What is Two Factor Authentication and Should You Use It?

Office IT, Security, ,
07
Dec 2014

Two_Locks_Two_Factor_Authentication

We use the Internet for almost everything from email to banking. Lets review how two factor authentication works and how it can protect you.

How does one ensure that their accounts are being kept safe at any point without risk of theft?

The truth is, the world is full of hackers trying to steal your personal information and money.  They’ll go as far as to phish your information without you knowing it. However, one good way to lock down access to your accounts is by using two-factor authentication, also known as 2FA. It’s highly likely that you’ve already used 2FA without even realizing it.

High profile companies such as Google and Twitter, along with many more, have adopted this security measure. Does this make any sense to you? If not, don’t worry as we’ll elaborate more on this.

What is it?

Let’s begin by understanding what single factor authentication is. When you log into an account with just a password, this is considered to be a single factor.

However, two factor authentication is used to verify the identity of the person who they say they are logging in as with the help of an additional factor.
This additional factor can be a piece of information such as:

  • An extra password, pin or pattern
  • Something physical such as a phone, ATM card or fob
  • Biometrics, such as voice, fingerprint or iris scanning

The additional factor forms part of the two factor verification during authentication, even if there’s no evidence of the person accessing the system being the rightful owner of the account.

Once the two factors have been successful verified, this would grant access to a computer system or website.

Example of Two Factor Authentication

An example of how Zoho Uses 2 Factor Authentication

An example of how Zoho uses 2 Factor Authentication

A common example is when you use an ATM machine. For this to work, you’ll obviously need an ATM card, which is one factor, and a pin as a second factor.  This makes it somewhat secure, where one will not work without the other. Say if your ATM card (without long-strip) was lost or stolen, it wouldn’t be any good to whoever gained possession of it without knowing the pin. The opposite is also true, in the case of someone else knowing the pin without having the card. They would be unable to access your account.

Should you use two factor authentication?

In principle, yes. It adds an extra layer to dissuade hackers from gaining entry into your accounts.  Although it isn’t necessary to use it on all of your internet accounts, enabling it on your main email account if it’s supported by your email provider and any financial accounts such as banks or credit cards is a good line of defense.

There are, of course, some downsides to two factor authentication:

  • 2FA logins can take a little longer to work out to login, as the additional step can seem like an inconvenience when using something like a mobile or a fob key to generate a code.
  • If any device, such as a fob or a phone is lost, you’re stuck having to find a way to log in and you’ll need to contact the company’s support.
  • If a hacker gained access to your main email account, which is listed within your contact details in another important account, they can receive the account recovery email. They can then reset it causing them to bypass the 2FA of the account they’re targeting.
  • A good way to prevent this is by having a smarter recovery option, such as an SMS sent to a cell phone to request any account actions.

Final Verdict

All in all, it is better to have 2FA enabled on your accounts than no additional step at all, especially if it means dissuading unauthorized access to your accounts. As 2FA has become more commonplace, it is likely that new developments in security will pave the way for more practical two factor authentication methods. It is fast becoming a necessity for both personal and business use.

For more information on using two factor authentication to protect your business and personal accounts, contact your local IT professionals.

Read More

HIPAA Technical Requirements for Medical Offices

Uncategorized,
19
Nov 2014

HIPAA_Compliance

Is your medical office HIPAA compliant? Here are 8 HIPAA technical requirements you should address to avoid fines that could cost tens of thousands.

In recent years, there’s been cases of data leaks either through innocent cases losing a notebook or information to leak in the office. Tighter IT security measures and policies can help prevent unauthorized access to medical data. We’ve compiled a list in-line with the HIPAA and Omnibus technical requirements and regulations.

Review for HIPAA Compliance

  • Assigning unique usernames– This helps to identify and track different users in Medical Office software containing patient health information.
  • Contingency procedures for accessing medical data in an emergency– A well-documented procedure that can appropriately guide any authorized staff to access protected medical information.
  • Logging off idle sessions– This is a good way to protect and minimize any unnecessary user load on the system, as well as preventing any potential unauthorized access to unattended endpoints.
  • Encryption and decryption of data– Put into place an encryption and decryption process when accessing or externally sending out any sensitive medical information.
  • Auditing systems– It’s strongly advised to run periodic audit controls on systems, including software, hardware, and not excluding, procedures, that use and hold confidential and sensitive medical information.
  • EPHI Integrity– Prevent any alteration of destruction of protected medical information by implementing effective procedures and clear procedures.
  • Authentication procedures– Authenticate authorized staff that are verified to be who they say they are and which are granted access to specific medical information.
  • Securing external transmissions of data– Implement technical and updated security processes to protect data from unauthorized access, especially when transmitted via any type of electronic communications network.

Next Steps

Now that you have a better idea hipaa technical requirements within the IT portion of the HIPPA regulations. The next step is to take action and formulate your own policies and procedures.

Most changes in procedures can be delivered as onsite training for staff, which in our experience is very effective. You may have the best tools in the industry to protect data, however it is also what staff do within these procedures that matters. For example, staff may occasionally share usernames and passwords, or even write them down on a Post-It note and leave these on their desks, all of which are prone to social engineering types of compromises. Not only is this a risk, but it also makes it difficult to audit and trace any work or process carried out on endpoints.

For more ways to secure your medical office technology to ensure HIPAA compliance, contact your local IT professionals.

Read More
Malware holding data ransom
Malware holding data ransom

Cryptowall Becoming The Most Destructive Malware of 2014

Network, Office IT, Security, ,
11
Nov 2014

Malware holding data ransom

Cryptowall, Cryptolocker and Cryptodefence; all malware looking to hold your computer ransom. Here’s what you need to know about these viruses.

Cryptowall is one of the worst malwares out there that can maliciously encrypt your network and system files, holding them ransom in exchange for a Bitcoin payment. Typical Bitcoin payments can vary between $500 to $1000. Since there’s many hacker groups in existence in the wilderness, Cryptowall  has evolved from Cryptolocker to practically do the same thing. And to confuse matters even more, there’s another variant like Cryptowall known as Cryptodefense.

Cryptowall Decrypt Message

The ransom message from a Cryptowall infection

Cryptowall in a nutshell

  • Cryptowall works by using encryption to change all of your network files, making them unreadable.
  • It affects Windows XP to Windows 8 Operating Systems.
  • It also cleverly deletes Shadow Volume Copies to stop any admins from restoring encrypted files.
  • Only the attacker holds the key to decrypt the files that makes them readable again.
  • The ransom increases after 7 days to nearly double the amount and is only payable with Bitcoin.

With this angle of attack, it’s no wonder why hackers are using this hostile method to forcibly siphon Bitcoin payment from their prey.

Examples of attacks

Durham Police

Durham Police Department hit with Cryptowall

  • One prime example that has gained recent media coverage is Durham town police in New Hampshire. As a typical response from any law enforcement agency, the police refused to pay the ransom to cooperate with the cyber criminals.
  • It had impacted 1500 of their own computers, with most of their police e-mail system, spreadsheets and word processing functions being affected. It had bypassed their spam and AV filters, and was masked as an attachment in an email.
  • The danger lies in that the police receive plenty of emails with attachments to notify them of complaints such as potholes from residents, which of course, aren’t to be ignored. For this very reason an infected email attachment was opened, executed and it ran through the system.
  • Fortunately for them, they were able to stop the attack from spreading to other company functions and police networks in other towns by isolating their network and recouping their system from offline back-ups.

Business Decisions

Another example of an attack came from a client of Stu Sjourwerman’s security training firm knowB4.  The attack happened after an administrator opened an infected file, which ran through onto their 7 mapped server drives, encrypting all 75 GB of data held there.

There were many negative factors against them:

  • Firstly, they had unverified backups, which would take time to see whether they worked or not, a risk which would be costly to the time in terms of extended downtime with no guarantee of a successful restore.
  • Secondly, setting up a Bitcoin account involves a lengthy process to set up with society checks that can take days to complete.
  • In desperation with shortening their downtime, they decided to pay the ransom. It was a business decision, meaning either losing out $500  in Bitcoin or thousands for operation downtime.
  • The problem was, they didn’t have the Bitcoin to pay the ransom.

The turning point:

Bitcoin

  • Luckily, they had sought Stu Sjourwerman’s help, where he had Bitcoins at hand, ready for such an event like this one.
  • This company’s IT admins had, prior to this event, taken a security awareness course lead by ex- hacker Kevin Mitnick and with Stu Sjourwerman.
  • Contrary to the police case, this company had taken the advice from the course, and with Stu Sjourwerman’s Bitcoins, they managed to pay the ransom to avoid further downtime.
  • In the end they did recover their files; however there was corruption to one of their databases, which all in all took another painstaking 18 hours to return to normal.

Not all cases end well and not all ransoms release the files as promised. It’s really at the discretion the criminal cyber gangs controlling the attack.

For more ways to strengthen your office security and IT policy enforcement, contact your local IT professionals.

Read More
Windows CVE-2014-4114 Exploit
Windows CVE-2014-4114 Exploit

Zero-day Microsoft Windows Exploit CVE-2014-4114

Internet, Office IT, Security, , ,
20
Oct 2014

Windows CVE-2014-4114 Exploit

A Zero-day Microsoft Windows Exploit CVE-2014-4114 has been found which impacts all versions of Windows. Here’s what you need to know to protect yourself.

The Russian espionage group, known as the “Sandworm team”, are the prime suspects believed to have launched a campaign to exploit a range of Microsoft Windows vulnerabilities.  The exploits are classified as Zero-Day, meaning they are so new that no anti-virus companies have figured out how to detect them yet. The ultimate goal is to inject and execute malicious code into systems and networks to leach data from computers.

Sandworm Team Logo

Their targets have involved NATO, US academic organizations, Western European Union and Ukrainian government agencies, European energy and telecommunication companies.

Systems are infected from files being attached to legitimate looking emails and extended through to social engineering methods. Most versions of Windows are affected – including server 2008 and 20012, but excluding Windows XP.

Sandworm CVE-2014-4114 Vulnerability Timeline

iSight has provided a timeline of the Sandworm infection campaign.

The cyber intelligence firm, ISight, has been monitoring Sandworm’s activities. After alerting Microsoft, a patch was released called MS14-060 which is found in Window’s Automatic Updates. The fix is still an on-going work in progress.

The vulnerability explained

Here is a high level overview of what the CVE-2014-4114 Zero Day exploit entails:

  • The vulnerability allows a computer to have code executed remotely through a file that is initially opened by an unsuspecting user via an email attachment.
  • Within most software installation files, you’ll find a component called OLE (Object linking and Embedding) Package Manager.
  • An OLE package allows applications to share files and functionality.
  • The OLE package manager contains a file which permits it to download and run INF files.
  • This is where a computer is vulnerable since a hacker can run any program, virus or malware on a system.
  • Any acquired arbitrary code can then run from the downloaded INF files, which is presumed by the system to be associated with the application’s package.
  • This package will run from the logged-in user’s credentials, such as an administrator or anyone with admin rights.
  • The danger then rests from specific commands given to the file during the execution of the application.
  • It has been observed that unsuccessful attempts from this exploit can also lead to a denial of service, which can lead to service disruption.
  • As mentioned previously, the usual mode of target is through fake emails with attachments and social engineering, where the user would need to be convinced and tricked into opening the file.

Proactive measures to prevent an infection

Follow these guidelines to protect yourself or to quickly recover from a compromised system.

If you find your system compromised

For more details about the Zero-day Microsoft Windows Vulnerability CVE-2014-4114 issue and other security issues putting your business and private data at risk, contact your local IT professionals.

Read More
43 Percent of Companies had a Data Breach Last Year
43 Percent of Companies had a Data Breach Last Year

Report: 43% of Companies had a Data Breach Last Year

Office IT, Security,
24
Sep 2014

43 Percent of Companies had a Data Breach Last Year

A recent report from the Ponemon Institute shows 43% of companies had a data breach in the last year. Here’s how you can harden your office security.

The report cites data breaches affecting as many as 20 million people in one incident.  Criminals can use many different avenues into a company’s systems to steal client, proprietary or private information which then gets sold on the black market.  Here are some ways to harden your office security:

Keep an Eye on your Hardware

Data breaches often occur in the form of viruses, trojans or malware being installed on office computers.  These infections give criminals full control of the computer, even if it doesn’t look like it on the surface.  One of the first signs of infections are high hardware usage:

Patches, Updates and Security

When Microsoft releases updates to fix security holes, anyone is able to look at the update and determine exactly which weakness was fixed.  This is why it’s important to keep your system and anti-virus updated and patched:

IT Policy Enforcement

The first line of defense for any office or individual is a proper IT policy.  This means putting in place rules on systems or as policy to office staff on how to manage data to prevent infections and data breaches.  Here are some best practices we recommend:

For more information on managed IT services that can provide 24/7 monitoring, maintenance and IT management to prevent data breaches in your office, contact your local IT professionals.

Read More
1 … 42 43 44 45 46 … 49