Email Security

Email security is a crucial focus for your business, but as it offers a gateway into your systems you need to understand how to keep it secure.

If your email security is below standard then you’re opening up your network and sensitive data to the mercy of malicious software e.g. trojan horses, malware and viruses which can really disrupt your business and compromise your data.

No business wants this type of risk bubbling away in the background, so we’re going to take you through 5 essential tips which will ensure your emails are secure.

1. Does It Have to Be Emailed?

There’s a tendency to assume that because email is available it has to be used. And many people feel that, seeing as email servers have plenty of storage, that all those attachments are just fine to be stored there.

However, both these methods ensure that data is readily available should your servers be hacked.

Therefore, if you’ve got a highly important report which contains sensitive data it may be best to seek an alternative delivery method e.g. via courier. And do attachments need to stay on the email server? No, they don’t. They can easily be archived to external hard drives which offer security and plenty of retrieval options.

2. Don’t Access Emails from Public Networks

6_secure_email_iStock

It seems as though everywhere you go these days there’s a public wifi network that you can hop onto in a couple of seconds. This accessibility means you can connect with your emails no matter where you are, so many people take advantage of it.

However, the security of these public networks can never be predicted. Due to their ubiquity they’re also the regular targets of hackers. This means that secure data such as your passwords are at risk and this can grant hackers a foothold in your system.

Sometimes, though, you’re going to need to access your emails on the move, so connecting via a public network will be your only option. To protect against any viable security threats, the best practice is to employ two factor authentication for your email servers to provide extra security.

3. Password Resets

padlock-security-protection-hacking

Employees love to keep their password the same for as long as possible because it means it’s easy to remember. And the easier to remember it is, the less chance there is that they’ll have to go through the hassle of ringing their IT department to reset it.

However, this type of complacency leads to your emails becoming vulnerable as it becomes easier to infiltrate your system over a long period of time.

That’s why we would recommend that your email software forces users to routinely change their password every 4 – 6 weeks. And if emails are entered incorrectly 3 times then make sure that email account is locked straightaway!

4. Filter All Attachments

Malicious content is most likely to enter your business’ network through email attachments, so it’s vital that you set up email filters to protect your business. These filters will help block any suspicious attachments and give you the time to review them before releasing them into your system.

Remember, hackers are becoming increasingly sophisticated and are able to package malicious software into seemingly innocent files e.g. a spreadsheet entitled “Monthly Sales Report” may appear genuine, but something nasty may be lurking in the background.

5. Train Your Staff on Email Security

email security training

Staff, of course, represent the final wall between emails and your servers, so it’s important they receive training on email security.

This should be carried out upon their induction into your company, but it’s also a good idea to regularly email updates around warning of any on-going threats. This knowledge allows them to understand what they should be looking out for and helps keep your email security sage.

For more ways to secure and optimize your business technology, contact your local IT professionals.

Read More


banner-05

It’s essential for businesses to protect their data assets from any potential security threat. Here are tips to help your business achieve this.

The world of IT security, however, can be an intimidating landscape and many business owners struggle to put a plan of action together. And this leaves them vulnerable to security attacks.

Thankfully, though, we’ve learned a thing or ten about protecting data from rogue elements and will be sharing these security best practices with you.

  1. Segment Your Networks
    ibwf_diagram_3

One of the best strategies to minimize data loss is by segmenting your networks. The use of firewalls between each network segment will prevent attackers gaining access to all of your data at once. It’s likely that this frustration will lead to attackers giving up and heading elsewhere.

  1. Visualize What You’re Securing

Data, in its purest form as binary code, isn’t something you can physically see. And it’s this lack of physical mass which means it’s difficult to assess the knock on effect of implementing new security policies. To prevent leaving your business open for attacks, keep detailed visibility records of your networks and their configurations. This allows you to make future changes which won’t compromise your security.

  1. Don’t Give Everyone Admin Rights
    1311_WindowsPromote2

There needs to be a level of control when it comes to your network, so you can’t issue everyone admin rights. Sure, it may save users a little time in sorting out network issues such as installing new hardware, but it also sets your network up for an attack by making admin rights less privileged.

  1. Keep Tabs

It’s vital that you create a ‘security knowledge’ database to help keep everyone on the same page as to who has specific access to which security features. This allows a hierarchy to be observed and easy to understand processes to be carried out when dealing with applications or even decommissioning them.

  1. Carry out Security Training

Everyone in your organization will need to undergo some form of security training. This allows your business, as a whole, to be more secure from attacks. And it doesn’t need to be intense training either, it may be as simple as going through the company IT policy with new starters or regular email updates about current viruses and malware.

  1. Regularly Patch your Systems
    3

The easiest security attack is one that targets a known vulnerability e.g. an opportunity to get into your system via a ‘back door’ in a piece of software. Therefore, always make sure you install every patch you’re offered as it could make a huge difference to your chances of staying secure.

  1. Analyze your Security Stats

The only way to confirm that your security efforts are working is to analyze their performance every month. This is why you will want to measure metrics such as number of attacks, user errors etc. to monitor exactly which direction your security is heading in.

  1. Communicate with Other Teams
    cross functional team

Communication needs to be clear and defined between your security team and other in-house teams to guarantee high levels of security. Any changes that are made in-house need to be communicated between security and the corresponding team to allow security provisions to be updated/implemented. Likewise, your security team has to inform all other teams of any upcoming security changes to keep everyone aware.

  1. Reduce Outbound Access

Many data thefts occur from within businesses, so it’s good practice to limit the amount of outbound access available. So, if, for example, your business has no need to use Google Docs then put a block on it and prevent any data leaking out via this avenue. Don’t forget: insider data theft can not only be disastrous, but also highly embarrassing.

  1. Automate Certain Security Tasks

It’s a tough job to monitor every single aspect of your data security, so why not automate some of the more basic tasks e.g. monitoring unauthorized attempts at bypassing firewalls. This gives your security team more time to concentrate on more complex security issues.

For more ways to secure and optimize your business technology, contact your local IT professionals.

Read More


frame_ext

Wouldn’t it be great if you could block Flash ads which drain your PC’s resources? New features in Google Chrome disable flash ads automatically.

The Problem with Flash Ads

There is nothing more irritating than loading up a webpage and beginning to devour the content on offer when, out of the blue, a noisy Flash advert pops up and takes over your speakers.

It jars your concentration and means you lose focus on that amazing article about Malware you were enjoying.

Yep, we’ve all been there and we’ve all rolled our eyes and tutted aloud!

Unfortunately, for users of Chrome, the only choice they’ve had in these situations is to take a heavy handed approach to Flash plugins (tiny pieces of software embedded in a webpage). The choice has been to either allow all Flash plugins or disable all Flash plugins.

Now, with the dynamic nature of the web these days it’s impossible to disable all Flash plugins or you’ll find that you miss out on key information e.g. some older website still use flash to deliver the content you want.

Taking on the Ads

adobe-and-google-logos

Google, as we all know, are pretty much the guardians of the internet these days. They protect us from dangerous websites, offer us incredibly personalised search results and even find us the best price for a pair of jeans.

It’s this dedication to customer service which has inspired them to go that little bit further and make our web experience smoother than ever.

This is why Google has teamed up with Adobe (creators of Flash) to tackle this advertising nightmare through the Google Chrome browser.

Hitting the Pause Button

By utilising intelligent software, Google and Adobe have managed to program the latest beta version of Chrome to give context to content on a web page.

Say, for example, you’re on a website which features IT tutorials and you want to view their video on how to setup printers. If there’s a series of Flash adverts trying to sell you holidays to Brazil then Chrome will be able to determine which one to silence.

And, believe me, you won’t be hearing about holidays to Rio de Janeiro for long!

No piece of software, of course, is 100% fool proof so, yes, there’s a chance that Chrome could accidentally pause your video tutorial on printers. But the key word here is “pause”. No content will ever be blocked and it will all be readily available at the click of a button.

Thumbs up for Chrome

Google is cooking up something special with this latest advancement in browser software and we can only applaud them for it. We wouldn’t stand for an advert popping up unannounced in the middle of a TV show, so why would we tolerate it online?

The feature is currently only available in the Chrome desktop Beta version, but all the signs are pointing to it becoming a permanent Chrome feature in the near future, so keep your eyes peeled.

For more ways to secure and optimize your business technology, contact your local IT professionals.

Read More


Win10-security

With the release of Windows 10 just around the corner, learn about three new security features in Windows 10 being introduced in the operating system.

Microsoft has been branding Windows 10 as a system that will include security upgrades like biometric authentication and app-vetting.

Learning from past mistakes, Microsoft took note from the after the disappearance of the start menu in Windows 8. In fact, many users found it a challenge to navigate through Windows 8 because of the heavy tile-like set up. Windows 10 will bring the start menu back along with Cortana – a personal assistant and new browser called Edge. It is said that Microsoft is trying to emulate the Smartphone experience for a PC or a laptop with Windows 10.

Here are three interesting security features coming to Windows 10:

Device Guard

Device guard is a feature that will automatically block applications that lack an authentic vendor signature. Lenovo, Acer, HP are teaming up with Microsoft to utilize device guard on all their devices using Windows based services.

This feature will protect users from malware. When a user executes an app, Windows will run a credential check and notify the user about whether or not to trust the app. Device guard is unique because it can make these analytical decisions outside of window’s OS – which is known to be susceptible to hackers and malware.

Device guard is different from antivirus software as it is immune (for now) to stealth attacks and tampering. However it will guide your antivirus by flagging questionable apps. It will be functional even if Windows Kernel is not.

Windows Hello

windows-hello

Imagine your fingerprints, iris or your face being the key to access to your computer. Biometrics makes it all possible without the need to worry about passwords. Windows Hello attempts to make users immune to password hacking attacks as it lets them carry out their every-day online activities without having to key in a password or store one on your device or a network server. Your device will need a sensor to register such biometric information. So unless you are planning to buy a new device capable of Windows Hello, you won’t be able to experience it.

Passport

Windows-Passport

Microsoft is streamlining passwords by introducing Passport. Passport will allow you to access apps and services online without entering a password. This will be done by using a ‘pin’ or Microsoft hello. Before authenticating, Microsoft will be able to verify if you are in possession of your device. Passport will use Microsoft’s Azure Active Directory Services to accomplish this task.

For more ways to stay informed with new technologies, contact your local IT professionals.

Read More


coffee_on_computer_key

A recent security loophole has affected Starbuck’s customers thanks their mobile app. Read more on this story to learn how it happened and how to avoid it.

For some unlucky coffee lovers, it was not a great morning when they found that hackers were draining their bank accounts through Starbucks mobile app. Starbucks were not the prime target as many would think. The sneaky attack was aimed at users who were directly impacted by the latest Starbucks hacking incident.

Point of entry

It seems that the attacker had spotted vulnerability in Starbucks’ app that permits multiple attempts to guess the correct password.starbucks-tb

Not only did user’s passwords become compromised, the attack exposed some users with the same ID and password for logging into other existing accounts. In theory, this could give an attacker the keys to access and “drain” your online banking accounts and other significant accounts where shopping transactions are permitted.

Considering that 18% of Starbucks’ total transactions are made via their app, its imperative for Starbucks to take corrective measures to handle this issue.

The dirty deed

It’s estimated that $2 billion dollars were made in transactions via mobile payments alone in 2014. Yet, it was incredibly easy for the hackers to carry out this hacking attack.

  • The attackers managed to acquire stolen passwords and ID’s from “black-hat” sources.
  • The attackers used a program to test out combinations of stolen ID and password on the Starbucks app until they successfully gain access into an account.
  • These programs are believed to be sophisticated and efficient enough to process thousands of ID and password combinations every second.
  • Once the attackers were able to access an account, they’d add a gift card to it.
  • After adding the gift card, hackers would then typically transfer all the money from the user’s main account on the app to the gift card itself.
  • The gift card is then managed entirely by the hackers who pocket all the funds.

The real danger lies on what other accounts the hacker may have access to once they’ve compromised an account through the Starbucks App. PayPal account or Credit Card details are also at risk as these can be linked to Starbucks accounts. All this can lead to unimaginable financial damage in both the short and long run.

The “Gift” card

Ever wondered what happens to the money transferred to the gift cards?

Hackers or thieves, whichever way you look at it, will sell or resell these gift cards for their face value. They sometimes fetch less on the internet, churning real dollars out of Starbucks dollars. It may be worth holding on to your real wallet for a little longer!

635671531553796731-star

The whole Starbucks hacking ordeal was first reported by consumer journalist, Bob Sullivan. In fact CNN-Money was able to interview many who had experienced same scandals in the past. The interviews reveal Starbucks slacking on security procedures by not having enough secure authentication processes in place for transactions. For instance, transactions involving those who deposit money onto gift cards or initiate money transfers from bank accounts.

How to stay protected

If ever you’ve been a victim of such a scam, then we suggest you put in a complaint about it to Starbucks ASAP. They will most likely investigate the matter; however you may be prompted to take it up with you bank or PayPal.

Also be sure to update, cycle and change your passwords at your earliest convenience. If you suspect your account details were stolen, your old account credentials may have been sold under scheming “underground” trade sites that buy lists of user credentials.

Many customers have uninstalled the Starbuck’s app and have started to pay with cash or with credit/debit cards. We suggest you follow this advice too until tighter security measures are put in place.

For more ways to safeguard your personal data, contact your local IT professionals.

Read More