Category: Cloud Services

Zero Trust – Trusted Vendors

This is the second in a series about the concept of Zero Trust, which means in the IT sense that you trust nothing and always verify everything surrounding and connected to your network. Today’s discussion will be on the vendors you purchase network equipment from. 

Trusted Vendors

Trusted vendors are those who supply workstations, servers, routers, switches, power protection, software, and anything else connected to your network. Here are some questions that you should be asking yourself:

  • Do you know who makes your network equipment, servers, computers, and software?
  • Do you know the way to contact their support and have current account access information?
  • Do you have current warranties / support contracts on hardware and software?
  • Is the hardware able to perform at the level needed?
  • Are you purchasing software from those who meets industry standards?
  • If a subscription, how much are you paying and are you on the correct plan for your needs?
  • When is the last time you upgraded your software and hardware?
  • Have you budgeted for the next upgrade?

Take time to think about these questions and decide where changes can be made to better protect your IT investments, or contact us to do the thinking for you.

Hackers Penetrate 93% of Company Networks

Hacked - Grants Pass, OR

Security researchers performed penetration testing on the networks of 45 various mid-sized companies and found that in real life scenarios 93% of those networks were able to be compromised to the point of business disruption. Here are the details:

The Target

The 45 companies were polled to determine what would be an unacceptable business interruption. They decided that the following met that criteria:

  • Disruption of production processes
  • Disruption of service delivery processes
  • Compromise of the digital identity of top management
  • Theft of funds
  • Theft of sensitive information
  • Fraud against users

These became the target for the penetration testers. 


The Process

In order for the penetration tester to achieve their target, they followed the following process:

  • Breach the network perimeter – This was done by the use of compromised passwords found on the Dark Web and know vulnerabilities on devices that were directly connected to the internet
  • Obtain maximum privileges – In 100% of the networks, once an attacker was inside the network
  •  Gaining access to key systems – With maximum privileges, the testers are able to gain access to other areas of the network including databases, executives computers, and production servers
  • Develop attacks on target systems – Once key systems are compromised the testers then figured out how to create the unacceptable business interruption. Although they could have created these interruptions, they only gathered proof that they could to present the data to the companies. 


How to Defend 

There are a couple main ways to defend against these kinds of attacks:

  • Security Controls / Segmentation – Creating least privileged access to key systems and segmenting the network will keep hackers from traversing the network once inside
  • Enhanced Network Monitoring – Modern cyber security tools watch activity and traffic on the network to find indicators of compromise. They pool this information into an attack history that can be used to remediate and further protect. 


Your company is not as safe as you think, so contact us for free initial cybersecurity evaluation and risk report.  .

Find and remove Office 365 Public Folder Calendar

Here is a quick bit of Powershell that helped me to track down a “shared calendar” in a Co-Managed IT / Tier3 client’s Office 365 tenant. After looking in Shared Mailboxes and Resources for the calendar with no luck, we tried to get into the Exchange Management Console (EMC). The loading circle of death went on for an eternity, so switched to good old Powershell. Found the commands as follows after connecting to Exchange Online in Powershell:

get-publicfolder -Recurse

Remove-PublicFolder -Identity \[PublicFolderName]\[calendarname]\

If your company is looking for local management of your Office 365 tenant or need advanced support for your IT team, then contact us to find out how much you can save with us. 

Calls Marked as SPAM

Here is a quick tip for anyone doing advertising from their phone number, you can be marked as SPAM LIKELY or SPAM RISK by phone companies. Each phone carrier keeps a list of numbers they determine to be spam risks based on the history of the number. Unfortunately, there is no central database or service so far that manages this number designation. 
 

What Causes the SPAM Designation?

In short, here are the most obvious reasons for designation:

  1. Volume of Outbound Calls Per Day Per Number
  2. Someone Flagged a call from your number in that carrier’s app as spam 
  3. Outbound Caller ID number is not set properly from your system and incomplete will probably be flagged as spam automatically


How to Get De-Listed

You can use the links or email addresses below to register legitimate numbers and also address any incorrect labeling or call blocking with other carriers:

AT&T:

https://hiyahelp.zendesk.com/hc/en-us/requests/new?ticket_form_id=824667

Sprint, Verizon, U.S. Cellular:

https://reportarobocall.com

Comcast, Charter, Cox, Altice and other fixed line (VoIP) providers, email Nomorobo for call blocking services:

reports@nomorobo.com

If your company is looking for locally managed VoIP service, then contact us to find out how much you can save with us. 

Did I see your Indicators of Compromise?

Nobody wants to be hacked, breached, compromised, or whatever else they are calling it now. Here is a quick list of things to think about to keep your company safe:

Compromise Prevention

  • Keep track of your inventory, both software and hardware.
  • Make sure to properly dispose of these things (recycle or responsible destruction)
  • Scan your network for vulnerabilities
  • Patch or remediate everything you find
  • Manage your antivirus & keep it up-to-date
  • Keep your passwords complex & safely stored
  • Remove all users / accounts when no longer in use
  • Look at best practices to harden your computers / network to attacks
  • Monitor your network for strange activity (indicators of compromise)

If your company is concerned about security, then contact us to take care of it for you.

How is Malware Delivered?

Malware

Read a recent study on the origins of malicious software aka malware. Here are the highlights:

Current Malware Statistics

29% – Malware is previously unknown to security vendors due to the continued efforts of malware creators to hide the software or make it undetectable.

88% – Malware is delivered to people’s inboxes and some of it bypassing normal SPAM filters.

8.8 Days – Time before regular antivirus vendors have discovered the malware and added it to their lists for detection.

$50 – The cost of a pre-fabricated malware kit that can be bought currently on the dark web.

“The most common type of malicious attachments were: documents (Word – 31%), archive files (ZIP & RAR – 28%), spreadsheets (Excel – 19%) and executable files (EXE – 17%).”

What can be done?

A multi-tiered approach to security remains the best solution:

  • Moving from traditional antivirus to Enhanced Detection & Response (EDR) software to go beyond lists of know infections to behavior tracking of software
  • Moving from traditional SPAM filters to Email Advanced Threat Protection which scans each email and opens each attachment to see if there is any malicious activity cause by them
  • Moving from traditional router to a business class firewall with Intrusion Prevention System to monitor traffic for suspicious activity
  • Employee training is also key to keep your staff aware of immerging trends and threats 


If your company is looking to enhance your network security posture, then contact us for assistance.

Don’t You Hate Having All Those Passwords

Whether you are buying something from an online store, reading your email in the browser, checking your account balances, or uploading photos / videos to social media, most websites require an individual username and password when accessing their services. This raises various problems.

What’s with ALL the Passwords?

Using the same password for all the websites you access is a bad idea and horribly insecure. If we run a quick check on the “Dark Web” for your email address, it would likely show that hackers already know the one password you have been using forever. So the only other option is multiple passwords, which can easily go beyond the limits of our feeble human brains to keep track of OR people start creating a list that is typically typed up and saved on the computer – if a hacker gets into the computer then all the passwords are theirs too. So then the option is to find a secure way of storing and backing up these passwords, not to mention trying to make them easy to use. 

Rangle Them Passwords!

That is the job of Password Management done by a small piece of software known as a password manager. It takes the complexity down to remembering the one password to open the software, then it tracks the rest from there. The good ones have the ability to generate passwords for you, store them in connection with the website you are visiting, auto-filling the password fields on the websites when you visit them again, and backup your passwords to the cloud – all with strong security and encryption to keep the hackers out of your business. 

If your company is still typing passwords into a list, or worse have a paper list, then contact us for assistance migrating to a password manager.

PPP Loans for Technology Upgrades

desktop upgrades - Grants Pass, OR

A bill in Congress has been brewing since October 2020 and finally passed in December 2020. Representative David Scott introduced H.R.8620 which is stated to:

“To permit payments for certain business software or cloud computing services as allowable uses of a loan made under the Paycheck Protection Program of the Small Business Administration.”

What PPP can do for you

This bill was an amendment to the Small Business Act that changes the definition of how PPP loan moneys can be used. The changes are as follows:

“the term ‘covered operations expenditure’ means a payment for any business software or cloud computing service that facilitates business operations, product or service delivery, the processing, payment, or tracking of payroll expenses, human resources, sales and billing functions, or accounting or tracking of supplies, inventory, records and expenses”

So what does this mean for your business? That you can apply for the PPP funds then use them to upgrade your out-of-date software that runs your company or use the funds to move your business into the cloud. There has never been a better time or excuse to discuss the possibilities of moving your business to the cloud and implementing those upgrades that have waited so long. By doing so you will position your company better for the Work From Home trend and be prepared for business expansion once the pandemic is over. 

If your company is interested in software upgrades or moving into the cloud, then contact us for assistance.

FTC orders Zoom to enhance security practices

The Federal Trade Commission (FTC) has agreed with Zoom to settle their allegations that it “engaged in a series of deceptive and unfair practices that undermined the security of its users.” 

Settlement Conditions

The conditions put forth by the settlement The FTC complaint said that:

  • Since at least 2016, the company misled users by touting that it offered “end-to-end, 256-bit encryption” to secure users’ communications, when in fact it provided a lower level of security, i.e., it encrypted communications but stored the encryption keys on its servers
  • The company misled users by saying that recorded meetings that were stored on the company’s cloud storage were encrypted immediately after the meeting ended, which was untrue in some cases
  • In July 2018, the company compromised the security of some users when it secretly installed a hidden web server on Macs that helped with frictionless installation of the Zoom application

The settlement does not oblige Zoom to admit fault or pay a fine, but obligates it to:

  • Refrain from misrepresenting privacy and security practices, including about how it collects, uses, maintains, or discloses personal information; its security features; and the extent to which users can control the privacy or security of their personal information
  • Implement a comprehensive information security program and obtain biennial assessments of its security program by an independent third party and notify the FTC if it experiences a data breach
  • Implement a vulnerability management program
  • Assess and document on an annual basis any potential internal and external security risks and develop ways to safeguard against such risks
    Deploy safeguards such as MFA to protect against unauthorized access to its network; institute data deletion controls; and take steps to prevent the use of known compromised user credentials
  • Review any software updates for security flaws and ensure the updates will not hamper third-party security features

Quoted from https://www.helpnetsecurity.com/2020/11/10/ftc-zoom/

If your company is going to use video conferencing to assist with work from home or to remotely connect with clients, then contact us for assistance.

Archives

Categories

Plant a Seed @ 541-761-9549
233 Rogue River Hwy #873 Grants Pass, OR 97527
Mon-Fri: 9:00am-5:00pm
support@farmhousenetworking.com
© 2016-2025 - Farmhouse Networking. All rights reserved
Terms and Conditions Privacy Policy

Evaluation Signup

Error: Contact form not found.

And God will generously provide all you need. Then you will always have everything you need and plenty left over to share with others. As the Scriptures say,
“They share freely and give generously to the poor. Their good deeds will be remembered forever.”
For God is the one who provides seed for the farmer and then bread to eat. In the same way, he will provide and increase your resources and then produce a great harvest of generosity in you. - 2 Corinthians 9:8-10