by Felicien | Jul 31, 2019 | Education
You Can’t Get Away With Skimping on Technology
Is your IT a driving force for innovation, or simply being used to keep the lights on? Companies must fully leverage technology to compete — and win — in the future.
What does your company make or do? Chances are, the answer won’t be “technology”, but do you still have a tech slant to your business products, services and operations? Companies today can’t get away with simply saying “We’re not a tech company”, and shuffling off innovation. Technology is one of the most important tools that your business has to help bypass competitors and make a difference in the world. Investments in technology continue to rise, making many seniors executives question whether this trend of IT spending can continue — and whether it’s truly adding value to the organization. As a business leader, it’s crucial that you’re able to articulate what happens when you attempt to skimp on providing the necessary tech for your business.
Why is Technology Important in Business?
It may feel silly to even ask this question, but there are still people who struggle to see the fit for their business. Maintaining the status quo worked for generations, why is there a need to change and evolve? Operations are tightly integrated into technology, so every time your organization interfaces with another there’s a high probability that you will need some sort of technology solution. Your business technology handles everything from the way your customer service representatives answer the phone to routing orders and shipping products from your various facilities. The infrastructure that undergirds your business is an intrinsic part of your ability to thrive in today’s competitive marketplace. Simple solutions may miss the mark, costing you significantly more than expected in terms of remediation or hiring additional contractors to resolve any issues. Finding the right partner can make the difference between a well-scoped and successful project and one that runs significantly over-time and over-budget.
The Rising Cost of Technology Downtime
With the addition of more tech to your business, there’s always the potential for downtime and outages — something that is both increasingly familiar and increasingly expensive for your business. A study by AppDynamics examined the true cost of downtime and the failure of infrastructure, as a way to introduce the importance of DevOps cycling. This study showed that Fortune 1000 organizations are spending upwards of $1.25 – $2.5 billion on downtime each year, with the average hourly rate for downtime at $100,000. While this could be scaled down dramatically for a smaller organization, the scale of the impact is every bit as great. While downtime is something that is nearly inevitable, it can be minimized by creating a secure and redundant infrastructure that helps protect your organization in the event of a cybersecurity incident or other event.
Dire Results of Skimping on Technology
It’s not an overstatement to say that skimping on your cybersecurity or infrastructure technology could cost you your business. More than 60% of small businesses cease to exist within 6 months of a data breach, a sobering fact to say the least. These cybercriminals are targeting major enterprises, but these are the high-profile attacks that you see in the news. The more common M.O. for a hacker is to target small to mid-size businesses, as there’s the perception that these organizations are not as proactive about putting together proactive cybersecurity as their larger brethren.
While security is important, the overall experience of your customers is often the most critical measure of success for an organization. When there are competitors around every corner, your business must be able to differentiate in a way that provides unique value to your customers. That often comes in terms of superior customer service or more intuitive websites and interactions. Shoppers are often willing to pay 15-20% more for a better and more personalized experience, which offers even greater value back to your business. With an investment in your infrastructure, you’re not only improving your operational efficiency but also providing a more secure and robust platform with which your customers can interact. Customer experience may feel like a buzzword that is used by management gurus, but it’s a real concept for your customers.Reducing operational steps, driving efficiency back into your business and creating a truly customer-focused organization doesn’t always come cheap. When you reduce the quality of your operational infrastructure and technology support, you could be negatively impacting the future worth of your business — not to mention alienating the all-important customer.
by Felicien | Jul 31, 2019 | Education
Why Every Business Should Invest in Cybersecurity
Cyber security is essential to businesses of all sizes. Learn how to keep your business up to date and protected from the most common digital threats.
Cybersecurity is no longer a concern exclusive to large corporations. Since the infamous attacks on Equifax, Target, and Apple, cybercriminals have started to shift their focus towards smaller businesses. Without proper security protocols, small businesses are sitting ducks even for novice hackers.
In recent years, the cost of data theft targeting small and medium-sized businesses (SMBs) has risen significantly. The Ponemon Institute reports a 17% increase in the average cost of theft and damages, and a 26% increase in the average cost of disruption to operations. The threat has prompted many SMBs to invest more heavily in third-party data security services.
Cybersecurity in a Continuously Evolving Digital Space
Ever-evolving technology makes the world more connected, but also makes data more vulnerable to attackers. Gone are the days when an antivirus, firewall, and email filter were enough to earn a passing cybersecurity grade. As criminals refine and improve their methods of attack, businesses and IT professionals must step up their defenses.
The most recent trend in cyberattacks is a shift towards SMBs, many of which lack the breadth and depth of data security that larger corporations are likely to have. Illicit tactics such as email phishing, direct hacking, and installing ransomware can spell big trouble for SMBs. If your data is compromised, the results can extend to your customers and other members of your supply chain.
Consequences of a Data Breach
The fallout from a data breach depends on the scale of the attack and the value of the data stolen. Hackers may be able to seize control of accounts, drain funds, freeze assets, and access sensitive customer information. If you operate in the healthcare or financial sectors, you may be liable to pay reparations in addition to suffering the cost of stolen capital and the inability to continue operations. The cost of a large-scale data breach can devastate even the wealthiest of corporations, and will most certainly overwhelm a small business.
How to Improve Cybersecurity
A common misconception is that only large corporations can afford effective cybersecurity. In most cases, implementing cybersecurity isn’t merely a matter of money, but of proper training and awareness. A Ponemon Institute study linked 54 percent of data breaches to employee or contractor negligence. This includes email phishing, which is often the first step attackers use to conduct large scale theft of usernames, passwords, and other sensitive data.
Educating and training your employees on cybersecurity minimizes the risk of data theft at the point of contact. Your business should have protocols to identify signs of phishing, choose secure passwords, and grant or deny access to information. You can also inform your customers about how to keep their information secure. Taking this two-pronged approach shows customers how committed you are to keeping their data safe.
Being proactive and spreading the word on cybersecurity threats will help you protect your business from hackers. Whether you’re a multinational corporation or a two-person mom-and-pop shop, your customers rely on you to safeguard their data. Implementing the latest security practices lets them know that you value their trust.
by Felicien | Jul 31, 2019 | Education
What Is the Dark Web and How Can You Stay Off It?
Ever heard of the dark web? It’s definitely not a place you want your company’s information to be. Learn everything you need to know about the dark web here.
Most people have heard about the dark web in one form or another. It’s a place where criminal activity happens — from the purchase of illegal drugs to the hiring of assassins.
Of course, there is a legal side to the dark web as well; though, most people don’t know about. In fact, the origin story of the dark web is entirely legitimate and is even linked to the government.
Still, as a business owner or CEO, your relationship with the dark web (should you unfortunately have one) will not likely be good. It’s a bad sign if any of your information is found there. That’s why it’s important to know about what exactly the dark web is: Where it came from, what’s on it, and what you should do to stay as far away from it as possible.
What Is the Dark Web?
The dark web is essentially one “section” of the Internet. Specifically, it’s a section that isn’t included in mainstream search engines like Google. So, when you search a normal search inquiry, such as, “Where’s the best hamburger joint in downtown Pittsburgh?” you don’t get results from the dark web.
Instead, this section includes all sorts of illicit goings-on. Mostly, it’s a marketplace for things you shouldn’t be buying because they’re illegal to sell and/or buy. For instance, you can buy lifelong access to Netflix for a small price (six bucks). You can hire someone to hack into someone else’s computer for you and download their data or track their keystrokes. You can purchase credit card credentials. You can obtain prepaid debit card numbers and security codes.
How Does One Access the Dark Web?
We’ll reiterate again that the dark web is not a place you want to find yourself (or your information). However, for the sake of knowledge, we’ll explain that in order to access the dark web, you must download what’s called the Tor browser.
Tor stands for The Onion Router. This is basically the software that makes the dark web operate in the dark.
Where Did the Dark Web Originate?
The dark web began in the late 1990s as a way for the United States Naval Research Laboratory (NRL) to better hide their online communications. At this time, The Onion Router or Tor was brand-new.
Soon after its initial creation in 2004, the dark web’s Tor software was released for public use. Since that time, it has ceased to be solely a government resource and has turned into the “back alley” of the Internet.
How Can the Dark Web Affect Business Owners?
The dark web is a potential danger to all businesses of all sizes and in all industries. In fact, it can be a potential danger to individuals as well. But let’s talk about your business and the dark web.
Basically, it has been found that 60% of the web listings on the dark web could harm a business. That’s because, these listings offer individuals searching the dark web ways to obtain things like the following:
Customer data
Tips for hacking computers
Tips for hacking networks
Malware
Financial data
Phishing advice
Operational data
Intellectual trade secrets
Tutorials for cyber crime
Remote access Trojans (RATs)
Espionage services
Credentials access
How Can You Keep Your Business Safe From the Dark Web?
The best way to keep your business safe from the dark web is to have the proper cybersecurity measures in place. This means hiring a cybersecurity team or a managed service provider (MSP) to handle your company’s cybersecurity. Even if you’re a small business, hiring an MSP to have on retainer is a good idea.
They will make sure that you have firewalls and other detectors of malware in place for adequate security. It’s also essential to back up your data and to make everyone who works for or with your company aware of how to avoid phishing attempts.
Lastly, your cybersecurity team should be monitoring the dark web to make sure that none of your information lands there. This goes for personal information for you and your employees, as well as overall company information. Taking these measures is the only surefire way to ensure that your company does not end up on the wrong end of the dark web.
by Felicien | Jul 31, 2019 | Education
How familiar are you with all of the types of cyber attacks your company can become a victim of?
The list of companies who have faced a cyber attack recently is long and growing longer. Equifax, British Airways, Cathay Pacific to name just a few. In 2018 alone, the Ponemon Institute measured the costs of these data breaches at $3.86 million per incident globally. Recently, a cybersecurity trends discussion for 2019 with Check Point stated that it would be another year of hard-hitting cybersecurity attacks and breaches.
Security companies such as Check Point, a multinational provider of combined hardware and software products for security, is based in Israel. And they are searching for new ways to better secure IT. Their global chief of threat detection, Orli Gan, states that the solution will come from manufacturers, law enforcement and government, not from companies like Check Point. The cybersecurity company predicts that every company will become a victim of a cyber attack in 2019.
Gan stated to Verdict: “You can just choose whatever name you want, any company in the world and they either were, or are, or will be hit by a cyber attack.”
Fastest Growing Crime is Cyber Crime
When comparing cybercrime in 2019 to the popular heist film series Ocean’s 11, Gan stated that cybercrime is far more lucrative and less risky way to make money than a heist. Cyber attacks come in two formats:
Attacks that are to make money
Attacks to make a point (hacktivism)
When the cyber attacks are instigated by nation-states, they are morally ambiguous. It’s hard to know who is the good guy or bad guy.
Cyber Attacks by Nation-States
September 2018 – Check Point discovered an Iranian state-sponsored mobile surveillance operation against Iran’s own citizens called “Domestic Kitten.” Iran claimed that the attack was begun in 2016 and was using decoy content to get people to download mobile apps with embedded spyware. Those apps then collected sensitive information about targeted citizens including Kurdish, Turkish and ISIS supporters.
Lazarus, North Korean cyber hackers, are also politically motivated. In September 2018, a report showed that its worldwide attacks on U.S. and South Korean websites including Sony looked to be funded by the Kim Jong-Un regime.
2016 Election hacking in the U.S. from Russia caused concerns for democracy in several countries.
In October 2018, the UK government reported that Russian military intelligence was the actor behind a string of cyberattacks.
As a result, cybercrime experts advised to strengthen cybersecurity capabilities instead of using political sanctions. Despite warnings, it looks as if Russia will attempt cyberattacks in 2019 and 2020 elections.
Cryptomining Overtaking Ransomware
Routine, day-to-day cyber attacks are designed to earn money for the cyber criminals. This is becoming more used than ransomware which was bigger in 2017. One virus, WannaCry ransomware virus, infected computers in businesses, hospitals and schools in 150 countries.
“We see a quite steady decline in 2018 in the use of ransomware. It’s definitely not gone but it’s slightly more targeted these days towards companies that are more likely to pay significant amounts of money for the data they stand to lose,” Gan reported.
Instead, cryptomining is on the rise into 2019. This malware allows cyber criminals to hijack the victim’s central processing unit (CPU) to mine crypto currency, using up to as much as 65 percent of the CPU’s power. This type of attack was the leading attack in 2018, with 42 percent of global organisations hit between January and September, over double the 20.5 percent hit in the second half of 2017. The opposite of a ransomware attack, cryptomining is a stealth crime as it’s perceived by victims. Criminals like it more than ransomware, because it’s easy to begin, hard to trace, and has a long-term earning potential.
Crypto Currency Monero
The top three most common malwares seen in 2018 were crypto miners mining the Monero currency, says Check Point. Monero is preferred over Bitcoin because unlike the more well-known cryptocurrency, Monero is effectively untraceable and can use typical computer hardware very effectively for mining, while Bitcoin requires custom-made and optimised chips.
The cryptocurrency Monero has privacy features that cloak its transactions. When someone sends you Monero, you can’t tell who sent it. If you send Monero the recipient will not know who it is from. Bitcoin isn’t anonymous; people can trace every Bitcoin block, address and transaction. Bitcoin is not truly anonymous, so people can search for and trace every Bitcoin block, transaction and address.
Phishing in 2019
Phishing, one of the most common online fraud tactics, can easily get ahold of private information including credit card details, usernames, and passwords through email. In the third quarter of 2018, RSA detected 38,196 fraud attacks worldwide including phishing scams. Even with an awareness of phishing, many people still fall for these fraudulent attacks to get personal information. These crimes increase during the holiday season when many people are online shopping, especially Black Friday (Friday after American Thanksgiving) and Cyber Monday (Monday after American Thanksgiving). Without the proper malware attachments, these phishing emails often slip through other cyber defences. In fact, cyber security company Agari found that 54 percent of email phishing attacks use a well-known brand’s name to deceive recipients including Amazon, Microsoft, and Bank of America.
How Can an Organisation Protect Itself?
If you own or work for a company looking to protect itself, there isn’t a single approach that will guarantee success.
“You have to understand the complexity of the problem, you have to address the different angles in different capacities, and you always have to have multiple advisories and engines that combined can give you that accuracy that you require from a product that you’re actually going to use. Accuracy is number one in order to be practical because when you’re not, the reality is that people in the organisation will start getting angry – ‘I needed that email but it was blocked by your security system,” according to Gan.
Can We Win the War Against Cyber Crime?
In summary, With the rapid development of technology, that question is difficult to answer. Check Point is skeptical that cyber security can eradicate cyber crime. Gan states that the solution should be a three-part defence that involves government regulation, law enforcement, and manufacturers. We must regulate manufacturers of electronic devices to require them to use operators that comply with security requirements. And law enforcement has to hunt down and punish cyber criminals.
Melvin Felicien,
A seasoned engineer, who focuses on security, effeciency and ensuring that technology is being used effectively within its defined scope
by Felicien | Jul 31, 2019 | Education
Check Your IoT: URGENT/11 Zero-Day Vulnerabilities Impacting 2 Billion Devices
It was only a matter of time before connected devices become a target. The current vulnerability allows remote attackers to gain full control over IoT devices.
Security professionals have known that connected devices are a risk, but the latest news around the URGENT/11 vulnerabilities may surprise even the most hardened security professional. Over 2 billion connected devices are thought to be vulnerable, including a range of printers, VOIP phones, routers, medical equipment, firewalls, elevators and industrial controls. Any connected device that is running the VxWorks operating system created by Wind River has the potential to be affected, allowing users to remotely gain control over the device.
URGENT/11 Vulnerabilities
Dubbed “URGENT/11”, these security risks include six critical vulnerabilities connected with VxWorks 6.5 or higher that includes the IPnet stack. There are a few versions of the OS that may not be affected, according to security research firm Armis, such as their VxWorks Cert Edition and VxWorks 653. Whether devices are within the network perimeter or on the edge, they can still be leveraged for remote access directly into networks. The vast range of manufacturers of the devices at risk means the level of security at the device level is likely to vary dramatically between product types. Fortunately, Wind River Systems provided critical patches during a recent July 19 release, but that may not be enough to reduce the risk for organizations utilizing these connected devices.
What is VxWorks?
“VxWorks is the most widely used operating system you may never have heard of,” said Ben Seri, vice president of research at Armis. “A wide variety of industries rely on VxWorks to run their critical devices in their daily operations—from healthcare to manufacturing and even security businesses”. As an RTOS, or real-time operating system, VxWorks has generally been considered to be a stable solution for IoT and other interconnected devices with only 13 vulnerabilities reported in over 32 years of operation for the platform. Since it is only older versions of the RTOS that are vulnerable to attack, it’s thought that newer devices should be relatively safe and many affected devices are already reaching end-of-life. These devices are generally ones where chipsets only need to manage a few basic pieces of information, such as input/output operations, where little data processing is required.
How to Protect Your Business
While officials at VxWorks and Armis note that there are no indications that the URGENT/11 vulnerabilities have been exploited, the extreme disruption that could be caused within an organization is reason enough to warrant a proactive effort to protect your organization. Here are the recommended steps from Wind River security professionals and engineers:
Apply the recent patch immediately
Deploy specific firewall signatures/rules that will help mitigate the danger if patches cannot be applied immediately
You can view the full URGENT/11 whitepaper with a breakdown of the vulnerabilities and suggestions for remediation online. Experts note that the level of disruption could be significant, perhaps even rivaling the EternalBlue 2017 vulnerability or the WannaCry ransomware attack. In each of these instances, it was challenging for many small businesses to determine the best steps to move forward and protect their organization.
Partnering with an IT services firm helps ensure that your business is alert to this type of critical attack vector. Staying vigilant for vulnerabilities and quickly applying patches may mean the difference between a few hours of work patching devices or servers and months of remediation as you attempt to recover from a major attack.
