7 Basic Network Security Tips for Small Businesses

a man is looking at his laptop in the server room

Some small businesses might think it’s reasonable to assume that hackers and data thieves only go after large targets. Of course, these same criminals are well aware of this assumption, which is precisely why they know small businesses are often ripe for exploitation. According to CNBC, in 2019 small businesses were the targets of 43% of all cyberattacks, and more than half of them suffered some type of network security breach within the previous 12-month period.

Thankfully, there are some basic strategies that small businesses can employ to help them reduce their risk of ever having to experience a cyber attack.

Strong Passwords

Using a strong password is such a simple way to discourage hackers, yet many people still avoid using them.  Employers can enforce the use of strong passwords by requiring their systems to only accept passwords that consist of a combination of letters, special characters, and/or numbers, and are at least 8 characters long. For even better protection, enforcing the use of two-factor authentication provides another layer of security as it requires those attempting to log in to identify themselves by entering a code sent to their phone or email.

Network Security for your Corporate Wi-Fi

Businesses should always secure their Wi-Fi signal by requiring users to enter a password before gaining access. Leaving a Wi-Fi signal unsecured is simply another point of entry that leaves corporate software and data at risk for exploitation. 

Controlling Access

Employees should only have access to data and software on a need-to-know basis. Access to confidential information should be password protected and access to certain software applications should only be given to those required to use the software. Needless to say, a company should protect access to its network, requiring users to identify themselves before allowing access.

Encrypt Confidential Information

Some employees must use portable and removable media as part of their job responsibilities. Especially when working with confidential data, it’s important for companies to ensure that portable data is encrypted to prevent unauthorized access in the event the media becomes lost or stolen.

Disaster Recovery Planning

Companies should ask themselves if they are fully prepared if a long-term power outage should occur, or worse, an event such as a fire, flood, or some other type of natural disaster. If the answer is negative, they are overdue to get serious about developing a disaster recovery plan. Even small businesses are very dependent upon their hardware, software applications, and corporate data to conduct their daily business operations. Preparing a disaster recovery plan in advance means a company will be able to easily replace vital technology if a catastrophic event should occur.

Applying Network Security Updates/Performing Backups

Applying the latest software and hardware updates and patches allows companies to avoid malware and viruses that hackers often attach to outdated systems.  In addition, performing regular backups and making sure they can be easily restored is vital. Thus, ensuring that a company’s data is secure and readily available.

Educate Employees

Most business owners clearly understand that their ability to successfully conduct daily operations is very dependent upon having accurate and secure data to work with. However, sometimes employees may only consider how inconvenient certain security measures may make their daily tasks more challenging. Using a password of “1234” for every application they log into is convenient since it’s very easy to remember. However, weak passwords also leave business owners vulnerable to exploitation. This is where training employees on the “why” of security measures is so important. Employers can also train their employees to spot potential issues such as suspicious emails or unsecured web pages asking for confidential information.

Network Security Summary 

Companies should not feel discouraged if they find that safely and securely supporting their IT infrastructure is challenging. These types of challenges are precisely why Bluwater Technologies can help.

If you would like more information on how we can provide the technological support and security you need, please contact us.

What Business Owners Should Know About the Twitter #DataBreach

a book with a chain attached to it

One of the scariest things for business owners to see trending is the word #DataBreach. Over the past few days, Twitter has come forward to apologize for a significant data breach that occurred as a result of a nonsecure browser cache displaying sensitive user information. Although it remains unclear just how many businesses were affected, the compromise is believed to have impacted a large number of companies that utilize the platform for marketing and SEO.

If you are one of the thousands of business owners who received an email from Twitter apologizing for the breach — or if you’ve simply seen the hot topic trending on your dash — you may be anxious to learn the details and understand what you can do to prevent future vulnerabilities. 

Take a deep breath. #DataSecuritySolutions is always trending with Bluwater Technologies.

What Happened?

The core vulnerability responsible for Twitter’s security compromise lies in the way the app and website store user information. A browser cache allows platforms to remember details about a user and create key analytics. It relies on the process of saving temporary data, such as passwords and credit card information. Thus, the website or app does not need to download this information each time. This allows the website and app to load faster while keeping us connected with our various clients, contacts, and social media platforms.

Unfortunately, Twitter discovered that the confidential billing information of many of its business accounts had been erroneously stored in the browser’s cache. This made sensitive information visible to potential cyber criminals. Although no exploits have been confirmed, Twitter acknowledged that it was “possible” outside parties could access and view this information.

So what information was exposed? According to the official statement, email addresses, phone numbers and the last four digits of clients’ credit card numbers were the key pieces of data that may have been compromised. 

Who Was Affected by the Twitter Data Breach?

As previously stated, Twitter has yet to give an official estimate on how many businesses were affected.

This isn’t the first time the tech giant has had issues with data security. In 2018, a sitewide bug affected some 330 million users and compromised the password credentials of all business users involved. If this benchmark offers any guess, it’s likely that the current data breach has impacted a broad range of clients.

Non-Twitter users are not thought to be affected. As of May 20th, 2020, the caching issue has been resolved.

What Now?

While news of leaked information is no doubt a terrifying prospect, there’s no need to panic just yet. Modern businesses are more connected than ever through the collaborative powers of social media. That means business owners must prioritize internet security in an increasingly digital world in order to meet the needs of today’s compliance standards.

If your business was affected by the breach, take a moment to review your system information for any indication of a hack. It’s a good idea to call in the professionals. Utilize the knowledge of a trained IT consultant to identify any potential threats or vulnerabilities. Ensure all passwords are changed and updated (sentence-form passwords are best). If your company has suffered a data loss or been the victim of malicious ransomware attempts, don’t give in to cyber criminals just yet. Backup and disaster recovery options are available for small and mid-sized businesses.

Once you’ve assessed the damage and come out on top, consider proactive ways to prevent cyber attacks moving forward. Always clear your browser cache at the end of each day. Or set your browser to automatically clear so that stored information is not visible. Ask your IT consultant about curating how your information is transmitted online. VPNs — or virtual private networks — are a great option for masking and securing your online identity. A robust firewall and a comprehensive network and data security system is the best way to stop cybercriminals in their tracks and protect your valuable information.

Ask our Fort Lauderdale experts for more helpful tips and strategies for making your business #unbreakable.

The Home Chef Data Breach Affected 8 Million Customers

a box of home chef next to some vegetables

On May 20, 2020, customers of Home Chef got the unpleasant news that 8 million of their data records had been breached. The stolen information included names, email addresses, phone numbers, the last four digits of credit card numbers, and encrypted passwords. Other information, including mailing addresses and frequency of delivery, “may also have been compromised.”

The announcement came about two weeks after Home Chef learned of the breach. This is within a generally accepted time frame; the company’s first priority is to verify what happened and prevent further damage. What’s disturbing is that Home Chef learned of the breach only by discovering that its data was being offered for sale.

How Home Chef learned of the breach

An online criminal gang calling itself Shiny Hunters had announced that it was offering databases from eleven companies, Home Chef among them. In early May they offered 8 million records for $2,500. No details were publicly available on how the breach occurred, but Shiny Hunters apparently gained direct access to Home Chef’s customer database. The largest set of records the gang claimed to have was 91 million from Tokopedia, a major Indonesian online store. This number hasn’t been confirmed; the low-end estimate is 15 million.

The price might have been higher, except Home Chef did some things right. It didn’t store full credit card numbers, and it encrypted all the passwords in its database. Stolen information could make it easier to match credit card numbers with people or to crack passwords, but the breach didn’t outright expose that sensitive information. Even so, Home Chef is advising its customers to change their passwords.

What businesses and customers should do

The breach offers lessons to businesses and customers. Businesses need to remember the importance of network monitoring. If the security incident had been caught earlier, the thieves might have been stopped before they could steal the data. In the worst case, Home Chef would have known about the breach more quickly and started remedial action sooner. The process of acquiring the 8 million records could have taken weeks. Grabbing and exfiltrating that many records all at once could trigger alarms, so thieves prefer to acquire them slowly.

These events show why businesses should never store unencrypted sensitive information in their databases. Home Chef protected itself and its customers from a worse disaster by following this principle.

On the customer side, the breach shows the need for strong passwords. Depending on the details, thieves may be able to test long lists of passwords against the encrypted ones and discover the ones that match. A long and complex password is more resistant to this kind of cracking. When they learn of a breach, users should change their passwords immediately.

Home Chef warned customers to be wary of scams. Fraud operators can better target their phone calls and spam by knowing that a phone number or email address belongs to a customer. The company has reminded its customers that it will never ask for sensitive information by email. People getting phone calls claiming to be from Home Chef should likewise be wary of any odd requests.

Costs

Data security is a constant challenge. A typical data breach costs millions of dollars in downtime, reporting, mitigation, and liability. Businesses need to maintain a multilayered defense. It has to include not just technical protection but cybersecurity awareness training so that employees don’t give away authentication information or let malware get into their systems. System monitoring is important so that IT people can catch security incidents when they happen and not after massive data loss. Investing in data protection pays for itself by safeguarding a business’s operations and reputation.

Investing in data protection pays for itself by safeguarding a business’s operations and reputation. Bluwater’s network and system security services will reduce your company’s chances of suffering an expensive data breach.

Contact us to learn how we can help.

10 Cyber Security Myths for Small and Medium Size Businesses Debunked

a hand touching the word cyber security

By 2021, the annual global cybercrime damage is expected to reach $6 trillion. The average cost of a cyber security breach for SMBs is $117,000. That’s why many companies all over the world are struggling to maintain high levels of cybersecurity.

Due to the increase in activity related to this issue, false information is starting to appear. Let’s debunk the 10 most common SMB cybersecurity myths.

Myth #1: Cybersecurity is solely a technological issue

Truth: Besides beefing up antivirus software, cybersecurity involves many other actions, including employee training and high-quality IT support as well as clear procedures and guidelines. Without proper awareness, cybersecurity technologies are mostly useless.

Myth #2: Cybersecurity requires a formidable investment

Truth: The majority of the effort required to protect your data needs a reasonable investment. They include:

  • Training employees
  • Using a VPN to work from remote locations
  • Installing software updates in a timely manner
  • Consulting IT experts
  • Planning for disaster recovery
  • Creating proper authentication steps
  • Identifying security information
  • Setting up remote work guidelines.

Any investment you make in cybersecurity is many times smaller than the costs of data breach recovery.

Myth #3: SMBs are less likely to be hit by a cyberattack

Truth: According to Microsoft, about 43% of cyberattacks are aimed at small businesses.

With only a small percentage of SMBs being ready to defend themselves against an attack, cybercriminals target them consistently. Large enterprises tend to invest more time, money, and effort in cybersecurity, thus suffering fewer consequences.

Cyber Security Myth #4: My company doesn’t have anything cybercriminals may want

Truth: Even if you don’t deal with sensitive information, your company can still become a target of ransomware or DDoS attack.

It’s important to know that some cybercriminals assault small companies for fun or to train before a larger attack. Meanwhile, personal information about you and your employees may be a sufficient catch for some hackers.  

Myth#5: Cybercrimes only need attention when they occur

Truth: When a cybercrime occurs, it may be too late to fix the problem without substantial losses. It’s often hard to detect the crime before it causes irreversible damage. About 60% of small businesses stopped functioning 6 months after a cyberattack.  

The key to fighting the majority of cybercrimes is preventive measures.

Myth #6: If you have a firewall, you are safe against cyberattacks

Truth: Firewall and antivirus software are small parts of the big picture. Without a solid cybersecurity plan, you can’t prevent cyberattacks or react to them in a timely and efficient manner.

Cyber Security Myth#7: It’s an IT issue

Truth: Many SMBs believe that the IT department is responsible for cybersecurity. While your IT team players are likely to have an understanding of cybersecurity issues, they may not have sufficient knowledge and training. If you want to set up proper preventive measures and implement security controls, you need an expert’s assistance.

Myth#8: SMBs and enterprises face different cybersecurity threats

Truth: According to Cisco, the types of attacks that SMBs and large enterprises experience are similar. Companies of all sizes face the same amount of downtime related to cyberattacks. However, larger enterprises often have higher recovery potential due to better resources.

Myth #9: SMB leaders don’t take cybersecurity seriously

Truth: Cisco survey shows that 90% of IT decision-makers have knowledge of the company’s data privacy programs.

Cyber Security Myth #10: By taking the right approach, SMBs can be 100% protected

Truth: No matter how excellent cybersecurity preventive measures are or how much money you invest in them, the possibility of an attack exists. That’s why it’s imperative to have a disaster recovery plan.

Implementing security measures and preparing for cyberattacks is essential to SMBs’ stability. To learn more about strengthening your cybersecurity, please contact us today.

Top Cloud Security Threats Include Misconfiguration

a red wrong way sign sitting on top of a wooden pole

The shared, on-demand nature of cloud computing can only lead to more concerns about data security on the one hand and often forgotten areas like misconfiguration on the other.

Best Practices Begin with a Solid Cloud Adoption Strategy

The Cloud Security Alliance (CSA) pegs misconfiguration as a very real component to security threats. The Alliance is a leading global organization that not only sets “standards, certifications as well as best practices,” but annually lists top threats to cloud security. The biggest risks to today’s cloud strategy are related to an overall, poor cloud adoption strategy. 

Invariably, overlooking these areas can torpedo a company’s risk-management game plan. Generally, these sectors include data breaches, of course, but also:

  • Misconfiguration and improper change control
  • Overlooking the importance of cloud security architecture/strategy
  • Faulty permissions strategy and credentials
  • Threats from inside the company
  • Accounts ‘stolen’ by a hacker
  • Vulnerable APIs and interfaces
  • Vulnerable routing protocols (control plane)

Secure Your Single and Multiple Cloud Networks

According to CSA, these ‘call-to-actions’ should be a high priority for SMB decision-makers in order to secure their single, or multi, cloud strategies. 

“The complexity of the cloud can be the perfect place for attackers to hide, offering concealment as a launchpad for further harm. Unawareness of the threats, risks, and vulnerabilities makes it more challenging to protect organizations from data loss. The security issues outlined….are a call to action for developing and enhancing cloud security awareness, configuration, and identity management,” said John Yeoh, Global Vice President/Research for CSA.

Contact us to discover how you can partner with a proven, managed service provider (MSP) to achieve your security goals. Our expertise can not only help you deploy your programs and apps to the cloud but provide all the necessary security backups in a timely manner—and with minimal disruption to your network.