Month: July 2019

Categories
Blog

Why Every Business Needs Cybersecurity

Business Investment in Cybersecurity

Why Every Business Should Invest in Cybersecurity

Cyber security is essential to businesses of all sizes. Learn how to keep your business up to date and protected from the most common digital threats.  

Cybersecurity is no longer a concern exclusive to large corporations. Since the infamous attacks on Equifax, Target, and Apple, cybercriminals have started to shift their focus towards smaller businesses. Without proper security protocols, small businesses are sitting ducks even for novice hackers.

In recent years, the cost of data theft targeting small and medium-sized businesses (SMBs) has risen significantly. The Ponemon Institute reports a 17% increase in the average cost of theft and damages, and a 26% increase in the average cost of disruption to operations. The threat has prompted many SMBs to invest more heavily in third-party data security services.

Cybersecurity in a Continuously Evolving Digital Space

Ever-evolving technology makes the world more connected, but also makes data more vulnerable to attackers. Gone are the days when an antivirus, firewall, and email filter were enough to earn a passing cybersecurity grade. As criminals refine and improve their methods of attack, businesses and IT professionals must step up their defenses.

The most recent trend in cyberattacks is a shift towards SMBs, many of which lack the breadth and depth of data security that larger corporations are likely to have. Illicit tactics such as email phishing, direct hacking, and installing ransomware can spell big trouble for SMBs. If your data is compromised, the results can extend to your customers and other members of your supply chain.

Consequences of a Data Breach

The fallout from a data breach depends on the scale of the attack and the value of the data stolen. Hackers may be able to seize control of accounts, drain funds, freeze assets, and access sensitive customer information. If you operate in the healthcare or financial sectors, you may be liable to pay reparations in addition to suffering the cost of stolen capital and the inability to continue operations. The cost of a large-scale data breach can devastate even the wealthiest of corporations, and will most certainly overwhelm a small business.

How to Improve Cybersecurity

A common misconception is that only large corporations can afford effective cybersecurity. In most cases, implementing cybersecurity isn’t merely a matter of money, but of proper training and awareness. A Ponemon Institute study linked 54 percent of data breaches to employee or contractor negligence. This includes email phishing, which is often the first step attackers use to conduct large scale theft of usernames, passwords, and other sensitive data.

Educating and training your employees on cybersecurity minimizes the risk of data theft at the point of contact. Your business should have protocols to identify signs of phishing, choose secure passwords, and grant or deny access to information. You can also inform your customers about how to keep their information secure. Taking this two-pronged approach shows customers how committed you are to keeping their data safe.

Being proactive and spreading the word on cybersecurity threats will help you protect your business from hackers. Whether you’re a multinational corporation or a two-person mom-and-pop shop, your customers rely on you to safeguard their data. Implementing the latest security practices lets them know that you value their trust.

Categories
Blog

Capital One Data Breach Affects More Than 100 Million Customers

Capital One Data Breach Affects More Than 100 Million Customers and Small Businesses in The U.S. & 6 Million in Canada

On July 29, 2019, Capital One reported that their customers’ confidential information was compromised. This includes the Social Security and bank account numbers of more than 100 million people and small businesses in the U.S., along with 6 million in Canada.

Capital One Data Breach

The McLean, Virginia-based bank discovered the vulnerability in its system July 19 and immediately sought help from law enforcement to catch the perpetrator. They waited until July 29 to inform customers.

How Did The Hacker Get Into Capital One’s System?

According to court documents in the Capital One case, the hacker obtained this information by finding a misconfigured firewall on Capital One’s Amazon Web Services (AWS) cloud server.

Amazon said that AWS wasn’t compromised in any way. They say that the hacker gained access through a misconfiguration on the cloud server’s application, not through a vulnerability in its infrastructure.

Capital One says that they immediately fixed the configuration vulnerability that the individual exploited and promptly began working with federal law enforcement.

Who Breached Capital One’s Data?

Paige A. Thompson, a former software engineer in Seattle, is accused of stealing data from Capital One credit card applications.

Thompson was a systems engineer and an employee at Amazon Web Services from 2015 to 2016. In a statement, Amazon said that she left the company three years before the hack took place.

The FBI arrested Thompson on Monday, July 29 for the theft, which occurred between March 12 and July 17. Thompson made her initial appearance in U.S. District Court in Seattle and has been detained pending an August 1 hearing. Computer fraud and abuse are punishable by up to five years in prison and a $250,000 fine.

What Information Was Compromised?

Thompson stole information including credit scores and balances plus the Social Security numbers of about 140,000 customers and 80,000 linked bank account numbers of their secured credit card customers. For Capital One’s Canadian credit card customers, approximately 1 million Social Insurance Numbers were compromised.

The largest category of information obtained was that of consumers and small businesses when they applied for one of Capital One’s credit card products from 2005 through early 2019.

Capital One said, some of this information included names, addresses, phone numbers, email addresses, dates of birth and self-reported income.

Other data obtained included credit scores, limits, balances and transaction data from a total of 23 days during 2016, 2017 and 2018.

This is one of the top 10 largest data breaches ever, according to USA TODAY research.

What Is Capital One Saying About The Breach?

They will offer free credit monitoring services to those affected. Capital One said it was “unlikely that the information was used for fraud or disseminated by this individual” but committed to investigating the hack fully.

They’ve set up a consumer website about the breach at www.capitalone.com/facts2019 that you should refer to if you’re worried that your information was compromised.

Capital One expects that this hack will cost them approximately $100 million to $150 million in 2019.

What Should Capital One Customers Do?

If you’re a Capital One customer, you should check your account online. You should also freeze your credit through each of the three main credit bureaus: Experian, Equifax and TransUnion.

It’s important to remain vigilant. Businesses should sign up for Dark Web Scanning to detect whether your confidential business information is there for cybercriminals to use.

Prevention is always the best remedy. Ask your IT provider to ensure your that your firewall is properly configured and to continuously remotely monitor your network for intrusions.

Categories
Blog

5 Incredible Benefits of Effective Managed IT Services

Business Meeting Talking About Managed IT Services

5 Incredible Benefits of Effective Managed IT Services

Managed IT services are one of the many ways an organization can choose to handle their IT needs. With managed IT services, a third-party handles the entirety of the tasks and responsibilities regarding managing IT and keeping the company running. The difference between this and many traditional third-party services is that it’s provided for a set cost. Instead of having access to an hourly consultant rate, you’ll be paying a flat rate monthly (or annually) in exchange for total coverage.

Every arrangement is slightly different and must be outlined very clearly in the Service Level Agreement (also known as the SLA). This document will arrange not only the cost structure, but also the exact services that are included in the partnership, and the metrics that are used to define success or failure.

There are many reasons that companies elect to go with managed IT services to handle their day-to-day needs. Here are five of the most compelling reasons:

1. Provides Total Alignment Between Both Parties

In a managed services agreement, both parties are aligned for maximum efficiency and performance. Since it’s not an hourly rate, the third-party is incentivized to handle your IT in an efficient and effective manner. Otherwise, they have to spend more time and manpower resolving your issues, which brings down their effective hourly rate.

Additionally, if they don’t live up to the metrics set forth by the SLA, they may be liable for penalties or even complete termination of the contract. In this way, it’s in both companies interest to do the very best job possible.

2. Focuses on Being Proactive versus Reactive

If you’re paying by the hour, the services you’ll receive are going to be reactive. When your company notices an issue, they’ll reach out to the third-party to help fix it. Managed services provide proactive support. Since they’re working for you no matter if there’s a problem or not, much of their time is spent preventing problems in the first place. This results in much smoother daily operations and the avoidance of problems that could potentially hurt your businesses but would be unavoidable with another type of arrangement.

3. Contains Simple Cost Structure

The simple cost structure of managed IT services will be much appreciated by your accounting department and whoever is setting the budget. Instead of seeing costs vary wildly by the amount of support required in a particular month, the amount will be a flat fee. You’ll also likely save a great deal of money versus hiring a fully functional team in-house since you won’t need to pay for things like recruiting, onboarding, benefits, and continued training.

4. Makes Projects Easier to Manage

When you need to roll out a brand-new technology or simply update an existing one, it can take a great deal of time and resources. This is especially true if the third-party isn’t used to the way your business operates each day and has to fit the entire roll out into a small window of time. If you have continuous support, however, it’s a much more manageable process. They can work on the project when they have a spare moment in the day. Since they’re fully integrated into your day-to-day processes, they’ll have a much better idea of how to implement a new system from end-to-end, including training and providing post-launch support.

5. Offers Access to True Experts

Unless you’re a massive organization, it’s unlikely that you can afford to recruit, train, and maintain the very best in the IT field. With an agreement with a top-notch IT firm, you gain access to experience and perspectives that you would be unlikely to otherwise access. These talented professionals will be able to help you with all of your IT needs, from daily maintenance to improving upon your existing systems and processes.

Managed IT services are only one of the many ways that a company can choose to handle its IT needs. However, it offers many advantages over some of the other options, including handling IT in-house and going with an hourly consultant-based fee schedule. If you believe that your business could benefit from controlled costs, improved support, and access to an incredible variety of IT talent, managed IT services might be the best option for your business.

Categories
Blog

How To Download Audio From Facebook Messenger

Young Business Person Downloading Facebook Messenger Audio

How To Download Audio From Facebook Messenger

Facebook Messenger is one of the most popular chat and messaging services in the world. Increasingly, Facebook Messenger is increasingly being used to communicate using text, audio, and video.

However, a common question asked by users of Facebook Messenger is how audio files can be saved from within the messages app.

As it currently stands, the ability to save audio messages is not an integrated feature built into Facebook Messenger itself. Fortunately, there are a few reasonably easy ways to save audio messages to your desktop or laptop.

Method one: Open Web Inspector in your browser

The first method may seem a bit tricky, but it’s actually pretty easy once you get the hang of it.

First, find the audio message that you want to save within Messenger. Next, select “Develop” then “Show Web Inspector”. After that, you’ll want to select the “Network” tab and look for a file that starts with “audioclip-” followed by letters and numbers, and ending in “.aac”. Right-click or double-click on the file and it will download to your Download folder.

Once you’ve done that, the audio file will be saved to your computer, and can be shared or moved like any other file.

Method two: Mobile site hack

An alternate method involves using the mobile version of Facebook on your desktop computer. To do this, simply type “m.facebook.com” instead of facebook.com” as the URL. Once there, click on messages and find the audio file you want to save. Once you find it, click the down-facing arrow in next to the audio clip. As in Method one, you should see the file download to the Download folder on your desktop.

Hopefully, Facebook will eventually integrate the ability to save audio files in a streamlined and user-friendly way. For now, rest assured that the two methods described above will allow you to save audio files quickly and easily.

Categories
Blog

OAuth Phishing Attacks: Threat Advisory

OAuth Phishing Attacks

What You Need To Know About OAuth Phishing Attacks

Amnesty International has reported that OAuth Phishing attacks targeted dozens of Egyptian human rights defenders since the beginning of this year. They are warning that these human rights defenders should be vigilant and contact them if they receive any suspicious emails.

“Since January 2019 several human rights defenders and civil society organizations from Egypt started forwarding dozens of suspicious emails to Amnesty International. Through the course of our investigation, we discovered that these emails were attempts to access the email accounts of their targets through a particularly insidious form of phishing known as OAuth Phishing … We estimate the total number of targeted individuals to be in the order of several hundreds.” Amnesty International

What Is OAuth Phishing?

The Egyptian authorities are using a new spear-phishing technique called OAuth phishing. OAuth is an industry-standard protocol used for authorizations. All computer users should beware of OAuth Phishing.

OAuth Phishing is being used to abuse the legitimate authorization feature of online service providers that lets third-party applications gain access to an account. OAuth is the protocol used by many companies, including Google, Facebook, Amazon, and Microsoft. It’s used to manage access to user data across these and other platforms.

With access to a user’s email account OAuth can add events or flight times to their calendars. The OAuth Phishing hackers use malicious third-party applications to trick users into giving them access to their accounts.

OAuth Phishing targets OAuth tokens instead of passwords. When a user grants a third-party app the right to access their account, the application uses the OAuth token instead of a password. Egyptian authorities are gaining unauthorized access and use third-party apps to compromise users’ accounts.

How Does OAuth Phishing Work?

The hacker uses phishing emails with fake security warnings from Google to trick victims into clicking on a malicious link. The victim is instructed to click the “Update my security now” button. When they do, they’re sent to a third-party application called “Secure Mail.” This prompts the OAuth process.

But that’s not all. They are then asked to give the “Secure Mail” app access to their Gmail or other accounts. They’re told to click on the “Allow” button. When this happens, the hacker gains access to the victim’s account.

Now the attacker can use a malicious application to:

  • Download other messages, attachments and files.
  • Search for and read their messages.
  • Install filters and forwarding rules.
  • Inject macros into Word documents.
  • Access users’ contacts.
  • Get into OneDrive and search for downloaded files.
  • Extract emails by searching for keywords.
  • Setup malicious Outlook rules.

Amnesty International warns that these OAuth phishing attacks also target users’ Yahoo, Gmail, Outlook and Hotmail accounts.

How Can You Prevent Your Employees From Being Victimized By OAuth Phishing?

The best way is to be educated. Security Awareness Training is the go-to solution to keep employees informed about security threats and how to avoid them. But, because OAuth phishing can be difficult to detect and the victim authenticates through a legitimate site, people are still being tricked.

OAuth Phishing can be hard to identify. And, even with Security Awareness Training, people are being tricked. They’re trained to look for suspicious website URLs and to use Two-Factor Authentication. But these tactics don’t work to prevent OAuth phishing.

Phishing messages can convince users to click links that deliver malware or reveal their user credentials. Now with new tools, OAuth is being used for this. The account can be accessed until authorization is explicitly revoked. Not even password resets or using 2-factor authentication will work to stop it.

Train and test your users to:

  • Spot phishing messages and specifically OAuth phishing messages.
  • Know how to submit suspicious email messages if they find them.
  • Defend and respond to OAuth attacks.

Along with Security Awareness training, companies must ensure that their IT service companies have set up the technology, policies and remote monitoring and management to detect these OAuth attacks.

What Does OAuth Recommend?

You can visit this page for security guidance. They say that if a suspicious or malicious third-party application is found in the OAuth environment that all permissions should be revoked. Then review remote monitoring logs to learn what was compromised.

They also suggest that you:

  • Limit the number of third-party applications that can be accepted.
  • Disable any third-party applications that you don’t need.
  • Search and monitor all third-party applications that have been approved for use, and check for suspicious activity.
  • If you use Microsoft Office 365, be sure to monitor your application permissions in the Cloud App Security.

The Bottom Line

All of your employees should be educated about the dangers of OAuth and other phishing attacks. They should always use best practices and only access applications that they trust.

Also, make sure that you and your IT provider periodically review the list of applications that you use. Revoke access to all applications that you no longer need.

Categories
Blog

54 Questions To Ask When Considering IT Managed Services

54 Questions To Ask When Considering IT Managed Services

As you’ve been following along, you have a clearer idea of what outsourcing your IT responsibilities to an IT managed service provider entails. But before you meet with one and take the next step, we recommend asking the following fifty-four questions. Not just to the potential IT services company, but also to your staff if you employ an in-house IT team.

9 Questions to ask when developing the service

  1. What is your average network uptime performance?
  2. Do you have a list of tiered features and capabilities?
  3. Do you offer on-site hours built into the regular contractual fee?
  4. What metrics do you use to assess speed, reliability and overall performance?
  5. Is there enough flexibility to add or remove service offerings based on my business needs?
  6. Are you able to diagnose and remedy service issues remotely without the client’s IT team intervention?
  7. Do you offer customized solutions for different businesses regarding growth plans and achievable goals?
  8. Which software, professional services automation (PSA) or remote monitoring management (RMM) runs your managed services operation?
  9. How will my data be retrieved if my contract is terminated?

8 Questions to ask regarding your contract and fees

  1. Can a break clause be initiated if I decide to terminate my contract?
  2. Is your service level agreement consistent for all customers, or is this negotiable?
  3. Does contract flexibility include monthly and annual payments with capping on yearly rate hikes?
  4. Can you provide a comparison detailing the cost of on-premises versus cloud solutions over time?
  5. Will I need to purchase additional infrastructure when your managed services work with my business?
  6. Does your fee structure cover additional cost management that notifies when new charges get applied?
  7. Do you include an assessment of IT infrastructure before providing projected service fees?
  8. If so, is this a separate cost?

11 Questions to ask regarding your data management

  1. Who will have access to my data?
  2. What methods do you use to protect data?
  3. Will my competitors be able to see my data?
  4. What redundancy gets built into the solution?
  5. Who owns my data if it gets hosted at your facility?
  6. How are data backups and disaster recovery handled?
  7. What happens to my data if you go out of business; are they sold to or merged with another firm?
  8. What measures and processes are in place to protect my data against security breaches or data leaks?
  9. Ultimately, who is responsible for my data? You as the IT managed services provider, a third party, or me as the business owner?
  10. Do you host multiple clients on the same systems, in a multi-tenant environment or exclusivity in-area?
  11. Do you run your service operations through a 3rd-party hosting provider or data centers? If so, can you provide or validate these?

12 Questions to ask regarding the company’s credibility and capabilities

  1. How do you train ad-hoc support?
  2. Do you employ a dedicated staff, or ad-hoc?
  3. Can I meet the team members providing my support?
  4. How many years have you been providing IT Managed Services?
  5. Would you classify yourselves as experts in IT Managed Services?
  6. What is your level of expertise in my industry regarding regulatory compliance requirements?
  7. What industry credentials or certifications does your company, and your technical staff carry?
  8. How does your IT service desk team stay current with new technology developments and trends?
  9. Are your IT managed services primarily what you do or are they an add-on service to your business?
  10. Will you provide references and phones numbers to customers that are still doing business with you?
  11. What percentage of your business gets dedicated to managed services versus other business models?
  12. When I’m required to provide an audit trail showing compliance, how does your company handle this?

14 Questions to ask regarding their support model

  1. How is support provided?
  2. How are complex issues escalated?
  3. What are the hours of emergency support?
  4. What are the satisfaction levels with your customer help desk?
  5. Will you provide references to call from any existing customers?
  6. Do you offer on-site support hours as part of the contractual fee?
  7. What are the first, second and third line parameters for escalation?
  8. May we discuss your managed service support levels with existing clients?
  9. Is emergency support available twenty-four hours a day, seven days a week?
  10. Do you include channels such as telephone, email, portal access, and live chat?
  11. What percentage of issues are confirmed as resolved at first contact by your helpdesk?
  12. Do you offer traditional break or fix support for hardware, software and other infrastructure?
  13. What type of training is provided by your company for my in-house IT staff to educate them?
  14. How do I guarantee the return on my investment covering support and organizational IT knowledge?

Summary

Now that you’ve reviewed the fifty-four questions to ask when considering IT managed services, the answers you receive from the IT support company and your staff will give you a clear picture of the direction to go in and what to expect as you move forward.

Categories
Blog

Is Your Dallas IT Service Provider Able to Help with Microsoft Azure?

Is Your Dallas IT Service Provider Able to Help with Microsoft Azure?

Cloud services are a global phenomenon, a way for businesses to quickly scale their infrastructure while improving service levels and their customer experience. While Azure can be implemented relatively quickly, there is a level of complexity to the range of services that are offered if you’re not working with Azure on a daily basis. Having a trusted local partner to help implement and support Azure is best, which is why Dallas businesses of all sizes turn to Data Magic Computer Services when they need this type of assistance with cloud services.

How Can Azure Help Dallas Businesses Be Successful?

Working with local or on-premises solutions is a model that’s worked well for decades, and it can be difficult to make the shift away from this tried-and-true model. There are some benefits to maintaining your own servers, but many organizations are finding that they are gaining significant functionality and reducing their costs dramatically by moving towards an Azure environment to support their business. On-premise servers require time and attention to ensure that they are upgraded on a regular basis and running with optimal metrics. When you work with Azure managed services, you can be confident that your IT services partner in Dallas is fine-tuning your services to provide you with the best and most stable solution upon which to base your business applications and data storage.

Benefits of Microsoft Azure Managed Services

Cloud-managed services provide a variety of benefits to your business, but perhaps the most important is the ability of your internal IT team to focus on other projects while your infrastructure runs seamlessly and securely in the background. Managed services providers can manage your storage, network applications, vendors, application stacks, security, analytics and reporting. With managed cloud services, your business will:

  • Always have access to future-proofed technology that is always on the latest version
  • Enjoy the convenience of monthly billing that is consistent over time
  • Appreciate the robust infrastructure and enterprise-scale applications that would be difficult for smaller businesses to afford without the support of a managed services provider
  • Quick response rates based on your contracted service levels
  • Robust disaster recovery and business continuity services

Instead of dropping everything when you have a problem with one of your servers, your managed services provider will quickly take charge of the situation to help bring your business back online without a lot of added costs that you might find with traditional break-fix IT contractors.

Migrating On-Premise Applications to Microsoft Azure Cloud

Whether you are looking for Infrastructure as a Service (IaaS), Platform as a Service (PaaS) or other cloud-based solutions, migration requires a great deal of planning before you enter the execution phase. Azure services are highly flexible and extensible, providing you with a range of options for getting exactly the right configuration for your needs. Creating virtual machines, testing and developing scalable applications becomes much more straightforward when you work with a local IT services organization in Dallas that is familiar with the needs of your business and has successfully completed dozens of migrations from on-premise applications to Microsoft Azure cloud.

Our technicians have worked with hundreds of organizations to implement Azure services, and we have deep expertise working with this ever-changing platform. Are you ready to deploy Azure in your business, or want to know if you’re fully utilizing the services that you need? Contact us today at 469-200-3457 for a complimentary initial consultation and see how Data Magic Computer Services can help your problems melt away — just like magic! You can always chat online with our friendly services team to receive a quick response.

Categories
Blog

Intel Humiliated by Losing CPU Market Share to Eager AMD

Intel Processors losing to AMD

Intel Humiliated by Losing CPU Market Share to Eager AMD

Intel’s continued problems with delivering CPUs are expected to go on throughout the fall and potentially 2020. Intel’s CEO Bob Swan told shareholders during their second-quarter conference call that the delays in processor deliveries would continue until September.

The fallout benefits AMD, which increased its market share from 9.8 percent in 2018 to 18 percent by the end of June 2019.

Why is Intel having trouble shipping CPUs on time?

The culprit is Ice Lake, Intel’s high volume 10nm processor. The chipmaker announced Ice Lake at CES 2019, but the processor hasn’t been forthcoming in the volumes Intel promised. The 10nm project has slowed Intel’s other chip line production. Lower-end processors have especially suffered, leading to supply chain problems for manufacturers, retailers, and customers.

What are Intel’s problems with the 10nm CPU?

The current problems continue Intel’s struggles with 10nm chips which date back to 2013. Intel’s initial goal for 10nm CPUs was 2015. Year by year, Intel has pushed back the deadline for 10nm CPUs. Intel’s second-quarter conference call gave late 2019 as the deadline — but the real date is more likely to be 2020 for most people who want to buy PCs with the new CPU.

The bottom-line culprit is engineering choices. Intel’s 10nm design selections have consistently held mass production back on its 10nm CPU project. As problems continued, Intel responded by refining its 14nm CPU performance and production process. TSMC and Samsung have 10nm CPUs, but their performance is equivalent to Intel’s 14nm CPUs.

What is so good about increasingly tiny CPUs?

Intel and its competitors, including AMD, are continuing R & D on smaller and smaller gate-size processors. Smaller gate sizes allow more CPU cores, or they enable a smaller die for the same performance as a larger CPU.

Smaller CPUs also use less power and generate less heat, a must for mobile devices and laptops. With desktop PCs, heat and power consumption aren’t as important, so processor performance can be improved in other ways.

How have Intel’s supply problems affected its business?

Intel’s stock has increased 6% since January 2019 according to Fortune, but rival AMD’s stock has gone up 83%. Nvidia’s stock has risen 25% since January.

The supply problems are mirrored by leadership problems at “Chipzilla.” Intel’s former CEO Brian Krzanich resigned in June 2018 when a relationship with a former employee was disclosed. Krzanich’s replacement Bob Swan is credited with improving company morale and redirecting the floundering 10nm CPU team.

Has AMD taken advantage of Intel’s delays?

AMD is gaining market share with scaled-up production of 12nm circuits. The Santa Clara-based chipmaker is gaining market share from Intel with its Ryzen 14nm and 12nm CPUs. It has announced 7nm Ryzen and Rome CPUs. AMD’s year-to-year market share in desktop computers grew from 12.2% in the first quarter of 2018 to 17.1% by the first quarter of 2019. In notebooks, AMD’s share grew from 8% to 13.1 %.

AMD also expects the number of Ryzen CPU notebooks to grow significantly in 2019, with desktop units growing by 30% and notebooks by 50%. Lenovo, the world’s #2 PC manufacturer, will be using Ryzen 7 Pro 3700U chips in its upcoming ThinkPads.

Which Intel and AMD news should industry pros and investors watch in upcoming quarters?

Intel has delayed shipments of all of its CPUs, not just the promised 10nm Ice Lake and variant chips. Rivals AMD and Nvidia have taken advantage of ongoing delays to ink new deals with major companies including Lenovo.

Investors and industry pros should keep an eye on CPU market shares for the rest of 2019 and into 2020. This will indicate if the agile upstarts are going to continue to take on “Chipzilla” and change the landscape of computing power in 2020 and beyond.

Categories
Blog

Top Ways to Avoid Phishing Scams (Including Spear Phishing)

Office Worker with Spear Phishing email
Phishing scams — and, increasingly, spear-phishing scams — are the number one way that cyber hackers gain access to closed computer systems, steal information and money, and corrupt data.

Let’s take a look at what phishing and spear-phishing scams really are, how you can spot them, and how to help your organization avoid their highly detrimental consequences.

Phishing and spear-phishing: What’s the difference?

Both phishing and spear-phishing are forms of email-based cyberattacks.

Essentially, both terms refer to email-based attacks that attempt to gain personal or sensitive information using deceptive or disguised emails appearing to be from legitimate sources.

Phishing is the broad term for these attacks. Spear phishing only differs in that these email attacks are specifically targeted at an individual. This may mean that the email includes the individual’s actual name, address, and/or phone number. Or, the email may reference other personal information, such as the individual’s workplace, work position, alma mater, or where they bank.

Here are some examples of spear-phishing emails you may have seen before:

  • An email appearing to be from your actual bank: “Dear YOUR NAME, Your debit card may have been compromised. Click here to login to your account and check your statement.”
  • An email appearing to be from a store where you frequently shop online: “Your recent order from XXX STORE has been dispatched. Go here to track your shipment.”

Notice that each example includes a place where you should click. This is by design. Often, simply opening a phishing email will not result in any issues; however, clicking on a link inside the email can actually be enough to cause the bulk of the issues (sometimes, major issues). A police department employee in Florida recently opened a phishing email link that led to ransomware being installed on the city’s computer system. In the end, the ransomware cost the city hundreds of thousands of dollars.

How can clicking on a simple link end in such disaster?

The answer is malware.

Malware is a shortened term for malicious software. This software can be automatically downloaded to your computer and/or entire computer system and network by a “trap door.” These trap doors are disguised as links, attachments, login fields, or downloads, which are embedded within phishing emails.

If hackers can get a spear-phishing target to click on their “trap door,” they can use that gateway to install malware onto your system. And once this happens, your entire network and data are at risk.

How Can You Spot a Phishing Email?

Phishing emails often have specific features, which should raise red flags right away:

  • The message is unusual (comes at an odd time, is from someone you don’t know, is in a bizarre tone, makes a bizarre or out-of-the-blue request).
  • The message makes you panic (e.g., “Your money has been stolen!”).
  • The message is threatening (e.g., “If you don’t click here now, you risk losing your job.”).
  • It’s written poorly, as if by a non-English speaker.
  • The email includes personal information … but not very much.
  • The sender’s email address or the web address they want you to navigate doesn’t look right.

What Should You Do if You Think You’ve Received a Spear Phishing Email?

If you think you or someone else in your company has received a phishing email, do nothing at first. Remember that clicking on links, downloading attachments, and opening files or pictures are all the things that hackers want you to do, which is exactly why you should never do them if you are suspicious of an email.

On the other hand, some emails may be clearly legitimate. It’s important to know the difference.

For example, if you speak to Ross from accounting in person by the water cooler, and he tells you he’ll be sending over an invoice you need to sign in the next 10 minutes, if you get an email with an invoice attachment from Ross in the next 10 minutes, the email’s probably okay.

If you get an email from Ross out of the blue on a Saturday? And you didn’t expect it? And it’s not in the tone that Ross usually uses?

This is when you shouldn’t do anything. Instead, check the legitimacy of the email. Do this either in-person or over the phone. For example, call Ross or wait until Monday to speak with him personally. Double-check that he sent the email. If it turns out the email cannot be accounted for, contact your company’s IT security department immediately.

Train Your Employees to Spot Phishing and Spear Phishing Emails

Understanding and following these guidelines as a CEO or manager is important, but remember that spear-phishing emails can target your employees as well.

For this reason, ensure that all of your employees know and understand:

  • What phishing and spear-phishing emails are
  • How to spot these emails
  • What you should never do with a suspicious email (click, download, or login via the email’s prompt)
  • What to do if they suspect they’ve received a phishing email

By following these guidelines, you can keep your business safe from phishing scams and the subsequent ramifications.

Categories
Blog

How Can You Encrypt Files and Folders in Windows 10, 8 or 7?

Data Encryption

How Can You Encrypt Files and Folders in Windows 10, 8 or 7?

You can encrypt files and folders in Windows (vers. 7-10) using BitLocker. This Vista operating system extension has on-disk encryption as well as key management capability. It’s protected by two-factor authentication, so anyone who wants to crack the code needs a hardware key and your specified long passphrase.

Through its trusted platform module (TPM) hardware, BitLocker provides advanced security features. For instance, when encryption is only at the software level, access may be vulnerable to dictionary attacks. Hardware-level protection safeguards your system from guessing or automated attacks.

What Steps Let You Check For a TPM Chip?

Follow these steps to see if your computer has a TPM chip:

  1. Select the Windows key + X and choose Device Manager.
  2. Expand on Security devices.
  3. One of the devices should read Trusted Platform Module and contain a version number.

BitLocker is typically available on these platforms:

  • Windows 10 on Enterprise, Pro, and Education
  • Windows Vista and Windows 7 on Ultimate and Enterprise
  • Windows 8 and 8.1 on Enterprise and Pro
  • Windows Server 2008 and later

How Can You Encrypt Files and Folders in Windows 10, 8, or 7?

Follow this procedure to encrypt folders and files:

  1. In Windows Explorer, right-click on a folder or file.
  2. From the context-menu, choose Properties.
  3. In the dialogue box, click Advanced.
  4. The Advanced Attributes dialogue box appears. Look for the Compress or Encrypt Attributes section.
  5. Check Encrypt contents to secure data.
  6. Click OK then Apply.
  7. For folders, a Confirm Attribute Change dialogue box appears to confirm whether you want everything in the folder encrypted. Select your preference and click OK.
  8. You can also choose to Back up your file encryption key. If you miss the message, you can access it in Notification Area for your operating system.
  9. Make sure to plug in a USB flash drive.
  10. Choose Back up now (recommended).
  11. Click Next to create your certificate.
  12. You can accept the default file format for the export.
  13. on the next screen, select the Password: box to enter and re-enter your password.
  14. Go to the USB drive, enter a name for the key and certificate you’re exporting and click Save. (It’s saved with as a .pfx)
  15. Click Next, Finish, and OK.
  16. Remove the USB drive and store it in a secure spot.

How Can You Decrypt a Folder or File?

To decrypt your file or folder:

Follow steps 1-6 above. However, uncheck the Encrypt contents to secure data box for step 4.

Now, you can unlock your drive at startup by entering a password or inserting the USB drive.

You can encrypt the whole hard drive, but the process is time-consuming. If you have a lot of data, expect to wait a long time. You’ll want to leave your computer connected to an uninterrupted power source throughout the process. You have to reboot for the changes to take place. However, you can work throughout the process.

Now you can secure your files to keep out prying eyes and hackers.

Skip to content