Thanks to the COVID-19 pandemic, Zoom has gained some significant recognition and popularity in the past few months.
Remote workers are using software solutions like Microsoft Teams and Zoom to conduct meetings and keep in touch with coworkers. Since Zoom is free, along with the rise in popularity came little-known security implications.
Did you know, for instance, that a staggering amount of Zoom accounts were stolen, and these compromised accounts are now for sale on the dark web? This massive data theft impacted the email addresses and passwords of thousands of Zoom users, maybe even some at your company.
What is the Dark Web?
In simple terms, the dark web is the internet that exists underneath the commercial internet, a smorgasbord of anarchist websites, illegal drug sales, child pornography, illicit gun sales and everything else you can think of. In essence, if it is illegal, immoral or dangerous, it is probably for sale on the dark web.
Beyond the exploitation of the children and illegal arm sales, there are literally millions of stolen credentials for sale on the dark web like credit card numbers, bank accounts, email addresses, passwords and more. This personal information includes data harvested from data breaches and implanted malware, Social Security numbers stolen through phishing attacks and of course the Zoom accounts that were recently appropriated and put up for sale for less than a penny each.
If your company was part of the well-publicized Zoom breach, employee credentials could be waiting for a buyer on the dark web.
Is the Dark Web Illegal?
You might think that something as nefarious and clearly dangerous as the dark web would be illegal, but this is simply not the case. While many of the illegal activities that take place on the dark web, like the trading of certain sexually explicit images and the sale of mind-altering substances, are certainly illegal, the actual platform known as the dark web is not.
The reasons behind the legality of the dark web are complicated, involving subjects like free speech, free expression and the value of technology.
Shocking Statistics about the Dark Web
The statistics involving the dark web and the illicit sale of stolen information is staggering.
In one high profile case, more than $213 million dollars changed hands, facilitating the transfer of illegal drugs. The dark web site involved in those nefarious actions was known as Silk Road, a marketplace for illegal drugs and other contraband. One of the first forums of its kind, Silk Road brought together buyers and sellers from around the globe, functioning in much the same way as any other e-commerce site like eBay.
Fortunately, Silk Road was eventually brought down by authorities, shutting down in 2013, just two years after its inception. Unfortunately, there are plenty of other illegal marketplaces just like Silk Road, operating under the radar and trading illegal goods, stolen personal information and much more.
Since the takedown of Silk Road, federal agents have gained some ground, taking down another large marketplace called Alphabay in 2017. What once seemed like an endless string of dark net takedowns, is now looking like a brief window where marketplace technology outpaced law enforcement’s ability to track it. Today, federal agents have caught up – and based on the rate of successful takedowns, they’re making up for lost time.
What Can You Do to Protect Yourself and Your Business?
From deep scans, to targeted searches for information that may have been compromised, there are steps you can take to protect yourself from the dark web.
Dark Web Scans
If you suspect your data may have been compromised, a dark web scan can do a deep dive into the wilds of the dark web, looking for information concerning your business, employees and your data. These professional scans search for stolen credentials, sensitive business information, credit card numbers, and other data for sale on the dark web.
If your information has been compromised, you can take immediate steps to reduce the damage, including changing impacted passwords, closing unneeded accounts and beefing up security measures on your connected devices and company network.
Dark Web Monitoring
In addition to dark web scans, dark web monitoring can be incredibly helpful. Also known as cyber monitoring, dark web monitoring is an identity theft prevention solution that allows you to monitor your identity on the dark web. If your information is found, you will be notified immediately.
What To Do If You Suspect Your Information is on the Dark Web
The following steps are recommended in the event your data has been compromised.
Change your passwords. Change all passwords associated with the dark web search, including credentials used at other sites. This is especially relevant if you tend to use the same password for multiple websites.
Cancel stolen credit cards. Notify your credit card issuers immediately and let them know your number is for sale on the dark web. Doing so will limit your liability and reduce the financial fallout.
Monitor your accounts carefully. Even if you shut down your accounts, some charges may have already been approved. Monitor your accounts and statements carefully and report any suspicious activity right away.
Report the identity theft and freeze your credit. If your Social Security number is found on the dark web, you need to report the suspected identity theft right away and freeze your credit. Freezing your credit will prevent any new loans or credit cards from being issued.
If your organization has experienced a data breach or you need help conducting a dark web scan, Ontech Systems is here to help. Just contact us online or give us a call at 262-522-8560 and one of our experienced technicians will walk you through the process, from uncovering your information on the dark web to mitigating the damage and protecting your sensitive business data moving forward.
In this day and age, cybersecurity is more important than ever. This year, we’re faced with many older threat strategies that have evolved and adapted to a new landscape and to new targets.
Without a doubt, cybersecurity threats continue to be a problem that can’t be addressed with a single, silver-bullet solution. No matter what size your business, a layered security approach has consistently proven to be the best way to guard against security threats – and that won’t be changing anytime soon.
These are the top cybersecurity threats we recommend companies watch out for in 2020.
1. Malicious COVID-19 email spam, malware and ransomware campaigns
Cyber criminals thrive in times of crisis. Watch out for phishing emails that are engineered to get you to click. In the event you do fall victim to a phishing email, you’ll unintentionally download malware onto your device and your company network. With the remote workforce on the rise, now is the time to be vigilant when it comes to cyber security.
When working remotely, it’s important to enable multi-factor authentication whenever possible. (Both on business and personal accounts). You’ll also want to ensure your internet router is up to date on antivirus protection and that you are using a secure connection.
As a business, it is essential to remind employees to use the same care they would with confidential information as they would if they were in the office.
Personal email should not be used at any time for business related work. Remind employees to shred any confidential information they may have printed on their home printer or avoid printing that information in the first place.
In 2019, 85% of MSPs report ransomware as the most common malware threat to SMBs.
The average ransom requested by hackers is increasing. MSPs report the average requested ransom for SMBs is ~$5,900, up 37%, year-over-year.
Downtime costs are up by 200% year-over-year, and the cost of downtime is 23X greater than the average ransom requested in 2019.
1 in 5 small businesses have fallen victim to a ransomware attack. On average, businesses who don’t outsource their IT services report facing more ransomware
Ransomware has been with us for quite some time and it is interesting to see how it has evolved.
According to SonicWall’s 2020 Cyber Threat Report, ransomware is now being used to target victims that are more likely to pay the ransom given the sensitive data they possess. In 2019, much of the 187.9 million ransomware attacks were targeted at state, provincial, and local governments in addition to educational institutions.
According to statistics reported by Small Business Trends, 1 in every 99 emails is a phishing attack. This translates to 4.8 emails per employee throughout a 5 day work week. This is especially alarming considering one wrong click can take down your network without the proper security measures in place.
Phishing emails are one of the most effective tools in a cyber criminal’s “bag of tricks” because phishing has proven to be low cost with a high return. Hackers have developed sophisticated ways to trick victims into surrendering sensitive info such as login credentials, credit card details, and more. Phishing attacks are cheap, effective and easy for cyber criminals to pull off.
One of the best ways to guard against phishing attacks is by addressing users – the weakest link. Security awareness training can aid in helping employees learn how to spot a phishing email.
In addition, it pays dividends to evaluate employee privileges and ensure that each user has access to the bare minimum needed for them to fulfill their job. Learn about more phishing solutions to guard your network against this rising security threat today.
4. Distributed Denial of Service (DDoS) Attacks
While you might be unfamiliar with DDoS attacks, it is a type of cyber threat your IT professional should be well acquainted with. While the methodology of these attacks vary, denial of service attacks are designed to overwhelm network resources so your system can’t process legitimate traffic on your network.
DDoS attacks are often used as a type of distraction, frequently stopped and restarted in order to hide another attack in progress. While your IT technicians are busy addressing the DDoS distraction, the cybercriminal moves forward with their primary attack, similar to how a magician redirects his audience’s attention so they don’t notice how he performed the trick.
5. Internet of Things (IoT) Attacks Are Rising
In 2019, SonicWall reported a 5% increase in IoT malware, totaling 34.3 million attacks. And with a surge of new IoT devices connecting daily, they suggest increases in IoT malware attacks should not only be expected, but planned for.
If you’re not familiar with IoT devices, “internet of things” refers to Wi-Fi enabled devices like speakers, appliances, and alarm clocks. These devices are often overlooked when it comes to security making them easier to compromise.
To prevent this type of attack, it is critical to keep all firmware updated for IoT devices as updates often resolve exploits that were patched by the manufacturer.
There isn’t a “one size fits all” IT solution that is ideal to address DDoS attacks. It is best to contact your IT professional so they can evaluate your cybersecurity strategy as a whole, along with the threats you face, and the resources you have in place.
Contact Ontech’s support team if you notice any unusual activity with heavy server loads or any other type of unusual network behavior.
Our security technicians have extensive expertise in each of these threats and more. Call 262-522-8560 to discuss setting up a layered security strategy for your business. A quick 10 minute call is all it takes to see if we’re a good fit!
For years, a strong password has been the most basic form of protection for your online accounts, but today, it is no longer enough. In the age of security breaches, chances are good your credentials are among them.
If you truly want to protect yourself and your accounts, you need another layer of authentication. If you are not already using multi-factor authentication to verify your online identity, you may be on borrowed time with a false sense of security. By now, you may be wondering…
What is Multi-Factor Authentication (MFA) and Why Do I Need It?
Although you may not know it by name, you may already be familiar with multi-factor authentication. Many banks and financial institutions have been using MFA for years, favoring its inherent security advantages over the simpler user ID and password combination.
What Are Some Examples of Multi-Factor Authentication?
When multi-factor authentication is turned on, users must enter both their password and a second form of authentication. Depending on the business or institution, this additional authentication measure may be a phone call, an email or a text containing a code. But no matter what the process, access is not granted until that one-time code has been entered.
There are plenty of reasons to use multi-factor authentication, but among the most important is the additional protection it provides. With MFA, if a hacker obtains your login credentials or an identity thief purchases your information on the dark web, that data is useless without a special code.
The good news is multi-factor authentication is now available in a number of formats and platforms, including social media accounts, email and more. Many more organizations are now offering multi-factor authentication to their clients and customers, and in the age of rampant cyber breaches, that number is only expected to grow.
Microsoft and MFA
Software giant Microsoft is fully onboard with multi-factor authentication. The company now enforces MFA on all partner and administrator accounts.
Now that companies like Microsoft have adopted multi-factor authentication, this enhanced security verification has hit the mainstream. MFA is no longer confined to banks and brokerage firms; users are just as likely to encounter it on insurance accounts, email accounts and even social media profiles.
Single vs. Multi-Factor Authentication
Single-factor authentication requires only a username and a password, and while some sites require complicated passwords, others still allow simple credentials that are easy to guess and even easier to crack.
Multi-factor authentication adds an additional layer of security to online accounts, reducing the impact of stolen credentials and making the website far more secure. Even if a hacker has access to both your username and password, that individual will not be able to log on without the one-time MFA code.
With MFA turned on, the hacker would need physical access to the targeted individual’s smartphone or email account. It is this additional verification that makes multi-factor authentication so important, and that is why so many organizations have adopted the technology. If you have questions about securing your online accounts or your business security in general, contact Ontech’s support team online or by phone at 262-522-8560.
Each year, cyber crime continues to grow, infiltrating business through methods like phishing, ransomware and social engineering. Cyber criminals have found the path of least resistance andthey are running with it. Cyber crime statistics in 2019 indicate that cyber crime has grown in leaps and bounds over the previous year.
According to zdnet.com, the average cost of cyber crime for an organization increased $1.4 million over the past year, to $13.0 million, and the average number of security breaches in the last year rose by 11 percent from 130 to 145. What does this mean?
Cyber crime taking more time to resolve
It is becoming more expensive to fix
Everyone is a target
For now anyway, this is our new normal and hackers have evolved, adapted and they realize the most effective method is to target humans, the weakest link in cyber security.
2019 Cyber Crime Statistics
Check out these startling statistics that paint a very clear picture of cyber crime today – and learn what to do to stop it from happening to you!
1) Ransomware Remains the Biggest Threat to Small Businesses
In 2019, 85% of MSPs report ransomware as the most common malware threat to SMBs. (Source: Datto)
2) Small Businesses Are the Primary Target
On average, 1 in 5 small businesses report that they’ve fallen victim to a ransomware attack. Small businesses who don’t outsource their IT services are more at risk. (Source: Strategy Analytics’ proprietary research of the North American SMB market.)
3) 91% of Cyber Attacks Begin with a Phishing Email
Cyber criminals have zeroed in on the #1 most effective type of cyber-attack: phishing emails. As the leading cause of cyber threats, spear phishing involves targeting an individual or group of users by masking the email as a legitimate source like a banking institution or software company like Microsoft.
Hackers use tactics like urgency to get you to open the email without thinking twice and before you know it, you’ve clicked on a cleverly disguised malicious attachment or a link to malware.
The average ransom requested by hackers is increasing. MSPs report the average requested ransom for SMBs is ~$5,900, up 37%, year-over-year.
Tip: If your business has become victim of a ransomware attack, DO NOT pay the ransom. There is no guarantee you will get your data back and you could be out thousands of dollars for nothing. The best defense against ransomware includes a multi-layered security approach. (Source: Datto)
5) In 2019, the Average Cost of Downtime is WAY Up
($141,000 in 2019 vs. $46,800 in 2018) Yep, you read that right.
Downtime costs are up by 200% year-over-year, and the cost of downtime is 23X greater than the average ransom requested in 2019. (Source: Datto)
6) Ransomware Attacks Occur Every 14 Seconds
Every 14 seconds is the frequency in which a business will fall victim to a ransomware attack this year. Estimates show that this number will INCREASE to every 11 seconds by 2021.
At the very least, it is critical that you have a reliable, regularly tested data backup solution in place so that if you do lose access to your data, a backup can quickly be restored, minimizing downtime and saving you a significant amount of time and money. (Source: Cybersecurity Ventures – 2019 Official Annual Cyber crime Report (ACR))
7) USA is the #1 Target
It’s great to be #1, but not so much when it comes to being the primary target of cyber security attacks. The United States is ranked #1 across all other countries targeted by cyber criminals. (Source: Norton Security)
8) Ransomware Attacks Predicted to Increase 5X by 2021
It is predicted that ransomware attacks against healthcare organizations will increase by 5X between 2017 and 2021.
And consider this – healthcare ranks 15th out of 18 industries when it comes to cybersecurity and research shows hospital employees fall victim to 1 out of every 7 phishing emails.
This creates a tremendous opportunity for security awareness training for healthcare organizations in order to close the gaps and strengthen security from within. (Source: The Cybersecurity Almanac 2019 from Cybersecurity Ventures)
9) Cyber Crime is More Profitable than the Global Illegal Drug Industry
So why do they do it? It’s simple. Although it sounds crazy, cyber crime is now more lucrative than dealing drugs. The illegal drug industry totals around $400 billion/year. In 2018, cyber criminals earned a total of around $600 billion. (Source: Cybersecurity Ventures)
10) You Can Purchase a Consumer Account for $1 on the Dark Market
With billions of personal records stolen over the years, this creates an excessive amount of credentials for sale on the dark web. This in turn has lowered the cost of consumer accounts. Bank accounts run hackers anywhere between $3-25 each. (Source: RSA)
The Best Defense is a Good Offense
A solid data backup and disaster recovery plan. A good plan includes a multi-layered security approach.
Set up a data backup and disaster recovery plan. Also mention security assessment and also security awareness training.
Contact our support team today to strengthen the security of your network so you don’t become the next statistic.
Take the first step by giving us a call at 262-522-8560 for a quick 10-minute chat to see if we’re a good fit or submit a request online and let us know how we can help.
It’s only fitting that October is also National Cyber security month, a time to reflect on cyber threats and seek protection from security risks. So what is cyber security, and why is it so critical?
The Meaning of Cyber security
Cyber security can take many forms, from user training and ongoing employee education to assessment of potential vulnerabilities within a business network infrastructure. Technology and user education are complementary halves of a cyber security whole, and one is not effective without the other. A prominent part of network security is assessing network access and evaluating which areas are most deserving of your time and effort.
The Benefit of Security Assessments
At Ontech, we can provide your business with a thorough assessment of your cyber security, including an analysis of your network infrastructure, a deep dive into your security protocols, and a look at your vulnerability to both insider attacks and external threats.
Until you establish a baseline, it’s impossible to know where you are going and what you could be doing better. By having an assessment conducted, you can build on your previous efforts to create an even more robust online and physical infrastructure. If you have already had a vulnerability assessment completed in the past, we can provide a second opinion, so you know you are protected.
How Can You Be Cyber Secure?
One way to think of online security is like a pendulum, with security on one side and convenience on the other. Convenience is important, but easy access could also make it less secure. On the other hand, enhancing security can come at the cost of convenience, triggering complaints from employees and customers. Getting that balancing act right can be difficult, but it is essential if you want to keep your network and data safe.
Who Should Be Responsible for Cyber security?
There is an ongoing debate over cyber security and who is ultimately responsible. Should IT departments challenge upper management to enhance security? Should software companies and internet service providers take a larger role in security and data protection?
These are difficult questions with serious implications in the real world. In the wake of a recent ransomware attack, a governmental agency fired their IT technician, but the IT staffer fought back. He filed a lawsuit, and he is likely to prevail in that action.
In this particular case, the IT tech had an extensive paper trail, one that showed the lack of cyber security was largely the fault of management, and the agency shunned its responsibility for cyber security. As ransomware attacks grow more frequent, this situation is likely to recur, and businesses everywhere need to be ready.
Online Practices to Avoid
In the online world, it is critically important that you know and understand who you are giving information to and why. Hackers often target social media to influence buying habits, steal personal information, and compromise security. Understanding these tactics is the first line of defense when it comes to protection your data – both business and personal.
Knowing when to ask for help when you’re out of your element can save you a lot of heartache. For example, if your computer was infected with ransomware, it might be tempting to pay the ransom, but before you do anything, get professional help. Ontech is ready to be your partner.
Just contact us at 262-522-8560 for a thorough security assessment and additional tips on how to secure your network.
Data protection has never been more important for businesses of all sizes. Hardly a day goes by without word of yet another data breach, another stolen laptop and yet another PR nightmare for the business involved.
If you want to protect yourself, your data and your business, you need to take security seriously, and that starts with enterprise-level encryption. Solid encryption is a must for mobile devices, including the laptops your sales staff uses while on the road. That’s where BitLocker comes in.
What is BitLocker?
This proprietary encryption program is designed for business use, and it is an essential tool in your IT security arsenal.
Designed to be used seamlessly with Windows-based computers, BitLocker can encrypt the entire hard drive, rendering the files on it useless to a thief while allowing legitimate users to fully access the data they need.
That protection is certainly vital in today’s dangerous cyber world, but BitLocker can do more than just encrypt files – this powerful program also provides protection against unauthorized changes to the operating system, including firmware changes. This is particularly valuable, since many recent malware infections work by surreptitiously updating the firmware on targeted devices.
A Versatile (and Free) Tool
BitLocker comes free with Windows 10, so business users will not incur any additional expenses when using it. And while the BitLocker tool is free, it is also extremely valuable and versatile.
With BitLocker, users can encrypt the hard drives on their desktops, laptops and servers. This device-level encryption is a powerful security tool, but it is arguably most useful for mobile devices, especially laptops.
If a thief steals one of your company laptops, they will no doubt try to access the files it contains. They may even remove the hard drive and try to read it on a third-party device, but with BitLocker in place that access will be blocked.
HIPAA and Banking Compliant
Certain businesses, including firms subject to HIPAA regulations and companies doing business in the banking sector, are required by law to encrypt their data. When used as part of an overall security strategy, BitLocker allows those businesses to stay compliant and avoid possible penalties.
BitLocker can also provide additional protection from ransomware, but businesses should not rely on this one program alone. Some strains of ransomware can work their way around BitLocker, so use it as a small part of a larger data protection strategy. Other parts of that strategy should include a robust backup plan, ongoing employee training and executive awareness.
BitLocker works by using a 200-digit key. That key is associated with a user on the network, and once it is enabled, the user does not have to worry about it again. The network administrator can track the keys and keep all relevant information. If a user needs to recover a particular key, they can do so through the administrator.
How to Manage BitLocker
BitLocker is a powerful tool for data protection and encryption, but it is only as effective as the processes you put in place. In order for BitLocker to do its job, all vulnerable devices, including mobile computers, must be fully encrypted.
Running ongoing scans for unencrypted mobile devices can help you manage BitLocker more effectively, so nothing slips through the cracks and no proprietary data leaks from your organization. If you need help developing a sound plan for hard drive encryption and mobile device protection, Ontech Systems is always just a phone call away at 262-522-8560.
Does BitLocker Affect Performance?
When used as intended, BitLocker should not negatively impact the performance of your laptops and other computers. It does take time for the BitLocker process to run, so it is important to schedule the installation accordingly.
If you do notice issues with performance on devices running BitLocker encryption, it is important to find the root cause. Preexisting malware infections, undetected problems with the operating system, and other issues could cause performance to deteriorate.
If you need help installing, maintaining or working with BitLocker, you do not have to go it alone. BitLocker is a powerful tool, but making the most of it is not always easy.
For help with all your BitLocker related issues, just give Ontech Systems a call or send us an email. We are happy to assist you, so you can enjoy secure hard drive encryption and the peace of mind that comes with it.
