Data Security Archives

Understanding the FTC Safeguards Rule

data flow, data governance, Data Security, FTC Standards Rule, FTC violations, Ophtek, project leader, Security, security plandata flow, Data Security, FTC Standards Rule, FTC violations, Ophtek, security planOphtek, LLC

May 2024

As a business owner, it’s crucial you protect the data held by your organization. And the FTC Safeguards Rule means this is an absolute necessity.

Originating as part of the Gramm-Leach-Bliley Act in 2002, the FTC Safeguards Rule is a set of regulations which govern how a business must protect its data. After all, a business not only holds sensitive information regarding its customers, but also its employees. And in the modern age, this data is constantly in the crosshairs of threat actors. T herefore, safeguarding this data is paramount. Otherwise, your business is at risk of being slapped with hefty fines and penalties.

A Closer Look at the FTC Safeguards Rule

If you want to adhere to the FTC Safeguards Rule, you need to put a comprehensive strategy into place. Our recommendations for drawing up a plan are:

Appoint a Project Leader: it’s important you have a project leader when tackling the FTC Safeguards Rule. This leader will be able to build your strategy and execute it efficiently. They will, of course, require some level of IT competency and understanding of security procedures, but it can easily be any individual within your organization.
Identify the Relevant Data: the next step is to evaluate the data handled within your organization and identify what falls under the definition of personal information. So, start by creating an inventory of the personal data you hold. This allows you to understand where all your personal data is located. Next, you need to evaluate the data risk of these records e.g. whether this data i s encrypted or not.
Map Your Data Flow: with your data identified, it’s time to identify the lifecycle of this data and how it flows through your business. Make sure you can categorize each form of data and record how it’s collected, stored, and once it’s of no further use, the methods by which you destroy it.
Finalize Your Security Plan: your final step involves consolidating all the information you’ve gathered so far and implementing a security plan. This could include recommendations for data storage, security measures such as enhanced network monitoring, and ensuring that automatic updates are activated across your IT infrastructure.

What Happens When You Don’t Comply?

As of June 2023, if your business fails to comply with the FTC Safeguards Rule, the FTC have the power to hit you with a fine of up to $100,000 per violation. And if you make multiple violations, these fines can quickly cause you major financial damage. There’s also the risk of any affected customers or employees also taking legal action against you. Compliance with the FTC Safeguards Rule, therefore, needs to be a major priority for businesses of any size.

For more ways to secure and optimize your business technology, contact your l ocal IT professionals.

The Best Ways to Secure Your Digital Documents

Backup, Data Breach, Data Security, digital documents, Ophtek, password protection, strong passwords, windows encryptionbackup, digital documents, Ophtek, password protection, security, strong passwords, vulnerability, windows encriptionOphtek, LLC

May 2024

Every business relies on digital documents, but the threat of data breaches and cyberattacks mean these documents must be correctly secured.

There are many types of documents a business uses daily such as Word, Excel, PDF, and digital images. All of these can contain sensitive information, and it’s no surprise threat actors want to get their hands on them. Not only can a threat actor use these to compromise other accounts, but they can cause real financial damage with them. Accordingly, it makes sense to secure your organization’s digital documents to keep them safe.

Securing Your Digital Documents

Your business may contain numerous files in different locations, but the good news is that securing all of them is straightforward. Just make sure you follow these best practices:

Password Protection: the simplest way to secure your digital documents is by implementing password protection. A common security measure for decades, passwords put a major barrier in the way of unauthorized access. Not all files can be password protected, but common files such as Microsoft 365 documents and Adobe PDF documents can.
Use Strong Passwords: central to good password protection is strong passwords. Never use passwords which are easy to guess e.g. using “password” or “admin”. Instead, always use passwords which combine upper and lower case characters with numbers and symbols. It’s also recommended that passwords are longer than 8 characters and different passwords should be used for different documents.

Restrict Access: it’s important to remember not every employee needs access to every single file within your organization. Your marketing team, for example, doesn’t need access to your finance team’s documents and vice-versa. Accordingly, you need to restrict access to only those who need it. The best way to achieve this is by setting up ‘restricted’ drives for each team to store their department-specific documents.
Use Windows Encryption: compromised devices present a goldmine of data for threat actors, but it’s possible to avoid this disaster by encrypting your devices. Yes, if you’re running Windows 10/11 Pro or Enterprise versions, it’s possible to encrypt data and provide access only to those with authorization. This is easy to put in place and, if Windows encryption is not available on the device, you may still be able to use BitLocker encryption to encrypt it.
Always Create Backups: in the event of a ransomware attack, your organization could find all of its documents encrypted and inaccessible. This is why creating backups is the surest way to enhance the security of your digital documents. The preferred method for executing this is with the 3-2-1 backup method, as this provides you with multiple copies in different locations. Complete loss of your data is minimized and there’s no need to pay any ransom fees.

Final Thoughts

All it takes is for a single file to be compromised by threat actors to cause major damage, so it’s crucial that you prioritize securing your digital documents. Putting the suggestions above into practice is relatively easy, and it ensures your data remains safe. So, don’t delay, secure your digital documents today and benefit from the peace of mind it provides.

For more ways to secure and optimize your business technology, contact your local IT professionals.

Healthcare Organizations Targeted by new Lazarus Attack

Backup Strategies, Data Security, Lazarus, North Korea, Ophtek, Phishing, QuiteRATbackup, North Korea, Ophtek, phishing, QuiteRAT, security, updatesOphtek, LLC

Oct 2023

Healthcare organizations across the United States and Europe have recently found themselves targeted by Lazarus, the North Korean hacking group.

Lazarus, who are believed to have ties to the North Korean government, are well known in the world of cybersecurity. In 2022, Lazarus were rumored to have stolen a total of $1.7 billion worth of cryptocurrency across the year. So, yes, Lazarus is a force to be reckoned with. As their latest attack targets organizations rich in sensitive data, it’s important to understand their methods and determine the lessons that can be learned.

What Is Lazarus’ Latest Campaign?

At the heart of this new attack by Lazarus is the ManageEngine ServiceDesk. This management suite is used to help organizations manage their entire IT infrastructure. From networks and servers through to mobile devices and applications, ManageEngine helps make life easier for IT teams. It’s a highly popular management suite, with numerous Fortune 100 businesses implementing it. For healthcare organizations, it’s a crucial service which allows them to stay productive and support their IT systems.

However, as with all, applications, ManageEngine is not 100% secure. The CVE-2022-47966 vulnerability, which was discovered in January 2023, was first exploited by threat actors in February of the same year. This vulnerability allowed the deployment of QuiteRAT, a new and complex brand of malware. QuiteRAT let the threat actors steal data relating to the compromised device and, cleverly, allowed QuiteRAT to “sleep” in order to appear dormant and stay off the radars of security professionals.

Another part of the attack also involves a new strain of malware dubbed CollectionRAT, which has the ability to perform typical remote access trojan tasks such as executing commands on a compromised system. As with previous campaigns, this latest strike utilizes many of the trademark Lazarus tactics and innovations. For example, by using open-source tools to create CollectionRAT, the threat actors are able to launch their attacks more quickly and without raising the alarm immediately.

How Do You Protect Your Organization from Lazarus?

Naturally, the most obvious way to protect your IT infrastructure from Lazarus is to be prompt with installing software patches. Lazarus appears to have infiltrated these healthcare organizations due to a known vulnerability, so patching any holes within your IT systems is essential. Luckily, many updates, such as Windows, can be set to automatic and ensures that your applications are as secure as they can be.

Hacking groups, however, don’t rely solely on vulnerabilities to launch their attacks. In fact, they will deploy almost every technique you can think of to launch an attack. The best practices to stay safe from these are:

Create backups: when confronted with any form of malware, there’s a good chance that your business data will be at risk or being compromised or even permanently erased. Therefore, it’s important that your organization creates regular backups to preserve your data and productivity. One of the most comprehensive methods you should use is the 3-2-1 backup method.
Educate your staff on phishing: staff awareness of phishing is crucial due to the rising risk of phishing and social engineering attacks. Recognizing the telltale signs of a phishing email prevents the chances of data breaches and compromised credentials. This will result in a securer IT landscape for your organization and protect your networks and data.

For more ways to secure and optimize your business technology, contact your local IT professionals.

How to Complete a Business IT Vulnerability Assessment

Cyber Security, Data Security, email security, IT Vulnerability Assessment, Ophtek, procedureCyber Security, Data Security, email security, IT Vulnerability Assessment, Ophtek, procecure, vulnerabilityOphtek, LLC

Jun 2023

No IT infrastructure is 100% secure, but you can maximize your defenses and reduce your risk. All you need to do is complete an IT vulnerability assessment.

It’s important to understand exactly what your cybersecurity procedures can and can’t protect against. After all, assuming that your security measures are perfect is a sure-fire way to become complacent. And if there’s one thing that threatens the safety of your IT systems, it’s complacency. Therefore, it’s essential you understand why you need to complete an IT vulnerability assessment. And, more importantly, that you know how to complete one.

Understanding the Purpose of a Vulnerability Assessment

A vulnerability assessment looks at your IT infrastructure and reviews each and every security procedure, as well as highlighting any potential weaknesses. This pre-emptive approach is critical for reducing risk and protecting your systems. Its main objective is to evaluate your existing procedures and deliver suggestions for future improvements.

Preparing an Assessment

There are several steps when it comes to preparing an IT vulnerability assessment, and these include:

Identifying assets: if you’re evaluating the security procedures which protect your IT equipment, you need to start by identifying the assets which comprise your infrastructure. This means you will have a foundation to start your assessment from. So, for example, if you know that you have 20 laptops within your organization, you will need to evaluate all of these for upgrades, existing infections etc.
Determining the scope: it’s important for your vulnerability assessment to have a focus, so make sure you establish this early on. It may be that you simply want to carry out an assessment on your internal email systems, or it could be a more in-depth look at all your internet safety measures. Either way, with this scope established, you can conduct a targeted assessment with clearer objectives.
Select your tools: completing a vulnerability assessment requires numerous tools such as human labor, software, and new IT equipment. Accordingly, you need to make sure this is all available and can be budgeted for. This will allow you to complete a comprehensive assessment to the required standard and leave no shortfall e.g. IT systems which need to be upgraded will require funds to be available.

Analyzing Your Assessment

Once all your preparation is in place, you can complete your assessment as per your plan and guidelines. You then need to analyze the results of your assessment. As previously stated, no IT system is 100% secure, and your assessment will likely raise several concerns and vulnerabilities. Therefore, you will need to categorize these vulnerabilities both by area and severity e.g. weak firewall defenses (major) and staff writing passwords down (medium). This will allow you to begin planning a mitigation strategy to nullify these threats.

Implementing a Mitigation Strategy

With the information gleaned from your vulnerability assessment, it’s vital that you begin communicating this with the stakeholders within your organization. Ensure that your IT staff, department managers and executives are all aware of the vulnerabilities. Most importantly, also communicate how these will be mitigated, this will keep everyone on the same page and generate discussion on any potential implementation problems.

Finally, you need to put your mitigation strategy into place. These steps will vary, depending on your vulnerabilities, but common examples include additional training sessions for employees, updating software and upgrading legacy equipment. Whatever the plan, speed is of the essence to prevent these vulnerabilities turning into a catastrophe.

For more ways to secure and optimize your business technology, contact your local IT professionals.

Stealer Malware Hidden in Fake Zoom Sites

Cyber Security, Data Security, malware, Ophtek, stealer malware, zoomCyber Security, Data Security, malware, Ophtek, security, stealer malware, zoomOphtek, LLC

Oct 2022

Six malicious websites have been discovered which claim to offer downloads of Zoom, but contain nothing but the Vidar stealer malware.

The popularity of Zoom – a video meeting application – has exploded in the post-Covid landscape we find ourselves living in. No longer do people need to travel for face-to-face meetings, they can now be conveniently arranged and carried out over video. Accordingly, the demand for Zoom is huge, with around 485 million downloads completed since 2020. Due to this popularity, a gang of cybercriminals have decided to use Zoom as the bait for downloading the Vidar stealer.

As your employees are likely to consider a Zoom install safe, it’s important that we delve a little deeper and demonstrate why it may be far from safe.

Beware of Fake Zoom Sites

Vidar has been an active threat for some time now, but this latest attack is a new campaign and carries a number of unique threats. The six sites, discovered by Cyble Research, use a variety of URLs such as ‘zoom-download’ and ‘zoomus’ to appear legitimate. And, if you visit one of these sites, the visual aesthetics are remarkably similar to the official Zoom website, but this is where all similarities end.

Attempting to download the Zoom application from these malicious sites will, instead, redirect you to a GitHub file depository. From here, two files will be downloaded to your temporary folder:

ZOOMIN~1.exe: this is a genuine Zoom installer which is included to create a front that nothing untoward is taking place.

Decoder.exe: this is the malicious file which injects Vidar’s ability to steal into the Microsoft Build Engine. With this infection in place, Vidar is then able to contact remote Command and Control servers and begin transmitting data from the infected PC.

Like most stealer malware, Vidar concentrates on extracting confidential data such as login credentials, network details and whether any further vulnerabilities are present in the IT infrastructure. If vulnerabilities are detected, then it’s highly likely these will be logged and sold by criminal gangs. Protecting yourself against Vidar, therefore, is crucial.

How to Avoid Having Your Data Stolen

The mechanics of the Vidar Zoom threat are relatively common in the world of malware, so it’s likely you will run into a similar threat at some point. The best way to protect your PCs is by following these practices:

Always Verify Websites: Vidar’s latest attack relies on poor judgement from its intended victims, the main error coming when they assume that the malicious website is genuine. Many antivirus suites contain tools which allow search results to be rated as to their level of safety, and there is also the option for these tools to present warning screens before accessing sites deemed unsafe. If these are unavailable, and you need to download some software, reach out to your IT team instead.

Install Updates: Vidar is keen on logging any vulnerabilities contained within your PC, so it makes sense to limit these vulnerabilities. The best way to achieve this is by always installing updates as soon as they are available.

Segment Your Network: to protect your data, it makes sense to adopt network segmentation. This procedure divides your network into different segments and allows you to keep them separate. Therefore, if one segment is breached, the others will remain protected, and this allows you to limit the spread of the malware.

For more ways to secure and optimize your business technology, contact your local IT professionals.

1 2 3 … 5 Next »

Category Archives: Data Security