IT assessment, planning, execution, monitoring and preventative maintenance LEARN MORE

Dark Web Scans: Are They Worth it?

Dark Web Scans

Should you do a dark web scan for your business or personal information?  Many of companies promote dark web scans online or on TV.  For instance, Experian offers a free scan when you set up an account with them.1

Supposedly, dark web scans discover whether or not someone hacked your personal and financial information.  Often, you’ll find this info on the “hidden” web where criminals try to sell it.

In this article, we explore whether or not you should do a dark web scan.

What is the Dark Web?

Besides the Surface web which everyone explores, there exists a hidden web with sites called the “Deep Web.”

The Dark Web refers to the part of the Deep Web where criminals have illegal sites and conduct illegal activities, like selling stolen Social Security numbers or drugs.  Also, you need special software, like one called Tor, to access this web.

Dark Web Scans

Dark Web Scans: Are They Worth it?

To answer this question, we’ll compare the regular web with the Deep web.  The regular web, which we can see, is really small compared to the Deep web.  It can thought of as the surface of the ocean, while the Deep web constitutes the rest.

Dark Web

Also, you can search the Surface web using search engines like Google, Bing or DuckDuckGo.  On the other hand, one cannot search the Deep Web.2

Because of its large size and unsearchable neature, we don’t recommend doing a Dark web scan.   It’s like looking for a needle in a hay stack.  Also, criminals use a lot of tools on the Dark web to hide their identity.  Until they thoroughly screen other parties and collect payment, they do not make sensitive personal and financial information available .3

Nothing is Free!

Therefore, we suggest that you don’t try any of the free dark scans the Experian Credit Agency and others offer.  They advertise free scans to try to get users to sign up for their paid monthly services.

Experian offers a free dark web scan to see if someone hacked your email address and password.  We believe they don’t do a real dark web scan, but just looking at publicly available data dumps.  If you sign up for their monthly plan, Experian offers to do a search based on your Social Security number, bank account numbers and other information.  Therefore, Experian uses the initial free scan to entice you to sign up for their monthly subscription service.4

How Can I Tell if my Info has Been Hacked?

Instead of requesting a dark web scan, you can use some free tools to see if your sensitive information has been exposed.  For instance, at one website (https://haveibeenpwned.com/), you can check if someone hacked your info.  Also, you can set up an account to receive alerts in case someone hacks one of your accounts.

Hack Check

Also, BreachAlarm represents a good alternative to the “Have I been Pawned” website and offers many of the same services and features. A website called DeHashed differs some from these other two.  Besides checking on email address hackings, DeHashed searches for hacks related to your name, password and other info.5

How Can I Protect Myself and My Business?

You should operate under the assumption that a hacker compromised your login credentials at some point.  Last year, cybercriminals hacked the Equifax credit agency and got Social Security and Driver’s License numbers on over 143 million people.6

To protect yourself and your business, you should use unique passwords for every online account and also change these passwords frequently (at least once every three months).   By using a password manager like Lastpass or Dashlane, you can secure online accounts.7

To protect yourself further, you should consider putting a freeze on your credit with the three main credit bureaus (i.e., Equifax, Experian and TransUnion).  This will prevent any criminal from requesting credit using your stolen info.  If you need to request credit, like applying for a home loan, you can temporarily unfreeze your credit.8

Freezing you credit will not prevent your bank or other financial accounts from being hacked.  You will should monitor their activity separately.

References:

1 Experian.com “Is Your Information on the Dark Web?” Link to Site

2 Dailydot.com “A beginner’s guide to the dark web” Link to Site

3 Howtogeek.com “What is a “Dark Web Scan” and Should You Use One?”  Link to Site

4 Makeuseof.com “The Experian Dark Web Scan: Do You Need it and Can You Trust it?” Link to Site

5 Digitaltrends.com “How to know if you’ve been hacked” Link to Site

6 Fortune.com “Equifax Hackers Steal Personal Details of Up to 143 Million People” Link to Site

7 Malwarebytes.com “10 ways to protect against hackers” Link to Site

8 Consumer.ftc.gov “Credit Freeze FAQs” Link to Site

Credit Agencies:

Equifax:  Link to Website

Experian: Link to Website

TransUnion: Link to Website

Smartphone – Five Ways to Protect Your Device

Smartphone Hacking on the Rise

Smartphone

Do you know that there are about 230 million US smartphone users and over 2 billion worldwide?  Do you know that U.S. smartphone users spend about an hour and half each day on their phone?  For many of us, smartphones have become integral part of our daily lives.  Besides using them for email and making calls, we use them to do just about anything: banking, accessing social media and taking photos.  This means that smartphones can hold some really important personal and financial information.

Because the smartphone market is so large and these devices hold such valuable information, hackers have become increasingly focused on breaking into them.  Recently, there has been a large increase in smart phone hacking.  In the future, we expect the attacks to only get worse.

Recognizing these threats, we wrote an article about the five ways individuals can make their phones more secure and reduce the chances of being hacked.

Google Play StoreApplication Download and Installation

The first step you can take to better protect your smartphone is to be extremely careful about what you are downloading and installing.  The best rule of thumb is to only download apps from the Apple App store or the Google Play Store and not unofficial sites.

Apple does a great job of screening which apps become available through its App store.  You can be confident that the applications you install on your iPad or iPhone are free of malware and viruses.  The apps on the Google Play Store are more likely to have malware or viruses, but usually you can be confident when downloading from their store.  Google has a scanner which scans its Play Store for malicious apps.

Also, it is important to check the permissions a new app is requesting when you download it.  If a flashlight app is asking for permission to access your contacts, this should be a red flag.

 

Disable Bluetooth Bluetooth smartphone

When you can, we recommend that you disable bluetooth. Some hackers have used bluetooth to break into smartphones.  There are different bluetooth versions with varying levels of security.  The older versions have more security holes, while newer versions have become more secure.  In general, it is best to disable bluetooth when you don’t need it.

 

Find my iPhoneEnable Device Finder and Remote Wipe

If your smartphone is stolen, you want to be able to remotely track it and to delete it.  On the iPhone, you can enable “Find my iPhone” under the “iCloud” settings.  If your device disappears, you can put it in lost mode.  This locks your screen with a pass code.  You can display a custom message to help you get it back.  You can also delete everything on your iPhone, so your personal information cannot be accessed.  For Android devices, you can remotely locate, lock and wipe your phone by using the Android device manager and third party apps.

 

EncryptionEnable Encryption

While the iPhone comes with full-disk encryption automatically enabled, you will have to enable encryption on Android phones.  Basically, the encryption protects your data by requiring a password for someone to be able to access your information in a usable form.  Without that password, it would be extremely difficult to hack it.

To set up encryption on an Android, you would need to go into “Security” in the Android settings and select “Encryption.”  It may take an hour or two to encrypt the device.  Then, after this you will be asked to enter this password every time your Android device boots up.

 

smartphone Pass codeUse a Pass Code

Your phone should be set to immediately lock when not in use.  It is very important to set a pass code or biometric (finger print, face recognition, etc.) security to protect it.  If you are using a pass code, the longer the better.  If your code is six digits long, this will make it 100 times more secure than a usual four digit one.

There are locking settings you can change to increase your smartphone’s security.  For instance, immediate locking will ensure that it will be hard to access your important information.  Don’t set your phone to lock after one minute or so.  Also, you can set your phone to erase all data after a certain number of failed entry attempts.

Related References:

CNBC.com “Your Smart Phone could be hacked without your knowledge”: Link to Article

The New York Times “With Wikileaks Claims of C.I.A Hacking, How Vulnerable is Your Smartphone?”: Link to Article

Cnn.com “WikiLeaks CIA hacking claims: How worried should you be?”: Link to Article

 

 

 

 

 

 

 

The Hidden Cost Of Computer Downtime And What To Do About It

It’s nearly impossible for a small business today to survive without the use of technology. How many small businesses are left that don’t at least use email? The catch is that even if only a small amount of technology is used by a business, it becomes dependent on that technology and can’t properly function without it.

The technology must allow users to reliably and efficiently access the systems and data they need to do their job. If it doesn’t, there are significant costs and these costs are often underestimated. If there is an attempt to quantify these costs, it often doesn’t go beyond just multiplying employee downtime by the employee’s hourly wage. Direct employee cost is only a small part of overall cost of downtime.

losing_money

There are numerous indirect or “soft” costs associated with downtime and though difficult to quantify, they can drain massive amounts of profit from a business.

A major indirect cost resulting from downtime is the cost of poor customer service when systems are unavailable or slow.

poor-customer-service

When a customer calls to place an order, or check the status of an order, and can’t because the system is slow or down, what does that cost in customer goodwill? Will they order again? Are they likely to promote your business? What’s the cost of losing that customer? What’s the opportunity cost of that customer not promoting your business?  What damage results from them actually badmouthing it?

whistpering-290x300

Another indirect cost relates to employee morale. When employees can’t effectively perform their duties because the system or their workstation is slow or down, not only is there lost productivity, but there’s frustration.

cartoon-guy-waiting-for-computer-hour-glass-3-sequential

Frustration can affect employee morale and employees can feel management doesn’t provide them the tools they need to succeed or that management in general, doesn’t care about them. Low employee moral can lead to a poor work ethic and employee turnover, both of which can represent huge costs.

So, because of a small businesses’ high dependence on technology, downtime costs are high when that technology is unavailable or inefficient.  The trick becomes minimizing downtime. The traditional “Break-fix” approach to IT management, where nothing is done until something “breaks” is largely responsible for excessive downtime. There is an increasingly popular realization that the Break-fix model is ultimately more costly to the organization than a proactive model. Break-fix is more costly, because it results in an under-performing, unsecure IT infrastructure and therefore MORE DOWNTIME! A key element to the proactive approach is “Remote Monitoring and Management” or “RMM.”

monitoring-image-1

RMM services watch over computers and networks 24/7 and identify conditions requiring attention. This allows for identifying issues before users are affected to minimize downtime. Additionally, if systems do need to be taken offline for repair, the work can be done non-intrusively, off hours to minimize business disruption.  Here are some of the things that can be monitored …

  1. Computer hard drive space (did you know that when a hard drive reaches 80% capacity, it starts to slow down)
  2. Computer hard drive performance
  3. Computer hard drive health (is the hard drive badly fragmented, developing bad sectors or about to fail?)
  4. Computer processor performance
  5. Computer memory performance
  6. Operating system stability – are all the latest patches applied?
  7. Power usage and battery backup charge
  8. Temperature monitoring – are hardware components ready to fail or does the cooling fan need to be replaced?
  9. Network speed
  10. Anti-virus status – are file definitions up to date and is the anti-virus software running?
  11. Security – do operating systems have the most current security updates and is the firewall preventing un-authorized access?
  12. Backup status – is the backup software running?

Remote maint & security

When left un-monitored, all these things can result in significant downtime. Poor security for example can cause systems or data to become unavailable when a cyberattack occurs. Significant downtime can be incurred waiting for systems to be restored or cleaned of a virus.

bored-woman-at-keyboard

Sometimes poor security can result in more than just downtime costs. For example, if internal or customer information is stolen or compromised, there’s potential law suites, increased insurance premiums and more lost goodwill with customers, prospects and possibly employees. You don’t have to look outside the Philadelphia area to see an example of this. In March 2016, Main Line Health Systems had personal information of more than 10,000 employees and 2,000 physicians stolen in a data breach. This not only affected the public image of the health system, …

Reputation Management

… but also resulted in costs associated with having to provide support services for employees, including credit monitoring and a call center.

 

Another way Remote Monitoring and Management reduces downtime, is by allowing for instant, secure, remote control.

remote-control

This instant control and access to equipment, its configuration and history allows for rapidly analyzing systems and resolving problems, for example, it allows for quickly servicing password reset requests and common lockout issues. RMM in general reduces on-site visits and ultimately save times and money.

With RMM, businesses can avoid the burden of IT management and focus on their core business activities, while professionals make sure systems are working properly. RMM results in lower overall IT cost and costs are incurred at a predictable monthly or other periodic rate.

There are many reasons systems can go down or access can be slow or lost, but if someone isn’t watching over them, these interruptions to business productivity can’t be stopped before they happen. Remote Monitoring and Management is a critical component to reducing downtime and saves big money in the areas of customer service/retention, employee productivity/morale/turnover, third party liability and business reputation.

Ten Ways to Protect Your Important Business Data

 

 

cyber-crime

Cyber Crime’s Rapid Growth

Did you know that cyber crime costs are projected to grow to $2 Trillion in 2019?1  That is almost four times the estimated costs of breaches in 2015. According to a new report by Hewlett Packard and the U.S-based Ponemon, hackers cost the average U.S. business $15.4 million per year2.

While large corporations have sizable IT departments, budgets and resources available, recent attacks on Target and other corporations show that they are still very vulnerable.  Because they have limited resources, including less IT support, small to mid-size businesses are especially exposed to attacks and cyber criminals know this.  These businesses often do not put formal security procedures and policies in place and do not properly train their employees on security issues. They are ripe for attack.

For more information about the business of cyber crime, please view the following video:

 

Cyber Crime Types

 

Cyber crime can include viruses, malware, hacking of websites or networks, phishing & social engineering, Botnets, Denial of services attacks (DoS), stolen devices and malicious insiders.  As the most common type of attack, viruses, spyware and malware may be unknowingly downloaded when an employee opens an attachment from a malicious email or visits websites with embedded viruses or malware while at work. They can cause computers to slow down and become unstable, track user keystrokes or can sometimes spread through the company’s network scrambling any data they run into.

Phishing is becoming an increasingly common way to gain access to important business and personal information.  Typically, it happens in a business when an employee receives an email which appears to be from a higher up and asks for employee or customer information.  Thinking it is a legitimate email, the employee replies with the requested information.

Phishing Example:

 

paypal_phish_example

Cyber Attacks Could Never Hit My Business

 

Some business owners don’t think that they could ever become victims of a cyber attack.  They say the chances are very slim.  Are they really?

Of the 252 businesses surveyed by the HP and Ponemon report, 99% reported being hit by virus and malware attacks, 62% were affected by phishing schemes, 45% had stolen devices and 35% experienced attacks by malicious insiders3.

You don’t have to look far in the Philadelphia area to find recent attacks.  In March 2016, an HR representative sent the personal information of about 11,000 Main Line Health System employees to a cyber criminal4.  This representative replied to a phishing email which appeared to be from a manager.

The point is that any individual and small to mid-sized business is vulnerable to intrusion by cyber criminals.  Therefore, it is extremely important to take steps to reduce this exposure and limit the damage, which could result from an attack.  Below, we will outline some of the basic steps business and personal users can take to protect themselves and their critical data.

Ten Ways to Protect Your Critical Business Data

 

Conduct a Security Audit

 

network_security1

Before your company can put certain security policies and procedures in place, it needs to assess the current state of its IT infrastructure.  An IT services company or professional will conduct a security audit where they will look at your network setup and configuration.  They will also closely examine all of the devices and software your company uses.  Finally, they will examine your website.

The main focus will be on the vulnerabilities which exist and eliminating those.  Could someone easily hack the wireless network?  Is there any firewall to prevent malicious traffic from entering or leaving the business’s network?  What email service is the business using?  Is it secure?

One of the most important parts of the audit is identify the company’s critical data and where it resides.  Knowing this information, you can design policies and procedures meant to protect and backup up this vital information.

Set and Communicate Company Security Procedures and Policies

 

While this may seem obvious to do, a lot of small to mid-sized companies do not have formal IT policies and procedures in place.  Even if they do, they may not have communicated these clearly to their employees.

These should be clearly defined and as detailed as possible.  Should every company computer lock up and require a password to log in after 30, 60 or 90 seconds?  Who should have access to which data?  What happens if an employee leaves or is fired?

Mobile devices, like smart phones and tablets, have added to the complexity of designing a plan.  There need to be specific rules related to what information employees can access using theses devices.  There also need to be plans as to what will be done if an employee’s laptop, phone or tablet is stolen or hacked away from the office.  Some companies require that their employees’ smart phones are set up so that they can be remotely wiped, in case they are stolen.

Install a Hardware Firewall

 

firewall-networkA hardware firewall is the first line of defense for a company’s network.  It will protect a company from suspicious traffic entering and leaving the company’s internal network.  It can also limit content and websites employees can access, which will prevent malware and viruses loading onto computers.  A firewall should have an active anti-virus subscription to screen any files or traffic entering.  For specific brands, Nucleus recommends Sonicwall or Cisco firewalls.

Separate Guest and Company Wireless Networks

 

Some businesses let visitors connect to their wireless network by giving them the network key.  This is an invitation for disaster.  Once someone gets this information, they can easily access important company information.

Businesses should set up a guest wireless network which is completely separate from their own wireless network.  Also, they should avoid using a Comcast or Verizon provided router.  These routers lack the security and configuration features of enterprise grade routers.  Also, they tend to transmit a weaker wireless signal which travels less distance.

Use Strong Passwords on Every Device

 

This may seem very obvious, but unfortunately when given complete freedom to set up their own passwords, employees often choose ones which are very easy to hack.  All you have to do is look at the 2015 top login passwords to see this.  “123456,” “password,” and “12345678” were the top three5.  It doesn’t take much imagination to guess these.

In general, passwords should be at least eight characters in length and require a capital letter, number and symbol to be secure.  Employees should not use the same password across all accounts.  If a hacker figures out an employee’s email password, then he or she will be able to get into all of the employee’s banking, file sharing and social media accounts.  Think of the damage that can be done!

Regularly Update Your Operating Systems and Software

 

Windows7Update_UpToDate

This seems like a simple practice, but many businesses fail to pay attention to updates.  Recently, we saw a server which had not installed any Windows or software updates for over a year and a half.  When you are in the middle of work, it is annoying to see a pop up asking you to do an update and restart the computer.  They always seem to come up at the worst time.   It is understandable that you might ignore or close out these popups to continue working.

It is very important to do Windows and software updates, because they will help your system to be protected from malware and virus exploits.  Operating Systems and software, that have not been updated leave a door open for these exploits.  At the very minimum, you should install Windows, Adobe and Java updates on a regular basis.

Install a Reputable Anti-virus on Every Device

 

While a hardware firewall provides an outer barrier for your company’s network, an anti-virus on a PC will provide a second layer of protection in case something was able to penetrate.  An anti-virus can prevent employees from downloading or running malicious files.  While many people think that their Macs and smart phones will not get viruses, the truth is that they can be infected.

Recently, Nucleus has seen more Macs getting infected.  As the number of smart phones in the world increases rapidly, cyber criminals are looking to infect and hack them.  Therefore, it would be smart for businesses to have antivirus installed on all smart phones and Apple devices.

Limit Remote Access to a Virtual Private Network (VPN)

 

Employees are increasingly working from home or remote locations and need access to important company information.  Smart businesses limit the amount of company data employees’ have on their devices, including smart phones and they centralize their data. If employees need to access company information, they should do it through a Virtual Private Network (VPN).  This is the most secure way to create a remote connection.

Encrypt Data and Emails

 

security-and-computer

Encryption adds another layer of protection to a company’s data.  It makes it nearly impossible for cyber criminals to access information.  If an encrypted laptop were to be stolen, it would be worthless to a criminal, except as a large paper weight.  Encrypted emails are transmitted in a way that the cyber criminal has no way to decipher the message.  There are many solid encryption software products, like VeraCrypt, DiskCryptor, Folderlock and Kryptos 2.

Backup and Disaster Recovery

 

While it is important to take steps to prevent any cyber attack from happening, it is impossible to protect your business 100%.  New and more complex malware and viruses are created each day.  For this reason, it is important to have a disaster recovery plan and data backup in place in case a cyber attack happens.

Your disaster recovery plan is the overarching plan which outlines how your business will respond when hit by a number of disastrous events.  These include fires, floods, hurricanes, power outages, terror attacks, virus and malware infections, hackings and harmful employee acts.   In the case your business location(s) is(are) completely destroyed or unusable, you want to have an alternative offsite location to conduct business.  You want to designate who will communicate with everyone in the business about the next steps and which employees will be expected to show up at the alternative location.

Your data backup is a critical part of the disaster recovery plan.  We have been able to save several clients by restoring backups when their systems have been encrypted by the Cryptolocker virus and other “ransomware.”   Typically, we recommend both onsite and offsite backups.  Your backup should be frequent and automatic, so it is not dependent on anyone remembering to do it.

Final Thoughts

 

Today, cyber crime attacks are happening more frequently and causing more damage to individuals and businesses every day.  Because of a lack of resources, small to mid-sized companies are especially susceptible.  Owners and employees have only a limited amount of time to dedicate to IT security issues before their daily focus is pulled away from operations.

Cyber crime’s growing threat makes it increasingly important that businesses better protect themselves.  In order to give businesses a starting point, this blog post has covered some of the basic protective steps every owner, manager and employee should take.  After these steps, there is much more that can be done.  Our future posts will touch on these next steps.

Stay tuned!

References:

 

1 Juniper Research “Cybercrime will Cost Businesses over $2 Trillion by 2019:  Link to Article
2 Ponemon Institute “2015 Cost of Cyber Crime Study”: Link to Download the Study
3 Ponemon Institute “2015 Cost of Cyber Crime Study”: Link to Download the Study
4 ABC 6 News “Main Line Health Employees’ Information Compromised in Email Scam”: Link to Article
5 Gizmodo.com “The 25 Most Popular Passwords of 2015”: Link to Article