With cyber security breaches making headlines on an almost daily basis, it’s no wonder that it’s become an important area of focus for business owners. And while stepping up a firewall and antimalware software and adding additional protections such as two-factor authentication and data encryption are all critical when it comes to protecting your business, there is a much bigger flaw present in your security.

Despite being the single greatest vulnerability in any business’ IT security, the area that is universally overlooked is your employees. Human error accounts for more data breaches than any other factor and often plays a key role in all sorts of infections, intrusions, and thefts. One small, avoidable mistake can render every single security measure your business has in place all but useless.

There is no one mistake than can be blamed for these statistics. Some of the most common errors that result in data loss for businesses are:

• Poor password management
• Failure to recognize a phishing attempt
• Data being sent to the wrong recipient via email, fax, or post
• Unsecured disposal of outdated hardware
• Improper disposal of paper files
• Loss or theft of unsecured devices such as laptops, smartphones, or external drives
• Failure to encrypt or redact sensitive information

Waiting until after a breach occurs to address these vulnerabilities leaves your business open to a host of serious consequences such as loss of profits, loss of clients, fines, and potentially even legal ramifications. Which is why comprehensive and routine education and training for your entire team needs to be a critical component of your overall cyber security strategy.

Taking the time to educate your team on the proper way to handle data, how to spot and avoid the latest cyber threats, and what they can do to minimize the impact an infection or breach will have on your business will go a very long way towards keeping your business secure. Investing time, effort, and funds into new security software and tools will be a wasted investment if your staff conducts themselves – however unintentionally – in a way that undermines those measures.

Want to learn more about how you can take your employees from your greatest weakness to your biggest strength? Contact us at {email} or {phone}. We’re the IT professionals businesses in {city} trust.

You may have already had a network firewall to fend off malicious entry. How well-trained are your gatekeepers; i.e., your human firewall?

This article highlights some things you can do to make sure your system users can recognize intrusion dangers from other sources like email and malicious links.

This article highlights some things you can do to make sure your system users can understand intrusion risks from other sources like email and malicious links.

Whether your organization is a covered entity or business associate, the HIPAA umbrella casts a long shadow. Information breaches bring strong sanctions, even in the “Unknowing” category–with a maximum of $50,000 per violation up to $1.5 million annually. The fines and administrative penalties following a hack or unauthorized discloser are somewhat akin to receiving a traffic ticket following an accident that totals your vehicle after you have loaned it to an inexperienced driver.

Security measures are only the beginning

Your personal health record data is undoubtedly protected in secure servers. You employ malware and virus protection, because you know just how valuable medical records are to the cyber underworld. So the protection may be in the engine, but what about the users at the wheel?

Cyber attacks don’t always depend on backdoor intrusions through vulnerable websites or Internet browsers. For example, this LA Times online story chronicles how 108 county employees opened a phishing email and provided user names and password to their accounts, “some of which contained confidential patient or client information…”

Yes, county officials said “they have strengthened security measures…and enhanced employee training…” but that is scant consolation to the 756,000 people whose names, addresses, dates of birth, Social Security numbers, financial information and medical records ended up in the hands of a Nigerian scammer.

User Training is essential…

So protecting files is not the same thing as protecting access to them. The LA County incident illustrates several points made in this Health IT Security.com online article by Bill Kleyman:

End-user awareness of underlying security is no more complicated than learning how to identify the threats. Kleyman advises educating employees in what they should not do, i.e.:

• Don’t open attachments on emails from strangers. If the email is from someone they know, check with the send before opening the attachment. (Even then, the “friend” could be passing along something infected.)

• Don’t–that is, never–click on embedded link in emails from strangers. Check the link out by hovering your cursor over the link. If it looks suspicious, leave it alone and look online for suspicious cyber threat indicators.

• Don’t plug in USB peripheral devices that have not been scanned. Hackers have been known to place infected USB thumb drives in parking lots, relying on the natural curiosity of those who would foolishly plug them into their network computer.

• Don’t log into health care accounts from unsecured mobile wireless locations. Hackers hang out at coffee shops and other public areas with Wifi access and can glean usernames and passwords from mobile devices.

In the do category, Kleyman recommends:

• Do pay attention to regular data backups and do them offline. In the case of ransomware, backups might be the only way to restore blocked data.
• Do use anti-malware software that downloads periodic updates to keep up with the emerging threats.

• Do hold security workshops “with different user-focused themes.” This, according to Kleyman promotes positive interaction with the end-user community and keeps security awareness at the forefront.

How {company} can help

Looking for help with cyber security and training for your employees in {city}? Contact us at {email} to learn more, or call us at {phone} to talk to one of our dedicated staff.

Just like other cyber attacks, phishing scams are getting more sophisticated.

Phishing scammers are getting more and more sophisticated. You no longer have to only watch out for misspellings or fraudulent emails coming from your “IT Department.” Of course, these are still things to concern yourself with and be on the lookout for but the attacks are becoming more and more difficult to detect.

CEO’s and CFO’s Targeted

In recent weeks, there have been two cases of phishing scams that are otherwise undetectable. Not only are they more difficult to spot but they are going to more powerful people in businesses. Scammers took the time to research organizational structures so they not only would know who to contact but they also know who to impersonate. In the most recent cases, the cyber attackers used the internet to determine the organizational structures and who the CEO’s or CFO’s were. They then took the time to research board members and other senior employees who would have interaction with the intended target. This kind of implementation went even further because they found legitimate reasons for the board members or senior employees to request funds. They then sent the email to the intended victim and asked for money for a completely plausible need. The attacks were very well researched and thought out. They were even executed in a way that it was almost impossible to detect. There were no red flags with the emails and it was essentially the perfect implementation.

Protecting Yourself Against Phishing Attacks

Even though the nature of phishing attacks is changing rapidly, you still need to watch out for the most basic components of one to better protect yourself. In addition to the rules that many people already know, there are new things to be aware of. These are just some of the things to look out for:

• Misspellings. If you see an email that has a lot of misspellings throughout the copy, then you should be on alert. It is likely a phishing scam. Keep in mind that one misspelling may not mean it is a phishing email but it is still something you will want to further examine before you respond or click any links in the email.
• Requests for money. Even if it is not out of character for requests to come through your email at work, you should ensure they are legitimate before you send any money. Make sure the request comes through the normal protocol and do not make any exceptions. You may even want to call the person who sent you the request to ensure it came from them.
• Emails coming from strange email addresses. Something that can be difficult to notice unless you are paying attention is an email address that is not correct. If you get emails from strange email addresses that are similar to the authentic ones you are used to, delete the email immediately. This is likely a phishing scam that has been modeled to look as much like your normal emails as possible.
• Know that no one is completely safe. No matter how much security you may have within your company, there is always the risk of a cyber attack. Cyber criminals are getting much smarter in how they implement these scams and you should always be on high alert as a result.

For more information on how you can better protect yourself from potential phishing scams in {city}, be sure to contact {company} by calling us at {phone} or emailing {email}.

The largest Google account breach to date recently occurred and it is important to determine whether or not you have been a victim. Also learn how to better protect yourself from malware attacks in our latest blog.

Cyber attacks happen on a daily basis. Even if you think you are protecting yourself, if you keep your information stored in another location that is hacked or you download something you are not sure if you trust, you may still be at risk. This is exactly what happened in November of this year.

Gooligan

Gooligan is a new Android malware that has compromised more than 1 million Google accounts. The malware was first discovered by researchers at Check Point Software technologies. The number of affected account is increasing as well by almost 13,000 as people continue to download affected apps on their phones. Gooligan has been traced back to SnapPea, a malware that was identified last year. Since Gooligan has been identified, it has shown up in dozens of apps that appear to be legitimate through the third-party Android app stores. Because these third party app stores are not controlled by Google, the company cannot monitor the apps available. This is one of the main reasons why Google always recommends that people download apps directly from Google Play. People often use these third party app stores so they can find a free version of an app that they want but they could be opening themselves up to many more problems including malware. While this has been the most common way Gooligan has been installed, it can also be installed using phishing scams via SMS messages or even emails.

How the Malware Affects Your Device

If you device has been affected by Gooligan, then it is essentially allowing access to all data stored on any of your Google applications. This means that you could be giving access to your Google Docs, Google Photos, Google Drive, Gmail, and Google Play to the malware software. The good news is that the majority of the infected accounts, 57 percent, are located in Asia. Only 19 percent are in the Americans, 9 percent in Europe, and 15 percent in Africa. However, just because the overall percentage of infected accounts is low here does not mean that there are not many people who have the malware. You also run the risk of not only providing your data to the cyber attackers but they can even turn your Android device into a money maker for them. They do this by stealing your account information and authentication information. They then use these credentials to install adware that can generate income for them. They may even install apps from Google Play and rate them to better their rating in the store and draw more victims to download their infected app.

How to Check to See if Your Account Was Affected

This has been the largest Google account breach that we have seen. If you are concerned about whether or not your account has been affected, then you can utilize a tool from Check Point, the researchers who discovered the breach. You can not only run your account through to see if it was affected but you can also look at the full range of apps that have been infected with Gooligan so you can help protect yourself and your friends.

It is always better to download official apps from Google Play, even if you have to pay for them. If you get a virus from an illegal download, it will cost you much more to clean it up. For more information, contact {company} in {city} via {email} or {phone}.

Phishing scams have been a favorite tool of cybercriminals for years. Learn about 6 particularly egregious scams.