Category

threat detection

Apr 21
0
COVID-19 threat landscape

Managing the Increased COVID-19 Threat Landscape

By | threat detection | No Comments

The threat landscape of COVID-19 is perilous. thinkCSC put together these guidelines for clients and shared the information directly with them via email, but any organization will benefit from these resources and guidelines.

COVID-19 Specific Security Recommendations

This information from the FTC should be shared with your remote workforce to ensure the security of your network as well as theirs.

CISA also has several recommendations worth sharing:

Phishing Scams Abound

We expect an increased phishing threat used mostly to steal personally identifiable information. Here is some additional information on avoiding various phishing threats.

CISA offers several guidelines to increase awareness for social engineering and phishing attacks. You can also download the thinkCSC email security guide (PDF). Read and share our resources on email security and phishing.

Is Zoom Secure?

Zoom continues to be a threat to your infrastructures and data. As securing a product is a lengthy endeavor, thinkCSC would suggest switching to a more mature product with greater security built in. If that’s not possible, here are some tips to help make meetings more secure. Also, make sure to always update your Zoom product when asked.

  • Don’t publicly share your Zoom “Meeting ID.” Send it directly to the people you want on the call.
  • Set a password for the meeting, then share that only with the right people.
  • Make sure “screen sharing” is set to “Host Only.” That prevents other people on the call from abruptly blasting text or images onto the other participants’ screen — a favored tactic of “Zoombombing” trolls.
  • Use the “waiting room” feature. It prevents new participants from joining the call until the host approves.

General Security Posture

While phishing and similar attacks will be on the rise, overall systems security will also be tested with the increased COVID-19 threat landscape. Provided are links with additional information and as always you can contact your thinkCSC team for details.

CISA

  • Update VPNs, network infrastructure devices, and devices being used to remote into work environments with the latest software patches and security configurations.
  • Alert employees to an expected increase in phishing attempts.
  • Ensure IT security personnel are prepared to ramp up the following remote access cybersecurity tasks: log review, attack detection, and incident response and recovery.
  • Implement MFA (multiple forms of authentication in addition to username and password) on all VPN connections to increase security.

NSA (PDF)

  • Update and Upgrade Software
  • Defend Privileges and Accounts
  • Enforce Signed Software Execution Policies
  • Exercise a System Recovery Plan
  • Actively Manage Systems and Configurations
  • Continuously Hunt for Network Intrusions
  • Leverage Modern Hardware Security Features
  • Segment Networks and Deploy Application-Aware Defenses
  • Integrate Threat Reputation Services
  • Transition to Multi-Factor Authentication

Be sure to review thinkCSC’s information on teleworking safely and our latest security alert.

thinkCSC is ready to help ensure the continuity of your business. While we may have entered uncharted territory with regard to this pandemic and the increased COVID-19 threat landscape, thinkCSC continues to be at your service. Please get in touch if you need support for your remote workforce. If you have questions or concerns regarding your organization’s security, get in touch.

Dec 10
0
malicious attacks

Malicious Attacks Are on the Rise

By | threat detection | No Comments

There has been a measurable uptick in malicious cyber activity globally, and what’s most concerning is that more than half of organizations are reporting that they either have no plans to thwart an attack, have never tested their plans or do not feel their plans are capable of protecting them, or have not updated their plans in over a year. And malicious cyberattacks are coming from every direction.

Software Updates

It’s not just the big threats of Windows 7 end-of-support that put your IT infrastructure at risk – it’s patching in general. If your IT department is understaffed or nonexistent, patching is one of the things that often gets postponed. But it’s important to realize that those patches function much like locks on the back doors of your network.

Apps – Both IOS and Google

Both Google and Apple have a high success rate with app security, but they are not flawless. Recently, Google disabled seven apps that were found to have undetected malware embedded in them. If your employees use their personal devices to access your network, be sure you have strict policies in place for securing those devices. And check your own phone, too: delete unused apps, set apps to update automatically, and secure your phone with threat detection and biometric (fingerprint or face recognition) access.

Emotet and Other Banking Trojans

Emotet is a botnet – a malware that, once embedded in your system, can be used to take control of your computer system and use it for malicious attacks, or to email spam, or to capture financial data. All it takes is an employee clicking a link for this type of malware to infect your entire network.

Phishing and Social Engineering

Phishing remains one of the most prevalent threats to your organization’s security, and social engineering is just making it more successful. Hackers spend time learning about the employees in your organization, using social media and other public information, so that when they do send an email that asks for password information or payments, it seems legitimate. Training your employees is a good beginning – they need to have a heightened awareness – but you also need to assume that somewhere along the way, regardless of your efforts, someone is going to click on a link, download a file, or attempt to process a payment. You need to have layers of security and protocol in place to protect you and your business.

Malicious Attacks Will Get More Sophisticated

As we enter the next decade, the struggle to protect your data will only get more intense. Outsourcing your IT to reliable experts adds power to your proactive data protection strategy, helping you thwart malicious attacks in their tracks..

Choosing the right managed services provider in the Columbus area takes more than just a quick Google search. You should invest your IT budget in a long-term partnership that improves your operational efficiency and provides the security, monitoring, and training required in today’s high-risk environment. Their objectives should align with your organizational and operational goals, and they should assume some of the risk and responsibility for your business continuity.

thinkCSC Can Help You Protect Your Data

thinkCSC has more than 20 years of experience helping clients exceed their goals. We understand that business and technology are so intertwined that you can’t be strategic about one without taking the other into consideration. We offer more than the typical MSP, and we bundle the IT services you need to achieve objectives; increase efficiency, productivity, and agility; cut down on IT costs; and ensure you have a competitive edge.  Whether you want to outsource most or all of your infrastructure management, or you simply want to optimize the systems already in place, thinkCSC provides personalized IT expertise that saves money and provides the manpower that ensures your infrastructure is always an asset – never a liability. Get in touch to learn more.