Blog – Cosaint Technologies – Page 12 – Blog

After being the main entry to the internet in the late 1990s and early 2000s, Internet Explorer (IE) is gone. As of June 15, 2022, Microsoft dropped the web browser from support.

IE ushered in the age of connection to the world in 1995 and held a majority of the browser market share for many years. But the release of newer technologies like Google Chrome made it less relevant.

In 2014, Internet Explorer still held about 59% of the global market share, with Chrome at 21%. But just two years later, IE lost its top spot to Chrome and trailed behind another newcomer, Safari.

In 2015, the writing was already on the wall when Microsoft released a new browser, Edge. With Edge destined to take IE’s place as the official browser installed on Windows systems.

It’s inevitable, the longer technology is driving work and home life, that we’re going to lose some of our favorites. Adobe Flash Player is another technology that used to be widely used and is now gone.

So, now that IE has reached its end of life (EOL), what happens next?

Microsoft Will Redirect Users to IE Mode in Edge

According to Microsoft, now that IE is officially out of support it will redirect users. Over the next few months, a new experience will happen. Those opening this outdated browser will instead land in Microsoft Edge with IE mode.

To ease the transition away from Internet Explorer, Microsoft added IE Mode to Edge. This mode makes it possible for organizations to still use legacy sites that may have worked best in IE. It uses the Trident MSHTML engine from IE11 to do this.

When in IE mode, you’ll still see the Internet Explorer icon on your device. But if you open it, you’ll actually be in Microsoft Edge.

Microsoft Will Be Removing Internet Explorer Icons in the Future

Microsoft isn’t yet getting rid of the IE icons that appear in places like the taskbar and Start menu on Windows. But it will in a future update. Users can expect to see those removed at some point.

Edge Will Import Browser Data from IE

What about your favorites, saved passwords, and other settings that you have in IE? Microsoft Edge will import these from Internet Explorer for you, so they’re not lost. This will include things like your browsing history and other data stored in the browser. You’ll then be able to access these in the Microsoft Edge’s settings area.

With IE Retired, What Do You Need to Do Now?

Uninstall the Browser

It’s risky to keep older technology that is no longer supported on your system. Cybercriminals love to exploit older tools that are not receiving any security updates. This leaves an open invitation to breach your network. Manufacturers are never going to address these because they retired the software.

Outdated technology costs enterprises approximately 47% more when they suffer a data breach. As compared to those with updated tools.

You should transition your stored information to Microsoft Edge (or another trusted browser). Then uninstall IE from your device or devices.

Ensure Employees Know How to Use IE Mode in Edge

A scenario that businesses want to avoid is what happened to many organizations in Japan. Several government and corporate users weren’t prepared for the retirement of IE.

It was reported that IT and engineering departments received many calls for help. This was due to unpreparedness for the browser’s demise. Although it came with warnings, it was a shock to many that used legacy sites that need IE to work. This included the customers of government agencies, financial institutions, and other organizations.

This left them scrambling to try to figure out what to do at the last minute. They still needed access to employee attendance management, and other online tools.

Of course, with IE mode in Edge, this transition didn’t need to be so chaotic. But without communication or training, more than 20% of affected users hadn’t figured out what to do.

Make sure you communicate with your team what to do. Companies can automate IE mode for their users so that it launches automatically.

Train Employees on Microsoft Edge Features

Microsoft Edge has a lot of benefits over IE and other browsers. It’s faster and more responsive than Internet Explorer. It also has comprehensive security controls (including password breach monitoring). And has unique features such as “collections.”

But with all new tools, if you want employees to use them proficiently, they need to have a chance to learn them. Take the time to transition right, and have your employees trained on Edge.

Need Help Upgrading Your Digital Tools?

You don’t have to panic when a technology you use retires. We can help you upgrade well ahead of any deadlines. Reach out today to schedule a technology consultation.

—
Featured Image Credit

This Article has been Republished with Permission from The Technology Press.

MacBook Pro on table beside white iMac and Magic Mouse

5 Mistakes Companies Are Making in the Digital Workplace

By David Littrell

On October 5, 2022

In Productivity

The pandemic has been a reality that companies around the world have shared. It required major changes in how they operate. No longer, did the status quo of having everyone work in the office make sense for everyone. Many organizations had to quickly evolve to working through remote means.

During the worst of the pandemic, it’s estimated that 70% of full-time workers were working from home. Even now that the pandemic has hit a new waning phase, remote work is still very much a reality. 92% of surveyed employees expect to still work from home at least 1 or more days per week.

This transformation has forced companies to rethink the tools and policies they use. Many have also needed to completely revamp how they work. They’ve had to switch to a cloud-based digital workspace to enable a hybrid team.

This transition has brought newfound benefits, such as:

Lower costs for employees and employers
Better employee work/life balance
Higher morale
The same or improved productivity
More flexibility in serving clients

But, the transition to a digital workplace has also brought challenges and risks.
These include:

Vulnerable networks and endpoints
Employees feeling disconnected
Communication problems
Difficulty tracking productivity and accountability
Increased risk of data breaches

20% of organizations experienced a breach during the pandemic due to a
remote worker.

Overcoming the challenges and reaping the benefits takes time and effort. It also often takes the help of a trained IT professional, so you avoid costly mistakes.

Below are some of the biggest company mistakes when building a digital workplace. For the statistics, we referenced IGLOO’s State of the Digital Workplace report.

1. Poor Cloud File Organization

When companies go virtual for their workflows, files live in a cloud-accessible environment. If those cloud storage environments aren’t well organized, it’s a problem. It can be difficult for employees to find the files they need.

About 51% of employees have avoided sharing a document with a colleague for this reason. They either couldn’t find it or thought it would be too hard to find. It’s notable that this is the highest percentage recorded for this stat in the IGLOO report. Meaning that this problem is getting worse.

Some tips for making shared cloud storage files easier to locate are:

Keep file structure flat (2-3 folders deep)
Create a consistent hierarchy and naming structure
Don’t create a file for fewer than 10 documents
Archive and delete older files monthly to reduce clutter

2. Leaving Remote Workers Out of the Conversation

No one likes to hear people start talking about something at a meeting and realize they’re lost. They missed an important piece of an earlier conversation. Many companies haven’t yet overcome in-person vs remote communication challenges.

In fact, nearly 60% of remote workers say they miss out on important information. This is because colleagues first communicated it in person. Efficiency suffers when in-office workers make decisions without regard for remote colleagues.

Managers and bosses must lead the way in changing this culture. While old habits do take a while to change, mindset can transition to be more inclusive of the hybrid world.

3. Not Addressing Unauthorized Cloud App use

Unauthorized cloud app use (also known as Shadow IT) was already a problem before the pandemic. That problem escalated once people began working from home. Which is often using their personal devices.

Over half (57%) of employees use at least one unauthorized app in their workflow. When this happens, organizations can suffer in many ways.

Some of the risks of shadow IT include:

Data leakage from non-secured apps
Data privacy compliance violations
Redundancies in-app use that increase costs
Unprotected company data due to a lack of visibility
The employee leaves and no one can access the data in the unauthorized app

4. Not Realizing Remote Doesn’t Always Mean From Home

Remote employees aren’t always working from home, connected to their home Wi-Fi. They may also be working from airports, hotels, a family member’s home, or local coffee shops.

Companies that don’t properly protect company data used by remote employees, can be at risk of a breach. Public networks are notorious for enabling “man-in-the-middle” attacks. This is where a hacker connects to the same public network. Then, using software can access data transmissions from others on that
network.

It’s advisable to use a business VPN for all remote work situations. VPNs are fairly inexpensive and easy to use. The employee simply enables the app on their device. The app then reroutes their data through secure, encrypted servers.

5. Using Communication Tools That Frustrate Everyone

Are virtual meetings giving your team problems? As many as 85% of remote workers say that they’ve had 1-2 meetings interrupted by technology. It’s getting so you can hardly have a virtual meeting without someone having a technical issue.

Communication is the oil that makes the engine of a digital workplace run. Effective cloud-based video calls, audio calls, and chats depend on the right technology. This facilitates a smooth experience.

Don’t rush to use just any communication tools. Take your time and test them out. Get help optimizing settings to improve your virtual meetings. Additionally, ensure your remote team has tools to foster smooth communications. This includes headsets, VoIP desk sets, webcams, etc.

Boost the Productivity of Your Hybrid Office

Reach out today to schedule a technology consultation. We can help you improve the efficiency and productivity of your digital workplace.

—
Featured Image Credit

This Article has been Republished with Permission from The Technology Press.

You Need to Watch Out for Reply-Chain Phishing Attacks

By David Littrell

On September 30, 2022

In Cybersecurity

Phishing. It seems you can’t read an article on cybersecurity without it coming up. That’s because phishing is still the number one delivery vehicle for cyberattacks.

A cybercriminal may want to steal employee login credentials. Or wish to launch a ransomware attack for a payout. Or possibly plant spyware to steal sensitive info. Sending a phishing email can do them all

80% of surveyed security professionals say that phishing campaigns have significantly increased post-pandemic.

Phishing not only continues to work, but it’s also increasing in volume due to the move to remote teams. Many employees are now working from home. They don’t have the same network protections they had when working at the office.

Why has phishing continued to work so well after all these years? Aren’t people finally learning what phishing looks like?

It’s true that people are generally more aware of phishing emails and how to spot them than a decade ago. But it’s also true that these emails are becoming harder to spot as scammers evolve their tactics.

One of the newest tactics is particularly hard to detect. It is the reply-chain phishing attack.

What is a Reply-Chain Phishing Attack?

Just about everyone is familiar with reply chains in email. An email is copied to one or more people, one replies, and that reply sits at the bottom of the new message. Then another person chimes in on the conversation, replying to the same email.

Soon, you have a chain of email replies on a particular topic. It lists each reply one under the other so everyone can follow the conversation.

You don’t expect a phishing email tucked inside that ongoing email conversation. Most people are expecting phishing to come in as a new message, not a message included in an ongoing reply chain.

The reply-chain phishing attack is particularly insidious because it does exactly that. It inserts a convincing phishing email in the ongoing thread of an email reply chain.

How Does a Hacker Gain Access to the Reply Chain?

How does a hacker gain access to the reply chain conversation? By hacking the email account of one of those people copied on the email chain.

The hacker can email from an email address that the other recipients recognize and trust. They also gain the benefit of reading down through the chain of replies. This enables them to craft a response that looks like it fits.

For example, they may see that everyone has been weighing in on a new product idea for a product called Superbug. So, they send a reply that says, “I’ve drafted up some thoughts on the new Superbug product, here’s a link to see them.”

The link will go to a malicious phishing site. The site might infect a visitor’s system with malware or present a form to steal more login credentials.

The reply won’t seem like a phishing email at all. It will be convincing because:

It comes from an email address of a colleague. This address has already been participating in the email conversation.
It may sound natural and reference items in the discussion.
It may use personalization. The email can call others by the names the hacker has seen in the reply chain.

Business Email Compromise is Increasing

Business email compromise (BEC) is so common that it now has its own acronym. Weak and unsecured passwords lead to email breaches. So do data breaches that reveal databases full of user logins. Both are contributors to how common BEC is becoming.

In 2021, 77% of organizations saw business email compromise attacks. This is up from 65% the year before.

Credential theft has become the main cause of data breaches globally. So, there is a pretty good chance of a compromise of one of your company’s email accounts at some point.

The reply-chain phishing attack is one of the ways that hackers turn that BEC into money. They either use it to plant ransomware or other malware or to steal sensitive data to sell on the Dark Web.

Tips for Addressing Reply-Chain Phishing

Here are some ways that you can lessen the risk of reply-chain phishing in your organization:

Use a Business Password Manager:

This reduces the risk that employees will reuse passwords across many apps. It also keeps them from using weak passwords since they won’t need to remember them anymore.

Put Multi-Factor Controls on Email Accounts:

Present a system challenge (question or required code). Using this for email logins from a strange IP address can stop account compromise.

Teach Employees to be Aware:

Awareness is a big part of catching anything that might be slightly “off” in an email reply. Many attackers do make mistakes.

How Strong Are Your Email Account Protections?

Do you have enough protection in place on your business email accounts to prevent a breach? Let us know if you’d like some help! We have email security solutions that can keep you better protected.

—
Featured Image Credit

This Article has been Republished with Permission from The Technology Press.

What Should You Do to Reduce Risk When Your Mobile Device Goes Missing?

By David Littrell

On September 22, 2022

In Cybersecurity

Few things invoke instant panic like a missing smartphone or laptop. These devices hold a good part of our lives. This includes files, personal financials, apps, passwords, pictures, videos, and so much more.

The information they hold is more personal than even that which is in your wallet. It’s because of all your digital footprints. This makes a lost or stolen device a cause for alarm.

It’s often not the device that is the biggest concern. It’s the data on the device and access the device has to cloud accounts and websites. The thought of that being in the hands of a criminal is quite scary.

There are approximately 70 million lost smartphones every year. The owners only recover about 7% of them. Workplace theft is all too common. The office is where 52% of stolen devices go missing.

If it’s a work laptop or smartphone that goes missing, even worse. This can mean the company is subject to a data privacy violation. It could also suffer a ransomware attack originating from that stolen device.

In 2020, Lifespan Health System paid a $1,040,000 HIPAA fine. This was due to an unencrypted stolen laptop breach.

The Minutes After the Loss of Your Device Are Critical

The things you do in the minutes after missing a device are critical. This is the case whether it’s a personal or business device. The faster you act, the less chance there is for exposure of sensitive data.

What Types of Information Does Your Device Hold?

When a criminal gets their hands on a smartphone, tablet, or laptop, they have access to a treasure trove. This includes:

Documents
Photos & videos
Access to any logged-in app accounts on the device
Passwords stored in a browser
Cloud storage access through a syncing account
Emails
Text messages
Multi-factor authentication prompts that come via SMS
And more

Steps to Take Immediately After Missing Your Device

As we mentioned, time is of the essence when it comes to a lost mobile device. The faster you act, the more risk you mitigate for a breach of personal or business information.

Here are steps you should take immediately after the device is missing.

Activate a “Lock My Device” Feature

Most mobile devices and laptops will include a “lock my device” feature. It allows for remote activation if you have enabled it. You will also need to enable “location services.” While good thieves may be able to crack a passcode, turning that on immediately can slow them down.

What about “find my device?”

There is usually also a “find my device” feature available in the same setting area. Only use this to try to locate your device if you feel it’s misplaced, but not stolen. You don’t want to end up face to face with criminals!

Report the Device Missing to Your Company If It’s Used for Work

If you use the device for business, notify your company immediately. Even if all you do is get work email on a personal smartphone, it still counts. Many companies use an endpoint device manager. In this case, access to the company network can be immediately revoked.

Reporting your device missing immediately can allow your company to act fast. This can often mitigate the risk of a data breach.

Log Out & Revoke Access to SaaS Tools

Most mobile devices have persistent logins to SaaS tools. SaaS stands for Software as a Service. These are accounts like Microsoft 365, Trello, Salesforce, etc.

Use another device to log into your account through a web application. Then go to the authorized device area of your account settings. Locate the device that’s missing, and log it out of the service. Then, revoke access, if this is an option.

This disconnects the device from your account so the thief can’t gain access.

Log Out & Revoke Access to Cloud Storage

It’s very important to include cloud storage applications when you revoke access. Is your missing device syncing with a cloud storage platform? If so, the criminal can exploit that connection.

They could upload a malware file that infects the entire storage system. They could also reset your device to resell it, and in the process delete files from cloud storage.

Active a “Wipe My Device” Feature

Hopefully, you are backing up all your devices. This ensures you have a copy of all your files in the case of a lost device.

Does it look like the device is not simply misplaced, but rather stolen or lost for good? If so, then you should use a remote “wipe my device” feature if it has been set up. This will wipe the hard drive of data.

Need Mobile Device Security Solutions?

No matter what size company you have, mobile device management is vital. Contact us to learn more about our endpoint security solutions.

—
Featured Image Credit

This Article has been Republished with Permission from The Technology Press.

white wooden door with silver door lever

Microsoft Productivity Score Overview

By David Littrell

On September 15, 2022

In Microsoft

Productivity can be challenging to track, no matter where employees are working. How do you know they’re using their tools as effectively as possible? How can you enable them to adopt best practices?

These are questions that managers often ask themselves. If they’re looking at the wrong things, it can get in the way of empowering their team. For example, you can’t grade productivity simply by “clock in/clock out” times.

In today’s hybrid and mobile offices, the value and work product an employee brings is a better gauge. But you also must look at what may be getting in the way of great employees doing great work.

Technology tools can slow down dedicated workers if they’re not familiar with them. Employees may be doing things the way they always have been, and not realize there is a better way. A faster way.

But productivity can be a tricky area to address. You don’t want to invade a remote employee’s privacy by tracking their every keystroke. Nor would that likely help with positive forward motion.

What’s the answer?

If your company uses Microsoft 365 then you have a tool you can use to find nuggets of productivity gold. This tool is Microsoft Productivity Score.

What Does Microsoft Productivity Score Do?

Microsoft Productivity Score looks at some core areas of your employees’ workflow. It also looks at them in aggregate. Because it’s looking at your team as a whole, you avoid issues with employees feeling personally spied on.

The tool gives you helpful insights that you can share with your staff. These insights help to boost their performance. It also includes hardware-related information. You can use this to see if your company tools are holding people back.

MS Productivity Score looks at the following areas.

People Experiences

This category looks at how people work. Are they using best practices for collaboration or are they doing things the hard way? Do meetings go on forever? Are employees still emailing attachments instead of using shared cloud storage links?

One example of an insight from this category is as follows. Each employee can save an average of 100 minutes per week by collaborating with online files. Productivity Score can show you where your team stands in this metric, and many others.

Saving 100 minutes per week is equal to approximately 86.6 hours per year. That’s over 2 full workweeks!

The subcategories within people experiences are:

Communication
Content collaboration
Mobility
Meetings
Teamwork

Technology Experiences

Technology experiences look at the health and performance of your devices. Do you have hardware and software on endpoints that are causing issues? Is it slowing your team down? Are there network connectivity problems? Are apps updated as they should be?

This category will look at the technology that your team works with and let you know of any risk areas. When technology is not functioning well or isn’t secure, it can slow your business down.

You’ll find these three subcategories in the technology experiences area:

Endpoint analytics (You need Intune for these)
Network connectivity
Microsoft 365 apps health

Special Reports

Besides the people and technology experiences, there is more. Microsoft Productivity Score has a special reports area. It provides details on business continuity.

This report can show you how employee collaboration and other activities are changing. It looks at these as your company goes through transitions. Such as when you transition to remote working or back to in-office work. This report tells you how these changes impact your team’s productivity.

How Productivity Score Helps Your Company

Automatic Metrics Tracking

Microsoft Productivity Score tracks your team’s use of Microsoft 365 applications automatically. It then will provide you with helpful information on how staff use their digital tools.

These metrics give you a good picture of whether employees are using best practices. Often, they simply need guidance to learn a more efficient way of doing something.

Insights to Understand the Data

The tool provides you with helpful insights to understand the data. You won’t only get the metrics; you’ll get the context. This allows you to educate yourself. Then you can educate your employees on things that improve workflow and save time.

For example, getting a response quickly to a question saves time. But you may not realize that using @mentions can help achieve that. Productivity Score will tell you how many people use @mentions in team communications. And also, how much this increases the response rate.

Recommended Actions to Take

The third piece of guidance you gain is what to do about the information. Productivity Score will give you actionable recommendations to improve a metric. This helps you to improve productivity.

The combination of the metric, insight, and recommendation make this a comprehensive tool.

Would You Like to Get Started with Microsoft Productivity Score?

We can help you get your organization started with this great tool. And provide solutions to increase company productivity. Give us a call and let’s chat!

—
Featured Image Credit

This Article has been Republished with Permission from The Technology Press.

Helpful Tips for Keeping Your Shared Cloud Storage Organized

By David Littrell

On September 11, 2022

In Cloud

Cloud file storage revolutionized the way we handle documents. No more having to email files back and forth. No more wondering which person in the office has the most recent copy of a document.

Between 2015 and 2022, the percentage of worldwide corporate data stored in the cloud doubled. It went from 30% to 60%. A majority of organizations use cloud storage of some type. Typical services include OneDrive, Google Drive, Dropbox, and others.

But just like the storage on your computer’s hard drive, cloud storage can also get messy. Files get saved in the wrong place and duplicate folders get created. When employees are sharing the same cloud space it’s hard to keep things organized. Storage can be difficult to keep efficient.

Disorganized cloud storage systems lead to problems. This includes having a hard time finding files. As well as spending a lot of extra time finding needed documents. It’s estimated that 50% of office workers spend more time looking for files than they do actually working

Has your office been suffering from messy cloud storage? Does it seem to get harder and harder to find what you need? Review the tips below. They include several ways to tidy up shared cloud storage spaces and save time.

Use a Universal Folder Naming Structure

One person in an office might choose to name a folder by client name. Another person might use the type of industry. When people use different naming structures for folders, it’s harder for everyone. They often can’t find what they need. It also leads to the creation of duplicate folders for the same thing.

Use a universal folder naming structure that everyone follows. Map out the hierarchy of folders and how to name each thing. For example, you might have “departments” as an outer folder and nest “projects” inside.

With everyone using the same naming system, it will be easier for everyone to find things. You also reduce the risk of having duplicate folders.

Keep File Structure to 2-3 Folders Deep

When you have too many folders nested, it can take forever to find a file. You feel like you must click down one rabbit hole after another. When people need to click into several folders, it discourages them from saving a file in the right place.

To avoid this issue, keep your file structure only two to three folders deep. This makes files easier to find and keeps your cloud storage more usable.

Don’t Create Folders for Fewer Than 10 Files

The more folders people have to click into to find a document, the more time it takes. Folders can quickly add up as employees create them, not knowing where a file should go.

Use a rule for your cloud storage that restricts folder creation to 10 files or more. This avoids having tons of folders with less than a handful of files in them. Have someone that can act as a storage administrator as well. This can then be the person someone asks if they’re not sure where to store a file.

Promote the Slogan “Take Time to Save It Right”

File storage can get disorganized fast when people save files to a general folder. We’re all guilty from time to time of saving to something general, like the desktop on a PC. We tell ourselves that we’ll go back at some point and move the file where it should be.

This issue multiplies when you have many people sharing the same cloud storage space. Files that aren’t where they belong add up fast. This makes it harder for everyone to find things.

Promote the slogan “take time to save it right” among the staff. This means that they should take the extra few seconds to navigate where the file should be to save it. This keeps things from getting unmanageable. If you use a file structure that’s only 2-3 folders deep, then this should be easier for everyone to abide by.

Use Folder Tags or Colors for Easier Recognition

Many cloud file systems allow you to use color tagging on folders. Using this can make a folder or group of folders instantly recognizable. This reduces the time it takes to find and store files.

For example, you could color all folders dealing with sales as green. Folders for marketing could be orange, and so on. The brain can make the connection to a topic faster when you look at a color than when reading through text,

Declutter & Archive Regularly

Files get created at a dizzying pace these days. The more files you add to a cloud storage system, the harder it is to sort through to find what you need. This is true even if the file storage is well organized.

Keep older files from making it harder to find new ones. Do this by decluttering and archiving on a regular basis. This involves having an admin delete any unnecessary files once per month. For example, duplicate files or old draft versions of a document.

You should also have an archiving system in place that puts all older files in one big archive folder. This keeps files that aren’t actively used any longer out of the main file path.

Come to Us for Efficient Cloud Solutions

Is your cloud storage doing what you need it to do? Do you have a disconnection between cloud storage and your other apps? We can help. Reach out and let’s chat.

—
Featured Image Credit

This Article has been Republished with Permission from The Technology Press.

person holding pencil near laptop computer

6 Important IT Policies Any Size Company Should Implement

By David Littrell

On September 2, 2022

In IT Management

Many small businesses make the mistake of skipping policies. They feel that things don’t need to be so formal. They’ll just tell staff what’s expected when it comes up and think that’s good enough.

But this way of thinking can cause issues for small and mid-sized business owners. Employees aren’t mind readers. Things that you think are obvious, might not be to them.

Not having policies can also leave you in poor legal standing should a problem occur. Such as a lawsuit due to misuse of a company device or email account.

Did you know that 77% of employees access their social media accounts while at work? Further, 19% of them average 1 full working hour a day spent on social media. In some cases, employees are ignoring a company policy. But in others, there is no specific policy for them to follow.

IT policies are an important part of your IT security and technology management. So, no matter what size your business is, you should have them. We’ll get you started with some of the most important IT policies your company should have in place.

Do You Have These IT Policies? (If Not, You Should)

Password Security Policy

About 77% of all cloud data breaches originate from compromised passwords. Compromised credentials are also now the number one cause of data breaches globally.

A password security policy will lay out for your team how to handle their login passwords. It should include things like:

How long passwords should be
How to construct passwords (e.g., using at least one number and symbol)
Where and how to store passwords
The use of multi-factor authentication (if it’s required)
How often to change passwords

Acceptable Use Policy (AUP)

The Acceptable Use Policy is an overarching policy. It includes how to properly use technology and data in your organization. This policy will govern things like device security. For example, you may need employees to keep devices updated. If this is the case, You should include that in this policy.

Another thing to include in your AUP would be where it is acceptable to use company devices. You may also restrict remote employees from sharing work devices with family members.

Data is another area of the AUP. It should dictate how to store and handle data. The policy might require an encrypted environment for security.

Cloud & App Use Policy

The use of unauthorized cloud applications by employees has become a big problem. It’s estimated that the use of this “shadow IT” ranges from 30% to 60% of a company’s cloud use.

Often, employees use cloud apps on their own because they don’t know any better. They don’t realize that using unapproved cloud tools for company data is a major security risk.

A cloud and app use policy will tell employees what cloud and mobile apps are okay to use for business data. It should restrict the use of unapproved applications. It should also provide a way to suggest apps that would enhance productivity.

Bring Your Own Device (BYOD) Policy

Approximately 83% of companies use a BYOD approach for employee mobile use. Allowing employees to use their own smartphones for work saves companies money. It can also be more convenient for employees because they don’t need to carry around a second device.

But if you don’t have a policy that dictates the use of BYOD, there can be security and other issues. Employee devices may be vulnerable to attack if the operating system isn’t updated. There can also be confusion about compensation for the use of personal devices at work.

The BYOD policy clarifies the use of employee devices for business. Including the required security of those devices. It may also note the required installation of an endpoint management app. It should also cover compensation for business use of personal devices.

Wi-Fi Use Policy

Public Wi-Fi is an issue when it comes to cybersecurity. 61% of surveyed companies say employees connect to public Wi-Fi from company-owned devices.

Many employees won’t think twice about logging in to a company app or email account. Even when on a public internet connection. This could expose those credentials and lead to a breach of your company network.

Your Wi-Fi use policy will explain how employees are to ensure they have safe connections. It may dictate the use of a company VPN. Your policy may also restrict the activities employees can do when on public Wi-Fi. Such as not entering passwords or payment card details into a form.

Social Media Use Policy

With social media use at work so common, it’s important to address it. Otherwise, endless scrolling and posting could steal hours of productivity every week.

Include details in your social media policy, such as:

Restricting when employees can access personal social media
Restricting what employees can post about the company
Noting “safe selfie zones” or facility areas that are not okay for public images

Get Help Improving Your IT Policy Documentation & Security

We can help your organization address IT policy deficiencies and security issues. Reach out today to schedule a consultation to get started.

—
Featured Image Credit

This Article has been Republished with Permission from The Technology Press.

6 Discontinued Technology Tools You Should Not Be Using Any Longer

By David Littrell

On August 20, 2022

In IT Management

One constant about technology is that it changes rapidly. Tools that were once staples, like Internet Explorer and Adobe Flash, age out. New tools replace those that are obsolete. Discontinued technology can leave computers and networks vulnerable to attacks.

While older technology may still run fine on your systems that doesn’t mean that it’s okay to use. One of the biggest dangers of using outdated technology is that it can lead to a data breach.

Outdated software and hardware no longer receive vital security updates. Updates often patch newly found and exploited system vulnerabilities. No security patches means a device is a sitting duck for a cybersecurity breach.

Approximately 1 in 3 data breaches are due to unpatched system vulnerabilities.

Another problem with using discontinued technology is that it can leave you behind. Your business can end up looking like you’re in the stone ages to your customers, and they can lose faith and trust.

Important reasons to keep your technology updated to a supported version are:

Reduce the risk of a data breach or malware infection
Meet data privacy compliance requirements
To keep a good reputation and foster customer trust
To be competitive in your market
To mitigate hardware and software compatibility issues
To enable employee productivity

Older systems are clunky and get in the way of employee productivity. If you keep these older systems in use, it can lead to the loss of good team members due to frustration.

49% of surveyed workers say they would consider leaving their jobs due to poor technology.

Following is a list of outdated technology tools that you should replace as soon as possible. Are any of these still in use on your home computer or within your business?

Get Rid of This Tech Now If You’re Still Using It

Internet Explorer

Many moons ago, Internet Explorer (IE) used to be the number one browser in the world. But, over time, Google Chrome and other browsers edged it out. Including its replacement, Microsoft Edge.

Microsoft began phasing out IE with the introduction of Microsoft Edge in 2015. In recent years, fewer applications have been supporting use in IE. The browser loses all support beginning on June 15, 2022.

Adobe Flash

Millions of websites used Adobe Flash in the early 2000s. But other tools can now do the animations and other neat things Flash could do. This made the tool obsolete, and Adobe ended it.

The Adobe Flash Player lost all support, including security updates, as of January 1, 2021. Do you still have this lingering on any of your computers? If so, you should uninstall the browser plugin and any Flash software.

Windows 7 and Earlier

Windows 7 was a very popular operating system, but it’s now gone the way of the dinosaur. Replacements, Windows 10 and Windows 11 are now in widespread use. The Windows 7 OS lost support on January 14, 2020.

While it may still technically run, it’s very vulnerable to hacks. Microsoft Windows OS is also a high-value target for hackers. So, you can be sure they are out there looking for systems still running this obsolete version of Windows.

macOS 10.14 Mojave and Earlier

Because of the cost of iMacs and MacBooks, people tend to hang onto them as long as possible. Once these devices get to a certain point, updates no longer work. This leaves the hardware stuck on an older and non-supported macOS version.

If you are running macOS 10.14 Mojave or earlier, then your OS is no longer supported by Apple, and you need to upgrade.

Oracle 18c Database

If your business uses Oracle databases, then you may want to check your current version. If you are running the Oracle 18C Database, then you are vulnerable. Breaches can easily happen due to unpatched system vulnerabilities.

The Oracle 18C Database lost all support in June of 2021. If you have upgraded, then you’ll want to keep an eye out for another upcoming end-of-support date. Both Oracle 19C and 21C will lose premiere support in April of 2024.

Microsoft SQL Server 2014

Another popular database tool is Microsoft’s SQL. If you are using SQL Server 2014, then mainstream support has already ended. And in July of 2024, all support, including security updates will stop.

This gives you a little more time to upgrade before you’re in danger of not getting security patches. But it is better to upgrade sooner rather than later. This leaves plenty of time for testing and verification of the upgrade.

Get Help Upgrading Your Technology & Reducing Risk

Upgrades can be scary, especially if everything has been running great. You may be afraid that a migration or upgrade will cause issues. We can help you upgrade your technology smoothly and do thorough testing afterward. Schedule a technology review today.

—
Featured Image Credit

This Article has been Republished with Permission from The Technology Press.

How Using the SLAM Method Can Improve Phishing Detection

By David Littrell

On August 11, 2022

In Cybersecurity

There is a reason why phishing is usually at the top of the list for security awareness training. For the last decade or two, it has been the main delivery method for all types of attacks. Ransomware, credential theft, database breaches, and more launch via a phishing email.

Why has phishing remained such a large threat for so long? Because it continues to work. Scammers evolve their methods as technology progresses. They use AI-based tactics to make targeted phishing more efficient, for example.

If phishing didn’t continue working, then scammers would move on to another type of attack. But that hasn’t been the case. People continue to get tricked. They open malicious file attachments, click on dangerous links, and reveal passwords.

In May of 2021, phishing attacks increased by 281%. Then in June, they spiked another 284% higher.

Studies show that as soon as 6 months after training, phishing detection skills wane. Employees begin forgetting what they’ve learned, and cybersecurity suffers as a result.

Want to give employees a “hook” they can use for memory retention? Introduce the SLAM method of phishing identification.

What is the SLAM Method for Phishing Identification?

One of the mnemonic devices known to help people remember information is the use of an acronym. SLAM is an acronym for four key areas of an email message to check before trusting it.

These are:

S = Sender
L = Links
A = Attachments
M = Message text

By giving people the term “SLAM” to use, it’s quicker for them to check suspicious email. This device helps them avoid missing something important. All they need to do use the cues in the acronym.

Check the Sender

It’s important to check the sender of an email thoroughly. Often scammers will either spoof an email address or use a look-alike. People often mistake a spoofed address for the real thing.

In this phishing email below, the email address domain is “@emcom.bankofamerica.com.” The scammer is impersonating Bank of America. This is one way that scammers try to trick you, by putting the real company’s URL inside their fake one.

You can see that the email is very convincing. It has likely fooled many people into divulging their personal details. People applying for a credit card provide a Social Security Number, income, and more.

Doing a quick search on the email address, quickly reveals it to be a scam. And a trap used in both email and SMS phishing attacks.

It only takes a few seconds to type an email address into Google. This allows you to see if any scam warnings come up indicating a phishing email.

Hover Over Links Without Clicking

Hyperlinks are popular to use in emails. They can often get past antivirus/anti-malware filters. Those filters are looking for file attachments that contain malware. But a link to a malicious site doesn’t contain any dangerous code. Instead, it links to a site that does.

Links can be in the form of hyperlinked words, images, and buttons in an email. When on a computer, it’s important to hover over links without clicking on them to reveal the true URL. This often can immediately call out a fake email scam.

When looking at email on a mobile device, it can be trickier to see the URL without clicking on it. There is no mouse like there is with a PC. In this case, it’s best not to click the URL at all. Instead go to the purported site to check the validity of the message.

Never Open Unexpected or Strange File Attachments

File attachments are still widely used in phishing emails. Messages may have them attached, promising a large sale order. The recipient might see a familiar word document and open it without thinking.

It’s getting harder to know what file formats to avoid opening. Cybercriminals have become savvier about infecting all types of documents with malware. There have even been PDFs with malware embedded.

Never open strange or unexpected file attachments. Use an antivirus/anti-malware application to scan all attachments before opening.

Read the Message Carefully

We’ve gotten great at scanning through text as technology has progressed. It helps us quickly process a lot of incoming information each day. But if you rush through a phishing email, you can miss some telltale signs that it’s a fake.

Look at the phishing example posted above in the “Links” section. There is a small error in grammar in the second sentence. Did you spot it?

It says, “We confirmation that your item has shipped,” instead of “We confirm that your item has shipped.” These types of errors can be hard to spot but are a big red flag that the email is not legitimate.

Get Help Combatting Phishing Attacks

Both awareness training and security software can improve your defenses against phishing attacks. Contact us today to discuss your email security needs.

—
Featured Image Credit

This Article has been Republished with Permission from The Technology Press.

Did You Just Receive a Text from Yourself? Learn What Smishing Scams to Expect

By David Littrell

On August 2, 2022

In Cybersecurity

How many text messages from companies do you receive today as compared to about two years ago? If you’re like many people, it’s quite a few more.

This is because retailers have begun bypassing bloated email inboxes. They are urging consumers to sign up for SMS alerts for shipment tracking and sale notices. The medical industry has also joined the trend. Pharmacies send automated refill notices and doctor’s offices send SMS appointment reminders.

These kinds of texts can be convenient. But retail stores and medical practices aren’t the only ones grabbing your attention by text. Cybercriminal groups are also using text messaging to send out phishing.

Phishing by SMS is “smishing,” and it’s becoming a major problem.

Case in point, in 2020, smishing rose by 328%, and during the first six months of 2021, it skyrocketed nearly 700% more. Phishing via SMS has become a big risk area. Especially as companies adjust data security to a more remote and mobile workforce.

How Can I Text Myself?

If you haven’t yet received a text message only to find your own phone number as the sender, then you likely will soon. This smishing scam is fast making the rounds and results in a lot of confusion. Confusion is good for scammers. It often causes people to click a malicious link in a message to find out more details.

Cybercriminals can make it look like a text message they sent you is coming from your number. They use VoIP connections and clever spoofing software.

If you ever see this, it’s a big giveaway that this is an SMS phishing scam. You should not interact with the message in any way and delete it instead. Some carriers will also offer the option to delete and report a scam SMS.

Popular Smishing Scams to Watch Out For

Smishing is very dangerous right now because many people are not aware of it. There’s a false sense of security. People think only those they have given it to will have their phone number.

But this isn’t the case. Mobile numbers are available through both legitimate and illegitimate methods. Advertisers can buy lists of them online. Data breaches that expose customer information are up for grabs on the Dark Web. This includes mobile numbers.

Less than 35% of the population knows what smishing is.

It’s important to understand that phishing email scams are morphing. They’ve evolved into SMS scams that may look different and be harder to detect.

For example, you can’t check the email address to see if it’s legitimate. Most people won’t know the legitimate number that Amazon shipping updates come from.

Text messages also commonly use those shortened URLs. These mask the true URL, and it’s not as easy to hover over it to see it on a phone as it is on a computer.

You need to be aware of what’s out there. Here are some of the popular phishing scams that you may see in your own text messages soon.

Problem With a Delivery

Who doesn’t love getting packages? This smishing scam leverages that fact and purports to be from a known shipper like USPS or FedEx. It states that there is a package held up for delivery to you because it needs more details.

The link can take users to a form that captures personal information used for identity theft. One tactic using this scam is to ask for a small monetary sum to release a package. Scammers created the site to get your credit card number.

Fake Appointment Scheduling

This scam happened to a community in South Carolina. They had recently had an installation of AT&T fiber internet lines in their neighborhood. Following the installation, AT&T did a customer drive to sign people up for the service.

During this time, one homeowner reported that he received a text message. It pretended to be from AT&T about scheduling his fiber internet installation. He thought it was suspicious because the address they gave was wrong. The scammer had wanted him to text back personal details.

Get Your Free Gift

Another recent smishing scam is a text message that doesn’t say who it’s from. It says, “Thank you for your recent payment. Here is a free gift for you.” It includes a link at the bottom of the message.

This is a widespread scam that many have noted online. And it’s an example of a scammer using a common fact. The fact that most people would’ve paid some type of bill recently and mistake the text to be from a company they know. It also lures people in with the promise of giving them a free gift.

Does Your Mobile Device Have the Security It Needs?

Smishing scams are very clever and can easily infect your device with malware. Do you have the proper security precautions (mobile antivirus, DNS filtering, etc.)?

If not, give us a call. We can help!

—
Featured Image Credit

This Article has been Republished with Permission from The Technology Press.