October 23rd, 2013
The Bring Your Own Device trend is unavoidable. Because of the growing trend, cyber criminals are targeting mobile devices more. It’s more important than ever to properly secure smartphones and tablets since they’re now being used to access company data and valuable information.
Limiting the access each employee has is an important step to keeping your business from suffering a catastrophic data breach. As Laird Harrison, of Tech Page One, writes, there are also some device specifications that can be enabled to greatly impact security.
It’s shocking how many tablets and smartphones have no security on their lock screen. Considering how many hacking stories start with a device being lost or stolen, it’s a must to require a password to unlock. The use of Apple’s new biometric recognition is another good step.
When your device is dormant for an extended period of time, the screen should turn off and require a password to continue using it. This is called inactive time-out. Not only will it help to improve battery life, but it also makes the device harder to hack since it erases the possibility that a thief could find the device and use it without knowing the password.
By adding programs and enabling some options, you’ll be able to remotely view the data stored on a lost device. You’ll even be able to disable some applications and erase data that could be harmful in the wrong hands.
It’s a good idea to encrypt all data stored on mobile devices, but at the very least, encrypt company related information. There are a number of programs available that will effectively encrypt the most vital data on your device.
These are just a few options mobile users can enable on their device to make them more secure. If you’re using a personal device to store or interact with company data, these are certainly necessary precautions. Even if you’re only using your device for personal use, these are still good ideas.
For help increasing the security on any of your devices, or to recover lost data or fix a device that isn’t working right, call Geek Rescue. If it boots up or turns on, we fix it. Call us at 918-369-4335.
October 22nd, 2013
The Domain Name System, or DNS, is an essential part of the internet. To oversimplify, it associates domain names, or the name of a website, to the numerical IP address. This makes it much easier to navigate the web.
Robert Lemos,. of Dark Reading, explains how DNS services can be used to secure your company’s network through the cloud.
Rather than having to store DNS servers in-house, which requires a large budget, using a third party cloud service offers similar flexibility and increased security features.
There are many forms of malware that can be detected or stopped with DNS services. Recently, a banking Trojan was discovered used an algorithm to generate random domain names and communicate with other servers. Some malware is able to change the IP address associated with a domain, which causes all sorts of problems. In both cases, a cloud DNS service would be able to detect the malware’s actions.
Mobile users won’t be protected when DNS servers are being run on internal servers. DNS services on the cloud are able to protect mobile users, which comes in handy when employees are using their own devices. Even outside your company’s network, there’s still security in place.
Using internal servers for DNS services isn’t possible for most small businesses. Fortunately, there are a number of features cloud based DNS services offer that internal servers can’t.
For help setting up cloud based services, or to find out more about the cloud’s capabilities, contact Geek Rescue at 918-369-4335.
October 22nd, 2013
Free public WiFi is a well known danger to your device’s security. These wireless networks are unsecured, which makes it easy for hackers to intercept data being transmitted over them.
Most companies also use a wireless network for their employees, which can be just as dangerous. It’s often overlooked, but, as Sam Narisi of IT Manager Daily reports, there have been a large number of exploits due to wireless routers having backdoors and holes in their security.
Recently, D-Link wireless routers were discovered to have a vulnerability that allows a third party to change the router’s settings without needing the password.
Security firm Independent Security Evaluators released a list of 13 wireless routers that they found to contain security flaws. The routers came from trusted companies like Belkin, Netgear and Linksys and allowed hackers to intercept information, gain access to computers on the network and bypass security.
A technique called “wardriving” has been used to crack wireless networks, as well. By simply driving around and area and searching for wireless signals, hackers are able to then use software to break the network’s encryption.
Internal wireless networks are not inherently secure. There are, however, steps you can take to improve their security. Installing the latest patches and continually updating the router’s firmware is important. Replacing your hardware regularly is also necessary since older devices will stop getting patches and have flaws the newer devices don’t. Use HTTPS for administrator connections. And of course, use a long and strong password on your router.
There are a number of ways a criminal can gain access to valuable data within your company’s network. In order to improve your entire security, call Geek Rescue at 918-369-4335.
October 21st, 2013
As we’ve mentioned before, it’s impossible to be completely secure. Hackers continually adjust their tactics and upgrade their tools to breach any network. Because of this constant evolution, security has to constantly change and be updated as well. Your security infrastructure becomes less effective every day. Debbie Mahler, of the State of Security blog, writes that security is a process. She suggests some tips for how to continually improve your cyber security.
- Identify the weakest link
In order to improve security, you first have to find out where it needs to be improved. Usually, employees are the downfall of any security infrastructure. Unsafe web surfing habits, or human error often result in breaches. It’s important to study their habits in order to put policies in place that will keep your business more secure.
Having a firewall in place, and password protection on routers is a great step towards being more secure. But, too many people fail to utilize the tools they have at their disposal. For example, there have been many instances of security breaches stemming from a failure to change default passwords on routers. If you’ve taken the time to put these measures in place, take the additional time to make sure you’re using them effectively.
This is a common IT security rule. For any file, no one should have access. That’s where you start, then add permissions as necessary. This will keep your most valuable data secure because only a select few will have access to it.
Catastrophic data breaches usually happen after your network has been infiltrated previously. And, each time there’s suspicious behavior on your network, the logs have the evidence. Be sure to regularly review the logs in order to catch potentially harmful situations before they explode into disasters.
Security for your business is a big job that requires constant supervision. For help, contact Geek Rescue at 918-369-4335. We offer security audits and solutions for any breaches in your current security infrastructure.
October 21st, 2013
The security of data is extremely important for any business. The loss of data by any means can mean you’re unable to do business, or you’ve put your customers at risk. Sharon Florentine, of CIO, has a list of some common security risks and how to deal with them.
Smartphones are constantly being left behind in airports, coffee shops and bars. Laptops and tablets are the prime targets for thieves. When these devices have access to vital company data, or store data themselves, it becomes a serious problem. To combat it, back-up everything so you’ll still have access to it when that device disappears. Also, be sure to put protection in place so you can remotely wipe the device of any potentially harmful information.
Bring Your Own Device refers to employees using personal devices to access the company network and company files. This becomes a security headache because most individual’s fail to put proper security in place on their devices, and the devices might be infected with malware, which can then infect the entire network. Limiting employee access to certain files when on their own device is important. Ensuring that each employee has proper security in place on their devices is as well.
Without the proper protection in place, traffic from your network, or to your website, could be redirected through someone else’s server. This would allow that third party to collect data. For your most vital files and applications, create lists of authorized users, devices and IP addresses so no one else is able to access them.
There are unfortunately a number of ways to lose valuable data. Whether a device is physically stolen, or digitally compromised, you need to plan ahead for disaster.
Geek Rescue has the tools to help secure your company data, and recover and restore lost data. Call us at 918-369-4335 to improve your company’s cyber security.
October 21st, 2013
A lot of attention has been paid to Google’s recent changes. From their Hummingbird update of their search algorithm, and encrypting searches, there’s been no shortage of headlines about the search giant’s actions. Their latest move, however, isn’t about improving their own site. Instead, it’s an attempt to improve security for smaller, at risk sites.
Lorenzo Franceschi-Bicchierai, of Mashable, reports that Google has launched ‘Project Shield’, which allows small websites to offer content through Google’s infrastructure to keep them from being taken down by Distributed Denial of Service attacks.
A DDoS attack is a cyber attack that attempts to shut down a website by overloading it with malicious traffic. The traffic is impossible to block because it originates from thousands of individual, compromised machines.
With Project Shield, Google is trying to help individually owned websites that serve a public good in so-called “high risk conflict zones”. These would include Syria, Egypt and any country where the internet is controlled by the government.
In such countries, governments have used DDoS attacks in the past to take down certain websites. One example of this is a Syrian website set up by an activist to track scud missiles. The Syrian government used a DDoS attack to knock the site offline in July.
With it’s own DDoS prevention measures and an offering to serve content through Google’s resources, Project Shield is hoping to protect these types of sites, which are usually operated by small human rights organizations without the means to protect themselves.
Google is currently accepting applications to be “trusted testers” from sites that feel they deserve Project Shield’s protection.
For businesses in the US, Google is not offering such protection, but DDoS attacks and other cyber threats remain a serious concern. To improve your company’s security, contact Geek Rescue. We offer a variety of security solutions to keep you safe from attacks. Call us at 918-369-4335.
October 18th, 2013
Everyone has heard warnings about the dangers of spam. The term ‘spam’ is pretty general, however. The best way to stay protected from it is to understand what it looks like and avoid it.
A post on the All Spammed Up blog breaks down the different types of spam and the tell-tale signs of each.
Not all types of spam are malicious in nature. Some emails that end up in your spam filter are examples of overzealous marketing. They’re usually from a trusted company that you’ve given your email address to at one time or another. There’s a reason they’ve been marked as spam, however. That’s either because their marketing messages come far too often, or they offer little to no value. Whether these are arriving in your inbox or spam folder, you’ll probably want to unsubscribe.
This type of spam isn’t from reputable companies but is hocking some sort of product. Usually it’s supplements, education or financial services. They’re sent out in bulk and not personalized to a single user. Usually, you’ll even be able to tell that there’s a long list of email addresses listed as recipients. These are sent out by individuals who get money each time someone clicks the links in the emails or signs up for the products offered. The products are worthless, if they exist at all. If one of these arrives in your inbox, mark it as spam and move on.
This type of spam email attempts to steal information from users. Many have malware attached to them, or direct you to a malicious website that will download malware to your machine. They use social engineering to convince you to give up information like account log-ins and passwords. There are more specific attempts called spear phishing, that target small groups of people in order to obtain specific information. These types of attacks will appear to know a great deal about you. In order to avoid these scams, it’s a good idea not to follow links provided in emails and never download attachments unless you are expecting them from a trusted source.
This is similar to phishing and can even be combined with a phishing scam. An email arrives claiming to be from a legitimate source that you have an account with, like Facebook, Verizon or even a credit card company. It usually tells you there’s a problem with your account and you need to log-in by following the link provided. This link will take you to a different site where your log-in information will be recorded and used to hack your account. Again, don’t follow links provided in emails. If you want to check out the legitimacy of an email, go to the source’s site directly, or call them. Also, check the sender’s email address. A representative of Facebook, for example, will have an email ending in @Facebook.com. Many of these scammers have email addresses like FacebookHelp@ccvs.com.
Knowing what to look for is key to avoiding email scams. Improving the security on your email and your computer are also important.
For help bolstering your cyber security, either at home or at the office, contact Geek Rescue at 918-369-4335.
October 17th, 2013
Nearly every day, there’s a new report about a corporation being hacked and experiencing downtime or losing account information for thousands of customers. These attacks and the subsequent fallout are incredibly costly. Debbie Cohen-Abravanel, of Seculert, reports that network security for most businesses is shockingly lacking and it allows targeted attacks to easily slip past defenses.
Spear phishing, SQL injections and cross-site scripting are fairly basic attacks that have been surprisingly successful recently. Hackers have been able to spot weaknesses in security and attack them with these basic tactics. This makes attacks much less labor intensive for criminals, which in turn makes them much more attractive.
Some suggestions for closing up potential holes in security are :
- Keep all software, not just antivirus programs, updated.
- Perform an audit on server login security.
- Regularly delete unused and unnecessary browser plug-ins.
- Enable “click-to-play” in browsers to protect from drive-by attacks.
- In Microsoft Office, disable ActiveX.
These measures won’t keep you completely secure, but they do fix common weaknesses in a company’s security. A more serious investment in security goes a long way to protecting you against attacks. Hackers are usually looking for easy exploits, so if your security is difficult to by-pass, most criminals will move on to an easier target.
For help improving the cyber security at your home or office, contact Geek Rescue.
October 17th, 2013
Passwords are a constant object of concern for security experts. We’ve used this space previously to talk about the potential weakness of passwords to protect your online accounts. Robert Lemos, of Dark Reading, reports that the habits of users creating easily guessed passwords and an upgrade in hackers’ capabilities for breaking them have made password protection increasingly weak.
When creating passwords, even seemingly strong ones that include upper and lower case letters, numbers and symbols, most users still use similar passwords so they’re more memorable. This use of mnemonics makes passwords predictable.
Hackers have tools capable of brute force password guessing. These programs guess billions of possible password combinations until they’re able to gain access to an account. Some top of the line programs can guess about 1-billion passwords per second.
When a user’s password is predictable because of recurring habits, hackers are able to make intelligent assumptions about what your password will look like. That narrows down their list of possibilities considerably, making their password guessing tools even more effective.
Add that to how many websites don’t have ample security on their customers’ passwords. There have been multiple examples over the past year of hackers stealing huge lists of passwords in one attack. This not only gives them access to those accounts, but also gives them real world examples of the types of passwords typically being used.
These brute force attacks are actually fairly rare. Most criminals won’t take the time to launch an attack against a single account. For that, they prefer to use phishing scams and social engineering to get users to send them their passwords unknowingly.
Having a secure password is still important, but it’s even more important to understand where secure passwords will do you the most good. For example, banking sites usually put the most security on their users’ passwords and they’re very rarely compromised. Using a secure password for your bank account is a given, but you want to be sure not to re-use that account on a less secure site. That’s how many bank website’s are compromised. A user will use the same password on a site that isn’t very secure, then a hacker will steal a large number of passwords from the unsecure site and use them on more secure sites.
Using a password manager is one way to enable you to use unique passwords for each account, but never have to worry about forgetting them. However, even this method is hackable.
Although it’s probably impossible to be completely secure, avoiding phishing scams and social engineering and having strong passwords in place will serve you well.
For more information about how to keep your accounts and your computer safe, contact Geek Rescue. We not only fix devices that aren’t working right, we also protect them against future attacks.
October 16th, 2013
Cloud computing has been hailed as a great innovation that changes the way we do business. It’s not without its flaws, however. There have been a number of well-publicized exploits of public cloud systems over the past few months. Tom Scearce, of Data in Motion, suggests that, while storing some files in the cloud is a great idea, there are a few types of files that aren’t worth the risk.
- Financial and Legal Information
Many businesses store tax records or bank account information in the cloud because it’s always accessible, but doesn’t take up storage space on a physical drive or server. What happens, though, when a hacker is able to access the cloud? Suddenly, your most critical documents are available to a third party. Despite the supposed advantages, storing this type of information on a public cloud is ill-advised.
Security experts advise you to create a strong, unique password for each of your online accounts. That adds up to more passwords than most can remember. Storing your password on the cloud seems like a great solution, but once again, the lack of security could give a criminal access to all of your accounts. Even LastPass, which is hailed as the industry standard password manager, has experienced exploits.
- Employee and Customer Data
Your human resources department has collected social security numbers, tax and financial information from your employees. You’ve also collected credit card numbers from customers. Where should you store all of this information? If you decide to keep it on a public cloud, you’re asking for trouble. While losing control of this data might not directly impact your business, there are liability and credibility issues at stake.
- Presentations and other Time Sensitive Files
The other concern, besides security, with the cloud is availability. One of its advantages is the ability to access and share files from anywhere with an internet connection. There are outages and downtime, however. If there’s a file you absolutely have to have at a certain time, it’s best to keep it off the cloud.
There are other options available for these and other types of files that aren’t a good fit for cloud storage. Rather than using public cloud services like Dropbox and Google Drive, consider investing in a private cloud. Not only will that improve security, but you’ll also be able to directly contact your hosting company if there’s any downtime.
Geek Rescue offers a variety of cloud based solutions. Call us to find out how cloud computing can help you do business better.
