I found this article to be very good at simplifying the current Cybersecurity Challenges IT faces today.
Sources of cybersecurity threats
The sources of cybersecurity threats and attacks are seemingly endless. There are all types of reasons and motivations why someone wants to break in. Let’s look at some of the more common sources of security threats and see if we can dig a little deeper.
Corporate spies
One source of threats is corporate spies. The larger your company gets, the more likely it is that competitors or researchers will want to figure out how you’re doing. They may want to steal data for their organization or sell it to the highest bidder. When it comes to safeguarding trade secrets, make sure to take extra precautions.
Hacktivists
If you are engaged in activism for some cause, DDoS and hacktivists may attack your website to prove a point. They may want to do something as simple as defacing your website or they may want to put you out of business.
Disgruntled employees
Another top security threat is disgruntled employees. A disgruntled employee may want to steal data or information to get back at the organization. They may even want to sell the data to the highest bidder. In other cases, they may wish to wreak havoc in a digital environment just because they can, and they aren’t happy.
Hackers/Cybercriminals
A hacker or cybercriminals are people who seek to circumvent security measures to enter a digital environment. In today’s media, the term hacker has a generally negative connotation, and the truth of the matter is we may not know their motivation. Whether it is an individual or an organization, hackers can get into your environment for just about any reason under the sun.
These are just a few items in the cybersecurity threat landscape. The fact of the matter is that a solid information security strategy and policy are paramount to keeping hackers out, no matter the motivation.
Now that we’ve reviewed the profiles of threat actors, let’s look at some types of threats and protect yourself from them.
Common cyberthreats
Here are some of the most common threats you will encounter in your environment and some things to think about when trying to protect your assets.
Malware/Spyware
The first category I want to mention is the malware/spyware category. Most malicious software programs fall under this category, and it is one of the most widely used to gain access to a system or network. Let’s take a look at some more specific types of malware.
Trojans
A trojan is one of the most classic malware pieces out there and one of the easiest to use to access an environment. A trojan looks like a standard piece of software to the end user, so when they think they are installing a new app, your network gets a special surprise.
Ransomware
Ransomware is currently one of the most active pieces of malware around. You are constantly seeing stories about ransomware in the news. The most dangerous piece about ransomware is that it gets into your network and may do nothing for some time, making it difficult to detect.
When the ransomware activates, it begins to encrypt your systems and cripple them. At this point, your only hope is to recover your systems or pay the ransom.
Wiper attacks
A wiper attack is what it sounds like; malicious operators attack your systems and wipe them. These attacks cause havoc. In this case, you have no choice but to recover your systems.
Drive-by downloads
A drive-by download is an unwanted download of malware that happens while your users are unaware. This attack comes in a couple of different flavors. First of all, a user may end up downloading a piece of software by clicking a link or opening an email. Secondly, it can tie back in with a trojan when a user thinks they are downloading something legitimate, and it turns out to be malware.
Rogue security software
There’s nothing worse than a user that thinks they did something wrong. They may realize that something is wrong with their computer and try to fix it on their own. There are many imposter security software packages out there that seem like they will help out an end user but end up doing more harm than good.
Social engineering attacks
We’ve spent a lot of time talking about hackers getting into your network. Now, let’s talk about hackers getting into your user’s heads. These attacks are called social engineering. It can be as simple as someone posing that they work at your helpdesk and asking a user for a password, or it could be more sophisticated.
Phishing attacks
A phishing attack tricks an end user by stealing credentials via email, text message, etc. Phishing happens when an email link looks like it’s coming from a legitimate site and asks you to enter your login information.
Homograph attacks
Homograph attacks are interesting because they make users think they connect to more innocent systems, like a phishing attack. Homograph attacks use identical letters and numbers to make things look and feel legitimate — think of things like swapping a capital letter I for a lower-case letter l in many fonts.
Distributed denial of service (DDoS) attacks
A distributed denial of service attack, also known as a DDoS, denies service. The theory behind these attacks is they overwhelm the target system entirely, making it unusable and denying service.
Botnets
Botnets are devices used in DDoS attacks. These bot devices are connected to the internet and controlled by the attackers. In some cases, botnets have been created by exploiting devices on the internet.
TCP SYN flood attack
An SYN flood attack takes advantage of part of the TCP handshake protocol. When creating a TCP connection, the client first sends a synchronize or SYN message to the server, acknowledging the connection, aka ACKs. The client is then supposed to respond with an ACK of its own to complete the connection. In this case, the client never responds with its ACK but continues to send SYN messages instead, ultimately flooding the connection and rendering it useless.
Teardrop attack
A teardrop attack focuses on sending incomplete packets to a destination machine. The target can’t assemble the packets and is overwhelmed by the requests it can never complete.
Password attacks
Another attack vector is targeting passwords to a system. There are several different ways to accomplish this.
Brute-force password guessing
A brute force attack keeps generating passwords and attempting to access a system. It systematically keeps changing the password until the correct combination is found.
Dictionary attack
A dictionary attack is a little bit different. Instead of randomly trying to figure out the password, a dictionary attack uses a dictionary of commonly used passwords. Passwords are meant to be protected and kept private. If your password has been made public in a data breach, change it.
Zero-day exploits
A zero-day exploit is an exploit that becomes available before a vendor has a software patch ready to mitigate it. In most cases, attackers keep their exploits secret, and they are made available on “day zero” when they cannot be immediately fixed. In some cases, hackers or researchers may let a software vendor know that they have found a vulnerability before releasing it.
Man in the middle attack (MITH attack)
A man in the middle attack is when a malicious actor intercepts the communication between two entities.
Session hijacking
This method focuses on hijacking a communications session. They act as the sender or receiver and begin collecting and transmitting data as their presumed persona. If they seize a session after system access has been granted, they can gain access quickly.
Replay attack
A replay attack is when data is saved during a communication session then replayed later. If authentication happened during a dedicated session, this is another “easy” way into a system.
Why is it necessary to protect against cyberthreats?
As you can see from this list, there are many cyberthreats in today’s landscape. It is vital to protect against them, so data is not stolen or compromised, and systems remain accessible for users.
Any security incident has a cost associated with it. Some are larger, and some are smaller. One way to help determine the potential impact of data loss or a data breach is to classify your systems and data.
Top cybersecurity challenges
There are many cybersecurity challenges when it comes to protecting an organization’s data and systems. In today’s world, there are a couple that stand out.
Mobile devices are difficult to secure
First and foremost are mobile devices. These bring all sorts of threats into an environment, especially with the rise of BYOD. Besides, mobile devices may be connected to a corporate network but managed by an individual. Mobile devices are still vulnerable to common attacks like malware and phishing attacks.
Complexity of cloud environment
There has also been a rise in cloud adoption in the last several years, but cloud environments can be complex. Everyone loves the adage of how easy it is to get started with the cloud. Just grab a credit card, and you’re up and running in no time. If organizations don’t have cloud policies and procedures in place, this can quickly become a huge security risk. Additionally, organizations may not fully understand their new cloud platform and may not secure it properly. Worse, they may assume they don’t even have to worry about security anymore since they are using the cloud.
How to protect against and identify cyberthreats
There isn’t an easy answer when it comes to protecting against and identifying cyberthreats. The first step is to make sure you understand the basic types of cyberthreats out there and start thinking about them regarding how they can impact your organization.
There are a few places to get started when it comes to protecting against cyberthreats. First and foremost, is to make sure you understand the applications and data in your environment and the cost associated with downtime, data loss and data leaks.
If you have a disaster recovery plan in place, this is an excellent place to get started. After all, a cyberthreat is a type of disaster. Be sure you have a good understanding of the Business Impact Analysis (BIA) that has been done in your organization. If no BIA has been done, this is an excellent place to get started.
After you understand how much these events cost, you can begin to put together solutions to protect against them. How much an incident will cost you will significantly impact your ability to mitigate security risks in your environment.
If an incident is a low impact in terms of cost, you will probably not be making a significant investment to protect that system. Likewise, if a system is deemed mission-critical and has a high price with an incident, you will preserve that system differently.
How can you detect cybersecurity threats before they occur?
Threat detection is no easy feat, but protecting your assets before they are exploited is a great first defense line. This, of course, is not a substitute for an incident response plan, but some work upfront may be able to lessen the severity and number of actual security incidents.
Monitoring systems in your environment are crucial to detect threats before they occur or as they are occurring. It is essential to have a monitoring system that can understand your environment’s baseline and alert you appropriately to things that are out of the bounds of normal. Alert fatigue is accurate, and if the monitoring system is ignored, it won’t help you detect threats.
OWASP threat model
OWASP is the Open Web Application Security Project and a nonprofit foundation focused on software security. Getting involved with OWASP is a great way to get started on your journey to protecting your applications. OWASP also has local chapters throughout the world, making it easy to connect with like-minded individuals to solve everyday problems.
One area that OWASP can aid practitioners in is threat modeling. Threat modeling is a method of examining an application to identify potential vulnerabilities and threats that it may be susceptible to.
Best practices for cyber defense for businesses
If you’re looking to build your cyber defenses, here are some areas that you should consider taking a look at when you are coming up with your strategy for mitigating cyberthreats in your environment. Now that you know more about the cyberthreat arena, you may have a better idea of prioritizing the following cyber defense mechanisms in your environment.
User education and awareness
Users are one of the most significant weaknesses in coming up with a cyber defense strategy, as we can see by the threat landscape. Investing in programs to aid user education and awareness will never be wasted funds. Many organizations often overlook this area since it can be harder to measure and is less tangible than other defense mechanisms.
Network Security
The network is, of course, another central focal point for hackers, as you can see by many types of threats. Investing in network security is a great way to get started in ensuring you can mitigate these threats. A strong network is an excellent defense against hackers. Penetration testing is a must when it comes to figuring out the weaknesses in your network, and it is often best done by a neutral third party. Sometimes we can be blinded to faults when we’re used to seeing the same networks and systems.
Malware prevention
Preventing malware is a great way to protect your assets. This, of course, ties back to user awareness and training, but software tools can help you prevent malware from getting into your network. Think basics like ensuring all endpoints have antivirus and antimalware software installed on them and more advanced systems to help stop malware in its tracks.
Removable media controls (3-2-1 Rule)
In the backup world, we like to talk about the 3-2-1 Rule to help protect data (LINK INTERNALLY). Stated, the 3-2-1 Rule means you should have 3 copies of your data on 2 different media types, with 1 being off site. This helps protect you if your primary data (or even your primary site) is compromised.
Secure configuration
There are so many different software pieces that make a business run, not to mention software that controls hardware! In all cases, your software or hardware vendor likely has something they call a hardening guide or a list of secure configuration best practices. It is always a good idea to make sure your components are configured with security in mind.
Managing user privileges
Since we know our users are often the target of so many cyberthreats, it is essential to manage user privileges. You may have also heard of the principle of least privilege. This means that we need to ensure that our users ONLY have the permissions they need to perform their essential job functions, nothing more, and no privileges that are just nice to have. There should always be a business driver for granting users additional rights.
Incident management
Unfortunately, it isn’t if you have a cyber incident in your environment, but when you have a cyber incident. That is why it is so important to have cyber incident management processes in place so that crucial personnel know precisely what to do in the case of an incident. At the core of incident management are quick responses designed to mitigate risk and damage.
Monitoring
Be sure you’re monitoring your environment, from your network to your servers to even your backup environment. A sound monitoring system can help you determine if a cyber incident has already started or will occur. For example, suppose you’re monitoring backups (INTERNAL LINK TO VEEAM ONE) and see they are suddenly larger and taking longer than expected. In that case, that could be a sign that ransomware is beginning to encrypt your data.
Home and mobile working
It is imperative to have policies on home and mobile working since so many are taking advantage of technology advances. Be sure to have a clear policy on what activities are allowed on corporate devices, even at home. Furthermore, if you have a BYOD policy, make sure there are controls to protect their systems from malware.
Review your processes
Last but not least is to periodically review the processes and policies you have in place regarding cyberthreats. The threat landscape is rapidly changing, and it is essential to make sure you can switch to protect against these threats quickly.
Summary
What are different types of security threats?
There are different types of security threats like malware, insider threats, or unauthorized access to data. To protect against them you can use security policies, antivirus software, firewalls, intrusion detection systems, and endpoint protection.
What are the three types of cybersecurity threats?
There are three types of cyber security threats that businesses may face: Information security, physical security and virtual security. Information security threats are the ones that involve the theft of information or data. Examples of this type of threat include malware, viruses, data loss and phishing. Physical security threats involve theft, loss or destruction of physical assets. Examples of this type of threat include theft, robbery, fire, vandalism and natural disasters. Virtual ecurity threats are the ones that involve theft or loss of virtual assets. Examples of this type of threat include malware, viruses and unauthorized intrusion.
What are the main cyberthreats of 2021?
The main cyber threats of 2021 are:
- Data encryption
- Cloud and SaaS
- Mobile Devices
Fortifying Network Security: Unveiling the Benefits of 802.1X Authentication
In the ever-evolving landscape of network security, organizations are continuously seeking robust solutions to safeguard their sensitive data and digital assets. One such powerhouse in the realm of network authentication is 802.1X, a protocol that has proven to be a game-changer. In this blog post, we’ll delve into the benefits of 802.1X authentication and how it elevates network security to new heights.
As organizations grapple with the ever-present challenges of securing their networks, 802.1X authentication emerges as a cornerstone in the defense against unauthorized access and potential security breaches. From enhanced access control to dynamic VLAN assignment and centralized management, the benefits of 802.1X authentication extend across wired and wireless networks. By adopting this powerful authentication protocol, organizations can fortify their network security posture and navigate the evolving landscape of cybersecurity with confidence.
Unlocking Success with IT Managed Services: Elevate Your Business Through Strategic Partnership
In today’s fast-paced and ever-evolving business landscape, organizations are turning to innovative solutions to stay ahead of the curve. One such transformative approach is embracing Managed Services—a strategic partnership that not only streamlines operations but also catapults businesses into a realm of efficiency and scalability. In this blog post, we’ll explore the myriad benefits of Managed Services and how they can be a game-changer for businesses of all sizes.
In a competitive business landscape, the adoption of Managed Services is more than a trend; it’s a strategic imperative. By partnering with a Managed Services provider, businesses can unlock a myriad of benefits—from cost-efficiency and scalability to enhanced security and strategic IT planning. Embracing Managed Services is not just an investment in technology; it’s an investment in the future success and resilience of your business.
Securing the Virtual Office: Navigating IT Security Challenges in Remote Work Environments
The global shift towards remote work has brought unprecedented flexibility and efficiency to the modern workplace. However, as organizations embrace this new paradigm, the need for robust IT security measures becomes more critical than ever. In this blog post, we’ll delve into the realm of remote work and explore the unique IT security challenges it poses, along with practical strategies to fortify the virtual office against cyber threats.
Remote work is here to stay, and as organizations adapt to this new normal, prioritizing IT security is non-negotiable. By addressing the unique challenges posed by remote work environments, implementing robust security measures, and fostering a culture of cybersecurity awareness, organizations can create a virtual office that is not only productive but also resilient against the evolving landscape of cyber threats. As we navigate the future of work, securing the virtual office remains a shared responsibility that requires ongoing vigilance and strategic planning from IT professionals and employees alike.
Windows Defender ATP: Elevating IT Security to New Heights
In the complex and ever-evolving landscape of IT security, organizations face an escalating array of sophisticated cyber threats. Addressing these challenges requires a comprehensive and advanced approach, and Windows Defender Advanced Threat Protection (ATP) emerges as a powerful solution. In this blog post, we’ll explore Windows Defender ATP from an IT perspective, understanding its key features, benefits, and the pivotal role it plays in enhancing the security posture of modern enterprises.
Windows Defender ATP stands as a cutting-edge solution for IT professionals seeking to fortify their organization’s defenses against advanced cyber threats. With its comprehensive endpoint detection and response capabilities, cloud-powered security analytics, and seamless integrations, Windows Defender ATP empowers IT teams to proactively identify, investigate, and respond to security incidents. As the threat landscape continues to evolve, Windows Defender ATP remains at the forefront of innovation, offering a robust and intelligent security platform for modern enterprises.
AI Revolution: Transforming the Present and Shaping the Future
Artificial Intelligence (AI) is no longer confined to the realms of science fiction; it has become an integral part of our daily lives, revolutionizing the way we live, work, and interact with the world. In this blog post, we will explore the fascinating landscape of AI, its current applications, and the potential it holds for shaping the future.
Artificial Intelligence is not just a technological trend but a transformative force reshaping the world as we know it. Embracing the opportunities while addressing the challenges is key to harnessing the full potential of AI. As we navigate this AI revolution, a thoughtful and ethical approach will pave the way for a future where human intelligence and artificial intelligence coexist harmoniously, driving progress and innovation.
Veeam – 2021 Cybersecurity Threats
I found this article to be very good at simplifying the current Cybersecurity Challenges IT faces today.
What Is a Cybersecurity Threat? (veeam.com) by Melissa Palmer
Veeam Cloud Tier
Data is growing faster and is more important than ever! All organization are experiencing explosive data growth and it’s becoming more and more apparent that the data being generated and protected is critical. Company viability is jeopardized when data is at risk and without secure and protected access to critical data, organizations face potential collapse. While the threat of a malicious attack against organizational data is not new, the methods and vectors of attack have evolved, and attacks have drastically increased in recent years.
Attacks on your data are at an all-time high! Ransomware is more powerful than ever, and corporations face an increased number of malicious attacks including both external and internal threats due to the era of connected platforms. The threat to data is real, and as part of an overall data management strategy leveraging new technologies is critical to protecting that data and ensuring that organizations are protected from malicious intent where data is either permanently deleted or held for ransom.
The storage landscape has fundamentally changed with Object Storage. With the release of Veeam Backup & Replication 9.5 Update 4 in 2019, we introduced the Veeam Cloud Tier which enabled customers to take advantage of Object Storage. Due to its increasing popularity, infinite scale-out capacity and lower cost for long term retention, Object Storage offers many advantages over traditional block and file-based storage systems. With regards to increasing amounts of backup data, and requirements to keep that data for longer periods of time, Object Storage is a perfect fit. Veeam has witnessed an overwhelming adoption of Object Storage with over 100PB of data offloaded to just a few top cloud object storage providers alone, despite the fact that in Update 4, the Cloud Tier was only capable of offloading older data to help to reduce the costs of long-term archival. This was just step 1, and now v10 brings more!
Introducing the next iteration of Veeam Cloud Tier in v10
With the launch of Veeam Backup & Replication v10 we have made drastic improvements. In v10, the Cloud Tier feature set has been extended to include three distinct, but very interconnected customer needs:
Let’s dive into each of these customer needs further.
Copy Policy: Makes 3-2-1 easier than ever
Building on the “Move Policy” in Update 4, Copy Policy allows backup data to be instantly copied to the SOBR Capacity Tier as it’s created. This is an important distinction from what Move Policy does, where there is only ever one copy of the data sitting either in Performance Tier or Capacity Tier, which can leave recent restore points within the Operational Restore Window at risk in the case of disaster or malicious intent.
With Copy Policy enabled on a SOBR, all backup files that are created are effectively duplicated as soon as they are created to the Capacity Tier. This allows us to adhere to the 3-2-1 rule (3 copies of backup, on 2 different media, with 1 offsite) of backup that requires one independent copy of data offsite. In fact, when using cloud object storage, it allows customers to much more easily achieve 3-2-1, by being 1 of the copies, on a different media AND in a different location. It’s a 3-2-1 rule slam dunk!
When used together, both Move and Copy policies complement each other perfectly to fully take advantage of object storage by keeping the local landing zone for quicker operational restore easier to manage from a data growth and capacity planning point of view. Copy mode then ensures that, in the case of disaster, there is a full copy of backup restore points available for recovery.
Ok, 3-2-1 is achieved faster and easier than ever. Check! Now, are you fully protected and 100% safe? Not yet. What about ransomware, hackers or malicious insiders?
Immutability – Your solution for ultimate protection.
Protection against malicious intent or accidental deletion of backup data has become critical in anyone’s data protection strategy– and with immutable backup functionality for Amazon S3 and S3-compatible object storage repositories, data that is shifted or copied into the Capacity Tier is further protected. This feature relies on the S3 API to set a period of time on each block of data uploaded to Object Storage where it cannot be modified or deleted by anybody. Yes, we mean anybody: intruders, malicious actors, accidental deletion by admins and more.
This effectively works to protect all recent (and generally most important) backup points until the set period has expired. And even having the highest-possible privileges on an AWS account does not provide you the ability to delete or modify the data, period.
As mentioned, immutable backups is a feature available for Amazon S3 and a variety of S3-compatible object storage providers including Ceph, Cloudian, Zadara and more. Check out the latest approved Veeam Ready “object” providers here for the latest and expect many more to come soon.
Now ransomware and inside threats are under control, but what if I lose the datacenter completely? We have a solution there too.
Enhanced Recoverability with Simplified Backup Import
The resiliency built into the Cloud Tier is such that if you totally lost your on-premises installation of Veeam Backup & Replication, you would be able to restore from data that was copied or moved into the object storage. This was true in the Update 4 release, but we have further improved the convenience and speed in which this data back be accessed after a disaster scenario has been triggered with the new Mount Object Storage Repository feature in v10.
With this feature, content in an existing object storage repository can be registered in a newly provisioned backup server (even running on a laptop and using Community Edition), and you can have the existing backup data points made available for restore operations in no time, including restores directly to the public cloud or instant recovery back to on-prem.
Unlike with the previous version, you no longer need to re-create and re-scan SOBR, because we make restore points available directly from the object storage by quickly downloading a very small amount of metadata during the most familiar Import Backup process. In other words, you can now import backups from object storage as quickly and easily as from local storage. How cool is that?
Conclusion
With these innovative additions to Veeam Cloud Tier, the abilities for customers to do off-site backup faster, store data for longer periods at lower costs, achieve 3-2-1 , and to recover quickly from a potential malicious attack or disaster scenario have been greatly enhanced. Not only are we now able to copy backups offsite for redundancy and longer term retention on object storage, but we are able to also have that data immutable, and easily recoverable with the new Import feature, leading to much lower RTOs.
This article was provided by our service partner : Veeam
5 Cybersecurity Tips for Better 2020 Protection
You couldn’t go a day in 2019 without hearing about another cybercriminal hitting a business or city, and 2020 will be more of the same. You’ve probably even had your fair share of conversations with your customers about what you’re doing to keep them and their data secure. It’s better to have the tough talks now and get a plan in place than try to make excuses for your lack of protection if your customers get hit. So, let’s get ready for 2020 together with these cybersecurity tips. Learn how incident response services can benefit and improve your business strategy.
1. Pay Attention to the Security Around APIs
Cybercriminals and their tactics are evolving and will continue to evolve. With new advancements in technology, attacks will go beyond the normal threat vectors. You can see Nettitude online for cybersecurity assistance
“There are still plenty of attack surfaces today in your traditional Windows® domain environments,” says Jon Murchison, CEO of Blackpoint Cyber. “As the shift starts to the cloud and as we open more APIs for automation, I think you’re going to see API-based attacks increase massively. Vendors need to pay attention as they open more of these things up, they’ll be turned against them.”
While the cloud and automation have made life easier for managed service providers (MSPs) and their customers, they also present an opportunity for cybercriminals to use that convenience against unsuspecting victims. When you’re looking at your security for 2020, you need to be aware of all the entry points into your network and your customers’ environments, which leads us to our next tip: enabling multi-factor authentication (MFA).
2. Enable MFA on Everything
Although it may seem like a minor inconvenience for end users, MFA is a small security measure that can have a significant impact on making sure the right people have access to networks and applications. MFA, or two-factor authentication (2FA), is an added layer of security that requires a user to present a second form of authentication, typically a code sent to an email or text after the user enters their account login information. Once the user enters the code, they’ll gain access to the account.
Like all things, MFA is only successful if you use it correctly. Having it enabled on just a few accounts defeats the purpose of implementing it to begin with.
“We’re seeing a breakdown of proper configuration and management of MFA,” says Drew Sanford, Director of Sales Engineering at Continuum. “If you’re managing remote systems or administering user access, you should be using MFA, but you need to be using it for all accounts, especially the MFA systems themselves.” That’s right. Secure the security measures.
“Nothing is worse than protecting your systems with MFA just to find the hacker was able to log in and reset your Google, LastPass, or other accounts,” Drew says
3. Have the Right Resources
There has been a talent gap across the industry for the past few years, and cybersecurity is no different. It’s a job-seeker’s market, with unemployment for cybersecurity professionals close to zero percent. That makes finding talent hard and keeping it even harder. Skilled professionals will demand top dollar for their expertise.
The hiring crunch trickles down to the quality of services. According to research from Continuum, 37% of MSPs say they aren’t able to obtain the right level of in-house cybersecurity skills. Without the right skill sets, your security team might not be able to meet the demands of your customers and leave them vulnerable to a security incident.
When it comes time to start providing security services, if you haven’t started already, you’ll need to decide whether to build your security offerings on your own, buy an established security company, or partner with a security vendor. There are pros and cons to each option, and there is no ‘one-size-fits-all’ approach. Your security requirements are unique to your business, so it’s crucial to pick the strategy that works for you—and getting it right can help you stand out from the competition.
According to Continuum’s white paper, Underserved and Unprepared: The State of SMB Cybersecurity in 2019, cybersecurity is becoming a determining factor for SMBs deciding to use or continue using an MSP. How much so? 84% of SMBs surveyed who do not currently use an MSP would consider using one if they offered the right security services.
4. Protect Your House
This has become one of our more popular cybersecurity calls to action, but it’s not just a saying, it’s an integral part of running your business. When you protect your house, you’re ensuring you have the proper security controls and procedures in place across your organization. Yes, you’ll be more secure, but you’ll also be showing current and potential customers that you’re committed to security.
You build trust with an SMB when you show them you not only take proper security precautions, but the solutions you use internally are the ones you’re selling them. Your security offerings are tried and tested. This could be the thing that separates you from the competition.
5. Take Advantage of the TSP-ISAO
According to the Department of Homeland Security, threat actors are exploiting the trusted relationship between technology solution providers (TSPs) and their customers to creep unnoticed into customers’ networks. In October 2019, ConnectWise announced the creation of the Technology Solution Provider Information Sharing and Analysis Organization (TSP-ISAO).
The TSP-ISAO is an independent organization formed to provide a secure infrastructure within the TSP industry to set the standard for TSPs in the services and products they provide to their clients, as well as the people, processes, and tools they employ.
“We believe that the TSP-ISAO has an important role to play in educating MSPs and SMBs to the existential nature of the threats they face. Both MSP and SMB industries have never faced a threat like this and are collectively unprepared to understand the true nature of the threat. Working with our public and private partners, we will develop programming to ensure the threat is understood and countered,” said TSP-ISAO Executive Director, MJ Shoer.
This article was provided by our service partner : connectwise.com
Best Practices for Optimizing Patch Management with RMM Software
Patching—the act of updating, fixing, or improving a computer program—is an important part of maintaining your clients’ systems against viruses and hacks. The majority of MSPs do this through remote monitoring and management (RMM) tools. But no matter how well your RMM software can fix a bug or close a vulnerability, if you don’t follow the right patching policies and procedures, you may end up putting those same clients at a higher risk of security breaches.
According to the Ponemon Institute, 57% of data breaches can be directly attributed to attackers exploiting a known vulnerability that hadn’t been patched. That’s a real problem. And patching doesn’t just improve system security—it facilitates overall smooth processing, ensuring that there are no bugs slowing down your (or your clients’) day-to-day operations.
Clearly, regular patching is important—but how can you make it a seamless part of your workflow? To help you out, here are some best practices to follow as you use RMM tools to perfect your patching processes—and reasons why they’ll help you, your technicians, and your clients.
Make Patching a Priority—and Ensure Your RMM Tools Facilitate That
In 2018 alone, there were upwards of 15,500 published common vulnerabilities and exposures (CVEs). And as technology increases in complexity and sophistication, these numbers will only continue to multiply. Keeping up is a challenge for businesses and their IT service providers—especially those that may continue to rely on manual patching processes rather than their RMM software.
In addition to managing the sheer volume of vulnerabilities cropping up each day, the actual patching process can drain time, resources, and disrupt the end-user experience. That’s why any RMM software comparison should take into account the ability to use these tools to streamline and simplify patch management. With the right RMM tools, it’s much easier to work regular patching into your workflow and to ensure your whole team is equipped to make it a priority.
Follow a Simple Framework Built Around Your RMM Software
When it comes to patching, there’s no need to reinvent the wheel. Aligning on well-established procedures or protocols for patch management works fine—applying them consistently is the key. For a strong start, select a simple and repeatable process to use as a guide. The entirety of this basic workflow framework can be performed with RMM tools:
This framework should provide a good jumping-off point. Build on it to customize the process to your specific team, organization, and RMM software.
Always Watch the Clock
A central challenge facing managed services providers (MSPs) is that once a vulnerability is officially announced, all information about it is disclosed along with it—giving hackers all of the information they need and a wide-open window to target and further exploit the vulnerability across your clients’ systems. The chances of exploitation and infection increase the longer an organization waits to apply the patch. At the same time, hackers and other cyberattackers are becoming increasingly quick to attack, giving organizations less and less time to patch.
Being cognizant of every disclosure and using your RMM tools to stay on top of each alert is critical. Even a few hours can make all the difference.
Integrate Patching Tools with Your RMM Software
With multiple vulnerabilities to remedy in little time, you want to implement as many tools as possible, as quickly as possible. Rather than having your technicians spend most of their time approving and applying patches to disparate machines, you can implement an integrated RMM tool like ConnectWise Automate, to alert you and handle much of the heavy lifting.
With the right RMM tools and increased automation capabilities, your technicians spend less time on tedious manual patching tasks and you reduce the likelihood of human error or important updates slipping under the radar.
Consider Third-Party Patching
Cloud-based, automated patch management software allows you to schedule regular update scans and ensures patches are applied under specific conditions. As you take on new clients, the software gains even greater value, enabling you to remain on top of patching while your business continues to grow.
Third-party patching is a native component of ConnectWise Automate, simplifying and securing the entire patch management workflow. The platform enables application updates, along with a host of other automatic capabilities—including automated billing through the professional services automation (PSA) software you already have with ConnectWise Manage
As you audit, patch, document, and bill for third-party application updates, all third-party patch definitions are deployed following our best practices. Automatic daily updates and downloads ensure that you’re always patching with up-to-the-minute technology. And as you streamline patch management for you and your clients, you gain recurring monthly revenue streams.
Generate Regular Reports
It’s important to make patching and staying on top of every client relationship a priority. With streamlined automated regular reporting you have a simple and effective solution right in your hands.
This article was provided by our service partner : connectwise.com
DNS over HTTPS – What You Need to Know about Content Filtering
In September, Mozilla announced its plans to implement the DNS-over-HTTPS (DoH) protocol by default in the Firefox browser. Subsequently, Google announced its intention to do the same for the Chrome browser. Firefox has already started to gradually shift to DOH. Chrome is expected to start shifting some traffic by the end of the year.
What is DoH?
DNS stands for Domain Name System; it’s the system for matching the domain names to IP addresses, this obviously makes it easier for us to browse the internet by name rather than having to remember IP addresses. Until now, all of that has happened via an unencrypted DNS connection. As the name DNS over HTTPs implies, DoH takes DNS and shifts it to a secure, encrypted HTTPs connection.
What is http/https?
http is a system used where a browser make a GET request to a server, then server then sends a response, typically a file containing HTML. Of course, the browser usually does not have a direct connection to the server so this request with have to pass through multiple hands before it gets to the server, the response is dealt with in the same way.
The problem with this is that anyone along the path can open the request or response and read it. There is no way of knowing what path this traffic will take so it could end up in the hands of people who do harmful things such as sharing the data or even changing it.
HTTPS fix this poor state of affairs, with https – each request/response has a lock on it. Only thye browser and the server know the combination of that lock meaning only the browser and the server can read the contents of this data.
This solves a lot of security issues, but there are still some communications happening between the browser and server that were not encrypted, this means people could pry on what you are doing. One of the places were this type of communication was exposed is in DNS. In steps DoH which works on the same idea described above to prevent tampering and eaves-dropping.
By using HTTPS to exchange the DNS packets, we ensure that no one can spy on the DNS requests that our users are making.
Mozilla and Google are making these changes to bring the security and privacy benefits of HTTPS to DNS traffic. All those warnings about the security risks of public WiFi? With DoH, you’re protected against other WiFi users seeing what websites you visit because your activity would be encrypted. DoH can also add protection against spoofing and pharming attacks and can prevent your network service providers from seeing your web activity.
Privacy vs. content filtering: a conundrum
So far, so good – we have underlined the possible privacy benefits of DoH but could there be a problem on the horizon for schools and organisations that use DNS based content filtering?
DNS-based content filtering is so prevalent that almost every parental control device (whether its installed on your network or via some type of web service) uses it. If DNS queries are now encrypted before passing through these products, they could see cease to work.
This could see broader DoH adoption by web browser disrupting existing content filtering implementations.
DNS-based filtering still possible
Since the DNS queries are only encrypted when they go beyond the router, DNS-based threat intelligence and parental control functionality can still work. For example, if someone accidentally stumbles on an adult website, the router will intercept his DNS queries and show him your custom message instead. It’ll also encrypt the rest of his innocuous queries so that people outside of your network won’t be able to exploit his browsing history.
Next steps?
You need to confirm that your existing content filtering will work when browsers start support DoH by default.