Posts

Phishing Attacks Spike Amid COVID-19 Crisis

/in

Cyber AttackIt should be no surprise to you that we are seeing a surge in phishing and other cyber attacks, as criminals look to take advantage of the COVID-19 crisis. A sample of recent news reports illustrates the scope of the problem.

  • In April, the FBI issued a warning about COVID-19 stimulus package scams (CNET).
  • In mid-April, Google reported the daily volume of malware and phishing attack emails jumped to more than 18 million per day (The Verge).
  • Last week, TechRepublic reported a surge in phishing emails trying to exploit DocuSign and COVID-19.
  • Hackers are impersonating Zoom, Microsoft Teams, and Google Meet for phishing scams (The Verge 5/12/20).

Understand the Risk

The risk to your business, employees, and customers is greater at time when your systems may be less secure.

If your employees are using home computers while following stay-at-home orders and guidance, your risk of falling victim to an attack is significantly greater.  Most home computers do not have commercial-grade, next-generation endpoint protections and many run outdated versions of the consumer-grade products installed.

CPR is Still the Best Practice

Our model remains the best, holistic method of avoiding attacks at the human and tech levels, and for responding should something slip through.

Communicate & Educate

  • Remind your employees to be on the look out for suspicious emails, phone calls, web links.
  • Encourage your team to get help and verification if a message or interaction appears or feels suspicious in any way (better safe than sorry).
  • Consider testing employees with simulated attack messages and identify those that may need additional training and guidance.

Prevent & Protect

  • Deploy multi-factor authentication (MFA) and, optionally, single sign-on (SSO) services to prevent the use of compromised accounts.
  • Install Advanced Threat Protection solutions for inbound and outbound email to catch phishing, ransomware, and other illegitimate message.
  • Deploy “next generation” endpoint protection on computers and mobile devices to detect, prevent, and undo damage from dangerous files and applications.
  • Put Web and DNS protection services in place to prevent downloading attacks from hacked websites and identity impersonation.
  • Monitor the “dark web” for direct and third party breaches that may compromise your employees’ business accounts.
  • Take advantage of data loss prevention features built into G Suite and Microsoft 365, and consider tools to identify and prevent unauthorized access, permission errors, and data loss.
  • Eliminate the use of “shadow IT” services, particularly free or consumer-grade services by providing those capabilities to employees and making sure they know how to use them.

Restore & Recover

  • Ensure that you back up and can recover your data, regardless of location.  Your data is not just on your physical or virtual servers, it resides in your Microsoft 365 or G Suite environment, in SaaS applications like Salesforce, on desktops and laptops, and on mobile devices.
  • Put business continuity systems in place with affordable services that let you spin up and run images of your servers and workstations in a cloud data center while you recover your primary systems.
  • Have a breach response plan and service in place as an increasing number of attacks are stealing information, as effective data breach response involves:
    • Forensic analysis and recovery
    • Legal compliance with reporting requirements
    • Legal strategies to minimize liability
    • Increased customer service demand
    • Communications with customers, stakeholders, and the media
    • A potential need to provide consumer protection services
    • Cyber Insurance claims management

Fortunately for most businesses, putting these protections in place is affordable and can be done with minimal impact on your employees and their productivity.  Understand your needs, assess the value proposition (include the risks and costs of doing nothing), and deploy a solution that is the best fit for your business.

Please contact us for assistance as you evaluate your risks, needs, priorities, and solutions.

 

See the Best Single Sign On (SSO) Solutions For Small Business and Even Better Alternatives

/in ,

In today’s fast-paced digital landscape, small businesses face numerous challenges when it comes to managing user access to various applications and systems. A single sign on for small business is unlike the traditional methods of authentication, such as separate usernames and passwords for each platform, can be cumbersome, time-consuming, and prone to security risks. That’s where Single Sign-On (SSO) solutions for small businesses comes in.

Single Sign-On is a powerful authentication solution that enables small businesses to simplify and centralize user access across multiple applications, platforms, and services. With SSO, employees and stakeholders can log in once using a single set of credentials and gain seamless access to all authorized resources.

This technology not only enhances convenience and productivity but also strengthens security measures by reducing the risks associated with weak passwords, password reuse, and unauthorized access. By implementing SSO, small businesses can effectively mitigate the complexities of managing multiple logins and bolster their overall operational efficiency.

As you move your small or midsize enterprise into the cloud, you will face new challenges around identity management.  Historically, identity management was an operational issue that managed user logins to desktops and local area networks. As you move to the cloud, the network is no longer local. Your network includes the suite of applications and services run and hosted by others. Identity management is now a security issue that should control access to your cloud applications, data, and services as well as your computers and mobile devices.

Single Sign On for Small Business

Even with the proliferation of usernames and passwords, most small businesses are not investing in Single Sign On (SSO).  With many applications using federated or 0Auth login services from platforms like Google Apps or Office 365, SMBs expect users to adapt and manage their identities. The result is a mix of usernames, passwords, and connections without a clear system of record and no centralized management. And while Single Sign On can help eliminate this mess, most SMBs struggle to justify the value.  In addition, single sign on solutions for small businesses lack the ability to manage access to devices, WiFi services, and other resources.

With SSO in place, you still need to manage and maintain a directory service. Directory services, such as Microsoft’s Active Directory and the many LDAP solutions are, in theory, capable of managing more than on-premise systems. Actually integrating directory services, however, is complex, costly, and requires regular maintenance.

Directory-as-a-Service and Identity Management

Directory-as-a-Service® (DaaS) is a modern identity platform that centrally manages user connections to this new world of cloud and SaaS-based infrastructure.

Compared to a single sign on for small businesses, it acts as a virtual directory, enabling businesses to securely manage user accounts, permissions, and policies across diverse applications, systems, and even remote environments.

Identity Management, on the other hand, refers to the processes, technologies, and policies that govern the lifecycle of user identities within an organization. It encompasses activities such as user provisioning, authentication, access control, and user lifecycle management. By implementing Identity Management practices and leveraging DaaS, businesses can streamline user administration, improve security, and enhance operational efficiency.

Features of a cloud-based directory service include:

  • Mac, Windows, and Linux devices are all treated as first-class citizens
  • Tight integration with Office 365 and Google cloud Apps, centralizing control over the productivity platform and enabling single sign-on capabilities for end users
  • Single Sign On integration with other cloud applications and services
  • Improved WiFi security that connects the authentication request to the directory service
  • Multi-factor authentication at the system level
  • Hosted LDAP capabilities can eliminate the need to have an on-prem LDAP server

In short, Directory-as-a-Service covers what contemporary organizations need in a modern identity management platform.

Learn more about Directory-as-a-Service and JumpCloud (our preferred DaaS solution), or contact us for a free, no obligation Cloud Advisor Session.

 

Chromebook SSO Eases Access Administration

/in ,

Single Sign-On (SSO) enables users to access multiple systems and applications with a single username and password, and a single login screen.  And while many schools and businesses use SSO for Google Apps and related solutions, Chrome devices have always required a separate login.

To easy access administration and simplify user logins, Google has launched SAML-based SSO login for Chrome devices.   Organizations running current versions of Chrome on devices registered via Chrome Management licenses can now extend their Google Apps SSO login to the registered Chrome devices.

Feel free to contact us if you would like more information or assistance with your setup.

 

Tuesday Take Away: DLP in Google Apps

/in

In at least one prior post, we have written about the nature of data protection and the reasons for backing up information in the cloud.  Backupify, one of the vendors we work with often, recently conducted  a study of known data loss incidents in Google Apps with known resolutions.   Here is what they learned:

  • 0.00% = Due to Google systems or software
  • 4.05% = Due to an integrated, third party application
  • 10.81% = Due to unauthorized use of a users’ credentials
  • 85.14% = Due to user action

What does this mean?

For most Google Apps users, the best mechanism for Data Loss Prevention (DLP) is to protect your data from user error and malicious acts.  In other words, back up your data!  Assess your needs with respect to retention period and retention points, and pick the backup solution that best meets your business needs.  And remember, backups solutions for Google Docs should do more than export with conversion.

In addition, users should understand the importance and risks involved in sharing account information or using weak passwords.  If you want to enforce best practices, consider Google Apps Directory Sync or an affordable Single Sign-On (SSO) solution.

Drop us a note if you want to know more.