Category: Encryption

Using SSO Single Sign-On for Enhanced Security and Convenience

Individuals and organizations rely heavily on various online platforms and services, the need for a secure and convenient way to access these resources is paramount. This is where SSO Single Sign-On comes into play. SSO Single Sign-On is a powerful authentication method that allows users to securely sign in to multiple applications and platforms using just one set of credentials. In this article, we will explore the benefits of SSO Single Sign-On, its implementation, and how it enhances security while streamlining the user experience.

Understanding SSO Single Sign-On

What is SSO Single Sign-On? SSO Single Sign-On is an authentication process that enables users to access multiple applications and platforms using a single set of login credentials. With SSO Single Sign-On, users only need to remember one username and password, eliminating the hassle of managing multiple credentials for different services. This not only saves time but also enhances convenience for users.

How does SSO Single Sign-On work? SSO Single Sign-On works by establishing a trust relationship between an identity provider (IdP) and the various service providers (SPs). When a user attempts to access a service, the IdP verifies the user’s identity and provides a token to the SP, which grants the user access without requiring additional authentication. This seamless process simplifies the login experience and eliminates the need for users to repeatedly enter their credentials.

Benefits of SSO Single Sign-On

Enhanced Security: One of the key advantages of SSO Single Sign-On is its ability to enhance security. By consolidating login credentials into a single set, users are less likely to resort to weak passwords or reuse passwords across multiple platforms. This reduces the risk of password-related security breaches. Additionally, SSO Single Sign-On allows for stronger authentication methods, such as two-factor authentication, further bolstering security without requiring multiple accounts.

Streamlined User Experience: With SSO Single Sign-On, users no longer have to remember and enter multiple sets of login credentials. This significantly reduces the login friction and streamlines the user experience. Users can seamlessly navigate between different applications and platforms without the need for repetitive logins. This convenience not only saves time but also improves productivity.

Centralized Access Management: SSO Single Sign-On provides organizations with centralized access management capabilities. Administrators can easily control user access to various applications and platforms from a centralized dashboard. This simplifies user provisioning and deprovisioning, ensuring that employees have timely access to the resources they need while maintaining security and compliance.

Cost and Time Savings: Implementing SSO Single Sign-On can lead to cost and time savings for organizations. By reducing the number of password-related support requests, IT teams can focus on more strategic initiatives. Additionally, the streamlined login experience reduces the time spent by employees on authentication, leading to increased productivity and efficiency.

Implementing SSO Single Sign-On

To implement SSO Single Sign-On, organizations need to follow a few key steps:

Evaluate SSO Solutions: Begin by evaluating various SSO solutions available in the market. Consider factors such as compatibility with existing systems, scalability, security features, and ease of integration.
Choose an Identity Provider: Select an identity provider that aligns with your organization’s requirements. The identity provider will be responsible for authenticating users and issuing tokens for accessing service providers. Office 365 and Google Workspace are usually the best, most prolific IdP sources to use.
Configure Service Providers: Configure the service providers that you want to integrate with SSO Single Sign-On. This involves establishing trust relationships between the identity provider and the service providers.
User Provisioning and Deprovisioning: Implement a user provisioning and deprovisioning process to ensure that users have the necessary access to the applications and platforms they require. This process should be integrated with the SSO Single Sign-On solution to maintain centralized access management.
Test and Monitor: Thoroughly test the SSO Single Sign-On implementation to ensure its functionality and security. Regularly monitor the system to identify and address any potential issues or vulnerabilities.

Best Practices for SSO Single Sign-On Implementation

When implementing SSO Single Sign-On, it is essential to follow best practices to maximize security and usability:

Strong Authentication: Implement strong authentication methods such as two-factor authentication or biometric authentication to enhance security.
Regular Auditing: Conduct regular audits of user access rights and permissions to ensure compliance and detect any unauthorized access.
User Education: Educate users about the benefits of SSO Single Sign-On and best practices for password management to promote secure behavior.
Continuous Monitoring: Implement a robust monitoring system to detect and respond to any suspicious activities or potential security threats.
Regular Updates: Keep the SSO Single Sign-On solution and all integrated applications up to date with the latest security patches and updates.

Remember, security should never be compromised, and SSO Single Sign-On provides a robust solution to protect user identities and streamline access to applications and platforms. Embrace the power of SSO Single Sign-On and enjoy the benefits of enhanced security and convenience.

Adobe Acrobat Tips

Businesses are increasingly reliant on digital documents. From contracts to invoices, these important files need to be easily shared and accessible across different platforms and devices. This is where Adobe Acrobat comes in. Adobe Acrobat is a powerful tool that allows you to create, edit, and secure PDFs effectively. To help you make the most of this software, we have compiled a list of useful tips:

Create Interactive Forms

One of the key features of Adobe Acrobat is its ability to create interactive forms. Rather than wasting paper on printing out forms and having people fill them out manually, you can create digital forms that can be filled out electronically. This not only saves time and the planet but also reduces errors and allows you to collect data more efficiently.

Edit PDFs on the Go

With the Adobe Acrobat app, you can edit PDFs directly on your mobile device. This is incredibly useful for business owners who are constantly on the go and need to make quick edits to their documents. Whether it’s adding text, resizing images, or rearranging pages, you can do it all from the convenience of your phone or tablet.

Combine Multiple Files into a Single PDF

If you have multiple files that you want to combine into a single PDF, Adobe Acrobat makes it easy. You can simply drag and drop the files into Acrobat, rearrange them, and save them as a single PDF. This feature is ideal for business owners who often need to merge multiple documents into one proposal, contract, or report.

Protect your PDFs with Encryption

Security needs to be a top priority for businesses, especially when it comes to sensitive documents. Adobe Acrobat allows you to protect your PDFs by adding encryption. You can set passwords and permissions to ensure that only authorized individuals can access, print, or modify your files. This level of security is crucial for protecting confidential business and customer information.

Optimize PDFs for Web Viewing

PDFs can easily become large files, which can slow down loading times when viewing them online. Adobe Acrobat offers a feature called “Optimize for Web” that reduces the file size while preserving the document’s quality. This is particularly useful when sharing PDFs on your website or via email. When customers have to wait for things to load they are more likely to go somewhere else for what they are looking for.

Collaborate and Review Documents

Adobe Acrobat has collaboration features that allow multiple users to work on the same PDF simultaneously. You can easily share documents with colleagues, clients, or partners and track changes made by each. This streamlines the review and approval process, reducing the need for endless email threads and ensuring everyone is on the same page.

Automate Workflows with Adobe Sign

Adobe Sign, a component of Adobe Acrobat, enables you to send, sign, and track important documents online. It eliminates the need for paper-based signatures and accelerates the approval process. With Adobe Sign, you can automate workflows, whether it’s obtaining client signatures, approving contracts, or completing employee onboarding documents. This tool can streamline your business processes and save you a significant amount of time.

By familiarizing yourself with Adobe Acrobat, you can harness the full potential of this software and enhance your business’s productivity and efficiency. As an Adobe partner, Farmhouse Networking can help your company get the most out of its PDFs.

Zero Trust – Endpoint Security

This is the sixth in a series about the concept of Zero Trust, which means in the IT sense that you trust nothing and always verify everything surrounding and connected to your network. Today’s discussion will be on endpoint security.

Endpoint Security

Endpoint security is a fancy term used to describe how the computers on the network are protected. This used to be done by antivirus but due to the complexity of the attacks hackers are using to compromise networks these days, the definition has expanded greatly. This now includes things like Enhanced Detection & Response software, Security Operations Centers, DNS Filtering, employee train and more. Here are some questions that you should be asking yourself:

Are your endpoints protected by antivirus or enhanced detection & response?
Is website traffic being monitored? Restricted?
Are your employees being trained in cyber security?
Are computer logs being monitored for malicious activity?
Would unusual or suspicious activity on a computer be noticed? Alerted on?
Do you have security permissions set on all file shares?
Do you have least privileged access configured on those shares?
Do you keep track of what software is installed on all workstations?
Do you block access to unauthorized software?
Are files encrypted on servers and workstations?
Are your mobile devices managed? Can you wipe them remotely?
Are USB ports blocking removeable storage devices?
Are endpoints set to automatically log-out?

If your company is going to use full disk encryption or has compliance requirements that you need consulting for, then contact us for assistance.

Can Passwords Be Strong & Easy To Remember

The COVID-19 scare and ensuing rush to remote access has us thinking security. What is more basic to security than passwords. In an effort to find a way to make passwords both secure and easy to remember, I have found a website that seems to fit the bill:

https://xkpasswd.net/

A Secure Memorable Password Generator

The concept is surprisingly simple and is said to be based on a cartoon:

XKCD - Password Strength

I have played with the settings and found the following to generate some good password settings. Here they are for those who are interested:

The only other option would be to use random passwords stored in a password keeper. This also allows secure sharing of passwords throughout the organization.

If your company is using remote access, then contact us for assistance to make it secure.

Where do you keep your passwords?

Farmhouse Networking has had a long standing policy that we do not keep a record of client passwords (except when needed for device administration). That is about to change, but before we talk about our new password policy let’s talk password storage:

Common Password Storage

Here are some popular places where many businesses store their passwords that make them very vulnerable to being stolen.

Passwords written on paper (that are not under lock and key):

On your desk under your keyboard (or taped underneath)
Under your stapler or desk decorations
On sticky notes stuck to your monitor or desk
On a scrap of paper on your desk or in a drawer
In a notebook or address book
In a old-fashioned Rolodex file
Paper printouts or photocopies of your passwords

Anyone with access to your office could easily find and steal passwords stored like this.

Passwords stored in your computer (without using encryption):

Remembered in your web browser
A document called “Passwords” that you’ve created anywhere on your computer, perhaps using Microsoft Word or Excel
A document with any other name on your computer (including the password as the name)
Email drafts that you’ve created (but not sent) containing password information

Anyone with access to your computer could easily find and steal passwords stored like this, including both a person with physical access to it as well as a virus or hacker gaining access via the internet, or scamming you into granting them access, even once.

Passwords stored in your smartphone or tablet (without using encryption):

Electronic “Notes” containing password information
Other documents or emails similar to the ones listed in computer storage above

Anyone with access to your device could easily find and steal passwords stored like this.

Passwords sent via regular (insecure) email:

Emails that you have sent to yourself containing password information
Emails that you have sent to anyone else containing password information

Any information that you send using regular (unencrypted) email puts that information at risk of being stolen. Email is neither private nor secure. Sending an email is like mailing a postcard, and hackers and thieves can easily read the contents. You should never send passwords (or any other confidential or sensitive data) via regular email.

Secure Password Storage

Now for the discussion of Farmhouse Networking’s new password policy. We are partnering with a company to provide a storage of passwords and other client documentation with military grade encryption. This partnership also allows us to address the dangers that common password storage present by offering our clients this same encrypted password storage service. Here are some of the benefits of this service:

Unlimited users
Unlimited passwords
Each user has a personal password vault
Shared company password vault
Security groups to manage access
Auditing & reporting (Compliance)
Secure password sharing
1-Click Login Tool (for all major browsers)
Mobile Device Access
Only $15 per month (Compared to Lastpass Business at $4 per user per month)

If your company is using common password storage of any kind do yourself a security favor and contact us to upgrade to secure password storage.

Wireless Security Upgrade

Strange to think that the current wireless security protocol has been in use for over a decade, but with the release of WPA3 certification today the Wi-Fi Alliance has made some serious strides towards a more secure wireless security standard.

Security Improvements

Offline Password Guessing – Attackers will now only get one guess per offline packet instead of unlimited. This will force them to interact with the wireless device directly which will make their attacks easier to detect and easier to shut them out.

Forward Secrecy – Even if the attacker is able to record a data stream and crack the current password, they will not be able to read the recorded data – only new data flowing over the network.

192-bit Encryption: – Enterprise users and tech savvy small businesses will be able to take advantage of deeper encryption for more secure connections

Wi-Fi Easy Connect – Simple to use, secure way for home users to connect their devices by scanning a QR code instead of entering a complex password.

This new security protocol mixed with the latest 802.11ax (that could bring 10 Gigabit speeds to wireless) will make 2019 a banner year for wireless technology.
If your company is interested better wireless security or faster wireless speeds, then contact us for assistance.

Information Security while Traveling

The SANS Institute has been putting out the OUCH! newsletter for some time now in a project called Securing the Human. In the most recent Issue, they discuss some best practices and practical advice for traveling. Here are some highlights:

Minimize Possible Losses

Here are a few tips to protect information from the hazards of traveling and possible theft:

Remove any data that is not needed on the device
Use full disk encryption & strong passwords
Perform a complete backup before leaving
Install tracking software on the device
Update OSes and Antivirus

Lost/Stolen Devices

Although crime is more of a factor in some third world nations or those in active conflict, the human element of losing the device is 100x more likely. Keep inventory of your devices before, during and after transporting from one location to another. Do not leave your device in the hotel room, have the hotel front desk put it in their safe or locked administrative offices.

Public WiFi

If you have to connect to the internet in public spaces and/or cannot afford mobile data on your trip, then make sure to do the following:

Never use public computers for sensitive information, especially banking sites
When on public wifi, only surf to sites with HTTPS:// secure connections
Consider connecting to a VPN service to further encrypt communications

If your company is requires traveling or you are planning to remotely work while on vacation, then contact us for assistance. We would be happy to walk you through the full disk encryption process, update / secure your devices and configure a company VPN service to connect to on the go.

Oregon Cyber Task Force – Cyber Attack Mitigation

During a recent briefing from the FBI’s Oregon Cyber Task Force in Medford, OR they detailed best practices and industry standards for cyber attack mitigation. FBI special agents started with information and statistics about the most recent threats giving specifics of how the attacks were executed. Security Architect from the State of Oregon then outlined the specifics of how to mitigate these threats properly. Here is a summation:

Current Threat Landscape

Business Email Compromise (CEO Fraud): Involves cyber criminals posing as business executives at companies that regularly perform wire transfers. After compromising the executive’s email, the criminal requests employees to perform wire transfers to the criminal’s bank account. FBI Internet Crime Complaint Center (IC3) has reported over $3 billion of losses worldwide due to this threat.

Ransomware: Ransomware is a form of malware that targets weaknesses in networks to deny the availability of critical data by encrypting it and demanding a ransom for the encryption keys to decrypt the data. Ransomware is frequently delivered through spear phishing emails to end users.

Point of Sale (PoS) Malware: Cyber criminal steals payment card data by remotely infecting PoS systems with malware without the need to physically access the cards or the devices used to process them. This allows criminals to compromise PoS systems on a large scale with larger victim base.

Insider Threat: An insider is a current or former employee who has access to an organization’s network and intentionally misuses that access to negatively affect the company. IC3 has recorded business losses from insider threat to be between $5,000 to $3 million.

Internet Extortion: Victims are threatened by cyber criminal with Distributed Denial of Service (DDoS) attack that will make access to their e-commerce site severely degraded or impossible if they victim does not pay to appease them. These can be real or fake with price tags in the neighborhood of 50 bitcoin or about $30,000.

Cyber Attack Mitigation

Here is a list of items that will need to be addressed to comprise a complete mitigation plan:

Create company policy in regards to how wire transfers are handled that require verbal or in-person authorization from multiple company executives
Create company policy restricting details that can be shared about job duties and company hierarchy on social media
Review National Institute of Standards and Technology (NIST) Cybersecurity Framework and adopt risk management processes
Create, implement and keep up-to-date an incident response plan
Create company policy and implement lawful network monitoring
Have proactive relationships with law enforcement agencies – silence is letting cyber criminals win

Practical Security Best Practices

Network Segmentation – keep the guest wireless separate from the local network, keep payment processing in its own network and keep web servers in the Demilitarized Zone (DMZ) of the network.
Use firewall access rules, Active Directory Group Policy and physical security measures to limit unsecure access to every segment of your network.
Restrict usage of administrator level access by creating alternative accounts for these purposes that are not used for local login. Keep these accounts monitored.
Implement automated patching and managed virus scanning on all systems. Remove any unsupported / non-updateable software or sytems on the network.
Restrict remote access to the network to specific users and use only secure protocols like RDP through VPN
Conduct periodic testing of all security measures to identify weakness or failing procedures and adjust systems accordingly

Advanced Mitigation Processes

Use multi-factor authentication wherever possible
Establish baseline of applications used then implement application whitelisting
Standardize encryption for data both at-rest and in-transit
Conduct perimeter filtering via Intrusion Detection System (IDS)
Regularly backup system logs in a segregated portion of the network to prevent tampering

If your company is going to use full disk encryption or has compliance requirements that you need consulting for, then contact us for assistance.

Full Disk Encryption – Bitlocker vs. TrueCrypt

Recently had a financial planning firm contact me with their new compliance regulations which included full disk encryption on all workstations that accessed client data and on all thumb drives used. This led me on a search to find the best solution for their systems which boiled down to essentially two solutions – Bitlocker or TrueCrypt / VeraCrypt.

Full Disk Encryption w/ Bitlocker

This feature is built into the professional versions of Windows OS from version 7 and beyond. It is simple to use and can be implemented from the Properties on local drives. It works with the modern GUID partition table (GPT) and Unified Extensible Firmware Interface (UEFI) as well as the older MBR / BIOS model. It works best with a Trusted Platform Module chip but can also be setup to use an external USB device as the encryption key repository. There is also a “Bitlocker To Go” setup for thumb drives that will work easily on other Windows based devices.

Full Disk Encryption w/ TrueCrypt

TrueCrypt, and the more recent “fork” of the software VeraCrypt, are based on the same open source code and are compatible with all recent versions of Windows OS. These software packages are not for the faint of heart as they require following detailed instructions on their usage through a multi-stage process to perform the drive encryption. My testing has revealed that they do not work well with modern GPT or UEFI and instead the Master Boot Record (MBR) and Basic Input/Output System (BIOS) systems would have to have been implemented from the initial setup of the workstation to function properly. There is currently no support for TPM, so remember your password or else say goodbye to your data. There is the ability to create a portable drive via these software packages, but the process is not something an end-user could easily do themselves.

Based on the limitations of TrueCrypt and the steep learning curve. It will be my recommendation to use the more simple and up-to-date Bitlocker technology to protect their firm – even if the encryption algorithms available in the other software provide deeper security. If your company is going to use full disk encryption or has compliance requirements that you need consulting for, then contact us for assistance.

“Recent” Asante Employee Breach & Yahoo Hack

Very weird occurrence the other day, checked the post office box and found a letter regarding my son’s protected health information (PHI) had been improperly accessed in an Asante employee breach that started in 2014. Shortly there after upon returning home, found an email from Yahoo stating that they had been hacked back in 2014 and had just now finished their investigation which could have effected my wife’s personal email. Seems a strange coincidence that both firms had this happen two years ago and it took both firms two years to notice / do the investigation piece to rectify the situation. Here are some quotes from their responses:

Asante Employee Breach

“While Asante cannot provide details regarding the outcome of this internal investigation, we can assure you that we applied our employment policies and processes appropriately. A final audit of the employee’s actions showed that the employee inappropriately accessed records from August 18, 2014 to July 21, 2016 that may have included your child’s name, date of birth, medical records number, medications, diagnosis, and lab results… To date, we have no evidence that any patient information has been misused, nor do we have any reason to believe that the information will be misused. However, as a precaution, we wanted to notify you regarding this incident and assure you that we take it very seriously.”

Yahoo Hack

“A copy of certain user account information was stolen from our systems in late 2014 by what we believe is a state-sponsored actor… The stolen user account information may have included names, email addresses, telephone numbers, dates of birth, hashed passwords (the vast majority with bcrypt) and, in some cases, encrypted or unencrypted security questions and answers.”

So these two things were not related but it is scary to think that it took two years to notice this activity. Even if Asante believes that the employee didn’t do anything malicious with the information, it shows that their information access policies and audit logging on them is severely lacking. They need to step up their game and possibly adopt some behavioral based analysis of the audit logs for inappropriate access like this in the future.

As for Yahoo, why are some of the security questions unencrypted while others were and were the passwords just hashed? If a state-sponsored actor had unsalted password hashes for two years before being detected then the likelihood of them being able to crack the passwords is extremely high. They also state that they are working closely with law enforcement on this one, but what is law enforcement going to do against another government’s hacking crew (aka state-sponsored actor)?

If your company is unsure of its information security posture or needs an evaluation of audit logging / reporting, then contact us for assistance.

Category: Encryption

Understanding SSO Single Sign-On

Benefits of SSO Single Sign-On

Implementing SSO Single Sign-On

Best Practices for SSO Single Sign-On Implementation

Create Interactive Forms

Edit PDFs on the Go

Combine Multiple Files into a Single PDF

Protect your PDFs with Encryption

Optimize PDFs for Web Viewing

Collaborate and Review Documents

Automate Workflows with Adobe Sign

Endpoint Security

A Secure Memorable Password Generator

Common Password Storage

Secure Password Storage

Security Improvements

Minimize Possible Losses

Lost/Stolen Devices

Public WiFi

Current Threat Landscape

Cyber Attack Mitigation

Practical Security Best Practices

Advanced Mitigation Processes

Full Disk Encryption w/ Bitlocker

Full Disk Encryption w/ TrueCrypt

Asante Employee Breach

Yahoo Hack

Recent Posts

Archives

Categories

Evaluation Signup