Posts

Phishing Prevention Best Practices

Phishing Detection Is Becoming Harder

Recently I’ve noticed an uptick in very legitimate-appearing phishing emails. One came in as an email from “someone I knew” saying they had a task for me and to send them my personal number so they could reach me. My alarm bells went off because:

  1. The real person already had my phone number.
  2. They had “reached” me just fine through the email – why ask for my phone number?

Upon closer inspection, I could see that the person’s name was there, but the actual email address looked suspicious. One of the reasons we recommend getting an Office 365 or G-Suite account instead of using a free Yahoo or Gmail account is that employee emails are authenticated. We’ve had clients who have accidentally given away private information, mistakenly believing they were giving the information to a co-worker. As you can imagine, this data breach leads to a whole host of headaches.

Phishing Prevention Best Practices

  1. Never give out your email password.

  2. Never send passwords via email.

  3. Never send credit card information via email.

  4. Never send HIPPA or other sensitive information over email.

Email is an insecure platform. Even without hackers being involved, you could mis-type an email address and inadvertently expose sensitive information. Don’t take the risk. The small convenience factor isn’t worth it.

Common Phishing and Malware Scams

Hackers are becoming quite sophisticated, I’ve seen a few good imposters of Microsoft emails lately. Here’s a good example and where to look for clues that the email is not legitimate.

phishing email from microsoft

If you were to open up one of these emails, you expose your network to:

  1. Computer viruses, which are designed to self-replicate by sending an email from YOU to all the people in your contact list.
  2. Ransomware, where the hackers hold your data hostage until you pay them. FYI: Don’t pay them!
  3. Spyware, which will collect information from your computer and send it to the hackers.

How To Identify Phishing Emails

How can you find a phishing email / malware?

  1. Look at the sender’s email address. Usually the sender’s email address will not be a legit email associated with the organization that they are claiming to be from. They may claim to be from a company or a bank or even a friend or coworker, but the email address could have a totally different domain address.
  2. Look at who they are addressing. If they are part of a legitimate company that you work with, they should know your name. If it is a phishing email, it will most likely address you by your email address or a general name such as customer.
  3. Be on the lookout for bad grammar. Many times, there can be small to moderate grammatical errors that could easily be missed when quickly scanning an email.
  4. Be wary whenever someone tries to get you to provide personal information. They may give their own links that do not go where they say they will go, Hover over the link to see the website address. If you’re in doubt, ignore the email. Open a new web browser and login to your account. If a bank, Microsoft, Paypal or other service provider has a special alert, you can get the same information by going directly to their site.

Preventing Phishing and Malware Scams

Anti-virus software, firewalls and other data security solutions can stop most malware attacks, but they’re not infallible. If you open a suspicious email, contact an IT Professional IMMEDIATELY. The longer you wait, the worse the problem can become.

We help clients with data security breach prevention – and post-malware cleanup. Need our help? Give us a call at 586.263.1775 or support@eclipse-online.com.

Small Business Data Security Breach

Data Breach Protection Essentials

How to Prevent a Small Business Data Breach

How can you protect your company from a data breach?

Recent Data Breaches

Seems like every time you turn around, you’re hit with news of another major data breach. Just in the last few months:

Ransomware Attacks

We’ve also seen the rise of the threat of ransomware. Ransomware is malware that encrypts your files, making them unusable. You may see an image like the one below

Ransomware Example

data breach via ransomware

In a ransomware attack, the perpetrators promise to unlock your files if you pay the ransom. If you don’t have a reliable, recent backup, you may have no choice but to pay the ransom because everything in your system is unusable – including email, Word docs and databases.

The City of Atlanta recently experienced a ransomware attack where the than attacker demanded a $50,000 ransom. So far it’s cost the city $2.7 Million Dollars and major headaches to restore their system and tighten up their data security settings. Employees have resorted to paper-based applications and manual processes to keep operations running.

You may be thinking…

If these major companies can’t protect themselves from data breaches, how can small businesses expect to?

If you’re a small business, you have a few advantages over major corporations. First, small businesses are less of a target. Hackers go after big businesses because the payoff is big. Additionally, small businesses typically have more control over their IT environment. You actually have an advantage in protecting your data if you follow a few basic data security steps.

What is a data breach?

A data breach occurs when an unauthorized person gains access to your data.  The question is how they were able to access to the data.

The most common data breach causes are:

1.      Malware in email.

A user could click on a link in an email that causes malware to be installed on their computer.  This malware could then allow the attacker access to the computer, which then replicates itself to computers, servers and may even send emails to all the contacts in your contact list (including clients). This malware can slow down system performance, crash your system or display annoying popup ads. See 13 warning signs that your systems have been infected by malware.

Solution: Hover over any link and inspect where that link is going to. When in doubt, go to the company website and login there. For example, if you get an email from PayPal saying you need to update your password, instead of clicking the link in the email “PayPal” sent you, just go to the PayPal website and see if they’re prompting you for a password reset.

Also, be careful about opening any attachments. Computer viruses can be disguised as .PDFs, .XLS and other familiar formats. Have a reputable anti-virus software program installed on all machines at all times. Keep your anti-virus software up-to-date and regularly scan your computer.

2.      Email phishing tricks.

We recently had a user who was tricked into entering their email credentials into a fake web site.  The attacker was then able to login into this mail account.  They would have had access to any email in her mailbox (financials, emailed passwords, etc.).  In this case the attacker used the credentials to send spam from her account, probably trying to infect other systems.

Last year, even a White House officials were tricked into responding to a fake email that purported to be from Jared Kushner, but in reality was sent by an email prankster.

Solution: Adopt Office 365 or G Suite for your business. These solutions come with added security measures that consumer email systems don’t provide. Don’t EVER provide confidential information through email.

3.      Insecure websites.

Attackers can also gain access to servers through insecure web sites.  Once they have access to the website, they can then access any database on the server and the content in the databases.  This could be anything from e-commerce orders to financial or medical information. As an example, Drupal recently released a patch for a major security hole that allowed a virus to execute simply by browsing to a URL. Because WordPress runs about 25% of all websites today, it’s a big target for hackers.  The database, themes and plugins are continually being updated with added security measures. If you don’t apply the patches, you leave yourself vulnerable.

Solution: Companies who have had a web site developed, but don’t maintain it are putting themselves at risk. Website data security best practices create rigor around keeping your database, themes and plugins up-to-date. You’ll also want to ‘harden’ your website security settings and have a strong firewall in place.

4.       Password sharing / password weaknesses.

The easiest way to gain access to your small business software programs is to give someone your password. You may be sharing your password intentionally. Some companies share one password among employees to save money or for convenience. Other times password sharing may happen unintentionally. We’ve seen passwords written on post-it notes stuck to laptops. Now everyone who passes by while you’re working in the coffee shop can get into your systems.

Solution: Don’t share your password. Give each employee and contractor their own passwords. Have strong employee onboarding and offboarding procedures in place. Use a password software program like LastPass or Dashlane to create more sophisticated, and unique passwords for every site.

What about SaaS Software Solutions?

A question we commonly receive from clients is about online data security and the risks of SaaS (Software as a service) solutions. For example, with QuickBooks Online your financial data now resides on a server managed and maintained by QuickBooks. While that may feel risky, studies show that your data is usually significantly MORE secure when managed by a major online software company than when it resides on your own internal server.

Major software vendors like Microsoft and QuickBooks have invested in building sophisticated, multi-layer security systems.  They do all the backups and keep the system up to date. DIY IT Services can be a mistake, costing you more in the long run than you’re saving. If you are considering using a smaller, lesser-known company, you should investigate their data security measures. If you’re not sure what to buy, consult a reputable IT services provider for help in software selection.

What about Cloud Business Application Hosting?

A trend in small business IT strategy is to move your databases and applications from your physical location in your office to a cloud hosting platform like Amazon Web Services (AWS) or Azure. The security measures you need to take are the same, EXCEPT with AWS and Azure, you have the advantage of using their multi-layered security measures, and you’re at less risk for things like fires, flooding, hurricanes and other disasters.

Most data breaches are preventable.

Following these simple steps you can avoid most data security breaches.

Small Business Data Breach Security Steps

1.       Train employees to be wary of suspicious emails and websites.

2.       Don’t share passwords.

3.       Change your passwords frequently and make them hard to guess.

4.       Keep your software programs up to date.

5.       Keep your website up to date.

6.       Routinely use anti-virus software, firewalls and other data security measures.

7.       If you don’t have IT staff, hire an outsourced IT services company to keep your IT environment secure.

8.       Have backup and recovery procedures in place. If you need to restore your data, you can.

What if you get infected by a computer virus, ransomware or other malware?

Act IMMEDIATELY.

The quicker you can respond, the more likely it is that you’ll be able to thwart your attacker. Your employees should know who to go to in the event of a data breach. Seek the help of IT Support for malware removal, and just as importantly, close the security holes that caused the data breach in the first place.

If you need help, give us a call at 586-275-1775!

Request a Tech Check