It’s been a rocky pandemic for companies trying to keep their technology systems secure. The need to facilitate work-from-home (WFH) employees at the beginning of the pandemic opened up a network security risk. Hackers quickly leveraged the disruption COVID caused and increased their attacks. [Read more…]
Cloud security is becoming a major concern for companies of all sizes. Over the last 18 months, 79% of surveyed businesses have experienced a cloud data breach. [Read more…]
Microsoft just came out with a major new announcement recently. More than five years after Windows 10 launched, it has announced the next iteration of the Windows operating system. [Read more…]
Many companies find out the hard way that business IT security is never fully “done.” As soon as you implement safeguards against today’s threats, tomorrow, hackers will come up with new and inventive ways to break into company networks. [Read more…]
Verizon recently released its Mobile Security Index 2021 report, which provides details on the current state of mobile device security risks and the types of attacks companies should be prepared for.
The report illustrates the shift towards more mobile working and the fact that the security of smartphones and tablets hasn’t yet caught up to that of PCs. While offices are becoming more dependent upon mobile devices, those devices are creating more risk for business networks if not properly secured.
According to the report, 71% of surveyed organizations say that mobile devices are “very critical to their business” and 53% said their company has suffered major consequences in the past from a mobile-device-related security incident.
40% of surveyed professionals say mobile devices have become the biggest IT security threat.
While mobile devices are gaining more prominence at work, hackers have noticed and have been unleashing more mobile-specific attacks, such as banking trojans and spyware hidden inside mobile apps.
Businesses need to realize that users are now doing the same things and accessing the same sensitive data via mobile as they do computers. This means that smartphones and tablets (both company-owned and employee-owned) need to have the same strong protections as PCs.
One big risk with mobile device security is that phones and tablets are easily lost or stolen. If a thief gets their hands on a smartphone used for work, they could easily access platforms that have a persistent sign-in (always keep you signed in). They also have access to any text or app-based multi-factor authentication, which could give them access to multiple cloud and website accounts.
Using a lock screen might mean a few more seconds to unlock a device, but it can also give you time to remotely lock or wipe a device should it be lost. That can make all the difference between a major data breach happening due to a lost device and being able to lockdown information before it’s compromised.
Between 2018 and 2020, the number of global public Wi-Fi hotspots has increased 63% to 454 million. As mobile phones are being carried around, they can be connecting to any number of public, unsecured networks.
Public networks hold a big security risk for a man-in-the-middle attack when a hacker is on the same public network and using special tools to spy on the activity of other users.
Adding a business VPN is one of the important tools in any cybersecurity checklist. Once signed up, you can add your employees, have them download a mobile app, and it will secure their internet traffic through encryption. This keeps the data secure, even when on public Wi-Fi.
Mobile devices now make up about 60% of the endpoints in a company. They can be connecting to your business data from any location and that location often changes throughout the day.
Mobile device managers, such as Microsoft Intune, give companies a way to secure the business side of employees’ devices.
An MDM enables remote monitoring and administration for:
Employees should be instructed not to download any apps from outside a legitimate app store (Apple, Google, Microsoft). But even when downloading from an app store, it’s important to research an app online first to ensure it’s not a fake with hidden malware or one that overshares data.
Even fake apps can end up in a legitimate app store for a while before they’re found out and removed by the platform. Mobile malware has been increasing as the use of mobile devices at work has risen.
Employees need to be aware of the security of any new apps they install before they install them, and the fact that some malicious apps will actually hide their icon after being installed to make removal more difficult.
PCs aren’t the only device that needs an antivirus/anti-malware application, it’s also important to have one protecting business-use mobile devices.
All mobile devices used for business use, even if it’s just to receive work email, should have a reliable mobile version of an antivirus/anti-malware application. This helps ensure any infections are caught before they cause major problems and travel through your network to other devices.
Pro Tech Guy can help your Framingham business put a cost-effective mobile device security plan in place to ensure your company data isn’t at risk.
Contact us today to learn more. Call 508-364-8189 or reach us online.
Ransomware attacks are devastating to a business and often impact all areas of its operations. But as we’ve seen from the recent May 7th attack on Colonial Pipeline, a ransomware attack can also have far-reaching consequences beyond the victim. [Read more…]
Ninety percent of internet users are worried about having their passwords compromised, and they have a good reason. Password theft has risen to be the number one goal of phishing attacks and it’s responsible for a large percentage of cloud account data breaches.
Without proper cybersecurity protections in place, a hacker can wreak havoc if they compromise a user password. And one password breach often leads to more than one account being in jeopardy.
44% of people admit to reusing passwords across multiple work and personal accounts, so a breach of one account means all accounts using the password can also be accessed until it’s changed.
Unfortunately, we’re not usually aware right away when a password has been compromised. It can be months, for example, before you’d be aware that your password was involved in a major data breach. It takes time for the breach to be discovered and even more time for a notification plan to be carried out.
Even if you have strong security measures in place like encryption, if an attacker has a legitimate password, they can bypass safeguards designed to keep them out. Unless multi-factor authentication (MFA) has been put in place.
Using MFA with your logins can stop 99.9% of all fraudulent sign-in attempts. Even if a hacker has a password, it’s very unlikely they’ll also have the device that receives the code needed to gain account access.
Implementing MFA for all company logins is one of the best things you can do to boost IT security, and it’s important to understand the difference between the three main types of MFA.
When you enable multi-factor authentication, you’re setting up a system that sends a one-time, time-limited code to a specific device at login. Only after the user enters both the username/password combination and the code can they gain access to the account.
There are three different ways to receive the MFA code, and while all greatly improve security overall, there are some that are more secure than others.
We’ll go through each of the three types below and explain the key differences. For the security details, we referenced a Google study on multi-factor authentication that looked at the effectiveness of all three methods against three different types of cyberattacks.
The least secure of the three methods is receiving the MFA code by SMS/text message. This is the most common method to use and is often the default method of website accounts and cloud tools when setting up MFA.
In the Google Study, SMS performed as follows:
One vulnerability that using SMS to receive the code has is that SIM cards can be cloned by hackers. One phishing text that a user clicks on can unleash malware that clones the SIM card and send the details back to the hacker. They can then see all the text messages sent to that phone.
On the plus side, SMS is one of the most convenient methods for users.
The next most popular method and one that holds the middle position for security is receiving the code through an app and on-device prompt. A popular app for MFA is Google Authenticator. This method is also commonly used on iPhones through a built-in feature when signing into iCloud.
In the Google study, here’s how the on-device prompt did:
This method is also fairly convenient for users, but it does take a little more setup if using a universal app, like Google Authenticator, because accounts have to be set up to use it.
The most secure method and the most expensive is using a security key to receive the MFA code. The other two methods are typically free, but you need to purchase a security key device from a vendor such as Yubico or Thetis.
Security keys are small, generally smaller than a USB flash drive, and are physically plugged into a computer or mobile device to authenticate the MFA code.
The additional cost pays off in a higher level of security. Here is how the security did in the Google study:
Besides having to purchase the keys, one downside is that users must carry around the key, and if it’s lost, they’ll need to jump through a few hoops to get a replacement and could be locked out of accounts until then.
Pro Tech Guy can help your Framingham business put an effective cybersecurity plan in place. We’ll help ensure passwords are protected with a system that balances convenience, cost, and security to meet your needs.
Contact us today to learn more. Call 508-364-8189 or reach us online.
The Internet of Things (IoT) has gone from one of those “space-age” concepts to something we see in our homes and offices every day. Smart speakers are now used widely and have begun heading into the office along with many other IoT devices. [Read more…]
Most business owners understand the need to keep the operating systems and applications on their computers updated and patched to prevent a data breach. Without being updated regularly for newly found vulnerabilities, devices can be susceptible to ransomware, viruses, malware, and other attacks. [Read more…]
Are your employees still using one-monitor workflows? If so, your business could be missing out on a simple approach that significantly improves productivity.
