How to Properly Prepare Your Digital Equipment for Disposal

 

Equipment manufacturers are using technology more than ever to add functionality, flexibility, and reliability to their products. Today, nearly every piece of hardware in your offices has some form of non-volatile memory, whether a hard disk drive, solid-state drive, or flash memory. You must properly prepare your digital equipment for disposal to eliminate the chance of sensitive data ending up in the wrong hands.

Hazards of Multi-Function Printers Not Prepared For Disposal

Most organizations have one or more multi-function printers (MFPs) that allow staff to scan, print, copy, and fax documents. Connected to the company network, several workers can use the same machine, lowering equipment costs and improving efficiency and print quality. Some MFPs also act as collaboration tools,  streamlining workflows by digitizing and sharing documents. To provide all this capability, the MFP stores the digitized data.

One way organizations face the danger of an accidental data leak is by not preparing leased digital equipment for disposal. Many MFP manufacturers sell their products as a managed print service or lease the gear to a company. At the end of the contract, it’s common for the manufacturer to replace the MFPs with newer models. The manufacturer can then refurbish the older equipment and resell or re-lease it to another company.

Here’s where the danger comes into play: if the storage of the refurbished equipment isn’t cleared of data, the new user may be able to access it. However inadvertent the access is, your data is exposed to unauthorized people.

How to Properly Prepare Your Digital Equipment for Disposal

The moral of the MFP story is to prepare your digital equipment for disposal, principally by ensuring the memory of each piece of equipment is cleansed of your corporate data before turning it over to the manufacturer or leasing company. The same goes for PCs, servers, phone systems, and more. So, let’s look at ways to securely and permanently remove sensitive information.

Physical Destruction

Using a sledgehammer to physically destroy a hard drive is a pretty reliable way to make it impossible to retrieve data. Drilling holes in the drives or melting them are two additional ways to destroy the data. However, physical destruction is not viable when you have many devices or pieces of equipment to clean.

Full Drive Formatting

Simply deleting files from a drive isn’t very secure. There are many applications designed to recover accidentally deleted data. Full Formatting is better than deleting data, as it electronically erases and rebuilds the drive, providing a clean slate. However, if you lease the equipment, the manufacturer may not allow you to remove their proprietary software. While effective, full formatting is less secure than specialized data erasure tools.

Data Erasure Apps

These applications are the best at wholly and securely erasing data from both HDD and SSD devices. Following different government standards like NIST SP 800-88 Rev 1 or DoD 5220.22-M/ECE, these software tools overwrite your data with random patterns multiple times using either the 3-pass or 7-pass method, thus fully erasing the data on the device.

Let Us Properly Prepare Your Digital Equipment for Disposal

As much fun as it may be to take a sledgehammer to a hard drive, your time is better spent focused on your business. With that in mind, Digital Uppercut can lighten the load and help properly prepare your digital equipment for disposal. Call us at 213-398-8771 or contact us online today.

What is a Security Audit and How Do You Prepare for One?

 

Security audits have become increasingly important for businesses of all sizes. They can help protect your company from cyber threats, protect your data, and ensure compliance with industry regulations. But what is a security audit, and how do you prepare for one?

What is a Security Audit?

A security audit is an assessment of an information system's security posture to identify vulnerabilities and risks and make remediation recommendations. In the case of a security audit, this includes assessing what types of security technologies are in place and what weaknesses or risks exist. It also includes performing tests to identify potential areas of improvement and providing a summary report that outlines recommendations on how to improve security. The goal of a security audit is to ensure that an organization's systems are secure and conform to established security standards.

It typically involves analyzing the system's hardware, software, and networks, as well as its policies and procedures. A security audit is an essential component of any cybersecurity strategy, and its purpose is to identify weaknesses or areas of risk in the system. It is done through a combination of manual examination and the use of automated tools to inspect the system's configurations, code, and data flow. This helps to assess vulnerability levels and detect any malicious activity. By conducting a security audit, organizations can better understand what needs to be done to protect their assets from potential threats.

Security audits are an important part of maintaining a secure environment, as they help organizations remain compliant with regulations and industry standards. Thereafter, what is a marketable security audit risk? It is simply any potential vulnerabilities or threats that could be exploited by malicious actors. Security audits are an important tool to identify, assess, and remediate any risks present in an organization’s system. A successful security audit should include the assessment of policies, procedures and technical controls to ensure compliance with regulations and industry standards. Regular security audits further ensure that organizations can maintain reliable data security, protect their customers’ data, and remain secure against cyber threats.

Benefits of a Security Audit

A security audit helps identify potential vulnerabilities in your system’s security infrastructure before they can be exploited by malicious attackers. What is a security audit? A security audit is an in-depth analysis of the existing security state of an organization's infrastructure. It evaluates the security policies, infrastructure configuration, implementation, documentation, and effectiveness of an organization’s cyber defense. It also checks for compliance with applicable industry standards and regulations. The goal of a security audit is to identify areas where the organization’s security posture needs to be improved and what steps are needed to achieve this improvement.

Conducting regular security audits allows you to stay ahead of the latest threats, mitigating risks for your organization. A security audit log is a record of what has happened in your system and what was attempted to happen. It can help you detect malicious activities on your network, identify what compromises have occurred, and what access levels different users have on the network. By analyzing these audit logs, you can implement appropriate security measures that are tailored to your organization’s needs and address any security issues before they become a problem. Regular security audits are essential for keeping your system secure and protecting sensitive information.

Security audits can provide valuable insights into how your organization can better protect its critical data and systems from external threats. Also, what is a marketable security audit risk? Auditing is the process of assessing an organization's security posture, including what regulatory requirements must be met and what policy requirements should be implemented. It can help identify systemic risks that potentially put the organization's data at risk. A security audit can provide valuable insights into how your organization can better protect its critical data and systems from external threats by identifying what risks must be addressed and what steps must be taken to mitigate them.

Advice to Help You Plan for Your Security Audit

It is essential to have a clear understanding of your IT environment before starting the security audit process. A security audit looks at what is in place to protect your organization's IT systems, such as what protocols and tools are being used, what personnel have access to the system, what data is stored and processed on the system, and what other security measures are in place. By conducting a thorough audit of the environment, you can identify any vulnerabilities that could be targeted by malicious actors. This will help you take the necessary steps to protect your networks and data from future attacks.

You should also create a timeline for the audit and plan ahead for any potential security vulnerabilities. Knowing what cybersecurity measures to take can help protect your business and mitigate the risk of a data breach. Establishing a regular schedule for monitoring, auditing, and updating your system can be essential for a secure infrastructure. It's also important to train all employees on what constitutes safe online behavior and what malicious activity looks like. In addition, you should create an incident response plan that details what actions need to be taken if a security incident does occur. By implementing these cybersecurity measures, businesses can be better prepared for any potential cyber attack.

Lastly, make sure to have robust policies and procedures in place so that your team is prepared to respond quickly and effectively to any security threats. Moreover, what is a security audit log? This is a record of activity on a system or network that allows security administrators and auditors to quickly identify any suspicious activity. Having a robust and up-to-date security audit log is an important part of any cybersecurity strategy and can help in the event of a security breach. It's important to have reliable policies and procedures in place so that you and your team can respond quickly and effectively to address any security concerns or threats.

Implementing the Security Audit Results

Auditing the security systems and processes in place is important to ensure that any potential risks are identified and addressed. Cybersecurity is an ever-evolving field, so regularly assessing what is in place can help protect individuals and businesses against large-scale data breaches and cyberattacks. By understanding which systems and processes are in use, the threats they face and any gaps that might exist, organizations can work to ensure their cybersecurity is properly managed. Additionally, having a strategy in place to detect suspicious activity can be beneficial, as it allows organizations to take appropriate action quickly should issues arise.

Once the security audit is complete, it is essential to implement the recommendations made in order to strengthen the organization’s cybersecurity posture. A marketable security audit risk is a risk or vulnerability that could potentially be exploited by a malicious entity once they gain access to the organization's systems, networks, and data. It is crucial to identify what these security audit risks are and be able to accurately assess the organization’s current cybersecurity status in order to protect against cyber threats. The audit will help identify what cybersecurity measures should be implemented in order to mitigate and manage any potential risks.

This will involve implementing new technologies, training staff on security protocols, and regularly monitoring for any changes in the digital landscape. Also, a cybersecurity audit is essential for any organization that wants to ensure it has the most effective defenses against cyber threats. This will include evaluating what technologies are in place, training staff on best practices, and monitoring the system for any changes in the digital landscape. By carrying out such an audit, businesses can ensure they have a secure foundation in place to protect their confidential data.

Following Up on Results and Updates

It is important to regularly check the results of security audit tests in order to identify any potential vulnerabilities. A cybersecurity audit is a comprehensive review of the technologies, processes, and operations that an organization utilizes to protect its sensitive information from cyberattacks. This type of audit helps organizations identify any weak points in their security infrastructure and proactively address them before attackers can take advantage of them. By conducting regular cybersecurity audits, organizations can ensure that their systems are secure and up-to-date with the latest measures.

While it may seem tedious, updating systems and applications with the latest security patches is essential for keeping data safe. Security audits serve as a way of testing what is currently in place and what could be improved. In order to have an effective security audit, it is important to have the right measures, such as an assessment of the latest technology, applications, and system security. What is the purpose of a security audit? It helps detect any weaknesses that may exist within the system or applications and advises what can be done to fix them. It also helps identify existing threats that could pose risks to the system and provides solutions to prevent these potential attacks. By carrying out regular security audits, organizations can be sure their systems are kept safe from potential intrusions.

Additionally, following up with customers on any new safety protocols should be a priority in order to ensure maximum protection. Next, it is important for companies to conduct what is known as a security audit, which is a thorough examination of the security measures in place. This audit should be conducted regularly to make sure all customers are secure. Additionally, following up with customers on any new safety protocols should be a priority in order to ensure maximum protection.

Benefits of Ongoing Security Auditing

Regular security auditing helps organizations identify any potential weaknesses or vulnerabilities in their systems. A security audit is a thorough examination of an organization's network to identify any potential vulnerabilities or risks that could be exploited. It is important for organizations to regularly conduct security audits to ensure their networks are secure, reliable and compliant with industry standards. The audit assesses what technologies and tools are in place, what processes are currently in use and what access controls are being implemented. It is a necessary step in maintaining the security of an organization's cyber infrastructure and can help prevent cyber threats from becoming larger problems down the line.

It also allows organizations to stay ahead of the latest cyber threats and make sure their systems are up to date with the latest security measures. Cybersecurity is an important consideration in today's world, as more and more of our business and personal lives are becoming digitized. By investing in cybersecurity, companies can ensure their data is secure from malicious actors, including hackers, viruses, and other forms of attack. Furthermore, cybersecurity provides the necessary protection for organizations to remain compliant with laws and regulations concerning online data. With comprehensive cybersecurity measures in place, organizations can rest assured that their digital assets remain safe.

Ongoing auditing can also help organizations ensure their data is protected and that they are compliant with all applicable laws and regulations. In conclusion, organizations should develop and implement a comprehensive cybersecurity plan that includes frequent auditing. This ongoing auditing helps ensure that their data is secure and fully compliant with legal requirements. Regular auditing is the best way to stay informed of the latest cybersecurity threats and techniques to protect data from being compromised.

So, What is a Security Audit, and How Do You Prepare for One?

In conclusion, it is important to remember that security audits are key components to keeping your business safe from cyber threats and ensuring compliance with industry regulations. It is essential to have an understanding of what a security audit entails before undergoing one so that you know what to expect and can adequately prepare. Knowing the right questions to ask, having an understanding of the key components of a successful assessment, and working with a qualified auditor are all important steps in the auditing process. Call us at 213-398-8771, or use our online contact form to learn more. 

Cybersecurity Undone by Insider Threats

What does a dishonest FBI employee have to do with your company’s cybersecurity? More than you think. Kendra Kingsbury, a 48-year-old FBI intelligence analyst, was indicted on May 18, 2021, for “having unauthorized possession of documents relating to the national defense.” According to the FBI’s special agent in charge of this case, “Every FBI employee swears to support and defend the Constitution of the United States,” and Ms. Kingsbury allegedly violated that promise for reasons not yet publicly apparent.

Now, let’s think about all the people who work in and for your company, including employees, contractors, vendors and service providers. They may not have made a promise as important to national security as those made by FBI agents, but they could be just as likely (if not more likely) to be an insider threat, to betray your trust and do great harm to your business.

What are insider threats?

We often write about modern threats against organizations, including Ransomware, Data Exfiltration, Data Breaches, Zero-Day attacks, Hacks, Viruses, and other malware and cybercrimes. But the assumed context of all of those attacks is that they’re initiated by business outsiders, often Eastern European hackers, Rogue nation-states, or just plain old-fashioned individual cyber criminals writing viruses in their basements.

Over the last two years, we’ve reported on just one story about a potential insider threat, and that was to a company we’ve all heard about, Tesla. A cybercriminal attempted to bribe a Tesla employee with $1 million to insert a ransomware-filled thumb drive into his desktop PC. But the employee was trustworthy and reported the bribe to his supervisors, who, in turn, involved the FBI. The cybercriminal and one of his associates were caught because the honesty and integrity of a Tesla employee neutralized the threat before the attack could occur.

Would your employees and your third-party vendors do the same for you and your business? All business owners and managers hope the answer is yes, but most also know it’s unlikely.

So what are insider threats? Those are any of the incidents mentioned above (Ransomware, Data Exfiltration, Data Breaches, Zero-Day attacks, Hacks, Viruses and other malware and cyber crimes) perpetrated by someone who works in the company or a trusted vendor.

Are all insider threats malicious?

Interestingly, not all insider threats are malicious, where the actor intends to do harm to the company. According to Verizon’s Insider Threat Report, insiders are often motivated by these malicious motives:

• Financial Gain -- But not necessarily to do harm to the organization
• Espionage -- For the benefit of themselves or another organization
• Grudge -- Potentially against the business, but also potentially against specific employees
• Ideology -- The insider may be opposed to an action or philosophy of the organization

But insiders could also be motivated by these less-malicious reasons:

• Fun -- Can this be done?
• Convenience -- the desire to work around cumbersome security procedures.
• Fear -- perhaps fear of an impending financial catastrophe, or fear of being fired.

Supporting those statistics is Verizon’s assessment of who the insiders are. Three of their actor-types are malicious:

• The Inside Agent -- An employee motivated to act for the benefit of some other bad actor.
• Disgruntled Employees -- Potentially those passed over for raises and promotions, or who feel they were otherwise wronged by their employers, who are just out to harm the organization or other specific employees.
• Malicious Insider -- Those who steal data, usually for personal gain.

But two of them are not:

• The Careless Worker -- Employees who incorrectly address emails, install unpermitted software, inadvertently expose sensitive data, and work around security measures.
• The Feckless Third Party -- Business partners who do not support the same high security measures as the organizations they serve.

(Note: In the above list, the labels were from Verizon’s report, and the descriptions were our own.)

Reducing The Damage of Insider Threats

So your company has done all that it was supposed to do in order to protect itself from cyber attacks: you installed the latest firewalls and reinforced those with the best cybersecurity software. You’ve got endpoint protection, VPNs, multi-factor authentication, secure password policies, SIEM analysis of your device log files, a Security Operations Center monitoring your network 24/7...so you sleep well at night.

Despite doing all the right things, insider threats can undo several layers of cybersecurity in moments.

What can you do to help reduce the Damage of Insider Threats?

Cybersecurity Awareness Training

Cybersecurity Awareness Training helps to train your employees to look out for signs of Phishing, Business Email Compromise, and other signs of attempted attacks. But it can also train employees how to notice when other employees are doing things they shouldn’t be doing -- insider threats that may potentially harm your company.

Employee Background Checks

But Awareness Training depends on whether your employees actually want to protect the company. How can you ensure that they do? Trustworthy employees begin with the hiring process, and in particular, by running background checks on your employees.

Robert Glucroft, of BackgroundRunner.com, a Los Angeles-based background check company, says, “When you’re interviewing a prospective employee, they will often say whatever they need to say to get you to hire them...and not all of it is going to be true.” Glucroft continues, “You could be hiring people who have long histories of embezzling from their companies, or people who are in severe financial trouble or have substance abuse issues, all of which make them much more likely to betray your company for the right price or reason.”

But background checks are not only for potential new employees. Background checks should also be conducted on an annual basis on existing employees. “Situations change for employees just as they do for the general public. Sharp increases in debt, signs of substance abuse, and even a lengthening criminal record can indicate that an employee is under stress and may potentially harm the company,” says Glucroft.

Vendor Management and Review

We’ve been brought into companies with the goal of either reviewing or improving their current cybersecurity practices and those of their vendors and suppliers. We’ve discovered instances where our clients had the foundations and policies of a solid cybersecurity strategy, but all their efforts were undone by outside vendors.

• We’ve seen the aftermath of VOIP vendors and Video Security installers leave huge holes in previously-secured company firewalls in order to simplify the configuration of their own equipment.
• Software publishers have had their own software hacked and then installed their software onto the networks of other businesses, immediately adding backdoor access to your business and all its data.
• Even an improperly configured QuickBooks system can allow hackers to steal your data.
• Vendors for proprietary equipment, such as specialized medical equipment, have sometimes left security holes in their own products that will allow access to your office network in much the same way as smart light bulbs can give hackers access to your wifi network.
• Vendors can even install their own software via thumb drives without knowing that those drives contain malware.

Businesses often let vendors into their company without questioning their cybersecurity policies and procedures, it often leads to a disaster for the company. The only solution to this problem is to manage and review your vendors’ cybersecurity policies.

Conclusion

Business IT networks are getting more complex every day, and that means your cybersecurity strategy needs to adapt in order to be effective. But a huge, often overlooked part of your cybersecurity strategy includes the people who work in and with your organization. If you don’t know how to protect yourself from these dangers, let Digital Uppercut help. Use our online contact form or call us at 213-398-8771.

 

New cryptocurrency coins are created by solving complex mathematical problems, a process called “mining.” Those who mine cryptocurrency do so by building farms of extremely powerful computers designed specifically for these mining operations. Not only are the computers expensive, but so is the maintenance, networking and electrical power required to keep them running, sometimes making the effort unprofitable. But now cybercriminals have designed malware that seeks to avoid all of that expense by infecting millions of computers with code that will do the mining for them...on YOUR computers.

The malware, named Prometheus (after the Greek god of fire) and “Prometai” in Russian, exploits two vulnerabilities in Microsoft Exchange, collectively known as “ProxyLogon,” to help it spread to users of the Exchange server. But the threat doesn’t stop there.

How The Prometai Malware Works

According to a report on Cybereason.com, the attack begins with a hack of unpatched Microsoft Exchange servers that exploit the two ProxyLogon vulnerabilities. From there, it infects other PCs on the network.

Threatpost says that “ProxyLogon consists of four flaws that can be chained together to create a pre-authentication remote code execution (RCE) exploit – meaning that attackers can take over servers without knowing any valid account credentials.” That means that no matter how complex your passwords may be, your Exchange Servers may still be at risk.

The malware's main payload is to run a cryptocurrency-mining application. Miners do well when the costs of the machines, maintenance and network infrastructure are lower than the value of the coins generated by the application. And the venture becomes even more profitable when those costs are born by others.

Which Cryptocurrency is Mined by Prometai?

Most of us are familiar with Bitcoin, the most popular cryptocurrency, but this malware mines Monero, a lesser-known cryptocurrency. Why Monero? According to Genesis Mining, Bitcoin is optimized to run on specialized hardware that uses ASIC chips, and most office computers do not have high-performance ASIC chips. On the other hand, Monero is “designed in such a way that ASIC computers do not have much of an advantage over ordinary computers. As a result, ordinary people can use a simple CPU and start mining right away.”

That makes mining Monero ideal for the untargeted distribution of this malware, because any computer it infects can be used for mining the coins.

Why is the Prometai Malware Dangerous?

The damage to the owners of these computers occurs on many levels.

• The users of infected computers suffer from poor performance from their PCs, as processing power is diverted to the mining operation.
• Computers use additional electricity for the additional processor power required to run the mining software.
• The malware can affect the stability of the infected computers.
• It spreads to other workstations by using brute force techniques to guess user credentials, trying hundreds of common passwords
• It spreads to Microsoft SQL Servers and PostgreSQL servers

But the real danger of the malware is that it provides a backdoor for loading other software that could do even more damage to your computers and your company. The backdoor could be used for:

• Stealing Credentials
• Stealing Intellectual Property
• Installing Ransomware
• Allowing Remote Control and Takeover of the computers

How To Protect Your Company From Prometai

The first and best thing you and your company can do to protect yourselves from this and similar malware infections is to keep your software up to date. The entry point for Prometai is two vulnerabilities in Microsoft Exchange that Microsoft has already fixed. However, if your IT team has not installed the patches, your company remains vulnerable.

Systems that detect and prevent unauthorized installation of software on servers and workstations are another line of defense, as they could prevent the installation of the malware or detect its presence early enough to minimize the damage.

SIEM systems, which view and analyze your entire IT infrastructure as a whole (rather than as separate components), can help to detect unusual activity across your network.

If you run a business, from a single laptop up to large enterprises, your business is vulnerable to this or similar malware, and there is no way to protect your business except to take an active role in defending yourself. Digital Uppercut offers all of these services and more as part of our Business Protection Toolkit, which contains 10 separate business protection tools and is growing.

Call Digital Uppercut

The Business Protection Toolkit allows Digital Uppercut to provide big business protection on a small business budget. If your business isn’t protected, or you aren’t sure if your current IT team is protecting your business well enough, call Digital Uppercut for a free consultation and a discussion of your situation. Make an appointment using our online contact form, or call us at 213-398-8771.

How Much Should Good Cybersecurity Cost?

 

How Much Should Good Cybersecurity Cost? Business owners and CEOs are very familiar with the financial ratios they use to run and monitor their businesses. Good Inventory turnover often varies between 2 and 10, depending on the type of business. A 2-to-1 “Current Ratio” of assets over liabilities can indicate a healthy business.

Healthy Quick Ratios over 1.0 tell you how effectively the business can pay financial obligations...including emergency obligations, such as the hundreds of thousands or millions of dollars it takes to recover from a cybersecurity breach. So then what is the proper financial ratio for calculating how much you should spend on your company’s cybersecurity to prevent a breach? Like with other ratios, it depends on a number of factors.

How Much Should Good Cybersecurity Cost?

Good and bad assessments of the ratios mentioned above all depend on the type of business you’re running. Certainly, a wholesale business will have different ratios than a retail business. An online business will have different ratios than a brick-and-mortar business. And of course, service businesses will have different ratios than product businesses.

So how much should good cybersecurity cost? The problem with answering this question is that IT, in general, and cybersecurity, in particular, are generally considered cost centers rather than profit centers. So any number greater than Zero is going to be too much for some business managers.

Cybersecurity Economies of Scale

When asking what good cybersecurity costs, economies of scale hold part of the answer. As with most products and services, larger companies benefit from lower relative cost-per-user because their investment can be spread over more workstations and infrastructure. As a result, according to a report by InfoSecurity Magazine, which discussed the cost of cybersecurity as a percentage of revenue, large companies can often spend “anywhere from a fraction of a percent to a couple of percent on implementing and sustaining security.”

Larger companies enjoy lower per-user costs, such as software upgrades, security software, workstation purchases and upgrades, simply because they are buying larger quantities and can demand larger discounts. They can also spread high infrastructure costs, such as network servers, firewalls, backup systems, Security Information and Event Management (SIEM) and Security Operations Centers (SOC), among more users.

By contrast, small companies typically have fewer endpoints than larger companies, and cannot demand the same large discounts that their big brother companies can. And they need to spread their infrastructure costs over that smaller user count. The result is that, according to the same InfoSecurity Magazine article, small companies can spend 4% or more of their total revenue on Cybersecurity.

These percentages are not hard and fast rules. For both large and small companies, costs increase not only by the number of workstations and servers, but also by…

• The number of locations
• The number of remote workers has increased recently due to COVID-19
• The number and type of mobile devices
• The age of equipment and software
• The company’s efforts to update software and keep technology current
• The type of data being secured, especially as it relates to medical data
• The number and type of specialized devices, including medical devices, CAD/CAM equipment, manufacturing equipment and other diagnostic equipment

...and so much more. Whatever the circumstances, good security costs more for small businesses than for large companies.

How To Keep The Cost of Cybersecurity Down

Whatever size organization you have, there are ways to keep the cost of cybersecurity down.

Start when you’re small

It may sound counterintuitive, but starting your cybersecurity plan when you’re a small business allows you to grow cybersecurity incrementally, which can save the organization a lot of money.

Maintain The Cybersecurity You have

Creating a cybersecurity budget and maintaining your technology diligently costs far less, in both time and money, than letting your technology age without updates and then replacing everything a few years down the road. Plans like this not only cause you to incur huge costs all at once but also leave you vulnerable to attacks as your cybersecurity technology ages.

Don’t Wait For An Attack

We often gain new clients after they’ve been attacked. They often tell us that they were just about to upgrade their cybersecurity. By then, of course, it’s too late. The costs of upgrading your technology after a cyber attack are many times higher than before the attack.

Big Business Cybersecurity for Small Businesses

What if your small or medium-sized business could get the same cybersecurity economies of scale that large businesses get every day? Digital Uppercut’s Business Protection Toolkit is designed to provide big business cybersecurity to small and medium-sized businesses like yours. And the good news is that you can decide how much good cybersecurity should cost, and we can customize the Toolkit to fit not only your business, but your budget, too. Together, we can choose big business cybersecurity technologies such as SIEM, SOC, Cloud-based firewalls, Awareness Training, Advanced Endpoint protection, and more. Contact us online or call us today at 213-398-8771 to talk about how Digital Uppercut can help protect you and your business.

More Intelligent Phishing Attacks: Click Here To Claim Your Two Night Stay at Marriott Hotels

 

Imagine this email subject line: “Click Here To Claim Your Two-Night Stay at Marriott Hotels.” Would you read an email because of a subject line like this? It’s pretty attractive, and a similar message was sent to millions of people via email with a similar offer. The problem is that the offer was fake, and part of a more intelligent phishing attack designed to take advantage of a recent real Marriott International breach that affected approximately 5.2 million guests. This very sophisticated phishing campaign first referenced the January 2020 breach -- a true and widely publicized story -- and followed it up with the fake offer.

 Phishing Is Your Biggest Threat

Phishing, researchers say, is the number one “attack vector” affecting enterprises, mostly because it works. And while it’s no surprise that cyber criminals are coming up with new tactics for those phishing attacks, what is very surprising is the depth, intelligence and sophistication used in these new attacks, including advanced psychological techniques.

The Marriott 2018 Data Breach

According to an article in Security Boulevard, the Marriott 2018 data breach “may have taken personal details such as names, birthdates, and telephone numbers, along with language preferences and loyalty account numbers,” which gives the cyber criminals additional credible information for future cyber attacks. Imagine, for example, a subsequent Happy Birthday email offering you a free night’s stay to celebrate your birthday. Its authenticity could be very convincing.

But in this case, Marriott announced in its own press release that it “is sending emails to guests involved.” To Marriott customers who are aware of the original breach and this specific announcement, the phishing email looks very authentic.

We predict that there will be more phishing campaigns leveraging the news of other hacks and breaches to make their attacks look more legitimate as well. But the increasing sophistication of cybercriminals gets even more clever than this.

Making More Intelligent Phishing Attacks More Believable

Leveraging real breach news is one way that cybercriminals are making more intelligent phishing attacks, but there are others. If you’ve ever negotiated a deal on a new car in a buyer’s market, you know that your willingness to walk away from the deal puts you in control of the negotiations. The same holds true for the sales representative in a seller’s market: If the buyer is not willing to meet the price, all the seller has to do is threaten to take away the offer.

According to ThreatPost Magazine, there’s a new phishing technique that uses CAPTCHA challenges to actually prevent users from accessing a phishing site. This may seem as counterintuitive as leaving a negotiation that you’d like to win, but it’s actually quite clever.

The ThreatPost article describes how users are actually exposed to not one, but three separate CAPTCHA challenges, and quotes researchers at Menlo Security who gave two reasons for the effectiveness of this technique:

• CAPTCHA prevents security spiders from identifying these dangerous phishing sites
• CAPTCHA is used by legitimate “benign” websites, not fake sites. In other words, the user assumes the site must be legitimate if it’s using a CAPTCHA challenge.

But we recognize a third reason for this technique being effective:

• CAPTCHA...especially repeated CAPTCHA...may frustrate users, so that once they succeed at answering the challenge questions, they will be more eager to fill out the credential screen and less aware of the deception that is part of every phishing site.

Thinking back to the car sales analogy, it’s as though the seller has rescinded the offer twice, but finally agrees to your terms. You can imagine yourself eagerly filling out the contract terms.

So not only does this technique help the phishing site hide, but it also convinces the victim that the site is more legitimate AND makes the victim more eager to comply.

That’s a dangerous combination.

Could Your Users Resist These More Intelligent Phishing Techniques?

The first example above was a travel site, but it could just as easily resemble a recently hacked bank website, such as Bank of America (Hack reported in May 2020 related to PPP applications), CitiFinancial, Wells Fargo and others. It could also be a health-related organization, such as American Medical Collection Agency, lab sites like Quest Diagnostics, or other breaches involving health data records

Imagine having your best employee fall for one of these more intelligent phishing attacks, and the damage it could do to your own company (thousands or millions being wired to the criminals’ bank accounts) or to your medical practice (the breach of thousands of HIPAA-protected medical records).

Awareness Training Educates Your Staff

We have many techniques for protecting your business from breaches and hacks, including the more intelligent phishing techniques described here. Firewalls prevent direct attacks on your networks. Advanced Endpoint Protection protects individual workstations and devices from malware. Our Advanced Web Protection can even identify phishing sites. And we have a dozen other methods of protecting your organization from threats. But if your staff unknowingly cooperates and forfeits credentials to valuable resources -- especially on personal or unprotected devices -- the attack has a good chance of getting through.

It’s as though your staff has unwittingly joined the attacker’s team.

That’s why we recommend Awareness Training for all of our clients. Because C-Level executives are the most prime targets for phishing attacks, the training consists of a series of lessons that teach your staff at all levels, from clerical and maintenance staff up to the CEO. And not only do we offer the training, but we offer a console to help you organize and manage the enrollment of each of your employees, and the refresher training needed to keep your staff aware of the latest threats.

If you have cybersecurity insurance, and certainly if your company is required to follow HIPAA regulations, Awareness Training is required to be part of your cybersecurity plan.

Fight More Intelligent Phishing Attacks Today

Cybersecurity always feels like it’s too much until you discover that it’s not enough. Taking a few hours each week to keep your company safe may seem like too much, but you’ll know for sure that whatever you’re doing now is not enough once your company falls victim to a more intelligent phishing attack. As important as Awareness Training is, it’s not nearly as expensive as you might think, and is even added at no additional cost to some of our cybersecurity packages. Contact us online or call us today at 213-398-8771, and let’s talk about protecting your business from a phishing disaster.

Penalties for Uber Exec Who Covered Up Data Breach

 

Uber was hacked in 2016, revealing the personal information of 600,000 Uber drivers and 57 million Uber passengers. If you joined Uber in or prior to 2016, there’s a good chance your data was exposed in the Uber Data Breach. Why are you learning about this now? On August 20, 2020, the Federal Trade Commission filed a criminal complaint against Joseph Sullivan, Uber’s former Chief Security Officer, because he not only didn’t report the crime, but he also actively worked to “conceal, deflect, and mislead the Federal Trade Commission about the breach,” according to the FTC.

About the Uber Data Breach

This wasn’t even the first time that Uber had been hacked: Uber had been breached in 2014, and Sullivan was selected by Uber to respond to the FTC’s inquiries into that data breach. About ten days after Sullivan provided his testimony to the FTC, he was contacted by two hackers and told that they had accessed Uber’s data. According to Uber in its own blog post on the same day as the FTC and FBI’s announcement, the hackers accessed "data stored on a third-party cloud-based service that we use. The incident did not breach our corporate systems or infrastructure."

The Uber Driver data that was breached included names and driver's license numbers, but it was also among the 57 million Uber Rider Data records, whose names, email addresses, and mobile phone numbers were among the breached data.

Concealing the Uber Data Breach

Sullivan and his team took less than 24 hours to confirm the Uber Data Breach. However, he then worked with the hackers to pay them “hush money” in exchange for a promise not to reveal the hack to the public.

The payment was made to the hackers via Bitcoin under false names, which were also used on a written non-disclosure agreement, which included a “false representation” that no data was actually taken. In order to help conceal the breach, the payment was facilitated through a “bug bounty” program. Such programs are used to reward white-hat hackers when they discover, but do not exploit, data vulnerabilities.

The true identity of the hackers was later discovered to be Brandon Charles Glover of Florida and Vasile Mereacre of Toronto. Sullivan sought to have them re-sign their non-disclosure agreement under their true names. At least one other Uber employee was involved in the preparation of the agreement, but according to the FBI, "When an Uber employee asked Sullivan about this false promise, Sullivan insisted that the language stay in the non-disclosure agreements."

Sullivan Reveals the Breach to Uber Management

Uber Founder Travis Kalanick resigned as CEO in 2017, and new management, including a new CEO, Dara Khosrowshahi, was hired in August. Sullivan told the new CEO about the 2016 breach and then asked his team for a summary of the event to present to Khosrowshahi. Sullivan then edited the draft summary prepared by his team by removing details about the data that was taken, and then by adding false information that the payments were made only after the true identities of the hackers were known.

Uber’s new management ultimately discovered the truth and disclosed the Uber data breach publicly, and to the FTC, in November 2017.

Had Sullivan reported the breach rather than trying to cover it up, the FBI says that no charges would have been filed. But given the current facts, the criminal complaint filed on August 20 alleges that Sullivan deceived Uber’s new management team about the 2016 breach. The FBI is charging Sullivan with “obstruction of justice, in violation of 18 U.S.C. § 1505; and misprision of a felony, in violation of 18 U.S.C. § 4.” (The term “misprision” is the deliberate concealment of knowledge of a felony or treasonable act.)

What You Can Learn From The Uber Data Breach

There are several lessons to be learned from this story, not the least of which is that cloud-based services require the same or higher level of security as your in-house data. All cloud-based systems come with security by default, but they also come with security holes by default, and it’s your cybersecurity team’s responsibility to plug them. Not only are there optimizations that can be done within most cloud-based systems, but you can also increase and optimize your security around the cloud services with cloud-optimized firewalls, mandatory file and folder-based encryption, SIEM and Security Operations Center technologies, and other techniques.

The other lessons concern cover-ups. While data breach penalties that corporations can face can range into the tens or hundreds of millions of dollars, failing to report data breaches can result in even worse consequences, including criminal penalties.

What You Can Do

Some data security breaches have one level of penalties in the event of a breach, and a much higher level of penalties if there is no plan to deal with the breach, or if the plan is not followed. All of this serves as a warning to not only secure your business data but also to have procedures in place in the event of an incident like the Uber data breach. Digital Uppercut is here to help you with both your security and your plan. Call Digital Uppercut at 213-398-8771 or contact us online today.

How To Penetrate Your Network Security? Cash!

 

Sometimes, cyber-attacks enter your company network when an employee stumbles upon a virus-filled web page. Other times, the cyber-attack begins when an employee falls victim to a phishing attack or is tricked into downloading a virus-filled file. Other times, it’s a brute force attack on your network. Now here’s something else to worry about...a technique that might seem new but is as old as commerce itself: Dishonest employees willing to allow the bad guys to penetrate your network security for cash.

The FBI announced that on August 22, it arrested a man who bribed a Tesla company employee with a $1 million payment. What did they ask him to do? Plant one piece of malware -- Ransomware, actually -- onto his office computer. The story actually unfolds like a spy novel and holds a cautionary tale for any company’s cybersecurity team.

The Insider is Approached

Egor Igorevich Kriuchkov is a 23-year-old Russian citizen. According to an article on ClearanceJobs.com, Kriuchkov and his colleagues had inside information about which Tesla employees had access to the resources necessary to place the intended malware. They identified and contacted a non-U.S. citizen working at Tesla’s Sparks, NV facility who spoke Russian as their inside man.

Kriuchkov and the employee’s early contact, beginning mid-July, was through WhatsApp, a communications tool owned by Facebook that features end-to-end encryption for all communications. The two, along with other Tesla colleagues, met in Lake Tahoe between August 1 through 3. Initially, all contact was social, but on August 3, Kriuchkov asked the insider to participate in a "project."

Kriuchkov asked the insider if he would place some malware that Kriuchkov and his associates would customize and provide. In exchange, the insider would receive $500,000. After being contacted by Kriuchkov, the employee reported the contact to company officials, who then notified the FBI.

How the Malware Attack Would Work

According to the insider, he was told how the attack would work.

• The malware would be placed by the insider.
• Kriuchkov’s colleagues would initiate a Red Herring -- a Distributed Denial of Service (DDOS) attack, with the goal of keeping Tesla’s Cybersecurity team busy.
• While the Cybersecurity team was busy fighting the DDOS attack, Kriuchkov would spread the malware throughout the network.
• Sensitive corporate data would be exfiltrated, and the network files would be encrypted.

It’s at this point that a ransom demand would be made on the company, for many millions of dollars.

How The Cybercriminals Were Captured

For his fee, the insider was expected to provide additional inside information about Tesla so that its ransomware software could be customized. Communication happened via burner cell phones, WhatsApp, TOR and Bitcoin wallets.

Working with the FBI, the employee extracted additional information about the plans for the attack, and also demanded a higher payment, eventually settling on $1 million. During these conversations, Kriuchkov boasted that they had done this several other times, and that one of their previous insiders was still working at his company three and a half years later.

How To Defend Against Threats To Penetrate Your Network Security

You would want to believe that a company as large and sophisticated as Tesla would have network infrastructure strong enough to defend against such an attack. The cybercriminals seem to think otherwise, and fortunately, Tesla didn’t have to find out.

Would you be so lucky?

So what does this all mean to companies like yours? The first and most obvious question is whether your own employees would be honest enough to forego a huge payday in order to take down your company. Although this wasn’t mentioned in the research for this story, employees with large debts, gambling problems, and other serious issues and secrets would be most vulnerable to an approach like that received by Tesla’s insider. Background checks for current employees and new candidates could be helpful here.

It’s also possible that companies like yours might have already been targeted by cybercriminals, who may have already sent compatriots to apply for and take jobs in your company, with the express purpose of placing malware from the inside. These scenarios suggest it may be wise to add thorough candidate and employee background checks to your normal cybersecurity procedures.

The problem is that firewalls alone can’t protect against an inside job like this, and typical antivirus software isn’t strong enough to defend against more sophisticated malware. Most cybersecurity defenses exist in a silo and are designed to look at only a very narrow range of activities.

Only with a sophisticated SIEM (Security Information and Event Management) system can such threats be identified. That’s because SIEMs collect data from all parts of your organization -- every workstation, firewall, server, network appliance, access point, browser, and email program -- and view it all holistically, finding clues in one system that it can follow into another system in order to get a complete picture of the attacks you are facing.

Having a Security Operations Center (SOC) review the SIEM’s findings and other data makes the SIEM even more effective.

What Should You Do Now?

As you can see, attacks designed to penetrate your network security are getting more sophisticated every day. If your cybersecurity system isn’t designed to withstand these more modern, more sophisticated, and more elaborately planned and patient attacks, you might find that you’re on the losing side of a Ransomware attack...and that wouldn’t be good for you, your company, your employees, your vendors and your customers. Let Digital Uppercut help prevent that. Call us at 213-398-8771 or contact us online to set up an initial conversation and a preliminary risk assessment. Keeping your company safe is our business. Let’s talk.

Smart TV Security Becoming an Issue

 

If you have a Smart TV in your company conference room, break room, or spread throughout your offices as a perk for deserving employees, you may have allowed hacks, breaches, and privacy issues into your business. In December, the FBI’s Portland office issued a warning about Smart TVs that should concern everyone who owns one. It seems that the features that make these TVs Smart also make them excellent portals for malware, so you need to be concerned about Smart TV Security.

Essentially, a Smart TV is a TV with an internet connection and the ability to install “Apps” (Netflix, Disney+, etc.) to view certain content. Many of these TVs now also include microphones to receive verbal requests for programming (“Play Game of Thrones on HBO”) and cameras to help identify who is watching so that the TV can suggest new shows.

Why Are Smart TVs Dangerous?

So what is so dangerous about a Smart TV?

It used to be that television was one-way communication. An antenna signal came in, and it was displayed on the screen. These days, Smart TVs are actually powerful internet-connected computers, sending massive amounts of data in both directions.

And since Smart TVs are actually computers, they are open to a whole host of problems that other kinds of computers have. If you are at all familiar with cybersecurity, you are well aware of how bad the news is regarding cybercrimes, viruses, trojans, ransomware, device hacking, cyberespionage, and other security issues. The good news about conventional PCs is that these computers have an army of companies working to protect you against all of those problems. The bad news about your Smart TV is that there is no such army.

Your Smart TV -- whether it's a Vizio, Samsung, Sony, LG or other brand -- usually has one and only one company working on Smart TV security to protect that device and those who use it, and that’s the manufacturer. That makes it extremely likely that the Smart TV’s security is not as strong as it should be. Also at issue is that Smart TV manufacturers are very slow to react to any new cybersecurity issues, as their firmware is usually updated very infrequently, if at all.

Combine that with the fact that many of these Smart TVs have cameras and microphones, and you have a perfect recipe for cyber-stalking. If a hacker gets control of your Smart TV in your conference room, they could watch and listen in on your company meetings and easily steal confidential information.

Apps Can Make Smart TVs More Dangerous

Many Smart TVs use a proprietary operating system, but some are based on Linux and Android technology, which makes them especially vulnerable. For example, Smart TVs with Amazon’s Fire TV technology are based on Android. They are capable not only of loading apps for all the services and networks you know and love at home, but programmers can write other apps for them that promise they’ll do one thing, and don’t tell you that they’ll be doing something else, too.

And most people, when downloading these apps, rarely check to see what kinds of security holes they might be opening up. For example, a popular “Downloader” app on Amazon’s Fire TV platform grants the app the following permissions:

• Access information about networks
• Access information about Wi-Fi networks
• Open network sockets
• Read from External Storage
• Write to External Storage
• Sending in-app billing requests and managing in-app billing transactions

Many of these permissions are things that any good cybersecurity expert would not permit on a PC, but are nearly powerless to prevent on a Smart TV.

The Bottom Line on Smart TV Security

With Smart TV Security, you need to depend on the manufacturer to protect you, and that’s just not their primary purpose. As a result, there’s no antivirus, no anti-malware, no group policies, and no way to lock down the TVs to prevent the loading of dangerous apps. So what can you do?

• First, if you’re going to have Smart TVs in the office, make sure you isolate them onto their own network. That way, if someone installs a rogue app that can access your entire network, there will be very little for it to see, and very little damage that it can do.
• Second, for any of the services on the TV, create an email address specifically for these accounts. That way, if the email credentials are breached, there is no valuable company data to be stolen.
• Third, cover the camera with tape and the microphone with some material or device especially made for this purpose. This will help to prevent you from being watched and listened to.
• Fourth, if you don’t need a Smart TV, don’t buy one. A large, commercial-quality video monitor might be all you need for your corporate presentations.

Whatever you do, don’t ignore the fact that any new device that you invite into your office network has the potential to harm you and your company. And if you don’t have the time or know-how to do this yourself, call Digital Uppercut. We specialize in Cyber Security and work with these issues all the time. Smart TV security isn’t the only threat to your company. Contact us today online, or call us at 213-398-8771 and let’s talk about the security of your company.

The Danger of Browser Extension Malware

 

Cyber criminals are always looking for new ways to get their malicious code onto your computers. Usually, malware gets onto your PC via executable files, JavaScript code, and VB scripts within MS Office Applications. But there is another method that most Antivirus and other security software just aren’t ready or able to identify and trap for you: Browser Extensions. And if you think for a moment about how much of your working day is spent within a browser window, you can imagine how much of what you do could be tracked, snooped, breached, stolen or damaged by browser extension malware.

Why Target Browser Extensions?

How much time do you spend in your browser compared to just one or two years ago? If you’re a user of Office 365 or Google’s G Suite or Gmail, the answer is probably a lot. Microsoft has been moving its products from single-purchase licenses to cloud-based subscriptions for years, and Microsoft, Google, Salesforce, Netsuite, QuickBooks, Dropbox, Box.com and thousands of other web-based applications have us spending more time in our browsers than ever before.

And when you consider that we also access banks, investment, and even government resources via the web, it’s easy to see how being able to spy on what we do in our browsers can be very valuable to a cybercriminal.

Browser extensions allow them to do that.

Couple these threats with the fact that even though most good IT policies limit the installation of executable software by individual users, too many IT companies still allow individual users to install browser extensions without limit.

What Harm Can Browser Extension Malware Do?

Let’s start with keyloggers, which can track every button-press and mouse click on your computer. That means credentials for all your online resources, including your email, company intranet, accounting system, banks, and cloud-based storage, can be accessed by cybercriminals. Armed with your login information, the damage could be unending.

A cyber-criminal with access to corporate email accounts can use social engineering to send emails to other corporate personnel asking them to supply other network credentials, or even re-route pending vendor payments to the criminal’s bank accounts.

The access could be used to infect a network with Ransomware, possibly forcing the payment of tens or hundreds of thousands of dollars in ransom.

Your client, vendor, prospect or patient lists could be stolen, resulting in huge fines or criminal penalties imposed not on the cyber-criminal, but on you and your company.

The list of ways you and your company could be harmed is truly endless.

How Extension Malware Gets Onto Your Computer

So how could browser extension malware actually get on your computer? Most browser extensions are legitimate and benign, but others created by unknown developers can carry malware or create security holes that let malware or prying eyes in. So while you think you found a very useful plugin to solve a problem or simplify a task for you, what you don’t know is that the extension’s real purpose is something far more sinister.

Some cybercriminals purchase browser extension businesses from legitimate developers, then add their own malicious code, infecting all existing users with their new malware. Others simply hack into a browser extension’s programming environment and implant malicious code there, where it may be distributed by a legitimate company without its knowledge.

Visiting an infected website can also force the installation of an extension onto your browser.

Can You Protect Yourself From Browser Extension Malware?

One of the reasons that browser extension malware is so bad is that it often goes undetected for a period of time. Most security systems don’t check for it, or do a very poor job of looking for it. Often, a malicious extension will act benignly immediately after installation in order to be trusted, resulting in endpoint protection systems allowing it to be installed. It’s only later that the danger is discovered. Monitoring systems like our state-of-the-art SIEM system will then notice if the extension tries to send stolen data to some known bad place, but even this might be too late to prevent the actual breach.

At Digital Uppercut, we seldom rely on a single method for protecting our clients. That’s why, in addition to all of our other security systems, we further protect our clients by creating strict group policies that prevent the installation of any browser extensions by individual users. All browser extensions are reviewed, and their installation is centrally controlled.

Get Protected

Is your IT staff actively protecting you from browser extension malware? If you don’t know, you should ask. And if they don’t give you the answer you are looking for, call us and request a consultation. Let’s work together to protect you and your company from malware and cyber-criminals of all kinds. Use our contact form or call us at 213-398-8771.

How Many Hackers Are Targeting You Right Now?

 

If you read about cybersecurity at all, you have seen articles that claim that you are being hacked today -- even right now. To demonstrate the point, companies like SonicWall and FireEye put up global cyber-attack threat maps, showing how many hacks are happening right now, where the hacks originate, and where the targets are.

“But those are OTHER companies getting hacked…Not mine,” you think. “Maybe other companies are a target, but not MY company!”

But what if that weren’t true? Would it take a Cyber Attack Threat Map of YOUR company to show you that you are under siege right now? And if you saw such a map, and it showed how many hackers were attacking you right now, what would you do?

How Our Cyber Attack Threat Map Helped Two Clients

Two of our clients got their answers just last week. Their Cyber Attack Threat Map showed that one of their employees’ email accounts was being accessed from the Philippines. We contacted our client, who confirmed that the employee was not on vacation. We promptly changed the password for this employee’s email and began investigating how her data was compromised.

Another client’s Cyber Attack Threat Map showed access from Russia. Again, we contacted our client, who confirmed that the employee—who actually spoke Russian—was not overseas. So we changed the user’s password and locked down the account. Two days later, this account was again accessed from Russia. Our investigation revealed that the client had an unauthorized Russian-language email app on his phone, which was either insecure or was purposely sharing its user data with hackers. The employee has since stopped using the app.

If only certain people’s accounts in your organization are being attacked -- as with these two stories -- there’s a good chance their data was exposed and is available on the Dark Web. But the data there could be the result of a breach 6 months ago or longer. But when you have a Cyber Attack Threat Map system, you can know within hours that your data has been compromised.

What is a Cyber Attack Threat Map?

If you’re older than 50, you might remember a movie with Matthew Broderick called War Games. In the climax of the movie, you see a huge electronic map on a wall that shows the flight path of nuclear weapons around the world. Cyber attack threat maps look similar to that, but thankfully report on cyber attacks rather than nuclear weapons.

While this is comforting on a global scale, if your company is one being targeted by an aggressive hacker, you are still wise to be nervous, because unless you are extremely well protected, those hacks are going to become successful at some point.

That’s because many of those hack attempts are automated, which means that there is literally zero cost to trying to attack you and thousands of companies just like you. If you are unprotected, they will eventually be successful.

Why A Threat Map Should Be Part Of Your Security Plan

The main method by which your company will be hacked is through email. Hackers try desperately to gain access to your email server because once they do, they can send out fake emails to direct your staff to make financial transactions that end up in the hacker’s pocket. They can also install viruses across your network, malware, ransomware and more.

That’s why protecting your email is one of the most important parts of your cybersecurity plan.

Most email servers have moved to the cloud with services such as Office 365 and G Suite. While both of these systems have security tools built in, they can be expensive, weak and require frequent maintenance. So, it is difficult to know how many hackers are attacking you, or to guard against hacking attempts. As a result, phishing attempts and malware can still get in.

That’s why some companies try to use an email gateway. But those devices sit outside your cloud-based email and can only see inbound emails. That means they can’t see the emails and files shared among your internal users. They also can’t detect failed login attempts, typical of attempted hacks, or insider threats.

But our tools do all of that, giving you a clear picture of where your threats are coming from, whether that’s outside of your company or from inside.

We can even go beyond email because our tools also connect to and monitor your cloud-based storage and sharing systems, such as OneDrive, SharePoint, Box, Dropbox, and Google Drive.

How Many Hackers Are Attacking You Now?

If you are like most business owners or are responsible for your company’s IT, you are concerned about these issues. You also probably don’t have any idea how many hackers are attacking you. That’s why we make it so easy to get protected. Give us a call at Digital Uppercut at 213-398-8771, or contact us online, and let’s talk about a Threat Map and next-level protection for your email, cloud storage, and your entire business.

FBI Says Ransomware Threat Getting Worse Fast

 

In the wake of several high-profile ransomware attacks targeting state and local governments, healthcare and transportation companies, and even IT companies, the FBI recently issued a public service announcement about the growing ransomware threat.  The FBI says that individual ransomware attacks have remained consistently high, but they are becoming more targeted and costly, causing combined ransomware losses to increase sharply. Many companies fall victim to ransomware due to a lack of preparedness, cybersecurity awareness training, up-to-date software, and proper backups.

The ransomware threat is real, so what does the FBI say to do if you are attacked by Ransomware? According to an article on SiliconAngle, the FBI “...does not advocate paying a ransom, in part because it does not guarantee an organization will regain access to its data,” which is a valid concern.

How To Protect Yourself From Ransomware Threats and Attacks

Of course, at Digital Uppercut, we advocate taking steps to prevent your company from suffering the effects of a Ransomware attack in the first place...something that too few companies tend to do, often because of the costs involved. However, compared to the costs of business interruption, loss of customers, potential complications and lawsuits due to the business interruption, PLUS the cost of the ransom itself, protecting yourself is an extremely inexpensive and simpler alternative.

Your protections should include:

• Patch Management, to keep your software updated to patch known vulnerabilities
• Web Filtering, which blocks damage from known bad websites
• Advanced Email Filtering, with links wrapped and attachments sandboxed.
• Advanced Endpoint Protection, to stop known and unknown threats in their tracks
• Awareness Training, so that your entire staff can help identify and prevent malware. 
• Encryption of both your local folders and files, as well as cloud-based data.
• Security Operations Center so that a team of experts continually watches over your network security.
• SIEM, continuous real-time automated monitoring of your security logs
• Complete Backups, with encryption, multiple copies, cloud backups, physical offsite backups, and more, so that if (after getting through all of the above), you actually suffer a Ransomware attack, your data can be quickly and easily restored without having to pay a penny of Ransom.
• Ransomware Guarantee, also to be used only in case all else fails, to help restore your company to health. We offer a $1,000,000 Ransomware Guarantee.

What If You’re Not Prepared And You Get Hit By Ransomware

Companies sometimes come to us after being hit by a Ransomware attack. When they do, we assess their resources and review the prior steps they’ve taken to prevent the attack. We especially look at the backup systems they have installed and how well they are running (or ran). That’s because our first choice is to restore the data from known good backups.

However, sophisticated ransomware not only encrypts live data on the network but also seeks out and encrypts backup files it finds. In a recent Digital Uppercut blog post about a “ransomware horror story,” we wrote about ransomware that not only disabled the backup systems but also deleted all backup files—including those stored in the cloud—weeks before encrypting the company’s data. This left the attacked companies with no alternative but to pay the ransom.

Knowing that things like this happen to unprepared companies that ignore the ransomware threat, the FBI also said in their PSA that they understand that “when businesses are faced with an inability to function, executives will evaluate all options to protect their shareholders, employees, and customers,” and acknowledge that sometimes paying the ransom is the only alternative.

But they also warn that paying the ransom proves to the criminals that their tactics work, and makes them (and others) eager to attack more companies.

What Should You Do Now?

When the FBI says the Ransomware threat is getting worse fast, you would be wise to believe them. If you read the list above and didn’t think to yourself that you’ve done all of that to protect your company, then you are at risk. It’s never too early to secure your company’s resources, but it can quickly become too late.

Ransomware threats are growing, ransomware itself is getting more effective, and ransomware authors are getting more clever every day. That means the right time to begin protecting yourself is now. Call Digital Uppercut at 213-398-8771 or contact us online anytime. We’ll set up a time to assess what you’ve done so far, leverage what you’ve got, and fill in the gaps to ensure you are protected against ransomware.

Fileless and Zero-Day Attacks

 

Many computer users think that if they have a good Anti-Virus program running on their computer, their computers will be safe from hacks and threats. IT security professionals have long known this is not the case, but two new types of attacks are now proving it more often than ever. They are called Fileless and Zero-Day attacks. They happen FAST, and the damage can be huge. Here’s what they are and how they work.

What are Fileless Attacks

Most users think that computer attacks happen when you open a virus-infected file of some sort. Your antivirus software is designed to catch such attacks, and many of them do a very good job. But these days, attacks can be embedded within a web page you visit with your browser. In other words, no actual file download is required, which is where the term “Fileless” comes from.

Some antivirus programs scan web pages as you open them, but they generally work based on a set of rules or “signatures” that have been previously detected by the antivirus developers. Once the developers receive reports of a new virus (whether in a file or fileless), they analyze it, determine what’s different about it that caused it not to be detected by their existing virus definitions, and then they add this “signature” to the list of definitions. But that takes time... time you might not have to spare to protect yourself from a new attack.

The time between when a virus is released and when it is fixed can be days, weeks, or months, leaving computers vulnerable.

Many fileless attacks exploit newly discovered flaws in computer programs. For example, Microsoft Office has an entire macro language built into it. This language (and the code that runs it) is often updated, and if someone discovers a newly-added flaw in any of it, they can write some code that can exploit that flaw and attack your computer. And it’s not just new software that can be the source of a Zero-Day attack. Flaws are found all the time in older software, too.

That means that data can be corrupted, files can be deleted, and files can even be held for ransom.

Similar Zero-Day attacks can occur within web browsers and other web applications, revealing passwords, personal information, browsing history, cookie access, and more. None of this is good for you or your company.

What Are Zero-Day Attacks

A Zero-Day attack is one where a software flaw is discovered and immediately exploited. Generally speaking, it’s the software author's job to patch and fix their own software. If Microsoft is told about a bug in their software, they’ll go through a lengthy process to fix it. First, they need to determine whether the problem really exists. Then they need to figure out under what circumstances the flaw happens. If they’re successful in doing so, they need to determine where in the software the flaw was introduced and then write new code to fix it.

But they’re not done yet. Now they need to test this new software to make sure that it actually fixed the problem...and also that the new fix didn’t cause any new problems. This process can take weeks or months, depending on the software's complexity and the severity of the flaw.

So, a Zero-Day attack is one that exploits a flaw in software before the software publisher has had a chance to fix it.

Are These Attacks Really A Problem?

In a word, YES. The Ponemon Institute, which conducts independent research on privacy, data protection and information security policy, says that Fileless and Zero-Day attacks have increased by nearly 20% over the last year, and these attacks have hit about two-thirds of all enterprise-level organizations. The average cost of these attacks for enterprises is about $440 per endpoint (computer).

But what’s more significant to you is that the cost for Small to Medium-sized Businesses (SMB’s) is almost double that, about $763 per incident. And it’s only going to get worse.

How To Guard Against Fileless and Zero-Day Attacks

So if antivirus software and other file-based detection techniques can’t guard against these attacks, what can you do about them?

Computer Weekly says that “The report reveals that nearly half of all malware detected eluded basic antivirus (AV) systems, requiring a combination of legacy signature-based detection techniques and proactive behavioral detection to catch malware variants missed by signature-based detection.”

In other words, companies like yours need to increase the attention and investment you make in defending against malware such as Fileless and Zero-Day attacks. And that means you’ll need to start using tools that aren’t looking for “signatures” in the malware, but that instead look at their behavior on your computer system and network. If you find software that scans a database or registry for usernames and passwords, or that connects to and sends data to overseas servers, or that seeks to encrypt your files, then it's probably a sign that the software should be stopped.

There are hundreds, if not thousands, of different actions that malware can attempt, and behavior-based security software watches for them.

Protect Yourself And Your Company

What’s your best solution to defend against Fileless and Zero-Day attacks like these? First, always be careful when using new resources, websites and software. Second, call Digital Uppercut. We are cybersecurity experts and can configure your computers and network to minimize the likelihood of any attack. And in the event an attack is ever successful against your company, our disaster recovery solutions can help you get back to work in your business in no time. Call Digital Uppercut at 213-398-8771 for a security or IT evaluation, or contact us today here.

Security Problems for Chrome and Gmail Users

 

A recent change to Google’s Chrome browser is making us and other online security experts nervous. That’s because a new “feature” that Google introduced with Chrome version 69 to make users' online experience easier may leave those same users vulnerable to security problems they didn’t expect. These security problems with Chrome, Gmail, and other Google services are also affecting IT and Security companies like Digital Uppercut, as we now have to protect our clients from this new issue.

What Google Sync Does For Chrome Users

If you’re a Chrome user, you know that you can log into Chrome so that the browser stores your passwords and form-fill data, among other things. This is a convenience for Chrome users because they no longer need to remember complex passwords for their online accounts or enter the same personal information into online forms.

This feature also allows users to log into browsers on other devices, including mobile phones, and have all of the same stored information sync to those devices through the Chrome browser as well.

Before, the user had to explicitly log into Chrome to enable this sync feature, called Google Sync.

Google’s Change to Chrome 69

 

The red arrow above indicates that this user is logged into Chrome. The Yellow arrow shows this user logged into Google Docs -- a separate login.

Up to now, logging into other Google services, such as Gmail, Google Docs, Google Analytics and Google Ads, was separate from logging into Google Chrome. Google’s change to Chrome causes the user to be logged into Chrome when they log into these (and any other Google service), to also be logged into Chrome.

And so now, users on shared computers who are logging into specific Google services -- and then logging out of those services -- remain logged into Chrome unless they explicitly log out of the browser as well.

Here’s Where The Security Problems for Chrome Happen

So that means that when a second user sits at this shared computer, they may have access to the first user’s passwords. Would you like to log in to Fred’s bank? No problem. Just sit at his computer once he’s gone and visit his bank’s website. If Fred has saved his bank password, Chrome will offer to enter it into the form for you, after which you’ll have access to his accounts.

It’s very easy to imagine how bad this problem can get...but it gets worse.

Of course, it’s bad news if we’re talking about Fred’s personal bank account, but what if it’s your company’s bank account?

And not only are Fred’s business and personal passwords available to the next user, but so is Fred’s other personally identifiable information (PII), as well as your company’s private data. Want to know Fred’s social security number? No problem. Just visit a new bank and open a new account. When they ask you for Fred’s SSN, Google will happily give it to you. Google’s new security problem makes identity theft easier than ever.

How Google Sync Makes This Problem Worse

Google Sync, on its very own, poses problems, too. When Google Sync is enabled, your and your company’s information is stored in Google’s cloud data stores. If that data is eventually breached -- which is entirely likely one day -- so is your company’s data.

It also poses problems because some users use the same Google Chrome account for both home and business browsing. As a result, they may be storing business passwords in their personal Chrome accounts, effectively going right around any protections that you, your IT company, and your policies might be trying to enforce. And the problem gets multiplied into possible HIPAA violations if this problem ends up giving access to medical records and other PII.

Protect Yourself And Your Company

What’s your best solution to deal with security problems for Chrome and other vulnerabilities like this? The first step is to find out whether you are experiencing this or any other hacks, weaknesses or vulnerabilities. They can come not only from new software and services but also from old, outdated ones. So one of the very first things we do with any new client of our IT or Network Security Services is perform a security audit to identify issues like this that you might not even be aware of.

Once we find the vulnerabilities, we can set policies on your network or create rules on your firewalls or software to block such activity. And we go further by installing monitors to catch a variety of new issues that we can’t even imagine yet.

That’s why you should call Digital Uppercut. We are cybersecurity experts and do this kind of work for businesses like yours every day. Not only are we effective at finding and resolving security problems for Chrome and similar issues, but we are also backed by a Million-Dollar Ransomware Guarantee in case your network is ever attacked, and your data is held for ransom. Call Digital Uppercut at 213-398-8771 for a security or IT evaluation, or contact us today here.