Loading ...

Category: Disaster Preparedness

Small Business Information Security: The Fundamentals

CyberSecurity

NIST is the National Institute of Standards and Technology. It acts as the defacto baseline that all other security and compliance organizations use to construct their standards. Reading their publications is like reading any other government document – extremely long and not interesting. Farmhouse Networking recently became aware of one such document called NISTIR 7621 aka Small Business Information Security: The Fundamentals. We took the time to distill out the main points here:

The Fundamentals aka Best Practices

Identify: Who has access to the network, who has access to the data, and what do they have access to. This includes background checking employees during the hiring process, taking an inventory of data to see who needs access to what, requiring that each user have their own login, and company policy creation.

Protect: Protection starts with separating data into shares then giving access only to those who really need it. It also includes protecting hardware with uninterruptible power supplies (UPS) and protecting software with regular updates. Protecting the network includes setting up a proper firewall, separate wireless for guest access, and VPN only access for remote users. Web filtering, SPAM filtering, file encryption, proper disposal of old equipment, and employee training are also mentioned.

Detect: Having a centrally managed antivirus software on each workstation is a must. This includes the ability to look back in time via log files or monitoring system to find the root of the security breach.

Respond: Have a disaster recovery plan and security incident response plan in place.

Recover: Need full backups of all important business data, invest in cyber insurance, and regularly access your technology to find timely improvements.

If your company does not meet these fundamentals, then contact us for assistance.

Anatomy of a Breach

Read an amazing article published by Microsoft detailing the roadmap a hacker uses to breach a computer network. You can read the full article here:

https://cloud-platform-assets.azurewebsites.net/anatomy-of-a-breach/

Summary of a Breach

Phase 1: Break-In: Hackers are still using phishing emails, bad passwords, social media links, and poorly patched systems to make their way in with the initial infection. Employee training is the first step towards preventing breaches for 9 out of 10 companies now (and it is included in the price for all our monthly clients).

Phase 2: The Inside Man: Once inside the hacker will scan the network for further vulnerable systems, employees with more access rights than they need, and systems that allow access into other parts of the network. Having systems in place that detect strange or malicious activity are key to stopping an infection in its tracks.

Phase 3: Spread Out: This is where the hacker has all the access they need and start to find the data that is worth selling. Hackers will usually start moving data to places it doesn’t belong on the network then downloading it to their computers for resell. This is where strong access policies that are clearly defined and enforced make the greatest impact to protect sensitive data. 

Phase 4: The Long Con: Once a hacker has taken all they need for the short term payout, they will setup remote access back doors to allow for future access whenever they want to. It almost pays to assume that a breach has already occurred and continually scan the network for these kinds of activity to catch the hackers in the act.

Take the time to read this article, it is a wake-up call on security.

If you would like to learn more about creating an effective cyber defense strategy and mitigating risk, then contact us for assistance.

Disaster Recovery for Your Phone System

Phone System Disaster Recovery - Grants Pass, OR

What happens to your phones when the power goes out, the internet is down, or the old copper lines are down from a natural disaster? Are your customers going to get a busy signal? How quickly will they call the competition?

Phone System Backup Plan

With a standard phone service there would be nothing to prevent the busy signal from happening. With phone service from Farmhouse Networking all calls have the ability to be automatically forwarded and routed to virtually any person, device, or location. Plus our platform includes connectivity to multiple carriers for redundancy purposes, so no single carrier issue will impact your business.

Disasters might not be under our control, but business can continue to happen even when they occur.

If your company is concerned about losing calls or looking to add the protection a cloud phone system provides, then contact us for assistance.

Is the power out again?

Power Outage - Grants Pass, OR

It seems lately that the power company in the area has not been able to offer consistent service power to the city. This has left many businesses down without the technology they need to operate properly. These power outages cause data loss and damage computer components.

My own unexpected outage

Once upon a time, about two weeks ago, the unexpected happened at our offices. A semi-truck carrying a large backhoe on a trailer drove between two buildings in the area. The landlord had wired power between buildings and the truck driver did not lower the arm of the backhoe low enough. Sure enough the wire was snagged by the backhoe’s arm and pulled from the building. Needless to say the power was out to that part of the building until the landlord took care of the matter.

What can be done?

Farmhouse Networking recommends that all business workstations, servers, and networking equipment be protected by an uninterruptible power source aka UPS or battery backup. When the power goes out the right size battery backup will keeps things running for about 15-30 minutes to allow the last touches to be added to whatever was being worked on and things to be shutdown gracefully.

If your company is looking to better protect itself against power outages, then contact us for assistance.

 

Your Data is Already at Risk. Protect it Today!

computer virus

Did you know that malware accounts for 20% of all security incidents?

And that’s just one threat! Your data, no matter how proactive you are from a security standpoint, is constantly vulnerable to a multitude of security threats, the list of which is constantly growing. From ransomware, worms and phishing attacks to human error, your data needs to have a multi-layer defense in place to not only prevent downtime but recover quickly in the event that disaster strikes.

The following are just a few staggering facts about just how vulnerable our systems are to attacks and outages:

• According to Microsoft, the potential cost of cyber-crime to the global community is a $500 billion, and a data breach will cost the average company about $3.8 million!1
• A whopping 1 in 131 emails contain malware2
• 230,000 new malware samples are produced every day, and that number is projected to continue growing3
• It will take the average business about 197 days to detect a breach on their network4

If your company is looking to better protect its data, then contact us for assistance.

How Much to Budget for IT Spending

Phone Bill Savings - Grants Pass, OR

 

As we talked with our clients during our bi-annual meetings, the question again came to mind – How much should a small business budget for IT spend?

Questions to Ask

How will IT change competition in our industry?

In today’s marketplace keeping an edge above the competition can make or break the future of your business. If local customers are looking for a feature or product that you cannot provide they will look online and find it.

What will it take to exceed our customers’ expectations in a digital world?

With a broad landscape of choices available to them, what will make local businesses shine is deep customer engagement. Customer relationship management, targetted automated contact, and the consistently good products and services that technology can help provide to make this possible.

How will IT improve our operations?

Every industry now has specific software to manage the flow of business to provide repeatable and trackable results. The addition of industry-specific hardware takes the guesswork out how things get done right.

Who is accountable for IT?

Are you paying an employee or worse a manager to spend time fixing IT problems? It is always best to hire someone who is better than they are at these kinds of tasks so that they can be freed up to do what you hired them for. There are also limits to everyone’s knowledge in an alternate field, so having a next level IT provider will save headaches and downtime.

Are we comfortable with our level of IT risk?

Risks include cybercrime, downtime, employee theft, and many other possibilities. Having an IT provider with an eye for security can mitigate these risks and help eliminate the others that you never knew existed.

Boiling IT Down

According to the online studies that are out there small to medium businesses should be looking to spend around 4.1% and up to 6.9% for the smallest companies. That number has been growing about 8% year over year for the past few years. However, regardless of amount of spending, if technology investments aren’t made and used wisely, it will be reflected in that company’s returns and productivity.

Farmhouse Networking provides a free network evaluation that includes a full inventory of technology assets and 5-year technology budget.

Is this really SPAM?

Thought that I would share a recently received new SPAM email variant that could easily be overlooked and possibly be a scammer looking to take your money. This one is strange to me and I wanted to share my insites.

Starting from the Top

Look closely at the From portion of the email:

This email is from a legitimate email marketing firm called AWeber. The SPAMMER is actually using a website designed to help bypass SPAM filtering to deliver mail. There is also the fact that the email is form someone that I don’t do business with. Always fight the urge to look at things that are not yours.

Stick to the Subject

Now to take a look at the Subject line of the email:

The email marketing firm this SPAM is sent from is required that you confirm someone who is joining your email campaign. Guess I would have to agree to be scammed by this person.

And now the rest…

The final thing that caught my eye was the title of the email campaign in the email:

The enticing title “Clickbank – 30k project” sounded interesting. By clicking on the button I would confirm my existence as a real person and would likely kick off a communication from someone who is likely an “African Prince” with a money making opportunity. Hope this little tutorial helps you detect other phishing attempts in the future.

If your company is having trouble with SPAM or phishing, then contact us for assistance.

Is the internet down again?

broken internet - Grants Pass, OR

If it seems like this is a typical question in your office then there is hope. The concept of internet failover has been around for years. With the advent of 4G LTE cellular networks internet failover is now within reach of the small business. If the main internet connection goes down then the 4G LTE cellular network will kick in automatically to keep your business flowing. When the main internet connection comes back online it will automatically switch back to restore full speed access.

How We Fix the Internet

Business Class Router: The Datto Networking Appliance has all the specs of true business class router including all the usual services (DHCP, DNS, VLAN, DMZ, Access Rules, etc). It also has all the features that you need to secure and expand your business with seven layer deep packet inspection, intrusion detection, traffic shaping (VoIP), client VPN, site-to-site VPN, and cloud management.

Connectivity: This router has all the connectivity you could ever need. It has 4 Gigabit LAN ports to help physically segment the network. It has the latest and most redundant wireless connectivity available. It has a fully integrated multi-band 4G LTE wireless cellular modem to keep you connected when wired internet fails.

Peace of Mind: Leave the connectivity worries to us. Our expert team will be monitoring and maintaining the Datto Networking Appliance at all times via the cloud management console and integrated alerting. We will know the internet is down before you do and will take the steps needed to get your ISP to fix things.

If your company’s internet is constantly going down, then contact us for assistance.

Got everything backed up? You sure?

SaaS Protection - Grants Pass, ORAs companies increasingly move data into cloud-based applications, many administrators think traditional best practices such as data backup are outdated. After all, a Software-as-a-Service (SaaS) application is always available, accessible from anywhere, and highly redundant, so why is backup necessary?

1 in 3 companies report losing data stored in cloud-based applications. That means the permanent deletion of potentially hundreds of work hours.

The truth is that even data in cloud-based applications are vulnerable to:

  • Malware damage or ransomware attacks
  • Accidental end-user deletion
  • Malicious end-user activity
  • Operational errors such as accidental data overwrites
  • Lost data due to canceled user account subscriptions
  • Misconfigured application workflows

Datto SaaS Protection won’t let your critical data slip through the cracks. Engineered to be the leading, one stop shop for cloud-to-cloud SaaS application backup, SaaS Protection gives you consistently reliable granular backups, quick and easy restores and exports, secured data for compliance and regulatory needs, and world-class 24/7/365 support.

SaaS Protection Supports the Following Applications:

G-Suite – Protect emails, documents, calendars, sites, and contacts in Google’s G Suite.

There’s no such thing as too safe. Datto SaaS Protection goes above and beyond industry standards to make sure G-Suite data is secure, easily recoverable, and protected:

  • Automatic 3X daily backups of Google Mail, Drive, Calendar, Contacts, and Sites data
  • SOC2 Type II audited
  • Supports HIPAA compliance needs
  • Data encryption both in transit and at rest in the Datto Cloud
  • Advanced internal controls
  • Data controls and monitoring, including audit logs, uptime and availability SLAs, and export capabilities
  • Regular vulnerability management and testing

SaaS Protection saves you and your team time and stress with search filters that quickly locate backed up files and folders.. even if users can’t remember what they called them.

  • Easily track deleted items
  • Locate and browse any previous versions of documents
  • Lighten the help desk load: SaaS Protection lets users access their own backups

Office 365 – Protect Exchange Online, SharePoint Online, OneDrive, Contacts, and Calendars in Office 365.

There’s no such thing as too safe. Datto SaaS Protection goes above and beyond industry standards to make sure Office 365 data is secure, easily recoverable, and protected.

  • Microsoft Exchange, OneDrive, SharePoint, Calendar and Contacts are automatically backed up 3X a day
  • SOC 2 Type II audited
  • Supports HIPAA compliance needs
  • Data encryption both at rest and in transit
  • Data controls and monitoring tools, including audit logs, uptime and availability SLAs, and export capabilities

SaaS Protection saves your team time and stress with robust search filters that make it easy to quickly locate backed up files and folders.

  • Manage backups, view restores, and monitor activity across all of your customers from an easy-to-use dashboard
  • Zero in on emails, contacts, individual files and entire folders with our search function
  • Restore files directly to a user’s account or download them directly

If your company is G-Suite or Office 365 and want a complete disaster recovery solution, then contact us for assistance.

New Phishing Email Variant

Thought that I would share a recently received new phishing email variant that could easily be overlooked and possibly cause damage to your network. The email appears to have come from Dropbox as a user sharing a folder with me, but a closer look shows many obvious signs that the email is a fake.

Starting from the Top

Look closely at the From portion of the email:

The lettering is actually another language where the font makes it look like English lettering. There is also the fact that the email is form someone that I don’t do business with. Always fight the urge to look at things that are not yours.

Stick to the Subject

Now to take a look at the Subject line of the email:

This has different lettering but it is again a different language used to look like English lettering.

And now the rest…

The final thing that caught my eye was the “button” in the middle of the email:

It actually looked fuzzy. It turns out the entire body of the email is a single image that is a link to their malicious site. Clicking anywhere in the body of the email would send you on your way to infection or account compromise. Hope this little tutorial helps you detect other phishing attempts in the future.

If your company is having trouble with SPAM or phishing, then contact us for assistance.

Categories

Plant a Seed 541-761-9549
233 Rogue River Hwy #873 Grants Pass, OR 97527
Mon-Fri: 9:00am-5:00pm
support@farmhousenetworking.com
© 2016-2018 - Farmhouse Networking. All rights reserved
Terms and Conditions Privacy Policy

Evaluation Signup

Something went wrong, try refreshing and submitting the form again.