The Dark Web and Its Impact on Your Business

by

Business owners today know the internet is not only a force for good. Some people exploit the Web for ill intent. They congregate on the Dark Web, and small businesses need to understand the risks.

What is the Dark Web?

You and your employees spend time daily on the Web. They’re researching clients, checking out competitors, and searching for information. They are not accessing the Dark Web. The Dark Web houses dangerous, often illegal activity. This includes black-market drug sales, illegal firearm sales, and illicit pornography.

The Dark Web’s collection of websites is inaccessible using standard search engines or browsers. Users employ a Tor or I2P encryption tool to hide their identity and activity, and they spoof IP addresses.

To go into the Dark Web, you also need to be using the Tor or I2P service. Plus, you’d need to know where to find the site you are looking for. There are Dark Web directories, but they are unreliable. The people on the Dark Web don’t want their victims to find them. Ultimately, it’s not somewhere you or your employees need to be.

So, why do you need to know about it? Because Dark Web users can buy:

  • usernames and passwords
  • counterfeit money
  • stolen credit card numbers or subscription credentials
  • software to break into people’s computers
  • operational, financial, or customer data
  • intellectual property or trade secrets

The Dark Web is also where someone can hire a hacker to attack your computers.

The Dark Web business risk

The Dark Web itself isn’t illegal, and not all its traffic is criminal. It is also visited by journalists and law enforcement agencies, and it’s used in countries prohibiting open communication.

Yet the number of Dark Web listings that could harm your business is growing. A 2019 research study found that 60% of all listings could harm enterprises, and the number of those Dark Web listings has risen by 20% since 2016.

Business risks from these Dark Web listings include:

  • undermining brand reputation
  • loss of competitive advantage
  • denial-of-service attack or malware disruption
  • IP theft
  • fraudulent activity

With media attention on data breaches impacting millions, it’s easy to think a small business is not at risk. However, bad actors don’t target a business for its size – they look for ease of access.

Dark Web information is up to twenty times more likely to come from an unreported breach. Privacy specialists told a Federal Trade Commission Conference victims included medical practices, retailers, school districts, restaurant chains, and other small businesses.

Reduce your risk

If your information ends up on the Dark Web, there’s little you can do about it. The bright side, at least, is that you would know that your business security has been compromised. Be proactive instead. Keep your security protections current, and install security patches regularly.

Consider a unified threat management (UTM) device, or UTM appliance. The UTM plugs into your network to serve as a gateway and protect your business from malware, illicit access, and other security risks.

Your UTM security appliance can provide:

  • application control
  • anti-malware scanning
  • URL and content filtering
  • data loss prevention
  • email security
  • wireless and remote access management

Or let a managed services provider (MSP) take care of all aspects of protecting your business. Pay a consistent monthly fee for an MSP to handle all your technology, patching, monitoring, and assessment needs.

Stay on top of the latest cybersecurity threats with an MSP, or learn more about installing a UTM. We can help protect you from the dangers of the Dark Web. Call us today at 478-474-0861!

Facebook is for Sharing, Not Storing

by

When was the last time you held an actual photo album or actual prints of photographs in your hands? Maybe you look back at older photographs only when Facebook’s TimeHop app reminds you of a pic from five years ago. If so, you may be risking your visual history.

Facebook is a great way to share photos with friends and family around the world. You get to enjoy their comments and the affirmation of their likes. But using Facebook as storage for your photos is not a good plan. Here’s why.

Some people treat Facebook as their photo album archive. They delete the originals from their devices or digital camera when they need more space. But Facebook compresses images for faster download. It satisfies impatient social media users, which means photo quality suffers. If you wanted to print those photos in the future, they wouldn’t look as good as the originals.

That’s not the only drawback. When you trust Facebook with all your photos, you’re letting a company control your visual archive. It’s hard to imagine, given Facebook’s reach today, but what happens to your photos if the company goes defunct? We don’t know. The people who were keeping their photos on Myspace in 2006 might have an idea.

The younger crowd is already moving onto other social platforms. Plus, Facebook’s growth rate in North America and Europe is slowing. Those daily active users are the primary source of revenue. So, you know Mark Zuckerberg is in some meetings about that.

Even if Facebook continues as the business behemoth it is today, we don’t know what policy changes it might make. It could change its terms of service whenever it wanted (if you even read those in the first place). Users have no guarantee for how long Facebook will store their images or any type of content.

Keep in mind also that many of the photos showing up in your timeline are actually taken by friends. Facebook provides an entire album of other people’s photos when they’ve tagged you, but if they decided to untag you or remove it, that photo would be gone.

Finally, there’s also the risk of your account getting shut down or hacked. You’ve probably had friends warn you not to accept any new friend requests from them because they’ve been compromised. You wouldn’t want a thief to steal all your photo albums. Similarly, you don’t want a cybercriminal to gain access to all your images.

Our Recommendation

Just as with data, we recommend you have a “3-2-1” backup system for your digital photographs. This means having three copies of the photos you care about. You don’t need to back up the blurry ones if you don’t want to.

You might keep one copy on the original device, but you’d have two other copies of the high-quality, uncompressed, original image as well. One might be kept on an external storage device such as a USB thumb drive, and the other you could upload to cloud storage.

The cloud backup gives you access to the photos from any device in any location. So, if a flood, hurricane, or fire devastates your home, and you lose your device and the USB thumb drive, you still have a backup. Your Facebook photos and videos are just there to be shared with friends and family.

Not sure where or how to safely store your photos and videos? We can help! Our experts may even become new Facebook friends. Then we can all like each other’s photos with the peace of mind that the original photos aren’t going anywhere.

Why You Need Professional Virus Removal

by

“Your computer has a virus.” Such a dreaded five words! We don’t want to come down with a human virus; we’ll feel awful and miss work. But when a virus hits our computer, we could lose valuable information or be vulnerable to attack. Chicken soup won’t cut it.

Perhaps you have an antivirus product installed on your computer. This computer software is intended to prevent, detect, and remove viruses. Antivirus tools are designed to keep infections out. They can also delete any viruses that may already be on the computer when the software is installed.

The software provides protection by tracking malicious code and other computer threats via:

  • classifying the actions the file or code drives (as malicious or OK);
  • inspecting file signatures for matches to an existing signature in its virus dictionary;
  • scanning for rootkits that can change how your operating system functions.

However, antivirus software isn’t that good at cleaning up. When it detects a malicious file, it will delete it. But what if the virus spread before discovery? If the infection spreads before virus deletion, it can do all sorts of damage.

Think of it this way: you have a cyst on your knee. Doctors decide it is pre-cancerous and operate to remove the cyst before it spreads. But, that’s all they do. They have seen the cyst. They go for the cyst. However, they don’t notice the cancer that’s in your shin or femur, because they were only working on the cyst. The rest of your leg remains unhealthy, and you don’t even know it!

Getting a Second Opinion on Viruses

If the antivirus software is your primary physician, a computer professional is the specialist you go to for an expert second opinion. For one thing, antivirus products don’t always remove all the malicious files. Many viruses start as one thing but can mutate into several different strains. The antivirus software may not be programmed to identify all of the virus variants. A professional actively looks for undetected strains on your computer.

Viruses are always evolving. A recent strain of malware, SquirtDanger, let hackers take computer screenshots, capture passwords, download files, and empty out cryptocurrency wallets.

Some viruses can change the settings of your computer. For instance, a common virus changes your computer’s DNS, which is like a bit like the Yellow Pages for the internet. On a virus-free computer, when you type in “Google.com”, your browser goes to Google’s servers located at the IP address “216.58.203.100.” However, an infection can make Google.com on your computer go to a different address. Perhaps a server address cybercriminals use to capture your personal data. It still looks to you like Google, but it’s no longer safe. These settings can still remain after the infection is long gone.

Viruses can also leave behind browser toolbars, extensions, and other nasties designed to spy on your Web browsing habits. If you’re consistently redirected to unwanted sites, or seeing unwanted pop-up advertisements, it’s likely your computer’s infected with a browser hijacker.

Ultimately, if you detect a virus on your computer, check with a professional. Don’t trust that your antivirus software is going to do the same, thorough job an expert can offer. Sometimes your computer isn’t fully safe until the operating system is reinstalled, but you can’t know that until someone can go in and see what the virus did and what remnants are still there, lurking.

Cybercriminals are growing more sophisticated and better able to design viruses that disguise their tracks. Avoid being an unwitting victim. A computer security expert can diagnosis when your computer gets a virus, or determine if there are strains on your device you don’t know about. Let a security expert protect your computer from harm today! Call us at 478-474-0861.

Are You Due? What to Do When You Get a Renewal Notice

by

Your business relies on any number of service providers. You’re likely contracting for domain names, website hosting, data backup, software licenses, to name just a few. And that’s only your online presence! So, when a renewal notice comes in, you might just forward it on or file it away for future reference. Here’s what you should be doing instead.

First, when you get a renewal notice, you should confirm that it’s legitimate. This is especially true of domain names. Your business’s domain name and expiration date are publicly available. Anyone could look them up and send you an invoice. Scammers do. They monitor expiring domain names and then send out emails or convincing physical notices telling you it’s time to renew. They are not doing this as a civic service!

Instead, they will be trying to get you to switch your domain services to a competitor or, worse, hoping you’ll pay your renewal fee to their account, which has no connection to your domain.

  • Look out for the following indicators that the notice is a fraud:
  • The price is much more than you’d expect.
  • The deadline is within seven days.
  • You don’t know the business name.
  • This business has never contacted you before.
  • The notice requires you to send a check.

Handling Authentic Renewal Notices

Once you’ve determined the authenticity of the renewal notice, you’ll want to take stock. Putting your licenses or other online services on auto-renewal plans can be easier, but it may not be cost effective. Before re-upping your plan consider:

  • Are you still using this service?
  • Do you really still need it?
  • Do your current needs meet your current plan?
  • Should you upgrade or downsize?

You might also contact your provider directly and ask:

  • Is there a better product available now?
  • Are you eligible for a loyalty discount?

The company you’re dealing with wants to keep your business (hence, the renewal notice). That can give you some leverage in negotiating what you are paying or what service you are getting. You could treat an annual renewal notice as an opportunity to renegotiate terms. It’s not always going to work, but it can be worth a phone call as you try to keep business expenses under control.

Finally, you should pay attention to any deadlines on the renewal notification. Some are sent months in advance. That seems so helpful, but if you put it away to deal with later, before you know it you’ve missed an important date and the service is stopped.

You should always get a renewal notice for something like a domain name. The Internet Corporation for Assigned Names and Numbers (ICANN) requires companies to send reminders approximately one month and one week before your domain name expires.

Don’t leave your renewal to the last minute. With expired domain names, for instance, you can lose your website! Options and fees for renewing domain names, including expired ones, are going to vary, so be sure you know what your subscription involves.

Also, there are bad actors out there who monitor domain expirations to buy them up at bargain prices. Then, when you notice the subscription has lapsed, you have to pay a king’s ransom to get the Web address back. Yes, it can happen to you. In fact, the World Intellectual Property Organization (WIPO) handled a record 3,074 cybersquatting disputes last year.

Avoid being overwhelmed by all the subscriptions and service plans your business relies upon. A managed service provider (MSP) monitors your license and domain expiration dates to ensure your business is current. At the same time, the MSP has the expertise needed to determine what plans best suit your business needs.

Give us a call at 478-474-0861 to enjoy the peace of mind a managed service provider brings!

Handle with Care: Sending Data Securely

by

In our digital economy, we send and receive information quickly online. The Internet offers immediate communication with colleagues, clients, vendors, and other strategic partners. Yet we shouldn’t prioritize convenience over data security.

What data do you send in a day’s worth of emails? Sensitive data you send might include:

  • personally identifiable information (PII);
  • credit card or payment card information;
  • attorney’s client privileged information;
  • IT security information;
  • protected health information;
  • human subject research;
  • loan or job application data;
  • proprietary business knowledge.

The problem is people sending without thinking about the security of the transmission. One way to gauge the need for security is to consider how you might send that same information via the postal service. Would you put that data on a postcard that anyone could read? Or would you send a sealed, certified mailing and require the recipient’s signature?

Transmitting data on the Internet in plain text is like the postcard – anyone can read the information. And before you think that no one can actually see your data in transit, think about where you are sending from. Your office network may be password protected and secure, but what if someone waiting for their coffee at Starbucks opens the message using the free Wi-Fi network?

Anyone can intercept communications on open networks with the right tools. This type of cyberattack is common enough to merit its own name: a “man-in-the-middle” attack.

So, how can you stay safe when sending sensitive data?

Embrace encryption. Encrypting the data is like sending that sensitive information in a locked box. Encryption encodes the information to add a level of security. If encrypted data is intercepted, the scrambled data is unreadable by unauthorized users. Only a user with the correct decryption key can access the text.

Encryption also provides additional confirmation that the information is coming from a reliable source.

Your business should also require Secure File Transfer Protocol (SFTP) for sending and receiving large or numerous digital files. You may have heard of FTP, but this file transfer protocol is not encrypted. SFTP is the secure version of FTP, as it encrypts the files in transit. If a nefarious entity does intercept the files, it won’t be able to read them without the decryption key.

Specifically, encourage your employees to:

  • use encrypted email only (common providers such as Gmail and Outlook support it; others require third-party apps or services);
  • encrypt files before sending to the cloud (in case accounts are breached or services hacked);
  • never open business communications on unsecured Wi-Fi networks;
  • keep good track of laptops and other portable devices and use drive encryption in case – with encryption, a lost laptop or stolen thumb drive is more secure, and criminals will have a difficult time stealing sensitive information, too;
  • control data access – grant permission to view, edit, or send files with sensitive information only to users who need that data for their jobs.

Managed service providers help your business decrypt how to send its sensitive information. Turn to experts in cloud services and IT security to learn how to securely send and receive data.

Contact us today at 478-474-0861!

LetMeIn101: How the Bad Guys Get Your Password

by

Passwords are essential to your cybersafety. You know it, but if you’re like the rest of the digital society, you probably have dozens of passwords to remember. It’s a lot. So, you might take shortcuts. Taking advantage of your laissez-faire attitude is one way bad guys access your passwords.

Incredibly, there are still people out there using “password” or “123456” in their access credentials. Some people don’t change the default passwords on their devices. So, anyone can pick up a router, look at the sticker identifying the password, and access that network.

Tip: Avoid the obvious passwords! When you have to create a password, make an effort. When it’s time to update a password, do so. Steer clear of simple, easily guessed patterns.

Cybercriminals can also guess your password. With a little bit of research about you online, they can make some informed guesses. Common passwords include pet names, birthdays, and anniversaries. These are all easy to find via your social media accounts.

Tip: Be careful what you share on social media! Don’t befriend strangers, as you are giving them access to a goldmine of info for personalizing an attack on you.

If that doesn’t work, criminals may try brute force. They might script an automation bot to run thousands of password permutations until they get a hit. The software will try a long list of common passwords and run through dictionary words to gain access.

Tip: Use a complex password with numbers, letters, and symbols or a passphrase. A passphrase is typically at least 19 characters long but is more memorable, as it unique to you.

The criminal may also be working with info from a data breach. In early 2019, a security researcher found more than 2.7 billion email/password pairs available on the Dark Web. Criminals accessing that database could use the data as a starting point, as many people duplicate their passwords across accounts.

Tip: Use a unique password for each site. Yes, that’s overwhelming to remember, and that’s also why you should use a password manager to keep track of it all for you.

Criminals can also access your account if you’ve used a hacked public computer. The bad guys may have installed a key logger on the computer. The logger records every key you press on the keyboard. Or they might have compromised a router or server to be able to see your information.

Tip: Be cautious about your online activity on computers or networks you don’t trust.

Of course, there’s one more method of getting your password that we haven’t addressed yet. It’s the familiar phishing attack. For instance, you get an email that looks like it was sent by your bank. Phishing typically has an urgent message and a link that directs you to what looks like a credible page.

Tip: Pay attention to who is sending the email and hover the mouse over the link to see where it goes. If you are concerned about your bank account, for example, open up a browser and type the URL manually rather than clicking the link.

These tips can help you to protect your valuable passwords. Still, setting up a password manager and amping up your internet security can help too. Need support getting ahead of the cybercriminals?

Contact our experts today! Call us at 478-474-0861.

Island Hopping: Not Always a Good Thing

by

The phrase “island hopping” conjures up positive images. You might think of cruising beautiful sandy beaches on a tour of tropical islands. Too bad cybercriminals have given the term a new, less pleasant spin.

Island hopping is an increasingly popular method of attacking businesses. In this approach, the cybercriminal targets a business indirectly. The bad actors first go after the target’s smaller strategic partners. So, vendors or affiliates, who might not have the same level of cybersecurity, become stepping stones to hop.

Attackers might hack into smaller businesses handling the target’s HR, payroll, accounting, healthcare, or marketing. Then, they take advantage of the pre-existing relationship to access the final destination.

Humans are trusting. Cybercriminals exploit that. With island hopping, attackers leverage the trust established between strategic partners.

It’s quite simple: attackers gain access to Company A and send a counterfeit business communication to Company B. Company B, knowing the sender, is less likely to question a download link or opening an attachment.

After all, it’s not coming from a stranger; it’s a message from perfectly pleasant Jenny at Company A. You may have in the past already shared logins to various sites/portals, or passwords to unlock zip files.

The Rise of Island Hopping

This is not a brand-new form of attack. In fact, it’s named after a military strategy which the United States used in World War II to establish a stronghold in the Pacific Islands.

Perhaps the best-known island-hopping cyberattack was seen in the United States in 2013. Retail giant Target was the aptly named target of a point-of-sale system breach. Hackers stole payment information from 40 million customers. The first “island” in the planned attack was Fazio Mechanical Services. The heating and refrigeration firm suffered a malware attack shortly before Target’s breach. Fazio’s hackers stole email credentials needed to access the retailer’s networks.

As enterprises continue to strengthen their cybersecurity, it’s predicted that island hopping will gain momentum. According to Accenture’s Technology Vision 2019 report, less than a third of businesses globally know how strategic partners secure their networks. A majority (56%) rely on trust that business partners would uphold security standards.

Preventing Island Hopping

You may be one of the islands to hop or the attackers’ final destination. It depends on your business size and industry. Either way, your business is vulnerable to malware attack, infected systems, or a data breach. Plus, if you’re the stepping stone, you’re likely to lose the target company’s business, too.

How do you prevent island hopping? First, secure your own networks and systems:

  • Follow best practices to detect and identify vulnerabilities and reduce risk.
  • Educate your employees about the dangers of business communication scams.
  • Raise awareness of phishing schemes and social engineering.
  • Require two-factor user authentication.
  • Change all default, generic, or predictable passwords.
  • Keep security up to date (patching and system upgrades are mandatory).
  • Control who can access your networks and servers.
  • Protect all endpoints (including employee devices in a Bring Your Own Device workplace).

When it comes to cyber island hopping, your business doesn’t want to be a layover or the final destination. Keep your cybersecurity borders tight to avoid unwanted visitors.

Want to make your business inhospitable to island hoppers? Work with a managed service provider. They can help assess cybersecurity, provide a plan to reduce risk, and upgrade technology. Let us support your efforts to fend off unwanted tourists.

Give us a call on 478-474-0861.

Are You Sick of Ongoing IT Issues?

by

Like a persistent cough or muscle strain that won’t go away, many IT issues prove ongoing. Every time they come back you think about getting an expert’s opinion. Then, the cough fades, you can walk freely again, or your computers are back up and running. You keep on going. Until the next time. If you’re sick of ongoing issues with your IT, look to a Managed Service Provider (MSP) for help.

There are many IT ailments that can negatively impact your ability to do work. Let’s consider some of the particularly common ones, and why an MSP is the right prescription.

#1 Network and Internet issues.

Business is done online these days. Not being able to connect to the network and slow connections are frustrating. Without the Internet, how can you do your job? You can’t even check and send emails! Let alone access team documents or enter data into cloud-based accounting software. A lagging network also slows down application and data loading time. It may only be a few moments of thumb twiddling. But add that up over several times a day and multiple by employees. You’re looking at a decrease in productivity that adds up.

An MSP has the know-how to survey the IT environment for what’s causing these frustrations. When there’s a problem, they’re at the ready to resolve it and help improve reliability.

#2 Repeated malware infections.

This can mean a couple of things. First, you don’t have effective system and application protections in place. These attacks shouldn’t be able to make it through the door in the first place. With the right firewalls, anti-spam, and protections, you should be able to keep your system on lock down. You don’t have to do this yourself. Your internal IT team has a lot to manage and monitor. Gain expert backup with an MSP reviewing your security protocols to keep the bad guys at bay.

Secondly, educate employees about the dangers of social engineering. Don’t let them keep falling for the pretexts and downloading malicious files. Also, ensure passwords are strong enough to avoid adding another point of entry.

#3 Printing problems.

Many businesses are printing less today, but we’re not done with hard copies entirely. So, when a printer starts whirring, spinning endlessly, or can’t connect, efficiency halts. Know that printers sold at big box stores are consumer grade quality. Avoid printer frustrations with solid business-class printers (which your MSP can identify).

#4 Application overload.

Maybe some of your employees prefer Dropbox. Others rely on their free Gmail accounts. This hodgepodge of options can cause chaos. Staff have difficulty remembering the passwords to all of the accounts they need. So, they simplify, and that makes their accounts more hackable.

Upgrading to business-grade versions of important applications is easier with an MSP. They’ll help identify the software that best addresses your business needs.

#5 Aging technology.

You’ve had your current computers for ages. They are slower than you’d like, but you don’t have the time to look for something else. Plus, you can’t imagine having to learn something new. You’re too busy. But aging tech is more likely to fail, which could prove catastrophic if you don’t have the right systems backup.

MSPs know IT. Based on your individual business needs, they can suggest a plan of attack to update the IT and keep it secure. They can also provide backup strategies to prepare for the worst and recover quickly.

Basically, a managed service provider has your back when it comes to IT. Work with experts who focus on technology day in and day out. You’ll typically save money and gain time to spend innovating in your field.

Gain a competitive advantage with the support of an MSP. Give us a call at 478-474-0861 today!

Invest Well in Your IT Security

by

“If it ain’t broke, don’t fix it” is a common and useful rule for many business owners. It serves to protect your business against unnecessary costs and unneeded downtime. While protecting your business against many types of danger, it poses an outright threat when it comes to IT security.

Security threats to your firm move so fast that your IT should be working twice as hard as your company just to keep up. Every day, hundreds of thousands of new malware threats are released. Falling even hours behind means any one of these attacks can threaten your business.

The single most dangerous thing IT security can do is stand still. Keeping up with the latest advice, technology, and updates the security industry offers is vital to keep your business safe. This makes up much of the unseen job of IT professionals. Hackers never stop looking for new ways into your system, which means your security can’t stop looking for ways to keep them out.

Modern Systems for Modern Business

One of the most common security threats a business opens itself to is using an outdated operating system or software package. Many firms are scared to upgrade, update, or renew their IT over fears of breaking legacy systems. Many rely heavily on old software and are afraid to make a large change themselves. Some businesses today still run machines on Windows XP, an operating system first released back in 2001.

Old operating systems stop receiving security updates and patches that protect against newly released attacks. These systems become very vulnerable, presenting a large target for knowledgeable hackers. This happens many years after newer versions have been released, giving knowing IT firms a chance to migrate safely.

Hackers are always on the lookout for businesses that run IT equipment outside of its suggested service life. A server, desktop computer, or peripheral is a golden opportunity for criminals to enter and threaten a business.

Hackers purchase their attacks on the dark web, safe in the knowledge that old systems won’t be patched. These attacks can then be used to attack unguarded firms to steal or compromise vital company data.

An unpatched old machine is like a valuable security door left propped open overnight, a golden opportunity for thieves.

Smart Budgets

Budgeting for business is a difficult task. We aim to make the most of everything we spend and reduce spending as much as we can. IT security can easily fall very far down the list of priorities.

IT can seem like an easy way to cut costs. It’s a department that the customer doesn’t always benefit from directly, and when it’s working well, it might not be on the radar at all. Despite working largely behind the scenes, successful IT is one of the critical components of every highly successful firm. Good IT can be the binding glue that holds the company together.

Even businesses far removed from the IT world typically uses payment machines, ordering systems, and inventory. Even restaurants and retail stores rely on computers to operate. Downtime for any critical system can be a complete disaster. A business can be unable to trade, and costs can mount up fast.

When vital IT components are used by the customer, a sales website, or an automated booking system for example, the problem can multiply tenfold.

Keep On Top Of The Essentials

Good IT isn’t built on high peaks and deep troughs in the yearly budget. The kind of IT that makes your business and helps it to grow is built by smart financing and careful planning. Great technicians are what makes excellent IT.

Maintaining steady updates, keeping pace with the latest security, and building your IT as you build your business keeps you in the driving seat when it matters most.

When IT is planned and issues are solved before they appear, security becomes cheaper, easier, and many times more effective. System upgrades can be planned out months, if not years in advance so you are never caught unaware.

Don’t let your IT be broken before you take steps to fix it. Move ahead of the curve and give us a call at 478-474-0861 so you don’t have to find out what your business looks like without IT.

Don’t Get Hooked by Spear Phishing Attacks

by

Phishing attacks have been around for a long time in IT. Designed to steal your credentials or trick you into installing malicious software, they have persisted in the IT world precisely because they have been so devastatingly simple and effective. Today, a more modern and more effective version of the same attack is commonly used.

A typical phishing attack involves an attacker sending out a malicious email to hundreds of thousands, if not millions of users. The attacker’s email is designed to look like it comes from a bank, financial service, or even the tax office. Often aiming to trick you into logging in to a fake online service, a phishing attack captures the login details you enter so an attacker may use them to enter the genuine service later.

By sending out tens of thousands of emails at a time, attackers can guarantee that even if only one half of one percent of people fall for it, there is a lot of profit to be made by draining accounts. Spear phishing is a more modern, more sophisticated, and far more dangerous form of the attack. It’s typically targeted at businesses and their staff.

A Convincing, Dangerous Attack

While a traditional phishing attack throws out a broad net in the hope of capturing as many credentials as possible, spear phishing is targeted and precise. The attack is aimed towards convincing a single business, department, or individual that a fraudulent email or website is genuine.

The attacker focuses on building a relationship and establishing trust with the target. By building trust and convincing the target that they are who they are pretending to be, the user is more likely to open attachments, follow links, or provide sensitive details.

Consider how many times you have followed a link or opened an attachment just because it has come from a contact you have trusted before.

A Trusted E-mail

The malicious email can appear to come from a vendor you deal with regularly. It may even look like an invoice you are expecting to receive. Often attackers can simply substitute the vendors’ banking details for their own, hoping the target will not notice the difference.

Such an attack is very difficult to detect. It takes a keen eye, strong working knowledge, and constant awareness to keep your company protected. Even a single small mistake by an unaware member of staff can compromise your business accounts.

Defending Your Business

The key to stopping a spear phishing attack is education. Learning attack techniques, and how to protect against them is the single biggest thing you can do to enhance business security.

Whenever you deal with a vendor in a business transaction, you should always consider important questions before proceeding. Are you expecting this email? Is the vendor attempting to rush you into a quick decision or transaction? Have you checked all the details are correct and as you expected? Sometimes a simple query to the vendor can protect you against worst-case scenarios.

In many cases, a phishing attack can be halted in its tracks with a strong IT security package. Web filtering prevents malicious emails and links from entering the network, shutting attacks down before any damage can be done.

Good Security Practice

As with many types of IT threat, good security practices help mitigate damage. Locking down security to ensure employees only access the systems they need helps to prevent damage spreading across the network.

Enforcing unique and strong passwords prevents leaked credentials from affecting systems related to the one that has been compromised. Getting employees set up with a password manager and good security policies can do the world of good to boost your security to the level it needs to be.

Give us a call at 478-474-0861 to audit your security practices. It could be the difference that secures your firm against sophisticated spear phishing attacks.

FOLLOW US

Recent Posts

Tags

#bestservice #computerrepair #nocontract #qualitycomputers backup bad hard drive cloud computer repair consumer data loss data recovery email Hacker msp new computer new laptop online safety QualityCareSuite recover data remote support repair sale scam service small business Webcam