CyberSecurity

A Cybersecurity Checklist for Modern SMBs

The landscape of digital security is rapidly shifting, and even the largest tech giants are scrambling to keep up with new data regulations and cybersecurity threats. Small to medium-sized businesses (SMBs) are often left out of these important conversations, leaving themselves — and their users — vulnerable. In an effort to combat this trend, Webroot conducted a survey of more than 500 SMB IT leaders in the UK, revealing common blind spots in SMB cybersecurity practices. As businesses around the globe grapple with similar change, our Size Does Matter: Small Businesses and Cybersecurity report offers insight and guidance for companies regardless of geography. 

The biggest takeaway? We turned to Webroot’s Senior Director of Product Strategy Paul Barnes for his thoughts.

“The damage from data loss or downtime often means substantial financial and reputational losses, sometimes even leading to a business no longer being viable. A key learning for all small businesses should be to stop hiding behind your size. Instead, become educated in the risks and make your security posture a differentiator and business driver.”

When you’re putting together a cybersecurity checklist, you’ll need to do one thing first: check your preconceived notions about SMB cybersecurity at the door. Your business is not too small to be targeted. The data you collect is both valuable and likely vulnerable, and a costly data breach could shutter your business. More than 70% of cyberattackstarget small businesses, with 60% of those going out of business within six months following their breach. With both the threat of hackers and the looming possibility of increased GDPR-style data regulatory fines, your small business cannot afford to be underprepared.

The first step to a fully realized cybersecurity program? An unflinching look at your company’s resources and risk factors.

“Understand what you have, from a technology and people perspective, and the risks associated with loss of data or operations, whether through externally initiated attacks or inside threats,” advised Barnes. “This will allow you to plan and prioritise next steps for protecting your business from attack.”

For established SMBs, this type of internal review may seem overwhelming; with so many employees already wearing so many hats, who should champion this type of effort? Any small business that is preparing to modernize its cybersecurity protocols should consider bringing in a managed service provider (MSP) to do an internal audit of its systems and to report on the company’s weaknesses and strengths. This audit should serve as the backbone of your cybersecurity reform efforts and — depending on the MSP — may even give you a security certificate that can be used for marketing purposes to differentiate your brand from competitors.

With a strong understanding of your company’s strengths and weaknesses, you can begin to implement an actionable cybersecurity checklist that will scale as you grow, keeping your business ahead of the data security curve. Each SMB’s checklist will be unique, but these best practices will be integrated into any successful cybersecurity strategy.

Continuous Education on the Latest Threats

A majority of small to medium-sized businesses rely on software systems that are constantly evolving, closing old security gaps while potentially opening new ones. With a tech landscape in constant flux, one-off security training will never be enough to truly protect your business. Comprehensive employee training that evolves alongside cybersecurity threats and data privacy regulations are your company’s first line of cybersecurity defense. Include phishing prevention practices in these trainings as well. Although seemingly old hat, phishing attacks are also evolving and remain one of the largest causes of data breaches globally. Continuous training of employees helps build a culture of security where they feel part of the team and its success. 

Regular Risk Assessment and Security Audits

Just as one-off training is not sufficient in keeping your staff informed, a one-off audit does nothing to continuously protect your company as it grows. Depending on your industry, these audits should take place at least annually, and are the best way to detect a security flaw before it is exploited. Factors such as the sensitivity of the data your business houses, and the likely impacts of a successful breach—your risk profile—should guide decisions regarding the frequency of these security audits.

Disaster Response Plan

Having a prepared disaster response plan is the most effective way to mitigate your losses during a data security breach. Backup and recovery tactics are critical components of this plan. It should also include a list of security consultants to contact in order to repair the breach, as well as a communications plan that notifies customers, staff, and the public in accordance with data protection regulations. An MSP can work with your company to provide a disaster response plan that is customized to your business’ specific needs.

Bring Your Own Device

Never scrimp on mobile security. Many companies now tolerate some degree of bring-your-own-device (BYOD) policy, giving employees increased convenience and employer accessibility. But convenience is a compromise and, whether it be from everyday theft or a malicious app, mobile devices are a weak point in many company’s security. Including mobile security guidelines like automatic device lock requirements, strong password guidelines, and failsafe remote wipe access in your BYOD policies will save your company money, time, and heartache.

Layer Your Security

Finally, ensure your business has multiple layers of defense in place. Accounting for endpoint devices is no less critical than it’s always been, but businesses are increasingly learning that networks and users need protection, too. DNS-layer security can keep employees from inviting risky sites onto your network, and security awareness training will help your users recognize signs of an attack. No one solution is a panacea, but tiered defenses make a business more resilient against cybercrime.

Survey says: We don’t have time for this

One of the largest impediments to SMBs adopting these modern cybersecurity protocols is the perceived time cost, with two-fifths of IT leaders surveyed by Webroot stating they simply do not have the time or resources to fully understand cybersecurity threats. The uncomfortable truth is that, if you can’t find the time to protect your data, a hacker whodoes have the time is likely to find and exploit your security gaps. But there is a silver-lining, the smaller size of an SMB actually allows for a certain level of agility and adaptiveness when implementing cybersecurity policies that is inaccessible to tech giants.

“SMBs can no longer consider themselves too small to be targets. They need to use their nimble size to their advantage by quickly identifying risks and educating employees on risk mitigation, because people will always be the first line of defense,” said Barnes.

You’ll find additional benefits beyond the base-level protection a comprehensive cybersecurity plan provides. As 33% of SMBs surveyed by Webroot say they prefer not to think about cybersecurity at all, demonstrating that your company is ahead of the problem can be a powerful way to distinguish your business from its competitors. With consumer data privacy concerns at an all-time high, a modern cybersecurity checklist may be one of the best marketing tools available. The best way to stay ahead of cybersecurity threats is to stay informed. Read the entire Size Does Matter: Small Businesses and Cybersecurity report for an in-depth look at how your SMB contemporaries are handling data protection, and stay up-to-date with Webroot for additional cybersecurity reports and resources.


This article was provided by our service partner : webroot.com

remote access

Remote Access: What You Should Know

In the prehistoric age of computers, when they took up entire rooms in tall buildings, remote support was just a twinkle in the eyes of early engineers. Fast-forward several decades to the 1980s and the advent of the World Wide Web and voila! Remotely servicing machines was no longer a wishful thought, but an actual possibility.

Today, with billions of smart devices around the globe to support, managed service providers (MSPs) have come to rely on remote access tools to troubleshoot technology issues wherever the end user is in the world.

As remote access solutions become more sophisticated, there are fewer reasons to send technicians on site to support devices. This not only adds to an MSP’s bottom line, it also makes technicians and engineers more effective at their jobs.

What is Remote Access?

In its simplest form, remote access is a process where a technician is able to access a machine (it could be a computer, smart phone, or a server) from another location.

Can you think of an industry that doesn’t use smart devices (computers, phones, tablets, etc.)? Somewhere in the company’s infrastructure, there’s a machine – and those machines can malfunction. As glamorous as it would be to fly all over the globe to fix computers and phones in exotic locations, it’s not exactly cost-effective to send techs troubleshoot issues in person. So, when tech issues arise, it’s remote access to the rescue!

So, what’s the difference between remote access and remote support? Some in the IT community use those terms interchangeably. When you think about it, they’re not wrong. For the purposes of this article, the difference is this:

Remote access is the process where a technician remotely supports machines, mobile devices, servers, and systems that are unattended by the end-user.

Remote support is the same process essentially, with one key difference: the technician is assisting a person on the other end of the session while they address tech issues with the person’s device.

Choosing the Best Remote Access Software for Business

There are dozens of solutions on the market, ranging as broadly in complexity and capability as they do in price. Some cater to home users and others to enterprises. Some split up the remote access and support functionality into different tools. Others are all-inclusive (meaning one software offers the option to both support end users AND access unattended machines).

Narrowing the options down to the right one for your business can be tricky. It might even be tempting to opt for the cheapest one and hope for the best. But not all remote access solutions are created equal. Here’s what you should consider.

Security

Security is at the top of the feature list. Remote access without proper security exposes business data to cybercriminals. When data breaches happen, MSPs lose not only credibility, but money. MSPs can incur fines associated with data breaches, not to mention lost revenue due to poor reputation, lost clients, and remediation.

Look for a comprehensive security feature set that includes:

  • Role-based permissions
  • Password management
  • SSL
  • Alerts
  • Multiple authentication methods

MSPs that support industries like healthcare may require you to have specific security measures in place to comply with legal and ethical guidelines like PCI, DSS, and HIPAA. If these apply to you, make sure your choices include additional security features like:

  • On-premises options
  • Video auditing and recording

Reliable Connectivity

Another ding on an MSP’s credibility is slow, unreliable connectivity. Shaky remote access tools are bad for technician morale and can also leave your customers with a bad impression of your IT services. A remote access tool worth should let a technician connect to the device in seconds, temporarily install software for non-managed machines or break/fix scenarios, and will include options to install permanent agents as needed.

Cross-Platform Compatibility & Mobile Support

Companies that MSPs support will usually rely on an array of devices – both mobile and stationary – to run their day to day business functions. The thing is, many of these devices run off of different platforms, tasking MSPs with supporting Microsoft® Windows, Mac, Linux, Android, and Chrome. Likewise, it’s important for technicians to be able to access machines while they’re away from their desktops.

Integrations

Disparate systems are no good – that’s not a new idea. So, it’s crucial that the solution you choose integrates with the other systems you use (ticketing, billing, and business management). Otherwise, you could be creating more problems than you’re solving. When you’re researching remote access tools, ask yourself these questions:

Does this integrate with the solutions I already use?

Does this offer extensions and apps for enhanced capabilities?

How often are new solutions added to the integration roster?

Online Collaboration

A strong tech support team relies on collaboration to get the job done quickly and accurately. If your remote support solution doesn’t also offer remote meeting capabilities, you’re missing out on an easy way to promote team collaboration, and to share information quickly with your customers through screen-sharing and simple document sharing.

The right remote access solution allows your techs to help each other or request help easily, and gives them the capability to chat with end users, share screens with customers, and set up meetings to help explain issues quickly and directly.

Customization

White labeling is key for brand recognition and building trust. Remember that remote access can be daunting for end users. The more your customers see your MSP’s logo, colors, and messaging, the easier it’ll be to build your brand equity.

Beyond logos, colors, and custom URLs, consider which customizations would most benefit your team. The best remote access software will offer an array of editable settings, languages, designs, and workflows.

Setup & Implementation

Something to find out about before choosing a remote access tool is how much time and education is required before you’re up and running with your new solution. With some solutions, it’s a very simple process that involves installing an access point onto the machine(s) or “endpoint” you want to support. Be careful to consider things like compatibility – if your endpoints run on Windows OS, for instance, you should check to make sure the remote access tool support it.

The Future of Remote Access

Cloud information management has drastically changed how companies share resources. The cloud has made it possible for even the smallest companies to distribute information and resources around the world, making it crucial for MSPs to be able to administer cloud management and monitoring.

An MSP’s systems need to be able to weather the storm of a constantly changing industry. A robust remote access solution—allowing you to work in multiple environments and continue to support new tools—is key to building a successful business. Evaluate your selections for remote access tools by considering which solutions offer the development support you’ll need for scalability.

A Remote Access Solution that Checks All the Boxes

Every MSP and help desk needs a reliable and secure remote access tool that scales as the workforce needs change.


This article was provided by our service partner : connectwise.com

The Rise of Information Stealers

As noted in a previous blog post, mining malware is on a decline, partly due to turmoil affecting cryptocurrencies. Ransomware is also on a decline (albeit a slower one). These dips are at least partly the result of the current criminal focus on information theft.

Banking Trojans, hacks, leaks, and data-dealing are huge criminal enterprises. In addition to suffering a breach, companies might now be contravening regulations like GDPR if they didn’t take the proper precautions to secure their data. The ways in which stolen data is being used is seeing constant innovation. 

Motivations for data theft

Currency

The most obvious way to profit from data theft is by stealing data directly related to money. Examples of malware that accomplishes this could include:

  • Banking Trojans. These steal online banking credentials, cryptocurrency private keys, credit card details, etc. Originally for bank theft specialists, this malware group now encompasses all manner of data theft. Current examples include Trickbot, Ursnif, Dridex.
  • Point of Sale (POS). These attacks scrape or skim card information from sales terminals and devices.
  • Information stealing malware for hijacking other valuables including Steam keysmicrotransactional or in-game items

Trade

Data that isn’t instantly lucrative to a thief can be fenced on the dark web and elsewhere. Medical records can be worth ten times more than credit cards on dark web marketplaces. A credit card can be cancelled and changed, but that’s not so easy with identity. Examples of currently traded information include:

  • Credit cards. When cards are skimmed or stolen, they’re usually taken by the thousands. It’s easier to sell these on at a reduced cost and leave the actual fraud to other crooks.
  • Personal information. It can be used for identity theft or extortion, including credentialschildren’s data, social security information, passport details, medical records that can be used to order drugs and for identity theft, and sensitive government (or police) data

Espionage

Classified trade, research, military, and political information are constant targets of hacks and malware, for obvious reasons. The criminal, political, and intelligence worlds sometimes collide in clandestine ways in cybercrime. 

As a means of attack

While gold and gemstones are worth money, the codes to a safe or blueprints to a jewellery store are also worth a lot, despite not having much intrinsic value. Similarly, malware can be used to case an organisation and identify weaknesses in its security setup. This is usually the first step in an attack, before the real damage is done by malware or other means. 

“In late 2013, an A.T.M. in Kiev started dispensing cash at seemingly random times of day. No one had put in a card or touched a button. Cameras showed that the piles of money had been swept up by customers who appeared lucky to be there at the right moment.” –From a story that appeared in the New York Times

Just another day in the Cobalt/Carbanak Heists 

Some examples of “reconnaissance” malware include:

  • Carbanak. This was the spear-tip of an attack in an infamous campaign that stole over €1 billion ($1.24 billion) from European banks, particularly in Eastern Europe. The Trojan was emailed to hundreds of bank employees. Once executed, it used keylogging and data theft to learn passwords, personnel details, and bank procedures before the main attacks were carried out, often using remote access tools. ATMs were hacked to spill out cash to waiting gang members and money was transferred to fraudulent accounts.
  • Mimikatz, PsExec, and other tools. These tools are freely available and can help admins with legitimate issues like missing product keys or passwords. They can also indicate that a hacker has been on your network snooping. These software capabilities can be baked into other malware.
  • Emotet. Probably the most successful botnet malware campaign of the last few years, this modular Trojan steals information to help it spread before dropping other malware. It usually arrives by phishing email before spreading like wildfire through an organisation with stolen/brute-forced credentials and exploits. Once it has delivered its payload (often banking Trojans), it uses stolen email credentials to mail itself to another victim. It’s been exfiltrating the actual contents of millions of emails for unknown purposes, and has been dropping Trickbot recently, but the crew behind the campaign can change the payload depending what’s most profitable. 

“Emotet is an advanced, modular banking Trojan that primarily functions as a downloader or dropper of other banking Trojans. Emotet continues to be among the most costly and destructive malware affecting state, local, tribal, and territorial (SLTT) governments, and the private and public sectors.”- An August 2018 warning from the American DHS

  • Trickbot/Ryuk. Trickbot is a banking Trojan capable of stealing a huge array of data. In addition to banking details and cryptocurrency, it also steals data that enables other attacks, including detailed information about infected devices and networks, saved online account passwords, cookies, and web histories, and login credentials. Trickbot has been seen dropping ransomware like Bitpaymer onto machines, but recently its stolen data is used to test a company’s worth before allowing attackers to deploy remote access tools and Ryuk(ransomware) to encrypt the most valuable information they have. The people behind this Trickbot/Ryuk campaign are only going after big lucrative targets that they know they can cripple.

What are the current trends?

Emotet is hammering the business world and, according to our data, has surged in the last six months of 2018:

Data recorded between 1 July and December 31, 2018. Webroot SecureAnywhere client data.

Detection of related malware surged alongside these detections. Almost 20% of Webroot support cases since the start of December have been related to this “family” of infections (Emotet, Dridex, Ursnif, Trickbot, Ryuk, Icedid).

What can I do?

  • Update everything! The success of infections such as WannaMine proved that updates to many operating systems still lag years behind. Emotet abuses similar SMB exploits to WannMine, which updates can eliminate.
  • Make sure all users, and especially admins, adhere to proper password practices.
  • Disable autoruns and admin shares, and limit privileges where possible.
  • Don’t keep sensitive information in plain text.

This article was provided by our service partner : Webroot

How RMM Solves Break/Fix Problems

Despite the rise of managed service providers (MSPs), many IT companies still operate on a break/fix model. But the proactive managed services model is far easier and more cost-effective—and helps you provide a much stronger level of service to your clients. If you’re still providing services on a break/fix basis, a remote monitoring and management (RMM) tool can help you make the transition to managed services.

Not sure of the benefits an RMM tool offers? Here are a few.

Cash Flow

In a break/fix model, clients only pay for your services when they need something fixed. As a result, cash flow is inconsistent and unpredictable. By contrast, MSPs charge a uniform monthly fee in exchange for constant, proactive monitoring of a client’s systems. RMM tools proactively monitor a client’s devices and networks, allowing you to charge a monthly fee for your always-on service.

Complex IT Issues

In a break/fix model, you don’t hear about an IT issue until it’s grown large enough for a client to notice. This usually means the problem has become widespread and complicated—whereas a problem in the early stages can be simpler and quicker to resolve. RMM software can detect IT issues before the client notices them, enabling you to fix them proactively before they cause widespread problems.

Wasted Time

Time spent to and from client sites can represent a large part of a break/fix technician’s day—and eats up resources that could be better spent elsewhere. It also takes additional time to analyze a client’s devices and gather basic information about the infrastructure and issue. Every second spent traveling or collecting background information hinders your company’s growth by reducing productivity. But with RMM, you can gather information automatically and solve issues remotely, reducing costs and making every second count.

Client Mistrust

If you operate on a break/fix model, you may fix a client’s issue only to have them call you the next day with the same issue or a related one. The more problems a client experiences, the less they’ll trust you. If you’ve supposedly already fixed the issue, they’ll wonder, why does it keep happening? That’s a problem you can avoid with the help of an RMM tool. Constant monitoring means you’ll always know what’s going on, and if you discover a potential issue, you can fix it quickly. Give the client a well-performing infrastructure, and you’ll deepen their trust in your services.

Limited Manpower

Break/fix models can keep your technicians constantly busy as they dash off to fix one client issue after another. If they’re overworked, they may miss incoming work. An RMM tool automates tasks to ease up the strain on your team and help them handle clients more efficiently.

Outdated Systems

Outdated systems can be a strain on break/fix companies. If a client experiences problems with outdated software or devices, they may budget for upgrades rather than for the IT services you provide—costing you potential business. RMM keeps your clients’ systems up to date with the latest tools and software.

Negative Associations

The break/fix business model may cultivate an unhealthy relationship between providers and clients. You make money only when your client’s system is failing. This creates a negative association in your client’s mind, and they may put off calling you until it’s absolutely necessary. At that point, of course, the problem is much more difficult to resolve. With RMM, you keep everything running as it should, building satisfaction rather than resentment.

Loss of Business

If you don’t offer managed services, someone else will—and it’s only a matter of time before your client finds them. Transitioning to an MSP with the help of an RMM tool means better service for your clients and more business for you.

By adding an RMM tool to your solution toolkit, you’ll be able to proactively detect problems before your client notices, allowing you to offer a better quality of service. In addition, your staff will experience an increase in productivity that will help your company’s bottom line.


This article was provided by our service partner : connectwise.com