The Very Basics of Good IT Security

anti malware, disable employee access, email security, IT Best Practices, Ophtek, Password Security, Safety, Security, Security Threats, two factor, , , , ,
18
Jun 2019

Cyber-crime remains a major threat to any organization that works with IT, but the basics of IT security are often the best way to counter this threat.

It’s difficult to avoid the fact that cyber-attacks are reaching record levels. IT systems are less secure than ever and need protecting. And that’s where your organization needs to take up the baton. Protecting these systems may sound like a monumental task, but it’s a lot easier than you think. Key to success is following the basics of IT security. The simplicity behind these processes is remarkable and can make a significant difference.

It’s crucial that you know what these are, so let’s take a look at the very basics of good IT security. 

Understanding the Basics

The complexity of IT systems often means they’re difficult to work with. And from this complexity comes flaws in security. The good thing is that IT security doesn’t have to be difficult. The best way you can help protect your IT system is by following these basics:

  • IT Inductions: You should never assume that new employees have a solid understanding of IT security. And that’s why your staff should always have to complete an IT induction. Not only will this familiarize them with the technology you use, but it allows you to run through the basics of cyber threats. This knowledge can make a real difference in strengthening your defenses. 
  • Disable USB Ports: The level of damage that USB devices can cause is shocking and unbelievable. Your employees are unlikely to be aware of this threat. To them, a USB port is simply a handy device for charging their mobile device. The truth is much different. This threat can be extinguished by disabling the USB ports. This can be achieved by adjusting the USB settings for your employees. 
  • Use Antivirus Software: It may feel like a simplistic step in IT security but antivirus software remains essential. Good antivirus software can recognize malware within milliseconds and flag it. A manual scan will never be able to match this. And your employees wouldn’t know what they were looking for. The vast databases in use and the speed in which they operate ensures that antivirus software is a must have in business. 
  • Assign Privileges Accordingly: Different employees will need different network privileges. These variations arise from the different tasks they perform within your IT system. Certain departments, for example, will need access to one drive whilst another department will not. Understanding these differences is critical. Once the necessary privileges have been identified then you can minimize the risk of cyber-attacks spreading through the entire system.

For more ways to secure and optimize your business technology, contact your local IT professionals.

Read More

What Should You Do When Your Network is Hacked?

Hackers, Hacking, malware, Ophtek, Password Security, PC Security, Security, , , ,
28
May 2019

A hacked network is a disaster for any organization, so keeping things secure is vital. However, sometimes things go wrong and you need to know what to do.

Your IT operations are supported by your IT network, so, if it gets hacked, there’s every chance that all those PCs you have lined up in your offices will be unable to operate. Naturally, this means that productivity will drop off almost immediately and affect not just you, but also your customers. With good IT practices in place, you significantly reduce the risk of this happening. Mistakes, be they caused by hardware or human error, are inevitable, though, and it’s rare that a business can claim to have defenses which are 100% secure.

Therefore, it’s important that you know what to do when your network is hacked. Rather than have you learn the hard way, through experience, we’re going to save you some of the pain with a quick guide on how to cope.

Steps to Take When You’re Hacked

Most importantly, you need to take the following steps when you discover your network has been hacked:

  • Put Everything On Lock Down: The stealthy nature of hackers means that it’s difficult and time consuming to determine exactly how much of your network the hackers have breached. So, in order to preserve as much as your network as possible, you have to assume the worst: they’ve gained access to everything. And that’s why you need to lock down and change passwords on everything be it folders on a shared drive or your social media accounts. This is the only way to minimize damage. 
  • Learn from the Experience: As we’ve stated, it’s likely that your network will, at some point, experience a security disaster. However, while in the short term this may feel like nothing but non-stop chaos, there’s an important set of learning to be absorbed for the long term. Mistakes are what allow us to evolve and make better decisions in the future, so make sure you take the opportunity to analyze exactly what went wrong and the steps you can take to prevent it happening again. 

Final Thoughts

A hacked network represents every IT professional’s worst nightmare, but it’s important that you understand the best steps to take in this situation. Not only does it prevent network hacks from escalating into more devastating hacks, but there’s also the chance to learn and strengthen for the next time hacker aims an attack at your network.

For more ways to secure and optimize your business technology, contact your local IT professionals.

Read More

Are Internet of Things Devices Safe to Use?

Internet of things, IOT, IoT Attacks, Ophtek, Security, , , ,
16
Apr 2019

The Internet of Things (IoT) has revolutionized the way we connect and interact with physical devices, but is this new technology as secure as it should be?

Clearly, with around 26 billion associated devices estimated to be in use during 2019, the IoT needs to be secure due to the amount of data being transmitted. However, as the IoT is a relatively recent phenomenon, it’s no surprise that so many headlines are warning against the dangers of this technology. Naturally, this kind of scenario can cause concern for organizations that are looking to get on board with the numerous IoT benefits on offer, but should you really be worried about the security risk?

What is the Internet of Things?

The basic premise of the IoT is a lot simpler than you would imagine: using internet connections, physical devices can communicate with one another while also being remotely controlled and maintained. So, for example, if you want to control the lighting in your office, you could use a remote application to adjust the lighting from, if necessary, from anywhere in the world. And all you need is an active internet connection for the app to connect to the device.

What are the Safety Risks of IoT Devices?

As we’ve mentioned, there are certain dangers attributed to IoT devices that can seriously threaten the security of your devices and any data transmitted by them. Some of the more pressing risks include:

  • Default Login Credentials: Many IoT devices are sent out with default login credentials, so this means that the username and password details will be exactly the same for every single one of those devices sold. And it doesn’t take long for hackers to begin sharing details of this vulnerability with their fellow hackers. Accordingly, changing default login credentials to a more unique configuration should be the first thing you do before connecting such a device to your networks.
  • Unnecessary Features: Sometimes, IoT devices are packed with a wide range of features that are completely unnecessary for your organization’s needs. The most common example of this is the option of remote access which, for many in-house IoT devices, simply isn’t necessary as all it does is open up a pathway to your network for hackers. Therefore, make sure that only the most relevant features are activated on your IoT devices.
  • Patching IoT Devices is Difficult: Due to the wide variety of manufacturers making IoT devices, many of these companies simply don’t have the technical knowledge to release regular and effective patches. And this represents a major security risk due to the constant efforts of hackers to exploit security vulnerabilities. In these instances, the best way to prevent a breach is to monitor these less secure devices for any unusual network activity. This approach should, at least, indicate if there is a potential security breach in progress. 

Final Thoughts

Although there are a number of very real security risks associated with integrating IoT devices into your organization’s IT network, these don’t have to convert into a major security breach. Instead, these risks can be significantly reduced by following the advice listed above which will protect your network and keep all your IoT devices interacting with it seamlessly.

For more ways to secure and optimize your business technology, contact your local IT professionals.

Read More

The Biggest Cloud Security Mistakes You Can Make

Cloud, Cloud Backup, Ophtek, Password Security, Security, , , , ,
19
Feb 2019

Cloud storage and infrastructure is the way forwards for organizations due to the massive range of benefits it offers, but how secure is your cloud?

Security is the single most important factor when it comes to an organization’s IT operations, so it’s essential that it’s treated with the utmost attention. However, cloud networks are a relatively new platform and, as a result, the level of security knowledge behind these platforms is lacking compared to more traditional networks. Hackers, of course, are keen to this fact and invest substantial time and effort in uncovering security vulnerabilities that they can exploit. Combating this threat, therefore, is paramount to your organization’s security.

As I’ve already stated, cloud networks are a new phenomenon and the wider community generally isn’t as clued up on them as they perhaps should be. And this leads to common mistakes that can cost dearly. However, by taking a look at the biggest cloud security mistakes you can make, you can hopefully avoid them.

Multi-factor Authentication is Vital

Administrative accounts on cloud networks have significantly more privileges than your standard employee’s privileges. Mostly, this is down to the amount of IT knowledge required to carry out these system admin tasks. A non-IT employee simply doesn’t need these privileges. Accordingly, an administrative account is much more attractive to a hacker, so security needs to be tightened. Any cloud platform that understands security risks should have an option for multi-factor authentication, so make sure this is rigorously enforced for all administrative accounts.

Limit the Use of your Admin Account

The root account is the first account you create when you sign up with a cloud provider. It’s a highly privileged account as it contains access to every aspect of your cloud network. If this account is compromised then your entire cloud network is at the mercy of hackers. And this is why you need to limit usage on this account to only the most necessary tasks e.g. do not use the root account for general day to day tasks that put you more at risk of being infected by malware etc.

Check the Encryption Methods

Security moves at a rapid pace and the level of encryption that is now available on cloud networks such as TLS-based encryption is fantastic. Unfortunately, there are also plenty of cloud networks that still operate with less security encryption methods such as the SSL protocol. To minimize the risk of your cloud account becoming compromised, you need to investigate the encryption method used on your network. If it’s even slightly outdated, then it’s time to upgrade.

Restrict the Availability of Sensitive Information

The beauty of cloud storage is that it can be accessed from anywhere, so this opens up your data to a much larger audience if you grant them access to it. While this allows you to collaborate with other organizations and remote employees much more easily than ever before, it also puts your data at risk. Your organization needs to bear this in mind and access controls need to be thoroughly thought through to prevent sensitive data being accessed outside of your organization. Ensure that your employees are aware of the open nature of cloud networks when saving data to such public drives.

For more ways to secure and optimize your business technology, contact your local IT professionals.

Read More

How Did the DNC Get Hacked by Phishing Emails in 2016?

Cyber Attack, email links, Hacking, malware, Password Security, Phishing, Phishing Email, Security, , ,
18
Sep 2018

You may think that political parties understand the need for good security, but back in 2016 the DNC suffered a major hack due to phishing emails.

Thanks to a sustained attack, Russian hackers were able to infiltrate email accounts of those involved within Hilary Clinton’s campaign to become president of the United States. And, as you know, the rest is history. However, not many people are aware of exactly how the DNC got hacked so extensively that highly sensitive information was obtained and then leaked to the public.

Although not every single detail has been revealed, we know enough that the hack was, in relative terms, a fairly simple execution. Naturally, you’re unlikely to be targeted by the same people who are involved in political attacks, but their methods are likely to be similar. Therefore, we’re going to take a look at how the DNC was hacked by phishing emails, so you can understand how to avoid it.

Phishing for DNC Secrets

The hack began on March 10th, 2016 and involved a batch of heavily disguised emails, which appeared to be sent by Google, being sent to key members of Hilary Clinton’s campaign team. These emails purported to be advising the recipients that their passwords needed changing in order to strengthen their security. However, the links contained within these emails sent users to a malicious website where strengthening security was the last thing on their mind. With these email accounts compromised, the hackers were then able to access private contact lists held within them.

Within a day, the hackers had access to confidential email addresses for key targets within the DNC campaign. And, almost immediately, the hackers began to send phishing emails to these email addresses in order to work their way higher up the chain of command. Despite the presence of two-factor authentication, the hackers’ persistence paid off as they eventually managed to breach the defenses of John Podesta, chairman of the DNC’s campaign. This email account, alone, provided access to 50,000 confidential emails.

This assault is believed to have been organized and orchestrated by the Russian cyber-espionage organization known as Fancy Bear. Despite accessing such a huge amount of emails from Podestra, Fancy Bear intensified their hacking campaign and this led to security experts becoming suspicious of methods being employed to dupe Google’s spam filter into accepting malicious emails into the inboxes of DNC targets. The clean-up operation, however, was too late and Podestra’s breached emails were soon published on Wikileaks.

Be Clever, Don’t Get Phished

The 2016 attack on the DNC is probably the most famous, and damaging, phishing attack in cyber-history. Simply due to a few members of staff clicking malicious links, an entire election campaign was brought to its knees. Reinforcing good email security, therefore, remains a crucial practice for any organization in modern business. Even with millions of dollars of security in place, the DNC fell victim to a simple phishing scam and, next time, it could easily be your organization.

For more ways to secure and optimize your business technology, contact your local IT professionals.

Read More
1 2 3 4 5 6