DON’T FREAK OUT - JUST use MFA
Are you a business who is looking at a cyber insurance policy and just not ready to commit? Or, perhaps you haven’t renewed your cyber insurance policy recently? Read on, because this article is written just for you…
Requirements to get a policy are real! If you apply for a policy (or renew your policy) the following are hard requirements you need to have in place if you want to be covered. Don’t risk getting a ‘no’ from your insurance provider, be prepared starting with Multi Factor Authentication (MFA).
Cyber Insurance Prep for 2022
Are you a business who is looking at a cyber insurance policy and just not ready to commit?
Or, perhaps you haven’t renewed your cyber insurance policy recently?
Read on, because this article is written just for you…
RATES ARE GOING UP
No surprise that rates are going up especially since we’ve been seeing SMB rates for cyber insurance rise as much as 100% or more. The reason this is happening is because some insurers are taking unacceptable losses and are raising rates accordingly. Other insurers are not renewing or offering new cyber insurance policies going forward. A few are “pausing” writing new policies, probably trying to decide if they can weather the storm.
MFA TO HELP AVOID COVERAGE REJECTION
Requirements to get a policy are real! If you apply for a policy (or renew your policy) the following are hard requirements you need to have in place if you want to be covered. Don’t risk getting a ‘no’ from your insurance provider, be prepared starting with Multi Factor Authentication (MFA).
MFA is required for the following:
Microsoft 365 or other Hosted email services
VPN users
When enabling your Remote Desktop Protocol
WHY DO THEY REQUIRE MFA?
The above three areas are where most cyber incidents being which is why insurers will not cover your business if you won’t take these very basic (and often no cost) precautions. These days, not following this type of guidance is akin to inviting the bad guys in. Your business is NOT too small for the bad guys. They have an automated process which makes everyone a target, large or small.
WANT TO HEAR SOMETHING SCARY?
We received notice from our dark web monitor just yesterday that a client account was up for sale due to a phishing scam – this person’s email account credentials were up for sale and it was a current password! I logged in using the info the bad guys had, and lo and behold, someone from Russia was logged into the account too. Yikes! There was a 99.9% chance that this would not have happened if MFA was in use.
ON AVERAGE, 1.2 MILLION MICROSOFT
ACCOUNTS ARE COMPROMISED MONTHLY.
WHEW! CHECKLIST
1. Enable MFA for everyone using Microsoft 365, G-Suite, etc. and enforce this.
2. If you allow direct RDP access to computers and servers in your office, you really need to turn this off and pick a more secure method of remote access.
3. If you use VPN’s for remote access, enforce MFA usage.
4. Train your folks to recognize social engineering attempts and phishing (the most common form of social engineering we see) attempts along with clear guidance on what they should do when (not if) they encounter these situations.
5. Shore up your password policies. Require long, unique credentials for everything, backed up by MFA where possible. No password reuse either – it’s just inviting problems. Then, use a password manager to easily keep up with your good, unique passwords.
References
Technology Hurricane Preparedness Checklist
As Hurricane Michael makes its way towards Florida and the Southeast U.S., now is the time to take action and be prepared to protect your computers, printers, files and data.
As Hurricane Laura makes its way towards Florida and the Southeast U.S., now is the time to take action and be prepared to protect your computers, printers, files and data.
1. ENSURE YOU HAVE A BACKUP
Don't wait until the day before a hurricane to backup your files! It's good practice to frequently backup your data files. We recommend a hybrid-cloud image-based backup that can be used to restore data and applications even if your server is destroyed, and that can restore data from different points in time.
Print a copy of your important/emergency contacts and take them with you if you do not have access to them from your phone or computer, you'll have them available to use via a landline.
RealTime Clients: Everyone who is on our Business Continuity Service – Your servers are backed up and replicated offsite daily. If there is a problem, we correct that as part of the service. As hurricanes approach your physical location, we’ll be talking with you and confirm things are backed up and replicated prior to you shutting your operations down as part of your storm prep.
2. SECURE YOUR EQUIPMENT
COMPUTERS
Shutdown the operating system.
If connected to a surge protector or UPS - unplug from the wall outlet (or unplug power cables from the surge protector or UPS if wall outlet isn't accessible).
Unplug Ethernet cable from the back of computer or docking station.
PRINTERS
Power off the printer.
If connected to a surge protector - unplug as described above.
Unplug the Ethernet cable from the back of the printer.
Unplug the phone cable from the back of the printer (if a fax line is connected).
SERVERS AND NETWORK EQUIPMENT
Perform a normal shutdown of the servers. RealTime clients: Please coordinate with RealTime service desk.
Unplug all connections - Take photos to document how things were prior to the event.
Firewalls, Switches, Access Points - unplug them from power. Unplug the firewall from the internet connection as well. Ideally, unplug all the network connections (surges can travel through the network cabling).
Battery backups - power these off and then unplug them.
Phone systems - Check with your vendor to see what steps you can take to protect it.
3. PROTECT FROM WATER/WIND
When a major storm is predicted, elevate your CPUs, printers, servers, and other network devices, as well as other electrical appliances like space heaters, off of the floor. For high winds, move computers away from windows. If there is a possibility of water leakage, cover computer equipment with plastic.
4. CONTINUING OPERATIONS AFTER THE STORM
If you are in the path, power and internet connectivity may be hard to come by for a few days. Generators can provide enough power to run your critical computer equipment – just be sure you are connecting up to something that can deal w/ the power fluctuations many generators have. Please ask RealTime before connecting things up to generators as they can damage sensitive equipment. Modern battery backups may have the capability to condition the power off of a generator – check with the manufacturer to confirm before trying this.
4G USB modems or Mifi can get you connected in an emergency. Everything you do may not work, but basic web browsing.
Forward your phones – If the office is expected to be out a few days, most phone service providers have a way for you to forward calls to your business to a cell phone or alternate number. Get the steps now, before you need them.
5. BE PREPARED
Knowing what steps to take ahead of time will help you be prepared in the worst-case scenario. RealTime is committed to ensuring our clients are prepared with the proper technology to meet their current/future needs as well as advising them about safeguarding their business from weather-related, cyber and other disasters.
If you would like further information about RealTime managing Information Technology for your business, contact us at info@realtime-it.com.
HR's Role in Data Security
How should IT collaborate with HR to increase data security at your company? In this guest blog, our friends at PRemployer give us tips…
GUEST BLOG POST BY OUR FRIENDS AT PRemployer
HR's Role in Data Security
A common misconception in many businesses seems to be that IT, whether in-house or managed, is the only department responsible for cybersecurity. After all, it ultimately falls on IT to set the standard when it comes to cybersecurity, from setting policies that other employees throughout the company must follow to tracking and dealing with potential breaches and challenges.
In reality, however, Human Resources and IT work hand in hand to implement the company’s cybersecurity programs - all while ensuring that each member of the team has the knowledge necessary to help protect the company as a whole.
Ensuring Confidentiality
Over half of external attempts at infiltrating computer systems aim to uncover private customer or employee information. Hackers want access to that vital data to work their way deeper into your company or to take advantage of private information for their own purposes. In cases like these, HR and IT join forces to ensure confidentiality across the company.
Setting Expectations
When it comes to data management, HR policy should reflect IT's cybersecurity best practices. When the HR team communicates clear policies in support of IT security measures, they’re much easier to implement company-wide. For example, regulations might include:
How often the company will make data backups and who is responsible for ensuring that those backups are made each day;
How often employees will change passwords and specific password regulations;
Encouraging and implementing regular employee training so that employees know how to maintain security across the organization;
Establishing which devices can connect to the company network; and
Creating an expectation of how to respond in the event that an employee notices a potential breach or comes into contact with a phishing scam directed at the company.
When IT and HR work together to set clear, reasonable expectations that are well-documented, you can increase cyber protection across your entire company.
Balancing Access and Security
Each individual and department within the company may have different information they need to be able to access. Some employees need full access to as much information as possible, while others may need relatively limited access.
For example, the sales team might not need to have access to the same data as the team responsible for implementing contracts or checking compliance. Likewise, the average employee does not need to have access to other employees' records.
Both HR and IT departments should work together to determine what information needs to be kept secure and who should have access to it. Ideally, your company should segment its access so that employees who do not need to access private or confidential information cannot simply pull that information up. This helps to ensure that if one employee's account is compromised, much of the data throughout your company will still remain protected.
Conduct Training
Your employees are your most effective defense against many cybersecurity threats, especially phishing campaigns. By partnering with IT to identify cybersecurity best practices, the HR team can then train employees to provide a vital level of protection throughout the company.
Anti-spearphishing training, for example, can provide employees with the information they need to recognize phone calls and emails from a hacker determined to piece together enough information to threaten the company. When they know how to recognize a scam, employees can help protect your company.
Beyond training, HR helps to implement security awareness throughout the company by actively promoting IT best practices to employees. Cybersecurity should not be a one-time event for your company. Instead, it needs to be an ongoing campaign dedicated to keeping your company as secure as possible.
When HR and IT work together, you can set the tone throughout your business and provide employees with the security-minded tools and training they need to help decrease cybersecurity threats.
Dark Web Questions Answered!
Do you have questions about the Dark Web? We have an easy to read FAQ sheet for you to download in this brief blog post.
What is the Dark Web?
You’ve heard of the dark web…but what exactly is it? Here are some FAQs courtesy of DARKWEB ID.
The Dark Web is a hidden universe contained within the “Deep Web”- a sub-layer of the Internet that is hidden from conventional search engines. Search engines like Google, BING and Yahoo only search .04% of the indexed or “surface” Internet. The other 99.96% of the Web consists of databases, private academic and government networks, and the Dark Web. The Dark Web is estimated at 550 times larger than the surface Web and growing. Because you can operate anonymously, the Dark Web holds a wealth of stolen data and illegal activity.
Free download
Download the free DARKWEB FAQ sheet now!
Download a free FAQ sheet that explains how to protect yourself, what it means if your organization’s credentials have been exposed and much more…
Information courtesy of DarkWeb ID.
A How-To-Guide for Multi-Factor Authenticiation
Multifactor authentication (MFA) is defined as a security process that requires more than one method of authentication from independent sources to verify the user’s identity. In other words, a person wishing to use the system is given access only after providing two or more pieces of information which uniquely identifies that person.
