Is Working on Personal Devices Risky Business?

January 29, 2018 by Joseph Martin

It’s natural and common for your employees to want to conduct some of their work at home or on the road, and often the most convenient way is to do so on their personal devices. However, this could be putting your business at risk, and thus allowing your employees to conduct their work on personal devices could be risky business.

The Risk of Not Being Regulated

Since your employees personal devices aren’t the property of the company, they aren’t being properly protected and regulated. And thus, you have no control on how they are being used. Employees are easily at risk for downloading and infecting their personal devices with malware and viruses that can quickly find their way into your network.

Lost and Not Found?

Another risk of having business and client files and information on a personal device, is the risk of losing or misplacing the device. If your employee’s personal device is lost, so are the the crucial documents and files you may need for your company. Or even worse, what if the credentials and personal files of you business and your clients fall into the wrong hands? You would have to notify your clients of the security breach and your reputation and relationship with your clients could also be lost in a hurry.

Take the Proper Precautions

This all isn’t to say you shouldn’t allow your employees to use their personal devices for work. It’s often convenient and even necessary to allow them to do so. However, there is not excuse for not have the proper security and precautions in place. Be sure their devices are being secured and backed up like every other device in your network. The type of remote security monitoring you need will depend on the device, the in formation being stored or accessed and the laws regarding the information you store for your business or clients.

Joseph Martin

President & CEO
I hope you enjoyed this article. My mission is to take your stress away from dealing with IT problems. Call (252) 565-1235 or send me a message at our contact us page if you have a question, comment or want help.

8 Ways To Keep Your Small Business Secure

January 29, 2018 by Joseph Martin Leave a Comment

If you own and operate a small business, lowering costs is an important part of keeping your company in the black. Cutting costs on your IT budget could inadvertently compromise your company’s security. Even though small businesses may not have all of the resources that large corporations do, they are still just as vulnerable to the same security threats. Here are ways to help secure your small business:

1. Have Anti-virus & Malware Software

Every computer is vulnerable to the wide variety of viruses, trojans, and worms that are on the Internet. These malicious software programs can do anything from damage your computer and files to steal your password and other important information stored on your computer. Get a good anti-virus software program and make sure that it is always up to date. Also, check to see that your anti-virus software checks for spyware, adware, and any other type of malware that could be hiding on your computer.

2. Avoid Phishing Emails

It is important to discuss with your employees the importance of not opening spam email, attachments or forwards that could possibly contain viruses. Make sure that your email has a filtering system that helps to filter out spam and other malicious email. Responding to phishing emails can be another costly mistake. Phishing emails are disguised as legitimate emails that then request login and password information. Changing passwords monthly can help to lessen the damage should an employee accidentally respond to a phishing email.

3. Minimize Damage From Dishonest or Disgruntled Employees

It is often difficult to predict if one of your employees will become disgruntled or dishonest, but you can put some safeguards in place to help minimize the damage should you find that you have one. Thoroughly screen your employees before hiring them, especially if they will have access to any confidential or financial company information. Limiting the number of employees that have access to this confidential information and changing your company passwords often can help to prevent former employees from accessing company computers.

4. Secure Your Wireless Network

Make sure that your wireless router is encrypted, and that your business is using WPA2 wireless security. A firewall is another important key to protecting the security of your small business. A firewall will allow access only to authorized users while blocking unauthorized access to the computer.

5. Have An Internet Use Policy

Aside from the obvious lack of productivity that personal Internet use can cause for your business, it can often be too easy to click on websites that contain malicious software that could easily infect your company computer and shut your system down temporarily or even permanently.

6. Avoid Having Everything on One Computer

Purchasing computer equipment is costly, so many small businesses will try to get away with fewer computers in order to save money. If you have your financial information on the same computer that your employees are accessing their company emails, you could risk losing everything that is vital to running your business should an infected email slip through.

7. Have a Data Backup System

Be sure to have some type of data storage and backup system in place in the event that your current system goes down. Having all of your files readily available to you in case of an emergency can ensure that your business will retain customers and continue to run smoothly no matter what the disaster.

8. Minimize Damage From Stolen Equipment

It difficult to prevent break-ins or equipment from being stolen from your home or office building, but you can have some security by ensuring that all of the information on your computer is encrypted and password protected.

Trying to scrimp when it comes to your small business’s computer security can be a costly mistake. Arm yourself with the knowledge of what your business could be up against and take steps towards prevention. The investment will give your company the security necessary to keep your information secure.

Joseph Martin

Is Your BYOD Policy HIPAA Compliant?

January 29, 2018 by Joseph Martin

Bring Your Own Device or BYOD policies are a great tools for employees and a money saver for companies, but it can also be a risky policy if not conducted properly. Mobile devices and a BYOD policy in the health care field can allow professionals to easily transition workflows, boost productivity and improve communication. The major issue with a BYOD policy in this field is the risk of security breaches leaking personal information and medical records of the patients. This is not only a concern for the hospital and its staff, but it has also shown to be a major concern among patients and the public. Here are some tips on how to ensure your BYOD policy, employees and vendors stay HIPAA approved:

Everyone Is On The Same Page

When it comes to security and responsibility expectations, make sure you have a clear set of rules in line for your employees, staff, vendors and other members of your business network. If anyone in these groups is using a BYOD policy, ensure they are under a strict guideline of security protocols and are meeting expectations according to your HIPAA compliance program. Make sure your staff, vendors and sub vendors are all clear on security requirements and have a clear understanding of the steps and responsibilities that are to be taken in the circumstances of a security breach.

Better Safe Than Sorry

Don’t skimp on security protocols when it comes to private and sensitive information. Ensure that all devices that are in use and hold hospital records have two forms of security walls. The first can be a generic login where hospital staff can use their general credentials to gain access to log in. The second stage should contain a secure pin that is assigned to each individual and changed regularly. This pin should also be set to request re-entry if a device has been idle for a certain amount of time. If any devices should go missing, you must have a strict requirements that it be reported immediately and have a team in place to wipe the device clean before it can be breached.

Set The Standards

Not all apps on a device are up to the HIPAA security standards and encryption requirements. This means you should regularly monitor and audit the devices to ensure there are not apps, programs or breaches putting information at risk. This also means constant monitoring and updating of security programs. Don’t wait when it comes to updating security software on devices. The day or two you wait may be all the time a hacker needs to steal the information.

Joseph Martin

Pave the Way for a Successful BYOD Policy

January 29, 2018 by Joseph Martin

Is your company currently allowing a Bring Your Own Device or BYOD policy for your employees, or considering starting one? While this strategy is a great way to promote productivity and save money for your business, you have to make sure you know the lay of the land before you start allowing a BYOD program at your office. Here are some helpful tips to ensure a BYOD policy is a success and not a regret:

Decide On Your Devices

Before you open up a BYOD policy, make sure you make it clear to your employees which devices are and are not allowed. Are you still going to be supplying certain devices? Are you allowing only iPhones or only Android devices? Are laptops and tablets allowed? Be sure to define a clear service policy for the devices allowed under your BYOD policy. Make sure you clarify what is allowed under your BYOD policy, or you may find yourself flooded with more than you expected.

Don’t Skimp on Security

When it comes to personal devices, don’t let employees skip over security. If they want to be able to bring and use their own devices at work, they are going to be required to have complex passwords and lock screens on their devices. A simple swipe of the screen isn’t acceptable when a device contains crucial company and client information. And be sure to have a strict policy for an employee exit. You want to ensure your company and client information isn’t leaving with your employee.

Not All Apps are Allowed

With the threat of hackers, viruses and productivity reducers in today’s age, you can’t allow all apps on devices. These apps could put your company documents, files and other crucial information at risk. Not to mention your employee productivity could plummet in a hurry thanks to constant Facebook and Twitter updates. Limiting and monitoring the downloading of these apps can be difficult. So take the time to be sure which employees can be trusted for a BYOD policy.

Joseph Martin

Protect Yourself and Your Business Against Identity Theft

January 29, 2018 by Joseph Martin

Identity theft can happen to anyone, at any time. It is a common crime in today’s hyper-technology world. Hackers are coming up with new ways to steal your information at a rapid pace. You could be the average Joe on the street who accidentally gives your credit card information to a cloned PayPal, or someone steals your driver license’s number and applies for credit cards under your name.

Identity theft has become much more prevalent in the world than many would guess. Approximately 10 MILLION Americans become a target of some form of identity theft. If that number isn’t enough to make you uneasy then I don’t know what is. But not only does identity theft happen to individuals, it can happen to businesses that are not secure online. They can steal your business’s money, goods, information or any other assets.

Some common forms of identity theft are:

Financial Fraud: This is the most numerous fraud. Financial fraud includes stealing your identity to purchase or sell expensive items, steal your tax refunds, withhold portions of checks cashed, and simply steal your money to use in various ways. There are about 20 different financial fraud types that result in stealing your money.

Criminal Activities: This is where someone steals your identity to perform criminal activities under your name.

Cybercrimes: Many sophisticated phishing scams happen through the internet. Sometimes the perpetrator is right under your nose, such as an employee or caregiver. These hackers can access employee records, steal company mail (bank statements, tax documents, new checks), and gain authorized access to credit reports.

That’s why keeping a secure and protected office is extremely important. Hiring an IT company to make sure your files are safe is one way to help your business stays protected.

Other types of identity theft:

Organized Crime
Drug Trafficking
Alien Smuggling
Money Laundering

The main types of theft you should look out for though is financial and cybercrimes. Cybercrimes are numerous and many are designed to look identical to a regularly-used website or email from a known website.

For example, you go to a website you use to pay a monthly statement, instead of taking you to the official website, a hacker can redirect you to a malicious site that looks identical to the official one. Without knowing you make your payment on a website that is designed solely to steal your money and credit card number.

So, now that you have a better understanding of the different ways your identity can be stolen, what measures can you use to prevent fraud?

For starters, make sure you recognize a real website from a fraudulent one. Look to the URL link. If it has an “https” at the beginning that usually means it is a safe site. If it has just “http” at the beginning, that is deemed as an unprotected website.

For a business, many criminals prey on small businesses who do not have secure servers or protected files. But even protected businesses can be affected by cybercrime. As mentioned previously, insider computer crime can happen. Disgruntled employees who think they may be laid-off, or are not financially stable may commit identity theft to protect themselves.

Phishing scams, adware, spyware and other viruses are a form of malware that can be used to access private records.

For a business, downloading an anti-virus software is the first step. Keeping your systems up-to-date and regularly checking its status can alert you to any updates your anti-virus software has made that you need to implement.

Never give your individual or business information to companies you don’t know are legitimate. Many official websites will also have a lock icon at the bottom right corner of the page letting you know the site is secure. Do not make payments to any website that do not have the “https” URL and a lock icon on the page.

Make sure you shred all paper invoices, bills, receipts, statements or other mail that contains private information.

Never open emails from domains or usernames you do not recognize. Many mail applications will alert you if the mail looks like spam. Never reply to emails that are alerting you to verify your account information because your account is being suspended, closed, or charged.

Discussing these issues with your employees. By educating everyone in your business about the different forms of fraud and how to avoid them, this can prevent many types of identity theft.

Also, check your bank accounts for any activity that seems suspicious. Use a credit card for payments online instead of a debit card, because most credit card company offer a zero liability policy, meaning you will not be charged for fraudulent spending. Regularly check your credit score too- if it drops without reason that means there can be a hacker using a credit card in you or your business’ name.

Joseph Martin

Tips to Sink ATM Skimming

January 29, 2018 by Joseph Martin

Today’s world is far from the wild west, but bank robbers are still rampant and constantly after your money. The only difference is there tactics are far more technologically advanced. Criminals gain access to your bank account via ATM machines and some sneaky skimming of your money. These criminals use a combination of advanced card readers attached to the machine to capture your card information and small hidden cameras to snag your pin number. These cyber criminals then sell your information to third parties who copy your card and drain your account. This billion dollar bank robbing business is growing every year.

To help you protect your pin, card and money, here are a few tips to blank the cyber bank robbers:

Slight of Hand – Always make sure to cover the number pad with you hand when entering your pin. When it comes to breaking into your bank account, the cyber criminals will have no luck with no number.
Attention to Detail – Scope out the ATM before using it. Does anything look out of place or like it doesn’t belong? If there seems to be an “extra” piece of machinery, see if you can remove it. Because it most likely doesn’t belong. If there is excessive signage, mirrors or other “attachments” on the machine, then just avoid it completely.
Watch Your Back – This is an ATM tip that has been around as long as the machines themselves have, and it still applies. Do you best to avoid an ATM that is located in an isolated location, or an area with poor lighting. And if you find yourself in that situation, keep alert of your surroundings.
Don’t Stall to Make the Call – If an ATM looks like it could be a threat, or that criminals have possibly tampered with it, then let the necessary officials know. Don’t hesitate to notify the bank and law enforcement officials right away.

Joseph Martin

Do Not Use These Chrome Extensions

January 28, 2018 by Joseph Martin

Do you use any of the following Chrome browser extensions?

Change HTTP Request Header

Nyoogle – (a custom logo for Google)

Stickies – (a Post-It note for Chrome)

Lite Bookmarks

If so, you’re not alone. These four extensions have a combined user base of more than half a million.

Recently, security researchers from ICEBRG (a US cyber-security company) have discovered malicious codes embedded in copies of these on the official Chrome Web Store. The code allows hackers to manipulate the users’ browser via JavaScript.

So far, the hackers have only contented themselves with relatively tame activities like loading and displaying ads, clicking on ads, and loading malicious web pages in the background. However, the potential exists to do much more than this.

Since ICEBRG informed Google, the company has removed three of the four plugins from the Web Store. As of this moment, only Nyoogle remains, though the expectation is that it will be removed in short order as well.

While all four extensions utilize the same basic techniques, and do many of the same things, it is not clear if all four were created by the same group, although this seems likely.

Since the extensions have now been (mostly) removed, the rate of infection will slow. Of course, if you’ve already downloaded and installed one of these four, then you are going to continue to be impacted.

The extensions are easy to uninstall, and if you’re using one of them, that is the recommended course of action.

In recent months, Google has taken steps to make their auditing process more robust to prevent malicious extensions and apps from finding their way onto the web properties they manage. As this latest incident proves, no matter how careful a company is, sooner or later something is going to slip through.

Joseph Martin

Backdoor In Certain Lenovo Switches Discovered

January 27, 2018 by Joseph Martin

Does your company utilize either RackSwitch or BladeCenter networking switches? Are those switches running ENOS (the Enterprise Network Operating System)? If so, there’s a backdoor in your network you weren’t aware of. Even worse, it’s been there since 2004.

Engineers at Lenovo recently discovered the backdoor in the firmware when they conducted an internal security audit. These products were added to the company’s portfolio via acquisition from Nortel, and Lenovo only just became aware of their existence.

A spokesman for the company had this to say: “The existence of mechanisms that bypass authentication or authorization are unacceptable to Lenovo and do not follow Lenovo product security or industry practices. Lenovo has removed this mechanism from the ENOS source code and has released updated firmware for affected products.”

Updates are available on Lenovo’s website, and links to the updates are available inside the company’s security advisory on this topic.

It should be noted that this backdoor would be relatively difficult for a would-be hacker to exploit, because it’s not a hidden account whose password could be guessed at or cracked via brute force, but rather an authentication bypass mechanism that requires a strict set of conditions to trigger. Lenovo describes the various configurations of security settings that activate the backdoor in their security advisory.

In any case, the presence of a backdoor into your network (even one that’s hard to trigger and access) isn’t something to be taken lightly. If you’re able, grab the firmware updates from Lenovo at your next opportunity and seal the breach. If that is impractical for some reason, Lenovo has spelled out a few mitigation strategies your company can apply as a stop gap, until you can get the firmware updates in place.

Kudos to Lenovo from their swift, deft handling of the issue!

Joseph Martin

Vulnerabilities Found In Some GPS Services

January 26, 2018 by Joseph Martin

A duo of researchers stumbled across a series of vulnerabilities in literally hundreds of GPS services that leave sensitive GPS tracking data open to hackers. Dubbed “Trackmageddon” by the researchers, the vulnerabilities span a range of weaknesses that include default or easy-to-guess passwords, IDOR (Insecure Direct Object Reference) issues, insecure API endpoints, and data collection folders that are entirely unsecured.

The reason so many different tracking services are impacted is that most of them rely on the same online software to deliver their services, and that software (believed to be designed by ThinkRace, one of the largest vendors of GPS tracking devices) itself is flawed. As more and more companies license it, the issues spread, exposing the data of an increasing number of customers who are entirely in the dark about how vulnerable their location data is.

The researchers have made attempts to contact the vendors offering GPS tracking services with vulnerabilities, but so far, have met with only limited success. According to their report:

“We tried to give the vendors enough time to fix (also respond for that matter) while we weighed this against the current immediate risk of the users.

We understand that only a vendor fix can remove a user’s location history (and any other stored user data for that matter) from the still affected services, but we (and I personally because my data is also on one of those sites) judge the risk of these vulnerabilities being exploited against live location tracking devices, much higher than the risk of historic data being exposed.”

As to the types of data being exposed, it includes: GPS coordinates, phone numbers, IMEI numbers, device information, and depending on which online service is being used, a hacker could even gain access to audio, video, and photos uploaded by the device being used.

While extremely convenient, these services do carry significant risks. Use them at your own risk.

Joseph Martin

Electronic Device Search Rules Better Defined By US Customs

January 25, 2018 by Joseph Martin

There’s a constant tug of war playing out on the national stage. On one side, privacy advocates are pushing for greater autonomy for end users, and hard limits to the types of searches that law enforcement agencies are allowed to conduct.

On the other side are the government agencies themselves, which often cite national security concerns as the justification for more and easier access to the sensitive data contained on personal devices like laptops and smartphones.

Generally speaking, the privacy advocates lose those battles. This was the case recently, when the CBP (the US Customs and Border Protection agency) published their latest electronic search guidelines. The most significant change is that the new guidelines explicitly define the difference between basic and advanced searches.

CBP agents are authorized to choose any travel, with or without cause or suspicion, for basic searches. Under the clarified rules, a basic search is limited to an examination of data found on the device itself, which is accessible through already installed apps, or through the device’s OS.

Advanced searches may be conducted, but agents must demonstrate that there’s a reasonable suspicion of criminal activity, or that the person carrying the device represents a “national security concern.”

The individual singled out for an advanced search may be permitted to be present while the search is conducted, but are not permitted to view the actual search itself for fear of revealing law enforcement techniques. Of significance, even during the conduct of an advanced search, agents are not permitted to search cloud-based data. They are restricted to data stored on the device itself.

While none of this sounds especially heavy-handed, the biggest complaint privacy advocates have about the updated rules is the fact that border agents can, at their own discretion, still carry out warrantless searches without any judicial oversight whatsoever.

Although this may not impact you directly, it pays to be mindful of the recent changes.

Joseph Martin

Is Working on Personal Devices Risky Business?

The Risk of Not Being Regulated

Lost and Not Found?

Take the Proper Precautions

8 Ways To Keep Your Small Business Secure

1. Have Anti-virus & Malware Software

2. Avoid Phishing Emails

3. Minimize Damage From Dishonest or Disgruntled Employees

4. Secure Your Wireless Network

5. Have An Internet Use Policy

6. Avoid Having Everything on One Computer

7. Have a Data Backup System

8. Minimize Damage From Stolen Equipment

Is Your BYOD Policy HIPAA Compliant?

Everyone Is On The Same Page

Better Safe Than Sorry

Set The Standards

Pave the Way for a Successful BYOD Policy

Decide On Your Devices

Don’t Skimp on Security

Not All Apps are Allowed

Protect Yourself and Your Business Against Identity Theft

Tips to Sink ATM Skimming

Do Not Use These Chrome Extensions

Backdoor In Certain Lenovo Switches Discovered

Vulnerabilities Found In Some GPS Services

Electronic Device Search Rules Better Defined By US Customs

Contact Info

Navigation