Loading ...

Category: DNS Filtering

How to Safeguard Your Mobile Workforce with Zero Trust Security

Remote work and mobile devices have become the norm, so ensuring the security of your workforce and sensitive data is paramount. Traditional security measures based on perimeter defense are no longer sufficient to protect against the sophisticated cyber threats that target mobile devices and exploit vulnerabilities in the network. This is where the concept of zero trust comes into play. Zero trust is a security framework that challenges the notion of “trust but verify” and instead adopts a “never trust, always verify” approach. By implementing a zero trust model, organizations can establish a security infrastructure that provides continuous authentication, authorization, and monitoring to safeguard their mobile workforce and sensitive data.

Understanding the Concept of Zero Trust

The concept of zero trust is rooted in the recognition that a one-time authentication and authorization process is not enough to ensure security in today’s dynamic threat landscape. Changes in user behavior, location, and other factors should radically impact access decisions. Zero trust takes a proactive approach to security by enforcing minimal access to resources, requiring continuous security monitoring, risk-based access control, and real-time authentication and authorization based on up-to-date information. Unlike traditional security models that rely on perimeter defense and trust users and devices within the network, zero trust challenges the idea of inherent trust and verifies the authenticity and integrity of every user and device, regardless of their location or network connection.


The Evolution of Zero Trust

The concept of zero trust has evolved over time in response to the increasing risks and challenges posed by mobile devices and remote work. The rapid adoption of mobile devices and the proliferation of internet-connected devices have expanded the attack surface, making traditional perimeter-based security measures inadequate.


Key Security Technologies for Mobile Devices

To enhance the security of mobile devices and implement zero trust, organizations should leverage key security technologies designed specifically for the mobile environment. These technologies include:

Enterprise Mobility Management (EMM): EMM ensures that mobile devices have the necessary policies and configurations in place, including mobile device management for security settings and configurations, as well as remote user access policy implementation. EMM provides a foundation for enforcing security controls and managing mobile devices within the organization.

Mobile Application Vetting (MAV): MAV ensures that applications comply with enterprise policies and do not contain known exploitable vulnerabilities. By vetting applications, organizations can reduce the risk of malicious applications compromising the security of mobile devices and accessing sensitive data.

Mobile Application Management (MAM): MAM focuses on ensuring compliance in deployed applications. It enables organizations to enforce security policies and manage the lifecycle of mobile applications, including app distribution, updates, and revocation. MAM helps organizations maintain control over the applications used by their mobile workforce.

Mobile Threat Defense (MTD): MTD solutions detect and mitigate threats from suspicious user behavior, network activity, and malicious attacks. These solutions leverage advanced analytics and threat intelligence to identify and respond to potential security threats in real time, providing an additional layer of protection for mobile devices.

Secure Containers: Secure containers provide isolation techniques to prevent organizational and personal data from commingling. By creating separate containers for different types of data, organizations can ensure that sensitive information remains secure, even if the device itself is compromised.


The Role of Intelligent Authentication

Intelligent authentication, powered by advanced rule sets and artificial intelligence, can significantly enhance the security of mobile devices in a zero trust environment. By combining biometrics with user behavior analysis, intelligent authentication systems can provide adaptive authentication that adapts to each user interaction, ensuring precise security measures. Integration between EMM, mobile threat defense, and existing logging, monitoring, diagnostic, and mitigation systems further enhances security capabilities.


Developing a Mobile Zero Trust Strategy

Implementing zero trust in the mobile environment requires a tailored approach that aligns with an organization’s specific goals, risks, and infrastructure. Businesses should develop their strategies based on a comprehensive assessment of the risks they face, with granular policies to mitigate those risks. The granularity of continuous authentication should be carefully determined to strike the right balance between security and usability. It’s important to note that technology is only one part of the solution; organizations must also review their mobile use policies and ensure that processes and human factors align with zero trust principles

With an intelligent authentication approach and a tailored mobile zero trust strategy, organizations can safeguard their mobile workforce and data from advanced cyber threats. Farmhouse Networking can make this a reality for your organization. 

What every business has in common?

Every modern business has one thing in common – the internet.

Businesses are using computers, smart phones, tablets, etc. to connect to the internet for research, shopping, advertising, or any number of things. With a connection to the internet comes the need for routers, switches, wireless, and other network hardware to distribute internet connectivity across the company. There are malicious people on the internet that are setting traps and trying to break into companies which necessitate the use of tools like antivirus, internet filtering, spam filtering, and other protective measures. There are also people who work from their homes and need to have a way of tunneling safely into the network to use the resources there. 

All of this has to be managed by someone in the company or you can contract with a managed IT service provider. 

If your company needs help managing all the things connected to your internet, then contact us for assistance.

Zero Trust – Network Security

This is the ninth in a series about the concept of Zero Trust, which means in the IT sense that you trust nothing and always verify everything surrounding and connected to your network. Today’s discussion will be on Network Security. 

Network Security

Network Security is having the proper hardware and configuration of that hardware in place to protect the business network. This configuration includes segmenting network traffic to keep specific types of traffic, like guest devices, separate from traffic of business devices. It also includes keeping outsiders out of the network and detecting when they have breached security measures. Here are some questions to ask:

  • Do you have a business class router / firewall?
  • Do you have business class switches and access points that support segmentation?
  • Is your network configured to segment business traffic from guest traffic?
  • Are devices like VoIP phones and network cameras on their own network?
  • Is geo-location blocking turned on for non-essential countries?
  • Is network traffic being analyzed for suspicious activity?
  • Do you filter internet traffic?
  • Can your network detect and respond to a breach?

If your company is wanting to lock down network security, then contact us for assistance.

Zero Trust – Endpoint Security

Endpoint Security - Clackamas, OR

This is the sixth in a series about the concept of Zero Trust, which means in the IT sense that you trust nothing and always verify everything surrounding and connected to your network. Today’s discussion will be on endpoint security. 

Endpoint Security

Endpoint security is a fancy term used to describe how the computers on the network are protected. This used to be done by antivirus but due to the complexity of the attacks hackers are using to compromise networks these days, the definition has expanded greatly. This now includes things like Enhanced Detection & Response software, Security Operations Centers, DNS Filtering, employee train and more. Here are some questions that you should be asking yourself:

  • Are your endpoints protected by antivirus or enhanced detection & response?
  • Is website traffic being monitored? Restricted?
  • Are your employees being trained in cyber security?
  • Are computer logs being monitored for malicious activity?
  • Would unusual or suspicious activity on a computer be noticed? Alerted on?
  • Do you have security permissions set on all file shares?
  • Do you have least privileged access configured on those shares?
  • Do you keep track of what software is installed on all workstations?
  • Do you block access to unauthorized software?
  • Are files encrypted on servers and workstations?
  • Are your mobile devices managed? Can you wipe them remotely?
  • Are USB ports blocking removeable storage devices?
  • Are endpoints set to automatically log-out?

If your company is going to use full disk encryption or has compliance requirements that you need consulting for, then contact us for assistance.

How is Malware Delivered?

Malware

Read a recent study on the origins of malicious software aka malware. Here are the highlights:

Current Malware Statistics

29% – Malware is previously unknown to security vendors due to the continued efforts of malware creators to hide the software or make it undetectable.

88% – Malware is delivered to people’s inboxes and some of it bypassing normal SPAM filters.

8.8 Days – Time before regular antivirus vendors have discovered the malware and added it to their lists for detection.

$50 – The cost of a pre-fabricated malware kit that can be bought currently on the dark web.

“The most common type of malicious attachments were: documents (Word – 31%), archive files (ZIP & RAR – 28%), spreadsheets (Excel – 19%) and executable files (EXE – 17%).”

What can be done?

A multi-tiered approach to security remains the best solution:

  • Moving from traditional antivirus to Enhanced Detection & Response (EDR) software to go beyond lists of know infections to behavior tracking of software
  • Moving from traditional SPAM filters to Email Advanced Threat Protection which scans each email and opens each attachment to see if there is any malicious activity cause by them
  • Moving from traditional router to a business class firewall with Intrusion Prevention System to monitor traffic for suspicious activity
  • Employee training is also key to keep your staff aware of immerging trends and threats 


If your company is looking to enhance your network security posture, then contact us for assistance.

Local Church Hit By Ransomware

Got a call a couple weeks ago from a local church:

“we came in and open the computer and we have ransomware on there. We can’t even get to any of our stuff. It’s telling us to email somebody and so that they can free up the computer.”

How does this happen?

Generally these things happen because people click on things they shouldn’t. Whether in an attachment in email from someone they don’t recognize, a link in social media that sounds too good to pass up, or an advertisement for something they can’t live without. Once the user gives permission for something to open or run on their computer the game is over and the hacker wins.

What to do when it happen?

  • Stop using the computer.
  • Leave the computer alone! Do not carry out any further commands, including commands to Save data.
  • Do not close any of the computer’s windows or programs. Leave the computer alone.
  • Leave everything plugged in and do not turn off the computer or peripheral devices.
  • If possible, physically disconnect the computer from networks to which it is attached.
  • Call us immediately. Write down any unusual behavior of the computer (screen messages, unexpected disk access, unusual responses to commands) and the time when they were first noticed.
  • Write down any changes in hardware, software, or usage that preceded the malfunction.
  • Do not attempt to remove a suspected virus! Let the professionals do the dirty work.

How to prevent this from happening?

Layers of protection is the simple answer. A good antivirus installed to stop the bad programs from running, DNS filtering to keep users off of bad sites / advertisements, a good backup of all data to recover when this does happen, and most important of all EDUCATION – teaching users what safe internet usage looks like and having policies in effect to train them can mitigate 60-70% of infections. 

If your company is would like to discuss the layers of security you have in place, then contact us for assistance.

The biggest threat to your data security?

Computer Forensics - Grants Pass, OR

You and your employees, that’s who!

It’s an unfortunate reality but our workforce can often times be our worst enemies, often creating vulnerabilities and leaving our systems open to hackers, viruses, data breaches and data loss. More often than not, we do this through completely harmless, everyday activities like opening compromised emails and links.

As a leader in your organization it’s your role to monitor your team and arm them with the knowledge of good security practices. Without implementing a company-wide security training program, you leave your systems vulnerable to a host of attacks.

Another crucial step in preventing system attacks, is to configure a firewall to monitor user activity and website visits throughout your organization. An Acceptable Use Policy is helpful in establishing what your organization will and will not allow from its employees.

Curious how we can help you establish a more secure company infrastructure?

If your company is looking to better protect its data, then contact us for assistance.

ESET Antivirus Troubles

Eset Antivirus - Grants Pass, OR

Working with a webhost to tighten their security settings to get PCI compliant. In doing so we ended up breaking many of their clients email access by turning off SSLv3 and TLSv1.0. I was given the task of helping all the clients fix this issue (see seperate blog post for the fix). One in particular ended up not having issues beyond the normal problems with TLS and it turned out being ESET Antivirus. Here is the story:

Unable to Access Website:

The client first mentioned that they could not access a particular website that they needed to submit government paperwork. The error was related to the certificate being out of date. I checked the site on my own computer and it came up just fine, so looked at their certificate and it was current with plenty of time left before expiring. Cleared the cache and all the normal troubleshooting steps to no avail, so had to dig deeper. Remembered that some antivirus programs scan HTTPS traffic by putting their own certificate in place of the actual certificate from the site. Looked inside ESET Antivirus and found the culprit. Under Internet Protection > Web Access Protection I turned off the HTTPS Scanner. Restarted the browser and was able to surf to the site without issues.

Hidden Messages Stuck in Outlook Outbox:

The client then mentioned that some messages weren’t sending, so looked into it and found a couple messages that were 2MB+ which I told them were too large to send. We got rid of those but then messages were still stuck but were now hidden from view. I used the typical fix for read receipts that are hidden using the MFCMAPI tool but found nothing there. Tried removing the account and re-adding it to Outlook. After the clients 8,000+ emails downloaded via IMAP the same problem began occurring again. Remembering the issues with ESET Antivirus web filtering, I decided to take a look at that again. Under Internet Protection > Email client protection I turned off all the Email Clients, Email Protocols, and Antispam Protection. Restarted Outlook and the problem persisted. Had to remove the account and re-add it to Outlook. After the clients 8,000+ emails downloaded via IMAP the problem was fixed.

All that being said, these kinds of problems are another reason that I recommend Webroot to my clients for their antivirus protection. I prefer to have the Website filtering happen at the DNS level via a company like DNSFilter.com and the SPAM / Email filtering to happen via the email provider or an email protection service like Mailprotector.com.

If your company is interested in using a real layered approach to security not just putting a software band-aid on it, then contact us for assistance.

DNS Filtering for Security & Productivity

DNS filteringAny Human Resources department manager will attest to the need for an Acceptable Use Policy as part of the Employee Handbook. It should clearly state the proper use of business-owned workstations and what traffic is allowed on the company network. Monitoring this policy is next to impossible for small businesses, yet ignoring it leads to infections, security breaches, and huge losses to the bottom line by wasted employee productivity. How does a company stay safe from the big, bad Internet?

Policy Creation

This may sound boring, but before any monitoring and enforcement can take place legally, there must be a clearly defined policy in place with consequences for violations. This policy must be signed by each employee. Only when signed policies are in each employee’s file, can measures can be taken to monitor and enforce the new written policy.

No Administrator Access

There is no reason for the average employee to need Administrator access to a workstation once it is setup properly for business use. Most employees do not need to install any software or make any major setting changes without first consulting management and/or network support personnel. Software and operating system updates should also be handled by network support personnel or by an automated process. Installation of additional hardware should be cleared with management and implemented by network support personnel. Workstations are a company-owned tool to be used by the employee only for the best interests of the company, not for personal file storage or entertainment purposes.

DNS Filtering

The Internet is an invaluable tool for business purposes. There are, however, many threats out there, and the common user has no idea how to avoid them. There are also innumerable distractions ranging from time wasters to those that are downright illegal. DNS Filtering inspects every internet request against a database of known sites and blocks bad traffic before it goes anywhere on the internet. This keeps your internal network assets safe from malicious sites and content that is inappropriate for business or bad for productivity. This is accomplished without interrupting or slowing down the normal flow of good traffic around the Internet.

If your company is looking to add layers of security to your network or increase productivity by limiting Internet time wasters, then contact us for assistance.

Archives

Categories

Plant a Seed @ 541-761-9549
233 Rogue River Hwy #873 Grants Pass, OR 97527
Mon-Fri: 9:00am-5:00pm
support@farmhousenetworking.com
© 2016-2024- Farmhouse Networking. All rights reserved
Terms and Conditions Privacy Policy

Evaluation Signup

[contact-form-7 id="452" title="Free Network Evaluation"]
And God will generously provide all you need. Then you will always have everything you need and plenty left over to share with others. As the Scriptures say,
“They share freely and give generously to the poor. Their good deeds will be remembered forever.”
For God is the one who provides seed for the farmer and then bread to eat. In the same way, he will provide and increase your resources and then produce a great harvest of generosity in you. - 2 Corinthians 9:8-10