User login
Courtesy navigation
Search
Blog posts in IT security
How one hour can critically damage your business
May 07, 2013
Do your staff understand the full risks involved if they lose their business smart phone or another mobile device that contains company data?
Quite possibly not, according to new research carried out on behalf of Kaspersky Lab. It found that over three-quarters of people working in European small and medium-sized businesses would wait more than an hour before telling the company about the theft or loss of a business-owned device.
An hour doesn't sound long, but if a company smart phone falls into the wrong hands, 60 minutes is time enough to do a whole lot of damage. Racking up call charges to premium rate or international numbers is the least of your worries. Being slow to report a stolen device could see your valuable company data being siphoned off.
Data that's easy to lose
IT dealsSee the latest business tech bargains we've found online. Or buy IT equipment now from these trusted suppliers: |
Customer and employee contact details, financial information, confidential emails, access to company Twitter and Facebook accounts ... these days a smart phone is as powerful as a computer, only harder to secure and easier to lose. You need to treat it with the same amount of care.
What's more, the research questioned IT managers too. 29% of them reckoned it would take a whole day for employees to tell them about a lost or stolen device.
Take more care
David Emm, senior security researcher at Kaspersky Lab, has some good advice for companies that want to take better care of their mobile devices.
“The ever-growing abilities of mobile devices make our lives much easier," he confirms. "However, what we don’t always consider is the ease with which such tools can be stolen, leaving a wealth of business critical information in the hands of thieves."
"To a seasoned cybercriminal, it will take only a matter of minutes to bypass the four digit password protection used on most devices, especially smart phones. If your mobile device is lost or stolen, it is critical that the IT department is informed as fast as possible. They can then block access of this device to the corporate network and, in the best case, wipe all of its data.”
Of course, you can't remotely wipe a device unless you've put in place systems to let you do this. If you're a sole trader or run a very small company, it's probably enough to take steps to back up each individual device and install a remote wipe app. Read our advice here.
Larger businesses will want to look into mobile device management (MDM) solutions. MDM software gives you much greater visibility and control of the mobile devices in your business, so you can restrict how they're used, what's stored on them and - crucially - scrub them clean and lock them out of the company network.
|
Sponsored links: |
Protect your business from a cyber attack
April 25, 2013
There are an estimated 4.8 million small and medium-sized enterprises (SMEs) in the UK, many with their own ecommerce websites.
In 2011, 32 million people purchased goods or services online. That gives the UK one of the world's biggest internet-based economies. And it's why keeping your website safe and secure from cyber-attacks has never been more important.
SMEs are easy targets
As a business owner, you’re probably dealing with plenty of critical day-to-day issues. Perhaps worrying about your website’s security is not top of your list of priorities.
You may be wondering why hackers would want to target a small business rather than big brands like Lush and Adidas. The simple answer is that hackers know smaller businesses have fewer resources dedicated to online security, making them easier targets.
For those involved, cyber crime is big business. It costs the global economy $338bn a year which, according to Symantec, is significantly higher than the global narcotics black market.
Since the beginning of 2010, 36% of all targeted cyber-attacks have been directed at SMEs.
With around 44 million attacks a year taking place against home computers, businesses and government systems in the UK, an offline website means a loss of income. For instance, PayPal reportedly lost £3.5m due to a cyber-attack in 2010.
As well as lost revenue, a website security breach can result in losing vital data, your reputation and even your ranking on Google. Ultimately, it could damage your business beyond repair.
Six simple tips to protect your site
Here are six simple but effective tips to protect your business against cyber attacks:
- Choose your passwords carefully. Password123 is not a secure password! Make sure passwords have at least eight characters and use a combination of letters and numbers. Here are some ideas for creating strong passwords.
- Install anti-malware and anti-virus protection for your website in the same way you would your PC. Reviews can help you determine if the product is right for your business.
- Use SSL to encrypt data. SSL provides a secure connection, protecting data sent between a customer’s web browser and your server. Your hosting provider can help set this up for you. Learn more about SSL.
- Avoid using wireless networks. If you must use them, make sure you're using the latest encryption standard, WPA2. This offers government-grade security.
- Keep programs and hardware up to date. This helps block malware that thrives in older equipment and out of date software. If you are using Windows or a Mac you can set up weekly update checks. You should also do this for any software you use to manage your website.
- Educate employees about the latest online threats. This way they’ll know clicking on bad links or opening dodgy attachments can compromise data. All your staff should be as vigilant at work as they are at home. If in doubt, don’t click it.
So, if website security wasn’t on your priority list, it might be time to add it now.
Guest post by Rahul Mistry, content writer for www.heartinternet.co.uk. You can follow Rahul on Twitter and Google Plus.
|
Sponsored links: |
Don't panic, but 23% of your staff are stealing from you
April 17, 2013
If dodgy employees all looked like this, they'd be easy to spot.
A staggering one in ten employees has stolen important data from their employer after handing in their notice, reveals a new study from IT security specialist LogRhythm.
It seems that downloading a company's customer database onto a USB stick or copying crucial documents to CD is much more common than you might have thought. Of the 2,000 employees studied, the survey found that a massive 23% had taken confidential data from their workplace.
Often, people steal client details or product information in the hope that it'll give them a head start with their new employer. But 14% of people who admitted taking data did so to help set up their own rival company. And 23% did it out of revenge, because they felt undervalued and poorly treated.
Employers know the problems
Looking for a deal?See the latest business tech bargains we've found online. Or buy IT equipment now from these trusted suppliers: |
Clearly, anyone stealing data from their employer is in the wrong. But that doesn't mean businesses should make it easy for employees to get their hands on the good stuff.
This research also surveyed employers, 47% of whom said they don't have any system in place to stop staff accessing confidential information or taking data.
So, all-too-often it's lax security and a lack of concern that makes it easy for staff to walk away with crucial company assets.
Worse, 60% of employers said they never change passwords or access codes, which is a little like leaving the door wide open for former employees to come and grab what they like.
You wouldn't let a staff member keep their keys to the office after they've left, so why would you let their passwords keep working?
Are you at risk?
If this survey is at all representative, there's a good chance your business is at risk of data theft. So, what are you going to do about it?
- Restrict data access. Sensitive data like customer information should only be available to employees who absolutely need it. It should never be sent by email or stored in shared locations.
- Close user accounts promptly. If a member of staff has been sacked, close their network account immediately and revoke all their access rights.
- Don't share passwords. Shared passwords are the enemy of good security. Not only can people continue to use the password once they've left, but it's also much harder to tell who's been accessing the data.
- Rotate access codes regularly. If you have a PIN-entry system for your building or a wireless network with a password, make sure you have a system to change them regularly - probably every month.
Finally, there's an aspect to this that leaves a nasty taste in the mouth. The research found 53% of people who've stolen data use it to get a head start in their next job, or to impress their new boss.
If the new employer decides to make use of that data, what sort of message does that send? And do they really think that employee isn't going to do the same to them when the time comes?
In short: if you've ever benefited from a data theft, don't be surprised if you end up suffering sometime too.
|
Sponsored links: |
Can you spot the phishing website?
April 10, 2013
Looking for a deal?See the latest business tech bargains we've found online. Or buy IT equipment now from these trusted suppliers: |
You've probably heard of phishing. It's where scammers send you an email that looks like it's from an official organisation, usually your bank.
The email usually contains links to a fake log in page which collects your username, password and other security details. If you enter them, the scammers will subsequently use your credit card, empty your bank account or commit some other crime against you.
Some phishing websites are laughably bad, with terrible grammar, bad spellng and shonky design. But others can be very convincing.
Spot the phishing site
To show you just how convincing phishing sites can be, here are two screenshots for you. One is the genuine sign in screen for the Co-operative Bank's online banking service. The other is a fake sign in screen from a phishing email I received.
You can click the image to see both screens full size. Can you tell which is which?
So, how did you do?
Well, the top screenshot is of the genuine sign in screen. The second one is the fake.
If you're familiar with this bank's online interface, you'll probably realise that the site asking for your full name is not genuine. But if you don't use your online banking often or simply aren't paying 100% attention when you click the link, it's easy to see how you could be fooled.
Three principles to avoid phishing
Checking the address of a site like this is usually the most foolproof way to see if it's fake. In this case, it was easy to tell, because the URL clearly wasn't the Co-operative's normal address:
It isn't always as obvious as this through, so here are three foolproof ways to avoid phishing traps:
- Don't click sensitive links in emails. If an email from a trusted source like your bank asks you to log in to your account, do so by manually typing in the website address rather than clicking a link.
- Pay attention to security notices. Most phishing emails will be caught by email filters, security software or web filtering tools. If you see a warning about an email, link or website, don't ignore it. (It's amazing how many people do.)
- Let the sender know your concerns. If you're in any doubt at all about whether an email or website is genuine, get in touch with the organisation it claims to represent. A quick phone call should be enough to confirm your doubts.
And as a final warning, don't ever enter sensitive log in information if you have any concerns at all about the website you're on. Even if it just looks or feels a bit funny, that's reason enough to stop and think before you make a mistake.
Note: don't click links in dodgy emails like we did. They can be dangerous, even if you don't enter in any sensitive information.
Did we just nearly break the internet? What the Spamhaus attack says about our security
March 28, 2013
If you noticed your internet connection slowing markedly yesterday, with some sites sluggish and others unavailable, for once it might not have been down to your broadband supplier.
That's because spam fighting service Spamhaus was subjected to an enormous distributed denial of service (DDoS) attack.
It seems that Spamhaus blacklisted a controversial hosting provider, Cyberbunker, because its servers were apparently being used to send lots of spam. 'Friends' of Cyberbunker then bombarded Spamhaus with the biggest DDoS attack ever.
Are any of us innocent?
The incident spawned headlines like Global internet slows after 'biggest attack in history'. And with so much malicious data flying through the internet's wires, some innocent internet users found their service was disrupted as a result.
But how innocent are those internet users? Is our slack security as individuals partly to blame for the scale of the disruption?
It's an interesting question because this attack was coordinated using a huge 'botnet' of internet devices, including a large number of insecure broadband routers.
It's the exact threat experts recently warned us about, where hackers exploit weaknesses like default passwords to take control of these devices.
Looking for a deal?See the latest business tech bargains we've found online. Or buy IT equpment now from these trusted suppliers: |
Your router is part of the problem
As more details of the Spamhaus attack emerge, we might get a better idea of what devices it involved. But as The Guardian reports, that innocent-looking router in the corner of your office could have been a part of the problem:
"Some of those requests will have been coming from UK users without their knowledge, said Blessing [an internet expert]. "If somebody has a badly configured broadband modem or router, anybody in the outside world can use it to redirect traffic and attack the target – in this case, Spamhaus."
Obviously, whoever initiated the attack is ultimately responsible. However, the scale of it was partly due to the vast number of insecure internet devices out there.
We're all to blame
So, who is to blame? Manufacturers who sell their products with inadequate security and don't properly explain how to beef it up? Internet service providers that make their routers less secure so they can log in remotely when they need to? IT adminstrators who don't update their software promptly?
Or is it all of them, and each of us too?
The internet is a decentralised, open network. That makes it very difficult for any single body to effectively police this type of incident, and means that we're collectively responsible for the internet's security.
Yesterday, we almost broke it. Perhaps it's time we all took the time to be more secure online.
How to hack 420,000 internet devices
March 25, 2013
Here's a stark reminder that internet security perhaps isn't quite as tight as we'd all like.
An anonymous researcher managed to take control of 420,000 insecure internet devices like webcams, network routers and printers.
They were use to effectively create a huge network of internet devices that could be used for dodgy purposes like taking websites down via denial of service attacks. (The researcher didn't go ahead and cause any damage, but the potential was there.)
Standard passwords
Looking for a deal?See the latest business tech bargains we've found online. Or buy security software now from these trusted suppliers: |
What's striking about this research is both the huge number of devices that could be compromised, and the ease with which it could be done. Quite simply, the researcher accessed each device by trying standard usernames and passwords like admin or root.
In a month where a high-profile cyber-attack against South Korea hit the headlines, it's important for your business to remember that sometimes the simplest hacking attempts - like trying default usernames and passwords - can be just as damaging.
Don't neglect the obvious
The anonymous researcher summed up the problem in a post online:
"While everybody is talking about high class exploits and cyberwar, four simple stupid default telnet passwords can give you access to hundreds of thousands of consumer as well as tens of thousands of industrial devices all over the world."
In short: choose your passwords carefully. And whenever you add a new piece of equipment to your computer network, check if it has sign in credentials and change them if so. If you don't, you could be a part of this problem.
- The ABC of business IT security
- Most small businesses have had a security breach. Have you?
- Emma Watson could bring down your business computers
Image: Rob Kints / Shutterstock.com
Three things you can learn from NatWest's IT woes
March 07, 2013
Image: Flickr user StewC
If you were one of the millions of NatWest customers unable to access online banking, use debit cards or even get cash from a hole in the wall last night, the bank's reputation has probably dropped a notch or two in your mind.
It's hardly the kind of publicity a beleagured banking giant needs. However, major IT outages aren't restricted to banks. They can happen to any business. If one hits yours, it can have an immediate impact on your bottom line and longer-lasting consequences for your reputation.
So, as NatWest fights to deal with today's avalanche of negative coverage, what can you learn from its misfortunes?
Looking for a deal?See the latest business tech bargains we've found online. Or buy online now from these trusted suppliers: |
1. Keep communicating
One of the worst things you can do during an IT problem that affects customers is to go silent.
If you can explain the problem and when it's likely to be fixed, that's great. But even if you're unsure of the cause yourself, just being there to provide some information is better than nothing at all. At least you'll avoid that 'rats deserting a sinking ship' feeling.
Last night, NatWest was quick to apologise via Twitter, although few further updates were posted despite a veritable Twitter storm.
2. Learn from your mistakes
NatWest also suffered a huge outage last summer, which saw some people unable to access their money for days.
Although the bank has said yesterday's disruption wasn't connected to the previous problems, the fact that this is the second major outage in nine months has compounded the reputational damage, with many customers vowing to leave.
If a problem reveals failings in your IT systems, make sure you fix them properly. It may cost you time and it may cost you money, but the cost of inaction could be much larger.
3. Don't be afraid to say sorry
The most insincere apology I can recall in recent years is this classic from Apple. It's a great example of how not to do things.
Look, if your IT systems have failed and your customers were affected, it really is best just to apologise sincerely and explain what you're doing to fix things.
At this stage, being open and honest is the way to reassure customers that the same thing won't happen again.
Then make sure it doesn't happen again, of course. If NatWest suffers another outage any time soon then it'll take more than few words to restore its reputation.
The ABC of business IT security
March 04, 2013
It’s good to refresh your knowledge when it comes to something as crucial as IT and data security. So here’s a slightly tenuous ABC of business IT security. Plus a D and an E for good measure.
A is for anti-virus
Get good anti-virus software and keep it up to date. You usually have to subscribe to software updates, and don’t wait for this to expire before you renew it. Even a few days without adequate protection is asking for trouble.
Spyware - which attempts to extract information from your computer without your knowledge - is another threat. However, most anti-virus packages also include anti-spyware protection too.
You can shop around for the best anti-virus deals. Reputable suppliers include McAfee, Kaspersky and Bitdefender.
B is for backups
Ideally, all the data on your computer system needs to be backed up to external hard drives. This ensures that you won’t lose sensitive information if your computers are corrupted by spyware or viruses.
Inform your staff that they need to back up their data at the end of each day, and regularly remind them to do so. External hard drives don’t cost the earth (you can see a selection here on Amazon), and you’ll be saving yourself a lot of hassle if the worst comes to the worst.
C is for control
When it comes to protecting data from prying eyes, control is the key. If there are files on your company’s shared drive which you don’t want all your staff to view, you should control who can access them.
If you use Microsoft Windows, here’s how to restrict access to a certain folder:
- Right click the folder and click Properties
- Click the Security tab
- Click Edit and then Add
- Add the usernames of the people you want to access the folder into the box that appears on screen
- Click Ok
That’s it – you’ve created a list of people who can access that particular file or folder on the shared drive.
D is for data encryption
Encrypting your computer systems makes it harder for hackers and fraudsters to access sensitive business information.
This can be anything from emails and financial figures to documents and databases hat are stored on computers or servers in your business. You can also protect portable storage devices like USB drives, which protects them in the event of loss.
Setting up encryption software can be a little tricky, but this guide to encrypting your laptop is a good place to start. It’s also worth speaking to your IT supplier if you need help.
Encryption is an excellent way to ensure your business transactions are protected from unwanted attention. Even if a fraudster manages to steal a disk containing sensitive information, they should still be unable to read it.
E is for external help
Instead of relying on your own knowledge about maintaining computers, it is a good idea to have an trusted IT supplier you can turn to. They will help troubleshoot any problems with your system, allowing you and your staff to focus on running your business.
Even seemingly minor problems should be flagged up, as they can indicate larger problems with your IT security. It all helps avoid any lingering suspicions that your company has been targeted.
It’s often a good idea to choose a local IT supplier, so you can ask business contacts and friends who they’ve used in the past. Perhaps they could even negotiate you a discounted rate!
Written by online security expert, James Archer, on behalf of online retailer The Safe Shop
With IT risks worrying businesses most, here's how to cope
February 11, 2013
A survey into SME attitudes to risk has identified which of 24 'risk scenarios' (that's things that could go wrong, to you and me) are most likely to keep business owners awake at night.
The research, commissioned by McAfee, revealed UK SMEs view their technology systems and the integrity of their data as the biggest areas of risk.
In contrast, things that might traditionally have been perceived as significant risks - like big marketing campaigns or competitor initiatives - are seen as being much less likely to have a detrimental impact on business performance.
This graph shows the ten highest risks selected by businesses in the UK:
Although it's perhaps depressing that new technology is responsible for so many worries in business, this survey also suggests a greater awareness of the risks, which bodes well for long-term improvements.
What's more, most companies can reduce most of these risks by taking some fairly simple steps.
To start with, it's a good idea to create some sort of security plan. It doesn't have to be an enormous document, but writing even a short plan will force you to think about what the key risks are.
Once you've done that, make sure you've covered these basics:
- Get good IT security software from a reputable firm such as McAfee, Kaspersky, Bitdefender or Trend Micro. It can go a long way towards protecting your computers from viruses and hackers.
- Make sure you're on top of your IT maintenance and install software updates in good time. This will help you eliminate software bugs that hackers can use to break into your systems.
- Sort out your backups. Make sure you have a solid backup system in place and test it regularly. Cloud backup systems like Livedrive, Mozy and BackupGenie are good options for smaller companies.
- Think about how you'd cope in an emergency. You need to know how you'll carry on working in the event of problems and what steps you'd need to take to get things back to normal.
Finally, always remember that maintaining good IT security is an ongoing process. It's a good idea to find an IT supplier you trust and keep track of new security trends that could affect you.
Yes, you need to secure your smart phone too
February 07, 2013
Make sure you keep yours safe. (Image: Flickr user Johan Larsson.)
New smart phones have some strong security measures enabled out of the box. But did you know there are some simple steps you can take to make sure yours is secure?
Set a passcode
The simplest thing you can do protect your smart phone is to set a passcode. Once set, you will be required to enter the code to unlock and use your phone. The minor inconvenience of entering this each time will pay major dividends if your phone is ever lost or stolen.
A thief will be unable to access your phone without the passcode.
- With an iPhone, set your passcode by tapping: Settings > General > Passcode Lock
- On an Android phone, tap Settings > Security > Screen Lock
- If you use a Windows Phone, tap Settings -> Lock + wallpaper
Along the same lines, you should also make sure your phone is set to lock automatically when not in use. This means you won't have to remember to lock it yourself each time.
Keep your phone updated
Keeping your smart phone updated with the latest software is just as important as keeping your computer up to date.
Installing the latest updates helps you avoid any security problems that could affect your mobile operating system. For example, a security flaw in previous versions of Apple's iOS (which runs on every iPhone) could allow an attacker to bypass your lock screen.
You can search our website for details of security vulnerabilities affecting your particular model of phone.
Always be careful
All of the rules you've learned about being safe on your desktop computer apply when you're using your smart phone.
Be careful using public wireless connections, and particularly wary when the network doesn't require you to enter a password to connect. These connections are unencrypted, which means people can easily intercept your data.
Double-check the network you're connecting to is the one you think it is. Some attackers may try to steal your data by posing as a legitimate hotspot.
If you work with sensitive data a lot, consider a secure VPN connection for when you use public Wi-Fi. This should protect data even if you've connected to a dodgy network.
- Where to start with mobile security
- How to protect your phone from theft
- The business risks of smart phone apps
Giri Sreenivas is vice president of Mobile at security specialists Rapid7.
How predictable is your PIN?
December 06, 2012
How secure is your personal identification number (PIN)? An enlightening study reveals many PINs are predictable and easy to guess. So, is it about time you changed your PIN?
The safest PIN of all?
The fascinating study, by Data Genetics, reveals the most commonly used PINs and therefore the ones most likely to be guessed.
It found that the most infrequently used PIN is 8068. Does that make it the safest? Well, perhaps, although now it's been revealed in this study, it might become a lot more popular!
What makes a poor PIN choice?
According to the stats, the most common PIN is 1234. Out of the 3.4 million numbers surveyed, it made up 11% - or 374,000. What little imagination some people have!
In fact, the top 20 PINs all fall into the category of 'easy to remember'. For instance:
- 1111
- 0000
- 1212
- 7777
It seems PINs with lots of repetition or a pattern to them are chosen most frequently. Interestingly, 2580 comes just outside of the top 20 at number 22. This looks like a random number until you realise these are the numbers down the centre of a telephone keypad.
Other easy to remember four-digit PINs come from years of birth. A disproportionate amount of PINs begin with 19. This is bound to change to 20 as the population ages. Day and month of birth also figure quite prominently.
Does it matter if your PIN is easy to guess?
Most devices, credit cards and locks that are protected by a PIN limit the number of times an incorrect number can be entered. So does it matter if you use a common PIN?
Well, let's think about it in more detail. If I'm a bad guy and I get hold of your bank card, I generally get three guesses before the card is locked.
Going from the statistics in the study, if I take the three most common PINs as my starting point, I have a one in five chance of getting yours right. Not bad and probably worth a gamble.
Won't my bank cover me?
Unless your bank can prove you have been grossly negligent with your PIN (sticking it to your credit card, for instance) the general rule is that you will be reimbursed for any financial loss if your card is stolen and your PIN used to extract money.
So, isn’t it simply a case of using the most convenient, easy to remember PIN and - should it get compromised - waiting for the banks to sort it out?
Well, even assuming you are able to reclaim your money, there's quite a kerfuffle involved in the process. Anyone who's gone through it will know that the inconvenience and lost time is enough to deter you from using a weak PIN.
In addition, you may highlight yourself as an easy target – if you did it once, why not again? Don’t bring unwanted attention on yourself just for the sake of four little numbers.
Dave James is managing director of Ascentor, a company which helps businesses manage information risk. You can also follow him on Twitter.
Most small businesses have had a security breach. Have you?
December 04, 2012
If government statistics are accurate, even the smallest companies need to give serious thought to IT security. That's because official figures show 76% of small businesses have reported a cyber-breach in the last year alone.
You can tell the government is alarmed by the statistics, because it has decided to establish a 'Cyber Reserve' force to deal with the security threats posed by online crime. It's uncertain what this means in practice, as the details won't be revealed until next year.
However, it should signal a more co-ordinated approach to combating cyber-crime, with the goverment recruiting experts to fight back against sophisticated hackers and fraudsters.
Although things have moved on considerably since this 2006 report found internet fraud was slipping through policing procedures, it still sometimes seems like online criminals are several steps ahead of the authorities.
Your business is at risk. Really.
Just in case the message hasn't sunk in yet, let's make it absolutely clear: your business could be a target for online criminals.
We recently spoke to security expert Don Smith who explained that smaller companies often find themselves singled out in online attacks because they're seen as soft targets:
“More and more smaller companies are being attacked by cyber criminals, yet many still hold the view that they are too small to be targeted."
"If they have any public profile – if they’ve been in the news, for instance - then they can be a soft target. They also might get targeted if they handle the intellectual property of big clients, for example, a creative agency working on a big account."
“This leaves small organisations vulnerable to a number of risks, including attacks, data loss, service disruptions and reputation damage. Just like larger enterprises, small businesses need visibility into the threats that face their organisation.”
Clearly, that begs the question: what should you do about it? Hopefully, you'll have got the basics right. You'll be protecting your network with a firewall, and each individual computer and server in your business will have its own firewall too.
You should definitely be running security software too (try Norton Internet Security, McAfee All Access or ESET).
But to really get a grip on your IT security, you need to spend a little time on security planning. The first stage is to identify your most valuable data, so you can find ways to protec it.
It's worth reading the full interview with Don to understand a bit more about the security issues your company could face. We also have some really useful information about putting a security plan together and assessing the risks your business faces.
With just a little preparation, you can reduce the chance of your business becoming another IT security statistic.
- Staying safe in the changing world of IT
- Simple IT security for smaller companies
- Five mistakes you could be making with your IT security
(Police lantern image: conner395 on Flickr.)
TOTW: send sensitive information in a self-destructing message
November 23, 2012
Image: creating a self-destructing message
Sending sensitive information through email: most of us know it's a bad idea, yet we've all done it at some time or another. Whether it's providing the password to access a protected file or confirming your mother's maiden name, email often seems like the easiest option.
Yet email is inherently insecure. Not only can emails be intercepted as they travel through cyberspace, but if the recipient isn't strict about deleting messages, your information could sit in their inbox for months or years. If their account ever gets hacked, your data is in the hands of the bad guys. Email hacking happens a lot, so it is a real risk.
So, for this Donut tip of the week, we wanted to show you a handy online tool that lets you send sensitive information in a form that self-destructs once it's been read. Sort of like Mission: Impossible, only with fewer pyrotechnics.
To get started, hop on over to Oneshar.es. Then it's really easy to create your one-time message:
- Click the blue Create One Now button.
- Type your message into the big box on the screen. You can use up to 1,000 characters.
- The message will be deleted once it has been viewed by your recipient. However, in case they don't look at it, you can set the message to self-destruct after a period of time. Choose this from the drop-down menu.
- Click the Create Link button.
- You'll see a link to your message appear. You can copy this and paste it into an email before sending it to your recipient.
That's it! The link uses SSL encryption, which means the message itself is protected from interception when the link is viewed.
Obviously, anyone with access to your link can click it to see the message - but as messages self-destruct once viewed, you don't have to worry about who sees the link once your recipient has used it. Certainly, Oneshar.es deals with the problem of having important information sitting in inboxes.
Now there's no excuse for putting your password in an email ever again.
Could you keep your tech going through a blackout?
October 09, 2012
These won't run your server for long. (Image: mjtmail (tiggy) on Flickr.)
The UK could run out of energy generating capacity in winter 2015, reckons Ofgem, which says as spare generating capacity drops we could see energy prices rise too.
With the average business electricity bill at £2,600, that's not exactly something to look forward to. However, it could be a drop in the ocean compared to the loss in productivity a single blackout could cause.
No power, no business
Losses mount up very quickly when you can't use your computer, speak to customers over the phone or even see to pack orders and send them out. When there's no power, you can't do business.
Traditionally, businesses have planned for power interruptions by plugging their servers into uninterruptible power supplies (UPS). If you suffer a power cut, a UPS will continue supplying power. Chances are you won't be able to work, but you will be able to shut your server down properly, protecting it from damage and hugely reducing the risk of data loss.
If you have a server on your premises, you really should use a UPS. It's that simple. They start from around £100, but you'll need to spend a bit more to get a decent model like the APC Smart-UPS.
There are lots of UPS models available from companies like PC World Business, eBuyer and Servers Direct.
Introducing the BlackCurrent
But if you want to actually carry on working, you need significantly more juice than a typical UPS will supply. Step forward industrial battery specialist UK Powertech, which has launched a 'compact energy storage device' for smaller businesses and homes.
Called the BlackCurrent, it charges off the mains when the supply is good, then supplies electricity back to your equipment when required. You should be able to continue running computers, servers and critical gear for an hour or two.
The BlackCurrent does come at a price. It starts at £850, and you'll certainly have to spend more if you want to keep your computers and servers going for long.
Is it worth it? That really depends on your company's approach to risk, and how much damage a power outage could cause your business. But if predictions of power cut doom and gloom are in any way accurate, maybe it's worth considering.
Achieve security standards quickly and cheaply
September 17, 2012
Many companies are finding it’s becoming more common for them to have to comply to security standards.
These include as PCI DSS, which demonstrates you can hold customers’ payment details safely, or ISO 27001/2 which shows you use adequate, proportional controls to protect information.
Complying with standards like these can seem like a costly process. But if you look to change the way you do business rather than making big changes to your existing systems, you can reduce the cost and associated disruption considerably.
Change how you do business
The traditional way in which companies achieve standards compliance is to retrospectively add protective measures to existing business processes.
Having worked in this area for many years, I often see organisations with business processes that really are not set up to make it easy for them to comply with certain standards.
At such times it is worth taking a long hard look at your company. Instead of trying to tag compliance controls on to your processes, take a good look at how you do things.
Wasted technology
I have worked with many companies that have brought in new technology so they can comply with certain standards. However, often this technology is wasted because it is not properly set up. Managers lack either the time or expertise to use it properly.
This technology is only in these businesses because the standards demand it. It’s a tick in the box, but it is neither effective nor doing what it was intended for. In short, it is a waste of money.
The first law of any technology is that it needs to be managed. The second law is that any technology you are unfamiliar with needs to be managed far more than technology you are familiar with.
The problem with standards is that they tend to mandate technologies that many organisations are unfamiliar with.
How it works in practice
I worked with an organisation in the entertainment industry that acquires customer payment card details in two main ways: selling tickets and selling merchandise:
- The organisation’s IT infrastructure was old and had suffered many years of underinvestment.
- The organisation needed to become PCI DSS compliant quickly due to pressure from its bank.
- It would have cost £3m – £4m to update and improve the company’s systems to the required standards.
With a little lateral thought, we realised that ticket sales could be outsourced to the current market leader and merchandising could be moved to stand alone machines.
This meant the organisation didn’t have to worry about achieving compliance at all, and so could focus on redeveloping its network to meet business requirements rather than compliance obligations.
It does sometimes require some creative thinking, but it’s clear that making relatively simple business operational changes can lead to real savings in standards compliance costs.
- Secure your online shop
- An easier way to take credit cards?
- How to know what’s best for your business
Dave James is managing director of Ascentor, a company which helps businesses manage information risk. You can also follow him on Twitter.
Emma Watson could bring down your company computers
September 14, 2012
While the world's attention is diverted by a story involving a member of the Royal Family and partial nudity, don't let your guard down. Although the Duchess of Cambridge may be in the headlines today, there's a far more urgent threat to your IT systems out there: Emma Watson.
Security firm McAfee reckons the Harry Potter star is 2012's most dangerous celebrity. And it's not because she's particularly adept at hacking into Windows XP or an expert at guessing passwords (although who knows what damage a few well-placed spells could wreak?).
No, according to McAfee's research, anyone searching online using terms like 'Emma Watson and nude pictures' runs a high risk of landing on a dangerous website that's infected with malware. As the firm explains:
"McAfee research found that searching for the latest Emma Watson pictures and downloads yields more than a 12.6% chance of landing on a website that has tested positive for online threats, such as spyware, adware, spam, phishing, viruses and other malware."
Now, you might justifiably argue that anyone searching for things like that deserves everything they get from the web's seedy underbelly. But if they're doing it on work time, using your company computers, you should be worried.
Sure, you can discipline the employee responsible, but if your server's infected with a virus or a trojan has stolen your customer list then you'll have bigger problems to worry about than whether your staff member actually found what they were looking for.
Your company policies should - of course - make it clear that this sort of thing is not allowed, but that's not much use either once your computers are infected. And that's why every single PC in your company should have security software installed and up-to-date.
Packages like McAfee's own All Access software (£74.99) will guard against viruses, trojans and spyware, and show a warning screen when you try to visit a dodgy website. Alternatives include AVG Internet Security (£97.99) or Kaspersky's Small Office Security package (possibly best value of the lot because it covers five computers for £159.99).
While packages like these won't entirely guard against employee mistakes, stupidity or bad luck, they do provide a strong line of defence for your company. Even if you're not in the habit of searching for nude pictures of Harry Potter actors.
Image of Emma Watson: Flickr user david_shankbone under Creative Commons.
Five ways to create passwords that are hard to crack
September 12, 2012
Hardly a week goes by without one company or another being hacked and user passwords being made public on the internet. Do we have any hope of keeping our passwords safe?
Actually we do have some hope, but we all have to play our part and choose strong passwords.
Hopefully, the websites we have online accounts with are doing their utmost to protect our personal information, and in particular our passwords. But even if they are, that’s not the end of the story as simple passwords can be cracked quite easily by hackers.
We need to do our bit by making sure we have strong passwords that are hard to crack. Here are five ways.
1. Think of a word and a number
Word: Olympics
Number: 1066
All you need to do is mix these up a bit to come up with a good password. For example:
10Olympics66
Olym10pics66
1Ol0ym6pi6cs
Top tip: make sure you mix it up. The password Olympics1066 is not as strong as the others.
2. Think of a lyric, name and a number
Lyric: She was more like a beauty queen from a movie scene
Name: Michael Jackson
Number: 1983 (Song released in this year)
Choose the first letter from the phrase and mix the initials and number in. For example:
SwmlabqfamsMJ1983
MJSwmlabqfams3891
M19Swmlabqfams83J
Top tip: once you decide how you want to mix it up, stick with it. If the mixing it up part could confuse you then you could write down a memory jogger – read on to find out how.
3. It doesn’t have to be too long
Phrase: Just like that
Name: Tommy Cooper
Number: 1921 (his birth year)
Password:
JltTC1921
You get the idea!
4. Write down a memory jogger
We all need help remembering things so why not write down something to help jog your memory? It is very unlikely that someone will be able to decipher a decent memory jogger, because you can write things down in a way that makes perfect sense to you but is useless to anyone else.
Lets take the Tommy Cooper example. You could have ‘Tommy’ written down in your address book, followed by a memory jogger, like this:
Tommy: Idp-pdI
In this case the memory jogger stands for initial-date-phrase-date-initial
Using this would give a password of:
T19jlt21C
5. And finally…
Remember, that really need to change your passwords every so often, because you can never be quite certain if your password is in the wrong hands.
The biggest problem most of us face is that we have so many online accounts that we forget what they are. Give yourself a fighting chance and keep a list somewhere. As you join new shopping sites, social sites and other sites, add them to the list. If you want to change a password, you will at least know where to look!
Meet the information saboteurs, aka your employees
August 28, 2012
Who poses the biggest threat to your company data? You've probably thought about external security threats, but have you stopped to consider the damage your employees could do?
Information risk management specialist Ascentor reckons nearly 15.9m people are ready to damage their employer's business, and says over two million already have. These statistics and more are summarised in this infographic, and you can see the full version over on the Ascentor website.
See the full version of this infographic >>
Friday Donut tip: free tools to delete files forever
August 03, 2012
Not even emptying your computer's recycle bin guarantees your files are gone for good.
Although you can't see or open them on your desktop, the information is still there on your computer's hard drive, which makes it relatively easy to recover if you know what you're doing.
Obviously, that's good if you delete something by accident. But it's very bad if you're trying to delete sensitive information, like financial details or personal information. If your computer falls into the wrong hands, so could your data.
Thankfully, it's easy enough to scrub data off your hard disk for good. Here are three options for you to consider:
- Delete individual files for good with software like Freeraser or Eraser. These programs work by overwriting the files again and again with random data, eliminating any trace of the original files.
- If you want to scrub an entire PC securely - for disposal or resale - you can use CCleaner, which also has lots of other useful cleanup features too. Alternatively, copy Darik's Boot and Nuke onto a CD, put it in your PC, restart, and then type autonuke when prompted.
- Using a Mac? To permanently delete everything in your trash, click and hold the trash folder. When the menu appears, hold the command key, then move your mouse up to select Secure Empty Trash. Easy!
Of course, if you can't be bothered with all that and you don't need to keep your computer in working order, there's an option that's much more fun. Unplug your computer, rip out the hard drive and drill some holes in it. Satisfying.
Friday Donut tip: protecting your phone from theft
July 27, 2012
Smart phones are portable and valuable, making them prime targets for theft. Some reports suggest that 20,000 mobile phones are lost or stolen in the UK every day. And with the Olympics expected to attract extra opportunistic thieves, now's not a bad time to give your smart phone security the once-over.
Quite apart from the cost of replacing a phone (Apple's top-of-the-range iPhone costs £700!), you need to think about the value of the data stored on it too. All those contact details, emails, files, photos ... could you afford to lose them? That's why this Friday, we have three crucial security tips every smart phone owner should follow:
1. Regularly back up your phone
Most smart phones come with software to copy data to your computer, creating a backup of everything on your phone in case it gets lost or stolen. iPhone users will be familiar with iTunes. Android handsets usually come with something similar, like Samsung's Kies software.
Be careful though - if you keep your phone and laptop in a bag which gets stolen, you could lose your backup too. Perhaps it's better to back the data up online. Again, most smart phones offer this option: Apple has iCloud, and MyBackup Pro is a good option for Android phones. If you use a BlackBerry, check out the BlackBerry Protect app.
2. Use keylock with auto-erase
Keylock is the first line of defence when a thief gets their hands on your phone. It prevents them from accessing any of the phone's functions without entering a PIN code or drawing a certain pattern on the screen.
Every smart phone offers a keylock and you should definitely use it. Many handsets also have an auto-erase option, which wipes everything from the phone if an incorrect PIN is entered too many times.
3. Track your phone from afar
Mobile apps can help you fight back against mobile phone thieves. GPS functions can pinpoint where a stolen phone is. And - as news stories show - the police are becoming increasingly switched on about how to use these tools to recover stolen property.
The best-known is Apple's Find my iPhone. But other platforms are catered for too. Windows Phone handsets have tracking functions built in. Android users can try Plan B, and BlackBerry Protect includes tracking functions too.
Some tracking tools let you remotely wipe the phone too, but the key is to install one now. Because once your phone's gone, it's too late to do anything about it!
Previous Friday tips:
- Be careful what you share
- Faster ways to select text in Microsoft Word
- Generate unique passwords for any website
Image: Flickr user JAK SIE MASZ.
Simple IT security for smaller businesses
July 04, 2012
Keeping your IT system secure and protecting your data can be a complex task. A secure IT system has many elements, from a firewall and anti-virus software to strong passwords and physical security.
The human factor
Then there's the human factor. It's no good having the strongest passwords imaginable if your staff write them down or share them with each other.
For all but the smallest businesses, it's usually a good idea to seek expert IT security advice. Remote data access, cloud services and mobile devices are creating more fragmented IT systems - and with less centralisation, it's hard to keep everything under lock and key.
Free IT security guide
To help businesses get to grips with the different elements of their IT security, the Information Commissioner's Office has released a new guide. It's a little light on specifics, but it does contain a very useful checklist to help you cover all major areas of your IT system.
It's excellent reading if you want a good overview of the IT security challenges you face, or want to brief yourself before you speak to your IT supplier or security consultant.
Download the guide from the ICO website >> (PDF, 300K)
Friday Donut tip: generate unique, memorable passwords for any website
June 29, 2012
Passwords and website security breaches seem to be in the news constantly. Yet people still insist that passwords are generally a nuisance, and would rather have simple ones or use the same one for every website.
But that's risky. Having just one of those passwords revealed could potentially allow an attacker to access many of your other online accounts.
One really simple way to ensure you have a unique password is to use the name of the website in the password itself.
Come up with a password (or better yet, a passphrase) that you will remember. For example:
Ilikepineapples
That will be the base for your other passwords. For your Google account, you would use the password:
IlikepineapplesGoog
For your YouTube account you would use:
IlikepineapplesYout
Easy! You can obviously make the passwords as complex as you like, using numbers, symbols and both upper and lowercase letters.
Bonus tip:While browsing through the settings for my Gmail account, I spotted two-step verification. This is an excellent way to secure your Google account using your mobile. Every time you sign in on a new device, Google will call or text you a code which you must enter on the website. You won’t have to do this again for 30 days, unless you select otherwise. This way you’ll also know if anyone is trying to break into your Google account, as you will get an unexpected automated phone call from the big G. |
NB: I would recommend including numbers, symbols and capitals in your password. I didn't here for simplicity.
Previous Friday Donut tips:
Contactless payment infographic
June 18, 2012
Infographic supplied by Craig Murray, content c/o Caxtonfx.com
Friday Donut tip: securing LinkedIn passwords
June 08, 2012
This week, online services LinkedIn, eHarmony and Last.fm all suffered security breaches which saw users' passwords fall into the hands of hackers. It's not the first time something like this has happened and it won't be the last: previous victims have included Gawker and Twitter.
I've mentioned before that I think passwords are broken. But they're here to stay, at least for the foreseeable future. So for this Friday's Donut tip, we explain what you should do if you have an account with one of the affected services.
Secure your account
To begin with, be wary of any emails you receive warning that your password has been leaked. They might be genuine, but there are lots of phishing attempts going round too, so you're better off just deleting them.
The next step is easy: PANIC!
Actually, I'm just joking. You definitely don't need to panic. It's counterproductive and unnecessary, because it's actually pretty easy to secure your accounts:
- Go to the website of the service you use (LinkedIn, eHarmony or Last.fm)
- Log in using your normal username and password
- Use the change password option to make your password something completely new
(Don't just change a single letter or number of your old password - use something totally different. At this stage it's a good idea to make sure your password is nice and strong. I've put some tips below)
That's it, unless - like most people - you use the same or a similar password for other things. You see, scammers aren't stupid, and they know that if you use that password for your LinkedIn account, perhaps you also use it - or something similar - for more important services, like your email.
This means you also need to change any identical or similar passwords that you use on other services. You should really have a different password for each one.
Creating strong passwords
You've probably seen the usual advice about creating strong passwords. Use upper and lowercase letters, numbers and symbols, don't use words you'd find in the dictionary, and so on. But these passwords can be devilishly hard to remember.
I like the song lyrics trick: take a memorable line from a song, pull out the first letters of each word, then wrap it in a number that you can remember.
For instance, a Rolling Stones fan might choose the first line from Sympathy for the Devil: 'Please allow me to introduce myself'. And he might be able to remember 1960, because that's the year he was born.
Shortened, it becomes 19Pamtim60. Not bad.
Alternatively, you can use a tool like LastPass to generate and remember super-strong passwords for you. John Sollars talked more about keeping passwords safe in a recent post over on Startup Donut.
Previous Friday Donut tips:
Can you trust your staff?
May 10, 2012
We all trust our staff 100%, right? We’re not in any way worried that they might run off with our data, or email it to their personal email address the week they leave.
Unfortunately most companies can’t be so trusting. Data theft is a huge concern for many business owners. If someone steals your data and passes it to a competitor then you could be left with a major problem.
How to stop data theft
A few years ago data leakage prevention (DLP) technologies were considered only suitable for larger companies that could afford to spend thousands on sophisticated software and hardware to prevent their data being stolen.
But today things are changing. You may already have data leakage prevention technology at your disposal.
The data leakage risks
There are three key areas where your business is vulnerable:
- Email. Many smaller businesses keep customer data in spreadsheets. Perhaps you just save all invoices to a shared folder somewhere. In that case, it’s the easiest thing in the world for an employee to grab the data, attach it to an email and send it to themselves or someone else.
Really cheeky employees just use their work email address to share sensitive company data with outsiders!
You can stop this by doing two simple things. First of all, you can create rules so that all email sent out of the business to certain addresses needs to be approved by a manager. If someone sends a mail to anything@hotmail.com it can be sent for approval first. Or if someone tries to send an Excel spreadsheet to this type of address, you can send it for approval. There are lots of options here.
- Social media. Twitter and Facebook can be fantastic tools for your business, but they can also be risks. What if someone says the wrong thing, or posts something you’d rather your customers didn’t read? Well, it’s easy enough to prevent access to social media sites for those people that don’t need access to them.
- USB sticks and portable media. You can fit a huge amount of data on to a USB memory stick these days. It’s quite possible for someone to copy all of your company’s key data onto one in minutes. So consider disabling these copying functions altogether.
There are, of course, other data risks in your business. But those are three key areas to start when protecting your business from data loss.
- It’s time to loosen up your business IT
- Five mistakes you may be making with your IT security
- Action list: secure your IT system
Lee Wrall is founder and MD of Everything Tech, an IT support and service provider based in Manchester.
Small business technology advice, tools and resources | IT Donut
Copyright © 2010-2013
