving to The Cloud / How to Protect Against Spear-Phishing Attacks

How to Protect Against Spear-Phishing Attacks

Everyone who uses the internet has access to something that a hacker wants. To obtain it, hackers might level a targeted attack directly at you.

Likely objectives may include pilfering customer data in order to commit identity theft, gaining access to a company’s intellectual property for corporate espionage, or acquiring your personal income data in an attempt to steal your tax refund or file for unemployment benefits in your name. 

Targeted attacks, commonly referred to as spear-phishing, seek to fool you into volunteering your login credentials or downloading malicious software.

Spear-phishing attacks often transpire over email. Hackers typically send a target an “URGENT” message, incorporating plausible-sounding information that’s unique to you – such as something that could have come from your tax returns, social media accounts, or credit card bills.

These schemes often include details that make the sender appear legitimate in order to get you to disregard any warning signs you might detect about the email.

In spite of corporate training and dire warnings to be cautious about who you give your password to, people still get duped by these tactics.

Another byproduct of falling for a spear-phishing scam could be inadvertently downloading malware such as ransomware. You might also be coerced into wiring funds to a cybercriminal’s account.

You can steer clear of the majority of spear-phishing scams by observing the following security measures.

How to Protect Against Spear-Phishing Attacks

Recognize the Basic Signs of Phishing Scams

Phishing emails, texts, and phone calls attempt to trick you into accessing a malicious website, surrendering a password, or downloading an infected file. 

This works particularly well in email attacks, since people often spend their entire day at work clicking on links and downloading files as part of their jobs. Hackers realize this, and try to exploit your natural tendency to click without thinking.

Thus, the number-one defense against phishing emails is to think twice before you click.

Check for indications that the sender is who they purport to be:

  • Look at the “From” field. Is the name of the person or business spelled correctly? Does the email address match the name of the sender, or are there all kinds of random characters in the email address instead?
  • Does the email address seem close, but a little bit off? (For example: Microsft.net or Microsoft.co.)
  • Hover over (don’t click!) any links in the email to scrutinize the actual URLs they will send you to. Do they seem to be legitimate?
  • Note the greeting. Does the sender call you by name? “Customer,” “Sir/Madam,” or the prefix of your email address (“pcutler35”) would be red flags.

Examine the email closely. Is it mostly free from spelling errors and unusual grammar?

Consider the tone of the message. Is it excessively urgent? Is its aim to urge you to do something that you normally wouldn’t?

How to Protect Against Spear-Phishing Attacks

Don’t Be Fooled By More Advanced Phishing Emails That Employ These Techniques

Even if an email passes the preliminary sniff test defined above, it could still be a ruse. A spear-phishing email might include your actual name, implement more masterful language, and even seem specific to you. It’s just a lot harder to distinguish. Then there are the targeted telephone calls, in which an unknown person or organization calls you and attempts to finagle you into relinquishing information or logging on to a shady website.

Since spear-phishing scams can be so crafty, there’s an added measure of protection you should take before responding to any request that arrives via email or phone. The most significant, preventative step you can take is to safeguard your password.

Never click on a link from your email to another website (real or fraudulent), then enter your account password. Simply log on to your account by manually typing the URL into a browser or access it via a trusted app on your mobile device. Never provide your password to anyone over the phone.

Financial institutions, internet service providers, and social media platforms generally make it a policy to never ask for your password in an email or phone call. Instead, log in to your account by manually typing the URL into your browser or access it via a trusted app on your preferred mobile device.

You can also call back the company’s customer service department to verify that the request is legitimate. Most banks, for example, will transmit secure messages through a separate inbox that you can only access when you’ve logged onto their website.

How to Protect Against Spear-Phishing Attacks

Combat Phishing By Calling the Sender

If an individual or organization sends you something they say is “IMPORTANT” for you to download, requests that you reset your account passwords, or solicits you to send a money order from company accounts, do not immediately comply. Call the sender of the message – your boss, your financial institution, or even the IRS – and make certain that they actually sent you the request.

If the request arrives by phone, it’s still appropriate to hesitate and corroborate. If the caller claims to be phoning from your bank, you’re well within your rights to inform them that you’re going to hang up and call back on the company’s main customer service line.

A phishing message will often attempt to make its inquiry appear extremely urgent, prompting you to forgo taking the extra step of calling the sender to double-check the veracity of the request. For instance, an email might state that your account has been jeopardized and you should reset your password as soon as possible, or perhaps that your account will be terminated unless you take action by the end of the day.

Don’t freak out! You can always justify taking a few extra minutes to validate a request that could cost you or your business financially, or even mar your reputation.

8 Tips for Strengthening Your Cybersecurity

Lock Down Your Personal Information

Someone who wishes to spear-phish you has to obtain personal details about you in order to put their plan in motion. In some cases, your profile and job title on a company website might be sufficient to inform a hacker that you’re a worthwhile target, for whatever reason.

Alternatively, hackers can take advantage of information they’ve discovered about you as a result of data breaches. Unfortunately, there’s not much you can do about either of those things.

However, there are certain situations in which you may be divulging information about yourself that could supply hackers with all the data they need to proceed. This is a solid reason to refrain from posting every detail of your life on social media and to set your social accounts to “Private.

Finally, activate two-factor authentication on both your work and personal accounts. This method adds an extra step to the login process, meaning that hackers require more than simply your password in order to access confidential accounts. Thus, if you do end up inadvertently giving away your credentials in a phishing attack, hackers still won’t possess all they need to access your account and make trouble for you.

By taking these tactics to heart, you will be better prepared to avoid common online scams such as spear-phishing attacks.

Related Posts

Related Posts

Post Tags

Is Your Cybersecurity Policy (Or Lack Of One) Leaving You Wide Open To Attacks?

Is Your Cybersecurity Policy (Or Lack Of One) Leaving You Wide Open To Attacks?
Is Your Cybersecurity Policy (Or Lack Of One) Leaving You Wide Open To Attacks?

Is Your Cybersecurity Policy (Or Lack Of One) Leaving You Wide Open To Attacks?

Every business, large or small, should have a cybersecurity policy in place for its employees. Employees need to know what is and isn’t acceptable with regard to all things IT. This policy should set expectations, outline the rules, and provide employees with the necessary resources to put the policy into effect.

Your employees serve as the front line of your business’s cybersecurity defense. You may have all the antivirus software, malware protection, and firewalls in the world, but if your employees haven’t been instructed about IT security or don’t understand even the fundamentals, you’re putting your business in serious jeopardy.

What can you do to rectify that? You can put a cybersecurity policy in place. If you already have one, it’s probably overdue for an update. Once your policy is ready to go, it’s time to put it into action!

Are You Protected Against Business Email Compromise Attacks?

What Does a Cybersecurity Policy Look Like?

The particulars can appear different from business to business, but a general policy should include all the basic elements, such as password policy and equipment usage.

For example, there should be rules for how employees utilize company equipment, such as PCs, printers, and other devices connected to your network. Employees should understand what is expected of them when they log into a company-owned device – from guidelines as to what software they can install to what sites they can (or cannot) access when browsing the web. They should know how to securely access the company network and understand what data should (or should not) be shared on that network.

Many cybersecurity policies also incorporate rules and expectations related to:

  • Email use
  • Social media access
  • General web access
  • Remotely accessing internal applications
  • File sharing
  • Passwords
Business Email Compromise Attacks – Managed IT Services vs. In-House IT Specialists

Break Down Every Rule Further

Passwords are a prime example of an area of policy that every business needs to have in place. Password policy often gets neglected or simply isn’t prioritized as highly as it should be. Like many cybersecurity policies, the stronger the password policy is, the more effective it is. Here are a few examples of what a password policy might include:

  • Passwords must be changed every 60 to 90 days on all applications.
  • Passwords must be different for each application.
  • Passwords must be 15 characters or longer when applicable.
  • Passwords must use a combination of uppercase and lowercase letters, at least one number, and at least one special character. 
  • Passwords must not be recycled.

  • The good news is that many apps and websites automatically enforce these rules. The bad news? Not ALL apps and websites enforce these rules. That means it’s up to you to stipulate how employees should set their passwords.

    Setting up a cybersecurity policy isn’t easy, but it’s vitally important – especially these days, with more people working remotely than ever before.

    At the same time, cyberthreats are more prevalent than ever. The more you do to safeguard your business and your employees from these cyberthreats, the better off you’ll be when these threats come knocking at your door.

8 Tips for Strengthening Your Cybersecurity

Final Thoughts

If you need help setting up or updating your cybersecurity policy, do not hesitate to call your MSP or IT services partner. They can help you devise a cybersecurity policy that provides everything you need to ensure a safer, more secure workplace.

If you don’t currently work with a managed services provider or your in-house IT team is in need of additional support from certified professional technicians, DataGroup Technologies is happy to help! Give us a call at 252.329.1382 today or contact us here to see how we can #SimplifyIT for you and your organization.

Related Posts

Related Posts

Post Tags

Cryptocurrency 101

Cryptocurrency 101
Cryptocurrency 101

Cryptocurrency 101

Cryptocurrency: it’s a word that we hear all the time, but most of us don’t fully comprehend what it is or how it works.

In this article, we’ll take a high-level glance at cryptocurrency in order to gain a better understanding of this burgeoning trend. After all, it isn’t going away anytime soon and only seems to be increasing in popularity.

Additionally, in the unfortunate event that your business should become a target of a ransomware attack – like the one that recently shut down the Coastal Pipeline and triggered a temporary gasoline shortage – cryptocurrency could very likely be how the hacker demands payment.

While we’re not suggesting you pay that (or any) ransom demand, familiarizing yourself with the concepts behind cryptocurrency will give you a better grasp on how these cybercriminals are able to ply their trade seemingly undetected.

Cryptocurrency 101

What Is Cryptocurrency?

Often referred to simply as “crypto,” cryptocurrency is a digital currency and form of payment that’s used online in exchange for goods and services.  The companies that use cryptocurrency refer to the currencies that they’ve issued as “tokens.” And yes, they are very similar to a casino chip or arcade token which acts as a substitute for the actual currency you used to pay for the chips or tokens.

Cryptocurrency 101

How Does Cryptocurrency Work?

Cryptocurrencies work by utilizing something called blockchain. Blockchain is a decentralized form of technology that enables many computers to manage and record transactions. There are over 10,000 different cryptocurrencies that are publicly traded, and they raise money through an initial coin offering (ICO). The cryptocurrency that most people have heard of is Bitcoin.

Cryptocurrency 101

Should You Buy Cryptocurrency?

Look, we’re an IT company – so, it’s not exactly within our scope to tell you how to spend or invest your money. That being said, some people do regard cryptocurrency as a lucrative investment opportunity.

Business tycoon Warren Buffett famously compared the crypto Bitcoin to paper checks. Buffett said, “It’s a very effective way of transmitting money and you can do it anonymously and all that. A check is a way of transmitting money, too. Are checks worth a whole lot of money? Just because they can transmit money?”

Despite being something not many people are well-acquainted with, using cryptocurrency is, in fact, legal in the United States. You can purchase it by downloading different apps that act as trading exchanges for your money to be converted into cryptocurrency. Some of these apps are specific to cryptocurrency exclusively, while others allow you to purchase stocks as well as crypto.

If you do decide to invest in cryptocurrency, do your due diligence and research it as thoroughly as possible.

Cryptocurrency 101

Why Is Cryptocurrency Popular?

There are several reasons why cryptocurrency is so popular.

Some people like the fact that it runs on blockchain technology, which – due to its decentralized processing and recording system – makes it more secure than traditional payment processing options.

Others like the idea of removing central banks’ control over currency – because the bank isn’t involved, the anonymity that this provides in transactions means that hackers can receive a ransomware payment without ever having to disclose their identification.

Converting cash to cryptocurrency doesn’t even require a legal name or address – and neither does sending or receiving it. The only time personal identifying information (PII) comes into play is when the cybercriminals swipe yours and demand that you pay them to recover it.

Cryptocurrency 101

Final Thoughts

As you can see, it’s critical to know a little bit more about cryptocurrency because of its increasing prevalence in the market today.

But it’s even more imperative to understand how to be smart when it comes to your personal and professional cybersecurity, so that you never have to send crypto to strangers in the first place.

DataGroup Technologies, Inc. (DTI) offers a wide variety of cybersecurity services to help protect your business from cyberthreats, including: security risk assessments, email security solutions, web and DNS filtering, next-generation firewalls, network security monitoring, operating systems and application security patches, antivirus software, and security awareness training. Reach out to us today at 252.329.1382 or contact us here to see how we can help you #SimplifyIT!

************************

An earlier version of this article appeared on the BreachSecureNow.com website.

Related Posts

Related Posts

Post Tags

Don’t Let Your Employees Become Your Biggest Vulnerability!

Don’t Let Your Employees Become Your Biggest Vulnerability!
Are You Protected Against Business Email Compromise Attacks?

Don’t Let Your Employees Become Your Biggest Vulnerability

A couple of years ago, TechRepublic ran a story with the following headline: “Employees Are Almost As Dangerous to Business As Hackers and Cybercriminals.” From the perspective of the business, you might think that’s simply inaccurate. Your company strives to hire the best people it can find – people who are good at their jobs and would never dream of putting their own employer at risk.

And yet, many employees do – and it’s almost always unintentional. Your employees aren’t thinking of ways to compromise your network or trying to put malware or ransomware on company computers, but it happens. One Kaspersky study found that 52% of businesses recognize that their employees are “their biggest weakness in IT security.” 

Where does this weakness come from? It stems from several different things and varies from business to business – but a big chunk of it comes down to employee behavior.

Don’t Let Your Employees Become Your Biggest Vulnerability!

Human Error

We all make mistakes. Unfortunately, some mistakes can have serious consequences. Here’s an example: an employee receives an e-mail from their boss. The boss wants the employee to buy several gift cards and then send the gift card codes to them as soon as possible. The message may say, “I trust you with this,” and work to build urgency within the employee.

The problem is that it’s fake. A scammer is using an e-mail address similar to what the manager, supervisor, or other company leader might use. It’s a phishing scam, and it works. While it doesn’t necessarily compromise your IT security internally, it showcases gaps in employee knowledge. 

Another common example, also through email, is for cybercriminals to send files or links that install malware on company computers. The criminals once again disguise the email as a legitimate message from someone within the company, a vendor, a bank, or another company the employee may be familiar with. 

It’s that familiarity that can trip up employees. All criminals have to do is add a sense of urgency, and the employee may click the link without giving more thought.

Don’t Let Your Employees Become Your Biggest Vulnerability!

Carelessness

This happens when an employee clicks a link without thinking. It could be because the employee doesn’t have training to identify fraudulent e-mails or the company might not have a comprehensive IT security policy in place. 

Another form of carelessness is unsafe browsing habits. When employees browse the web – whether it’s for research or anything related to their job or for personal use – they should always do so in the safest way possible. Tell employees to avoid navigating to “bad” websites and to not click any link they can’t verify (such as ads). 

Bad websites are fairly subjective, but one thing any web user should look for is the presence of “https” at the beginning of any web address. The “s” tells you the site is secure. If that “s” is not there, the website lacks proper security. If you input sensitive data into that website – such as your name, e-mail address, contact information, or financial information – you cannot verify the security of that information, and it may end up in the hands of cybercriminals. 

Another example of carelessness is poor password management. It’s common for people to use simple passwords and to reuse those same passwords across multiple websites. If your employees are doing this, it can put your business at a huge risk. If hackers get ahold of any of those passwords, who knows what they might be able to access. A strict password policy is a must for every business.

Don’t Let Your Employees Become Your Biggest Vulnerability!

Turn Weakness Into Strength

The best way to overcome the human weakness in your IT security is education. An IT security policy is a good start, but it must be enforced and understood. Employees need to know what behaviors are unacceptable, but they also need to be aware of the threats that exist. They need resources they can count on as threats arise so that they can be dealt with properly. Working with a trusted managed services provider or IT services firm may be the answer – they can help you lay the foundation to turn this weakness into a strength.

Common Myths About the Cloud – DEBUNKED!

Final Thoughts

DataGroup Technologies provides businesses of all sizes with security awareness and best practices training. Our goal is to make sure that your staff can identify threats and remain proactive. Knowledge is power, and well-informed employees can serve as a human firewall for your organization. For more information about our security awareness training solutions, please call us at 252.329.1382 or drop us a line here!

Related Posts

Related Posts

Post Tags

How to Secure Your Business Website in 2022

How To Secure Your Business Website In 2022
How To Secure Your Business Website In 2022

How To Secure Your Business Website In 2022

If you have a booming business website that’s raking in profits and helping you establish your brand, that’s great! However, you still need to make sure your site is protected from hackers and trolls who might want to tarnish your image. To ensure continued success and prevent bad actors from appropriating your intellectual property, follow these tips to help better secure your business website.

Are You Protected Against Business Email Compromise Attacks?

What Is Business Email Compromise?

According to TechRepublic, business email compromise (BEC) is “a sophisticated scam that targets companies and individuals who perform legitimate transfer-of-funds requests.”

Through the use of social engineering or malware, cybercriminals will masquerade as one of the individuals involved in these money transfers to trick the victim into sending money to a bank account owned by the cybercriminal. Once the fraud is exposed, it’s often too late to recoup the money. Scammers are quick to relocate the money to other accounts and withdraw the cash or use it to buy cryptocurrencies.

However, the scam is not always associated with an unauthorized transfer of funds. One BEC variation involves compromising legitimate business email accounts and requesting personally identifiable information (PII), wage and tax settlement (W-2) forms, or even cryptocurrency wallets from recipients.

Business Email Compromise Attacks – Managed IT Services vs. In-House IT Specialists

How to Protect Your Business Against BEC Attacks

In the public service announcement, the FBI offers several suggestions for businesses to adopt to better protect against business email compromise attacks.

  • Use secondary channels (such as phone calls) or multi-factor authentication to validate requests for any changes in account information.
  • Ensure that URLs in emails are associated with the businesses or individuals from which they claim to be originating.
  • Keep an eye out for hyperlinks that contain misspellings of the actual domain name.
  • Steer clear of providing login credentials or PII of any sort via email. Bear in mind that many emails requesting your personal information may appear to be legitimate.
  • Verify the email address used to send emails – especially when using a mobile or handheld device – by making sure the address appears to match that of the purported sender.
  • Enable settings on employees’ computers to allow full email extensions to be viewed.
  • Monitor your personal financial accounts routinely for irregularities, such as missing deposits.
Are You Protected Against Business Email Compromise Attacks?

What to Do If You or Your Company Should Fall Victim to a BEC Attack

According to TechRepublic, business email compromise (BEC) is “a sophisticated scam that targets companies and individuals who perform legitimate transfer-of-funds requests.”

Through the use of social engineering or malware, cybercriminals will masquerade as one of the individuals involved in these money transfers to trick the victim into sending money to a bank account owned by the cybercriminal. Once the fraud is exposed, it’s often too late to recoup the money. Scammers are quick to relocate the money to other accounts and withdraw the cash or use it to buy cryptocurrencies.

However, the scam is not always associated with an unauthorized transfer of funds. One BEC variation involves compromising legitimate business email accounts and requesting personally identifiable information (PII), wage and tax settlement (W-2) forms, or even cryptocurrency wallets from recipients.

Are You Protected Against Business Email Compromise Attacks?

What to Do If You or Your Company Should Fall Victim to a BEC Attack

Cybersecurity has never been more important. We live in an increasingly connected world, which enables cyberattackers to constantly find new ways to carry out digital attacks. Even the most vigilant business owners and IT managers can become overwhelmed with the stress of maintaining network security and protecting their data.

These increasingly advanced cyberattacks create unprecedented situations of data breach and money extortion. The tools that hackers use are getting smarter and stronger every day. If you’re not proactive about protecting your network, your business will become a target of cybersecurity attacks.

DataGroup Technologies, Inc. (DTI) offers a wide variety of cybersecurity services to help protect your business from cyberthreats, including security risk assessments, email security solutions, web/DNS filtering, next-generation firewalls, network security monitoring, operating systems/application security patches, antivirus software, and security awareness training. If you’re not 100% certain that your business is protected from cybercriminals, contact us today at 252.329.1382 or message us here to find out more about how we can help #SimplifyIT for your business!

Related Posts

Related Posts

Post Tags