Posts

4 Lessons from the Q4 Data Breach Review

/in

Last week, our strategic partner Privacy Ref held their quarterly review of recent data breaches.  In his presentation, Ben Siegel, CIPM, identified 4 lessons learned from recent data breaches, including: Google Android; Hillary Tentler, CPA; Folsom State Prison; and the Internal Revenue Service.

#1: Unauthorized Mobile Apps Create Risk

Issue: Users can download apps from sites other than the Google Play store. These apps are not “vetted” and gain access to tokens used to control users’ accounts.

Lesson: As the threat is outside of Google’s control, you need to put systems in place to prevent unauthorized apps from access your company’s data via mobile devices.

#2: Local Data is At Risk, Too

Issue: In the burglary of an accountant’s home, three hard drives were stolen and only one was recovered during the arrest.

Lesson: Physical devices, when stolen, can result in a serious data breach; While moving 100% cloud is more secure, it may not be a practical option for your business yet. You should ensure any local data is encrypted and subject to regular backup.

#3: Internal Breaches are Still a Breach

Issue: A file including names, social security numbers, and other sensitive data was saved to a shared location accessible to anybody in the organization.

Lesson: You can protect yourself from internal breaches with solutions that use defined business rules to automatically enforce permission restrictions based on the content of your files.

#4: It is Too Easy to Email Protected Information

Issue: Employees were sending emails with personally identifiable information (PII) clearly visible, in violation of regulatory requirements.

Lesson: You should not rely on people to do the right thing all of the time — mistakes happen and can be damaging and costly. System exist that scan and encrypt emails automatically if they contain sensitive or protected information.

Do you need a privacy assessment or a privacy plan review? Are you ready to better protect your data — on premise and/or in the cloud?

Contact us to discuss your needs.

 

Myth Busting Monday: Cloud Lacks Security

/in

Office365-Logo-and-textSecurity is still the biggest fear across SMBs considering the cloud.  IT leaders and C-level execs worry about spies, cyberthieves, governments, and vendors access their company’s data. This fear is unfounded.

You are the Sole Owner of Your Data; You Manage and Control Privacy and Access.

Like most reputable and trustworthy cloud providers, Microsoft runs the Office 365 based on several key principles:

  • Microsoft never mines your data for any reason other than to provide you with the Office 365 services
  • Microsoft’s staff does not have access to your data
  • If you leave Office 365, you can always take your data with you
  • You control the security and privacy settings; you determine who has access to what
  • Auditing and supervision prevent your admins from unauthorized access to your data

Beyond the core security and privacy capabilities of Microsoft Office 365, we offer additional configuration, tools, and services to ensure compliance with privacy regulations and/or your internal policies.

Fear not the lesser known security of the cloud. Learn, trust, and go.

This is the sixth of a multi-part series designed to help companies better assess the opportunity and value of cloud-based solutions. Contact us to schedule a free, no-obligation Cloud Advisor session to discuss your priorities and plans.

Fast Fact Friday: Ransomware Cloud Attacks

/in

Fast FactAccording to the Datto’s 2016 Global Ransomware Report, a survey of 1,100 IT service providers …

70% report Dropbox being the target of the ransomware attack

44% of attacks targeted Professional Services

38% of attacks targeted Healthcare

Are you moving to the cloud? Is your roadmap in line with your business goals? Contact us for a no-obligation Cloud Advisor session.

SMBs Benefit from Tech and Policy Mashup

/in

Westborough, MA – Faced with increasing regulations and a changing technology landscape, small and midsize businesses (SMBs) struggle to ensure compliance and maintain data privacy. With the sophistication of rasonmware attacks and advanced persistent threats, employee awareness and behavior is more important than ever. Cloud technology makes it easier to share, even when sharing is not appropriate.

To help SMBs tackle these challenges, Cumulus Global (www.cumulusglobal.com) and Privacy Ref (www.privacyref.com) announced a unique partnership designed to help SMBs assess their needs and risks, plan and implement sound privacy practices, and respond to threats and potential breaches.

“Smaller businesses face the same regulations and requirements of large corporations,” noted Bob Siegel, Founder and President of Privacy Ref. “SMBs generally do not have the internal resources and expertise to create and manage a privacy program. This partnership gives SMBs a place to turn for guidance, expertise, and results.”

In addition to privacy assessments and policy updates, the Privacy Education Programs provides SMBs with the awareness education and training needed to ensure employees understand the risks and their role in preventing attacks and breaches.

“Our role is to ensure businesses can avoid and prevent malware attacks and data breaches,” noted Allen Falcon, CEO and Pragmatic Evangelist at Cumulus Global. “We ensure that the protecting technology, policies and procedures, and people are working together for the greatest level of protection.”

Through the partnership, SMBs also gain access to a range of data protection and recovery services and tools. These tools help prevent attacks and breaches and facilitate response and recovery if needed.

Myth-Busting Monday: On-Premise is Safer Than Cloud

/in

Office365-Logo-and-textJust because you can see it and touch it, does not mean it is safe and secure. With the number of successful ransomware attacks up more than 400% in the past year, it is increasingly clear that on-premise systems are not inherently more secure than they would be in the cloud. Many companies are hacked and remain unaware for weeks or months, as the use by cyber criminals of advanced persistent threats continues to rise.

Microsoft Office is secured with technologies and resources beyond the reach of nearly every small and mid-market business.

Large enterprises know that security is a full-time job, requiring a team of expensive experts and advanced technologies. And while large enterprise can afford to make this investment, most small and mid-size businesses do not have the resources to prevent, detect, and mitigate security issues.

Moving to Office 365, you enter an environment designed for security, backed by a team of security experts, industry leaders in regulatory compliance, and the latest security technologies and methods. Office 365 complies with the latest rules and regulations, including but not limited to:

  • HIPAA
  • Sarbanes-Oxley
  • Federal Information Security Management Act (FISMA)
  • ISO 27001
  • European Union (EU) Model Clauses and U.S.–EU Safe Harbor framework
  • Family Educational Rights and Privacy Act (FERPA)
  • Canadian Personal Information Protection and Electronic Documents Act (PIPEDA)

And, with this security, you get a 99.9% uptime guarantee.

Thinking of going cloud — or expanding your cloud use — and remain concerned about security and data privacy, give us a chance to assess your needs and map out a solution.

This is the third of a multi-part series designed to help companies better asses the opportunity and value of cloud-based solutions.  Contact Us for more information or a free Cloud Advisor session.

Rethinking Risks and Responses

/in ,

Malware, Ransomware, Natural Disasters and More Keep Hitting SMBs Hard

Never have we had a greater ability to work together to get things done than we do right now. As our cloud and hybrid environments expand, the ease-of-use encourages us to share ideas and information and to collaborate in new and exciting ways.

Never have we been under attack from so many directions. Changing weather patterns and aging infrastructure leave businesses without power for days instead of hours. Fading employee loyalty means more chances for information to walk out the door. The same features that let us easily share information also let us accidentally share information we shouldn’t. Malware and viruses have evolved from a nuisance to potentially existential threats with the increase in ransomware and advanced persistent threats.

Our Businesses, Employees, and Customers Need and Expect Protection

With the risks and impacts on the rise, we as small and midsize business owners and technologists should rethink how we both prepare and respond. Since the dawn of business computing, large enterprises have built expensive solutions to ensure that their businesses keep running “no matter what”.  Now that we are in the cloud, and solutions are incredibly affordable, we need to adopt the same approach.

Business continuity is no longer just being able to keep your business running after a disaster.

Business continuity means that you are able to prevent business disruptions and distractions, regardless of the cause. Business continuity means …

  • You actively work to minimize the chance of a ransomware attack, and that you can respond and recover quickly should it happen.
  • You have systems and procedures in place to prevent data loss and privacy breaches, and that you can detect and mitigate issues quickly and effectively.
  • You and your team are no longer tethered to the hardware, Internet access, and electricity in your offices.

For SMBs, now is the time to consider the tangible and intangible costs of business interruptions of all types and to see the value in solutions to prevent and recovery. Understand the value proposition of that goes beyond dollars and cents to include the customer relationship impact and the toll that business disruption has on your team.

Food for Thought:

Email Encryption is Not Compliance

/in ,

Security Key
While providing a reasonable level of protection from inappropriate access to your data, the built-in encryption is not sufficient to meet information privacy regulations. Laws such as the Health Information Portability and Accountability Act (“HIPAA”), and industry regulations including the Personal Card Information (“PCI”) standards require more than data encryption.

Privacy laws and regulations typically include three components:

  1. Policies and procedures that, when followed, provide appropriate data protections
  2. A means to monitor compliance, with the ability to detect and mitigate potential violations of the policies and procedures
  3. A defined response and resolution procedure in the event of a breach

As explained in our eBook, Email Encryption in Google Apps, Technology can support the implementation of these three components, but does not offer a full solution on its own.

Contact us to assess your email encryption needs and to define an affordable solution.

 

What Are the Risks Involved With Cloud Storage?

/in ,

risks involved with cloud storage

While cloud storage offers numerous benefits, it’s important to be aware of potential risks associated with this technology. Here are some common risks involved with cloud storage:

  1. Data Breaches: Cloud storage providers are responsible for securing your data, but no system is entirely immune to data breaches. A breach could potentially expose your sensitive information to unauthorized individuals or cybercriminals.
  2. Data Loss: Although cloud storage providers typically have robust backup systems, there is still a small chance of data loss. This could occur due to hardware failure, natural disasters, software bugs, or human error. It’s important to have additional backup measures in place to mitigate this risk.
  3. Limited Control: When you store your data in the cloud, you rely on the provider’s cloud infrastructure and security measures. This means you have limited control over the physical storage environment, data handling processes, and security protocols implemented by the provider. It’s crucial to choose a reputable and trustworthy provider to minimize this risk.
  4. Service Disruptions: Cloud storage services can experience downtime due to various reasons, such as maintenance, power outages, or network failures. During these disruptions, you may be unable to access your data temporarily, which can impact your productivity or business operations.
  5. Compliance and Legal Issues: Depending on your industry or geographical location, storing certain types of data in the cloud may raise compliance and legal concerns. You need to ensure that your cloud storage provider complies with applicable regulations and provides adequate data protection measures to avoid potential penalties or legal consequences.
  6. Vendor Lock-In: If you heavily rely on a specific cloud storage provider and its proprietary technologies, switching to a different provider may be challenging. This vendor lock-in can limit your flexibility, scalability, and bargaining power. It’s advisable to choose cloud storage solutions that allow for easy data migration and interoperability.
  7. Dependency on Internet Connectivity: Cloud storage relies on an internet connection for data access and synchronization. If you have limited or unreliable internet connectivity, it can hinder your ability to access your data in real-time or perform backups effectively.

Other Human Risks Involved with Cloud Storage

A recent survey by WinMagic, a UK-based storage security firm, highlights some interesting, if not disturbing, information about employee use of cloud file and storage services. Speaking with over 1,000 employees at companies with at least 50 employees, the survey found that both users and businesses appear to be unclear about the need to protect cloud data, and how to do it.

Key findings of the survey:

  • Only 35% use a service sanctioned by their employer
  • 50% use personal equipment to access work information and services at least once a week
  • 65% of employees don’t have or don’t know the company policy on cloud storage
  • 5% use cloud services knowing that the service has been restricted by the company

The disparity between IT policies regarding the use of cloud storage and employees habits is troubling, particularly given the risk of data corruption, loss, and breaches.

The solution is not to avoid the cloud due to the perceived risks involved with cloud storage. Nor should you create a draconian culture around technology and cloud usage.

To mitigate Cloud Storage Risks, Consider Implementing the Following Measures:

  • Create and share a clear, concise policy on the use of cloud services, and IT in general, for your company
    • Clearly require that work related to data to be stored only in sanctioned systems and services, and the work and personal applications and data be completely separate.
  • Provide a suite of services that meet users’ needs
    • Ask users which tools help their productivity and evaluate the secure, business versions. Remember that one size does not fit all and you may need or want multiple options.
  • Monitor and manage access, security, and privacy
    • Deploy systems that let you monitor and manage access to company data, the security of the data, and your data privacy compliance. In addition to user identity and access controls, monitor and manage file permissions based on content along with 3rd party application (especially mobile app) access to your data.
  • Inform and educate your team
    • You do not need a series of boring lectures and meetings to indoctrinate your team into the new world order. A clear, concise discussion regarding appropriate use policies gets the message across.
  • Be nimble and communicate
    • Cloud is still fairly new and services are constantly evolving and launching. Users’ needs are changing constantly as well. If you can respond to your users with tools and services that meet their needs, you eliminate their “need” to circumvent the official tools. Communication about why certain

By being aware of these risks involved with cloud storage and taking appropriate precautions, you can make informed decisions about utilizing cloud storage effectively while safeguarding your data.

A balance of useful and secure cloud services, clear policies that promote responsible use, and tools that monitor and mitigate risks will improve not just your security profile, but your efficiency as a business.

We offer a range of data protection & security services, contact us to learn more.