Posts

Improve Business Security With These Core Hacks

/in /by

StrategyDriven Risk Management Article |Business Security|Improve Business Security With These Core HacksWhen you are trying to run a modern company, it is important to do as much as you can to enhance the safety and security of the business. There are loads of things you can do that are going to help you make the most of this right now. The better you can protect your business the more important it is for you to be able to grow and develop as a brand, and there are plenty of ways of doing this.

You need to make sure you do as much as possible to think about how you can get this right, and there are loads of amazing ideas that will help enhance business security. One of the best things you can do is to focus on how your company is run in the safest and most appealing way. Here are some of the ways of improving business security and helping the company thrive and grow.

CCTV

Most modern businesses would do well to have some form of CCTV, and this is even more important if your company has premises where equipment and machinery is stored. This is something you’re going to want to protect, and you need to try to make the most of this right now. Come up with the best ideas that can play a role in helping you look after your business, and it’s pretty clear that CCTV is one of the best ways of being able to do this. Think about what it takes to work on this right now, and there are a lot of factors that play a role in helping your company improve its security.

Keycards

You have to try to make the most of doing as much as you can to take things to the next level. It is so important to integrate some sort of digital security procedures in order to make your business a bit safer and more secure. One of the best ways of being able to achieve this would be through an easy-to-use, on-site identity badge printer that can be used to create ID so that you know who is coming and going from the business, as well as being able to integrate keycards for entry and exit.

Cybersecurity

It is important to make sure you do as much as you can to look after the future and integrity of the business, and one of the best ways of doing this is to make sure you focus on cybersecurity, There are so many ideas that you need to work on that are going to allow you to focus on getting this right moving forward. Try to come up with some of the best ways of implementing cybersecurity in the business, and this is something you need to focus on right now.

Coming up with some of the best ideas to help you take your business security to the next level is really important because it is a great way of making everything easier for your business. There are a lot of factors that play a part in this, and you have to make sure you think carefully about the best ways of being able to improve your business security in the right sort of way.

How Technical Debt Opens the Door to Cyber Attacks—and Steps to Protect Your Small Business

/in /by

StrategyDriven Managing Your Finances Article |Cyber Attacks|How Technical Debt Opens the Door to Cyber Attacks—and Steps to Protect Your Small BusinessThe virus pandemic of 2020 is severely disrupting the economy and the large and small businesses that drive it. Poor practices such as ignoring safe distancing, insufficient sanitation, and not mandating mask-wearing open the door to infection of customers and staff and threaten the viability of a business.

Similarly, poor practices that allow a business to incur technical debt open the door to cybersecurity exploits that can bankrupt a business financially or through loss of trust and reputation in the eyes of its customers. Leaders of small and medium size businesses (SMBs) often think their size lets them operate under the radar, as less attractive targets to bad guys. But, actually, their lack of robust security strategy and resources make them easier to penetrate. And, sadly, the National Cyber Security Alliance (NCSA) reports that 60 percent of small companies are unable to sustain their business more than six months following a cyberattack.

Years of experience working and advising businesses domestically and internationally has shown that business leaders find it difficult to recognize tech debt and how it exposes cyber vulnerability. As technology has evolved over time from main frame to client server to the Internet and now the cloud, the impact of a new Tech Debt 2.0 has grown stealthier and more sinister. This is especially true for SMBs that lack the resources to apply to cybersecurity. CEOs and CFOs managing technology may not recognize tech debt building up in their SMBs—because it is not revealed in monthly variance reports or other accounting controls. Someone in their organization, without explicit or implicit authority or oversight, may be making decisions adding to the Tech Debt 2.0 load and increasing exposure to cyberattacks. Let’s look at how that might happen and how to prevent it.

Old and Obsolete Infrastructure:

Azeotrope, an aerospace firm in the Southeast, realized they were compromised when a number of clients complained of receiving invoices from Azeotrope that contained confidential information about their client’s orders and projects. Months of investigation by a cyber consulting firm finally determined the source of the vulnerability to Azotrope’s network: a combination printer/fax machine in their testing and QA area that engineers regularly used to fax lunch orders to a local Chinese restaurant. Because the device was connected to the company’s network for printing purposes, it provided network access using out-of-date insecure facsimile protocols. This gave the bad actors access to the company’s customer accounts and valuable data.

“Fax is an ancient technology; the protocols we use today haven’t been changed for the past 30 years,” notes Yaniv Balmas of Check Point Software, a leading provider of cyber threat intelligence. “Fax data is sent with no cryptographic protections; anyone who can tap a phone line can instantly intercept all data transmitted across it. Fax is always sent unauthenticated. There are absolutely no protections over fax.” Balmas advises: “If you can’t stop using fax, segregate the printers, put them on a separate network.”

The Tech-away: Identify and remove obsolete components from your network. Not just equipment with obvious vulnerabilities like fax, but all equipment no longer supported and updated by the manufacturer for cybersecurity risk.

A Stitch in Time . . .

Patches are often created after a software or hardware company has experienced a data breach or recognized a vulnerability that might allow one. The patch is issued to ensure other businesses’ data remains safe. Applying a patch as quickly as possible lessens the risk of your business becoming affected. But it is each business’s responsibility to know a patch has been issued and to apply it promptly. That is patch management—a relatively straightforward process, 10 or 20 years ago. Today, however, the vast proliferation of software and hardware components in our business environment have made patch management a complex, time- and resource- consuming necessity, critical to the cybersecurity of a business’s network. Failure to effectively manage patching is a main cause of accumulating excessive Tech Debt 2.0 and security penetration.

NETGEAR, a highly respected manufacturer of network equipment in data centers, offices, and the homes of hundreds of thousands of people working from home now, and, possibly, far into the future, recently sent an email alert to its customers. An excerpt is below. How would your CFO or CIO handle this?

Hello.

We have become aware of vulnerabilities involving certain NETGEAR products and have issued a security advisory.

We have released hotfixes addressing some of the vulnerabilities for certain impacted models and continue to work on hotfixes for the remaining vulnerabilities and models, which we will release on a rolling basis as they become available. We strongly recommend that you download the latest firmware containing the hotfixes as instructed in the security advisory. We plan to release firmware updates that fix all vulnerabilities for all affected products that are within the security support period.

Until a hotfix or firmware fix is available for your product, we strongly recommend turning off Remote Management in your product. Please follow the steps below to turn off Remote Management immediately. . .

The Tech-away: Take steps to reduce the burden and complexity of patch management. Adopt software and hardware that automatically detect and apply patches. Look for opportunities to shed responsibility for patch management through outsourcing cybersecurity responsibility or utilizing cloud services that provide monitoring and patch management services. Tech Debt accrued through failure to manage patching effectively can fatally compromise your network and business.

People, Policies and Processes

Of greater consequence than obsolescence and patch management to Tech Debt 2.0 and cybersecurity are the people, policies, and processes that make up the culture and collective mindset of a business organization. Properly patched, up-to-date infrastructure is not going to stand in the way of the accounts payable clerk or chief marketing officer who clicks on the attachment to an email from some bad actor posing as a trusted vendor or prospective customer. Equally dangerous is the computer operator who props open the data center door to make it easier to allow the guy who says he’s the A/C maintenance engineer get in and out. Or the CEO who shares her password with her husband and children so they can access her mail and messaging accounts.

Establishing a data security mindset from the bottom to the very top of an organization is a basic essential to safeguarding a business from cyberattacks. Policies and processes must instill in all the company’s people an always-on awareness of their responsibility to protect the physical and digital assets of the enterprise. That mindset needs to be reinforced frequently and backed up by actions that demonstrate commitment and consequence behind company policies and processes.

The Tech-away: Formulate and clearly communicate policies and processes governing any actions that involve cybersecurity. Visibly demonstrate across the organization the commitment to security.

Make cybersecurity awareness a visible priority for every person in the organization.

About the Author

StrategyDriven Expert Contributor |Michael C. FilliosMichael C. Fillios is the founder and CEO of the IT Ally Institute, a nonprofit organization providing small and medium-sized businesses (SMBs) access to knowledge, research, and practical tools to improve their tech bottom line. A senior global business and technology executive with more than 25 years of experience in IT, finance, operations management, and change leadership, he lives in Mason, Ohio. His new book is Tech Debt 2.0™: How to Future Proof Your Small Business and Improve Your Tech Bottom Line. Learn more at www.itallyinstitute.org.

8 Ways to Protect Your Business From Cyberthreats

/in /by

StrategyDriven Risk Management Article |cyberthreats |8 Ways to Protect Your Business From CyberthreatsEvery 39 seconds, there is a new cybersecurity attack. On any given day, there are around 80,000 cybersecurity attacks worldwide, equating to about 30 million attacks per year.

If you think your business is immune to cybersecurity threats, you’re wrong. Luckily, there’s a lot that you can do to protect your business from a cybersecurity attack.

Check out this guide to discover how to protect your business from cyberthreats.

1. Use Secure Passwords

A lot of times, cybersecurity attacks happen because of poorly chosen passwords. Creating a strong password is one of the easiest things you can do to prevent a breach in your system.

For a password to be strong it should:

  • Contain letters, numbers, and special characters
  • Be 8 to 15 characters long
  • Never be written down or stored in a nearby device
  • Updated frequently
  • Never contain personal information (Ie, birthdays, family member names, etc)

Make sure all of your employees know how to create a good password, and encourage them to change their passwords every 90 days or so.

2. Install Anti-Malware and Anti-Spyware Software

Installing anti-malware and anti-spyware software is another simple thing you can do to protect your business from cyberthreats.

When researching different software options, make sure you look for one that can run a full system scan on your computers. Also, you want to choose software that automatically updates itself and quarantines and removes malware and spyware.

While you may be tempted to purchase anti-virus software that comes with anti-malware and anti-spyware capabilities, it’s important to understand that a single piece of software is incapable of scanning and removing everything.

A multi-layered approach is the best way to secure your computer system.

3. Install Anti-Virus Software

In addition to installing anti-malware and anti-spyware software, you should also install anti-virus software.
This type of software continuously scans for viruses that are trying to break into your system files, emails, and operating systems. Just like quality anti-malware/spyware software, quality anti-virus software will run periodic updates.

When choosing an ant-virus software program, make sure you look for one that has daily-anti virus updates and a good reputation. You also want to double-check that the software program is compatible with your computer.

4. Use Email and the Internet With Caution

If your business does a lot of communication with email, then you especially want to be careful about what emails you open. While hackers can exploit an email in a variety of different ways, one of the most common things they do hide viruses in attachments.

If you receive an email from an address that you don’t recognize, don’t open it. Instead, delete it from your inbox immediately and add the address to your spam list.

You also need to take extra caution when using the internet, as even the safest websites can contain malware and spyware. One common way hackers lure internet users is by creating a fake website that looks just like a real website.

When entering a website URL, make sure to double-check the name of the website and make sure you’re spelling it correctly. Also, you should avoid clicking on graphics, popups, ads, and links to other websites.

5. Secure Your Wifi Network

Securing your Wifi network is another simple thing you can do to protect your business from cyberthreats.
If you leave your Wifi networks open, you’re giving hackers an open door to infiltrate your network and access your private information. So, make sure all of your business’ Wifi networks are private.

If you have a brick and mortar business that is frequented by customers, you should also create two Wifi networks: one for your business and one for your customers. This way, you don’t have to worry about your Wifi password getting into the wrong hands.

6. Backup Important Business Data

No matter how many steps you take to protect your business from a cybersecurity threat, cybersecurity breaches can still happen. Therefore, it’s important that you prepare your business for the worst-case scenario.

You should back up all of your critical business data and information. This way, if there is a cybersecurity breach, your business flow won’t be interrupted and your bottom line won’t be affected.

7. Train Your Employees On the Best Cybersecurity Practices

Knowing all of these cybersecurity protection tactics won’t do you any good if your employees don’t know them as well. As we mentioned earlier in the article, your employees should know how to choose a strong password and how often to change it.

But, the education shouldn’t stop there. You should also educate your employees on how to protect their data, set up a firewall, and how to recognize a security breach.

The reality is that most cybersecurity breaches are the result of human error, and all it takes is one mistake from an uninformed employee to compromise your business. While you can take on the cybersecurity training yourself, we recommend bringing in experts to help you, as they’ll be the most informed on the latest strategies and threats.

8. Conduct Penetration Testing

Last but not least, your business should conduct penetration testing on your computer systems.

Penetration testing involves simulating a cybersecurity attack in order to check for vulnerabilities in your computer system. Penetration testing comes with many benefits, including:

  • Detecting and avoiding security threats
  • Protecting customer loyalty and your company image
  • Evading penalties associated with breaches
  • To conduct penetration testing, make sure you work with a reputable company.

Are You Ready to Protect Your Business Against Cyberthreats?

Now that you’ve read this guide, it’s time to put these tips into action so you can protect your business against cyberthreats. Pretty soon, your business will be more secured than ever before.

Be sure to check back in with our blog for more cybersecurity-related tips and tricks.

Where Professionalism Is Important In Running A Business

/in /by

StrategyDriven Entrepreneurship Article |Professionalism in Business|Where Professionalism Is Important In Running A BusinessSure, you can be as free and liberal with your brand as you want; you can present a silly and non serious front, or you can present a laid back and easy going front. Branding is all about what you want it to be, and who you want to attract!

But even with this in mind, even with the kind of customers you’re pulling in, when it comes to certain areas of running your company, there are quite a few factors in which you’re going to have to be professional. Here are three key components of business that require you to be skilled, experienced, and professional in your manner.

In Customer Security

Your customers need to feel secure when they’re shopping with you. They need to know their payment details are safe and will never fall into the wrong hands. And seeing as you’re the retail portal they’re relying on, this is up to you.

Both online and offline, you need to be professional about security. Sure, you lock up your shop and make sure there’s no cash in the till at the end of the day, but what about your website? Is it even encrypted, when the time comes to put in card details to pay for items? It’s time to check on that.

In Shipping and Delivery

You need to be very professional about the way you pack, ship, and deliver any and all products and services. You need to have a safe and secure way to get your packages from point A to point B, and without professionalism to guide your way, there’s a good chance your delivery options will be subpar for the time being.

It’s why you might want to look into courier services; this will allow you to have more control over the process, be able to bundle your shipping needs, and with a handy Transport Marketplace to make use of, you’ll have a surefire way to chop and change your delivery services as you need to. There’s nothing quite like speed to show off your professionalism!

In Running Your Sales

And finally, you need to be very professional about the amount of sales you’re bringing in. After all, when it comes to building a customer base, and then ensuring you’ve got plenty of return sales to make profit off of, you need to cast a sure and professional eye over your books.

And being able to balance your books is another area that requires professionalism; if you can’t do it yourself, be sure to outsource your issues here to a trained and experienced accountant. Bring in the skills you need to ensure there’s plenty of professional talent behind the scenes, and your business will steadily climb up the profit margins.

Professionalism is something every single business needs. If you’re not sure about what you can manage in terms of bringing the right experience to your customers, make sure you’re working behind the scenes first, and then brand yourself second.

Office 365 phishing: the latest scams your employees need to know about

/in /by

StrategyDriven Risk Management Article |Office 365 Phishing|Office 365 phishing: the latest scams your employees need to know aboutMicrosoft’s Office 365 is often targeted by scammers and cybercriminals. This is a major problem, as Office 365 is one of the most widely used software suites by businesses around the world – undoubtedly part of the reason that it is so often under attack.

Despite the fact that the UK’s National Cyber Security Centre (NCSC) has made a concerted effort to implore system admins to implement stronger cybersecurity practice, Office 365 is still exceptionally vulnerable. In fact, there is damning evidence from Microsoft itself about the security practice of its users.

Through a security dashboard available to Office 365 administrators, users are given a ‘security score’ to indicate the strength of their defences and security processes. The maximum score is 707, and yet the average Office 365 score is just 37.

Businesses using Office 365 need to ensure that they are taking their cybersecurity extremely seriously. One of the most important ways of doing this is to provide your employees with as much information on the types of attacks they can face as possible. Some of the most common scams are phishing schemes – and these can take many forms.

Some of the Office 365 scams to look out for

Cybercriminals use a wide variety of tricks in attempting to compromise users – this can involve impersonating Microsoft or other well-known businesses. While there is an almost unlimited variation in the types of scams, some of the most widely seen include the following

  • Fake meeting requests – this type of phishing scam sends messages that spoof the name and email address of a senior executive and asks the users to reschedule a meeting, by taking part in a poll to choose the new date and time. When a user clicks on the link, they are presented with what appears to be an Office 365 login page but it is in fact a phishing site.
  • Employee pay rises – this scam uses the bait of a pay rise to convince employees to give up their Office 365 login credentials. The email contains a link to an apparent spreadsheet containing details of an employee salary increase – however, the link takes the user to a phishing site that looks like the Office 365 login page. This scam is especially effective because the login page displays the user’s email address prominently.
  • Voicemail scams – this scam makes use of a genuine audio recording that requests employees allow Microsoft access to their Office 365 account, along with an almost identical login page that actually harvests the victim’s details.
  • Content scams – it is also possible for criminals to utilise Microsoft Sway – a genuine presentation software – to create a spoofed site. This looks genuine and even experienced and knowledgeable users have been tricked into entering their details. The fact that the phishing email contains a link to a genuine Microsoft product makes it very difficult to spot this form of cybercrime.
  • Conversation hijacking – this scam sees phishers infiltrate a genuine email account using previously compromised credentials, and then insert themselves into a conversion – essentially taking on the persona of the account that they have gained access to. When another employee gets an email from this ‘trusted’ colleague, they will happily click on the links they contain, which takes them through to a spoofed site.

Admins are targeted too

It is not just general employees who are targeted with phishing scams. IT administrators are singled out by cybercriminals, as their accounts typically have greater privileges and access to more company data. With access to an admin account, criminals can carry out extremely effective attacks against other members of the organisation by creating new accounts.

Administrators in Office 365 typically have access to all of the email accounts on the domain, which may allow cybercriminals to take over those accounts or retrieve emails from them.

How to improve your Office 365 security

Of course, improving employee knowledge is a vital way to reduce the effectiveness of phishing attacks. But it is also important to take a multi-layered approach to Office 365 security and put additional defences in place in order to mitigate the potential damage of an attack.

There are various steps that businesses can take such as enforce multi-factor authentication as a part of account access, as well as ensuring that administrators have a separate account for day-to-day access and only use the admin account when necessary.

It is almost important to invest in proactive monitoring of your network in order to detect any malware or unusual activity. The earlier that any suspicious activity is detected, the sooner it can be acted upon. This reduces the window of opportunity for a cybercriminal to achieve his or her intended goal.