Bluetek IT Solutions Blog

Reports show security is a major concern when using a collaboration tool because it houses the customer data and also important internal data.

The benefits of collaboration tools are spoken everywhere: less reliance on email, more organic collaboration on projects, and better communication and relationships between teams.

Collaboration tools consist of solutions, including video conferencing, VoIP, document sharing, and instant messaging.

However, these tools create potential security threats, and evaluating vulnerabilities — and viable solutions — should be a sustainable part of our tool-selection process.

Security Threats To Be Aware Of — And Potential Solutions

Privileged users: Different individuals in the organization may have varying levels of access to your collaboration tool. With collaboration software, information can reside within unique partitions, with access restricted to selected team members. If a privileged user’s information is compromised, then the entire data will be available to all.

NATURAL LANGUAGE PROCESSING continues to find its way into unexpected corners. This time, it's phishing emails. In a small study, researchers found that they could use the deep learning language model GPT-3, along with other AI-as-a-service platforms, to significantly lower the barrier to entry for crafting spearphishing campaigns at a massive scale. 

Not a day goes by we don’t hear about another “ransomware” attack, it seems – including high-profile attacks on a major U.S. oil pipeline and the world’s largest meat processing company.

President Joe Biden pressured Russian President Vladimir Putin to crack down on ransomware attacks to “avoid unnecessary action.”

As the name suggests, ransomware is an attack that locks your computer and demands a ransom to give back your data.

Cybercriminals typically target businesses and governments – in the hopes they’ll pay bounties to release files and perhaps avoid a public relations disaster – but opportunistic crooks also extort money from regular computer users, like you and me. Because hey, it all adds up.

You might sit down to use your laptop or desktop and see an on-screen alert that your computer has been locked or that your files have been “encrypted.” To obtain a decryption key, you must pay up. The ransom demanded from individuals varies greatly, but it's typically a few hundred dollars and must be paid in difficult-to-trace cryptocurrency, such as Bitcoin.

You should turn off autofill in your password manager, and stop using some browser password managers altogether, argues a Czech security researcher.

"Most password managers have the autofill feature enabled by default, even though it reduces the security of the stored password," said Marek Toth, a penetration tester at Avast, in a recent blog post.

Autofilling is when your password manager fills in the username and password fields in a website's login page with your saved credentials without you actively prompting the password manager. 

The characters pasted into the field can then be "read" by scripts present in the login page — such as might be preset in an online ad that has nothing to do with the page itself — and those scripts will be able to copy and send your username and password anywhere. 

Browser developers are making privacy a priority, but they still may not be doing as much as you'd like in fighting pervasive ad industry trackers. You can take your online privacy into your own hands and outsmart that online tracking, though. A good way to start is by adjusting some of your browser settings. 

Incidents like Facebook's Cambridge Analytica scandal elevated privacy protection on Silicon Valley's priority list by revealing how companies compile reams of data as you traverse the internet. Their goal? To build a richly detailed user profile so they can target you with more accurate, clickable and thus profitable advertisements.

Apple and Google are in a war for the web, with Google pushing aggressively for an interactive web to rival native apps and Apple moving more slowly -- partly out of concern new features will worsen security and be annoying to use. Privacy adds another dimension to the competition and to your browser decision.

Ransomware is malware that encrypts your files or stops you from using your computer until you pay money (a ransom) for them to be unlocked. If your computer is connected to a network the ransomware may also spread to other computers or storage devices on the network. 

Some of the ways you can get infected by ransomware include:

-Visiting unsafe, suspicious, or fake websites.

-Opening file attachments that you weren’t expecting or from people you don’t know.

-Opening malicious or bad links in emails, Facebook, Twitter, and other social media posts, or in instant messenger or SMS chats.

You can often recognize a fake email and webpage because they have bad spelling, or just look unusual. Look out for strange spellings of company names (like "PayePal" instead of "PayPal") or unusual spaces, symbols, or punctuation (like "iTunesCustomer Service" instead of "iTunes Customer Service").

Ransomware can target any PC—whether it’s a home computer, PCs on an enterprise network, or servers used by a government agency.

Technology manufacturers cater to two very large markets with different needs: home users and businesses. You’re about to enter the SoHo (small office, home office) market where home technologies dominate because most single traders don’t need proper business systems with all the extra costs and complications involved.

Some complications are unavoidable. These include, as you know, backup and security, plus things like coping with data protection requirements. But as you will be a startup business working from home, I suggest using home technologies as far as possible. You can move to a business-oriented approach when you need to expand. When that time comes, you will have a much better idea of what you actually need.

The key to your online security is to have strong passwords, but the challenge is to create distinct passwords that you can actually remember -- or else you may fall into the bad habit of using the same login credentials for multiple accounts. According to LogMeIn, the company behind the LastPass password manager, you could very easily have 85 passwords for all your accounts once you count all of your social media, streaming, bank accounts and apps.

If your data is compromised, weak passwords can have serious consequences, like identity theft. Companies reported a staggering 5,183 data breaches in 2019 that exposed personal information such as home addresses and login credentials that could easily be used to steal your identify or commit fraud. And that pales in comparison with the more than 555 million stolen passwords that hackers on the dark web have published since 2017.

The identity protection of a post-password world isn't here for most of us. So in the meantime, try these best practices that can help minimize the risk of your data being exposed. Read on to learn how to create and manage the best passwords, how to be alerted if they're breached, and one crucial tip to make your logins even more secure. And here are three old password rules that wound up being dumb today.

Data security is an especially important topic in today’s remote environment. With employees working from home or on the road and connecting via a variety of devices, keeping tabs on data security is more important than ever.

What Is It, And Why Is It Important?

The definition of data security is very broad, but essentially, it means protecting data from destructive forces throughout the life cycle of its use.

Remote work increasing has been an ongoing trend. According to cloud security firm Netskope almost 6 in 10 American knowledge workers are working remotely because of the Covid-19 pandemic, and that number is likely to increase.

Even though there was a spike due to Covid-19, remote work increasing has been an ongoing trend. According to FlexJobs, "A special analysis done by FlexJobs and Global Workplace Analytics found that there has been a major upward trend in the amount of people working remotely in the U.S. In the span of one year, from 2016 to 2017, remote work grew 7.9%. Over the last five years it grew 44%, and over the previous 10 years it grew 91%."

The exponential development of computing devices has expanded access capabilities for cybercriminals to detect and exploit vulnerabilities in innovative ways. With a medium-grade smartphone now more powerful than the most advanced computers were only a few years ago, for example, cybercriminals can launch powerful and sophisticated attacks at a relatively low cost from a mobile unit while also working from home.

That ease of access goes some way to explain why there is a cyberattack every 39 seconds. As industrial organizations embrace digitalization, inadequate security protection can open up their systems to malicious actors. Criminals today use a wide variety of methods, from commonly used techniques such as phishing and computerized password hacking to more sophisticated operations such as watering hole attacks that deliver malware to visitors.

Increasingly, the same innovative technology that is being used to deliver innovative solutions for common benefit is being deployed in destructive ways to inflict catastrophic damage to infrastructure, business systems, and, ultimately, the citizenry.

Nobody likes passwords. They’re inconvenient. They’re a prime target for attacks. Yet for years they’ve been the most important layer of security for everything in our digital lives—from email to bank accounts, shopping carts to video games.

We are expected to create complex and unique passwords, remember them, and change them frequently, but nobody likes doing that either. In a recent Microsoft Twitter poll, one in five people reported they would rather accidentally “reply all”—which can be monumentally embarrassing—than reset a password.

But what alternative do we have?

For the past couple of years, we’ve been saying that the future is passwordless, and today I am excited to announce the next step in that vision. In March 2021, we announced that passwordless sign in was generally available for commercial users, bringing the feature to enterprise organizations around the world.

Beginning today, you can now completely remove the password from your Microsoft account. Use the Microsoft Authenticator app, Windows Hello, a security key, or a verification code sent to your phone or email to sign in to your favorite apps and services, such as Microsoft Outlook, Microsoft OneDrive, Microsoft Family Safety, and more.

With today's "new normal" ratcheting up the threat level, bolstering cybersecurity has become even more critical than before the pandemic. Here are five defensive measures that can help IT teams minimize the risk of cyberattacks and associated damage to the business. While you may think your business once had these areas under control, the reality is that may no longer be true thanks to the changing dynamics of our new landscape. Consequently, every organization should reevaluate its approach by taking these steps:

1. Conduct A Risk Assessment

Knowing where to focus your remediation efforts requires identifying the biggest weaknesses in your security fabric. This can be achieved by performing a risk assessment, either internally or with the help of an outside consultant. The process is essentially a security health check covering hardware devices, applications, network connections, user authentication systems, data classification and storage and other IT components and policies. Any vulnerabilities detected by this analysis can be prioritized based on the risk level and used to create a roadmap for strengthening your security posture.

Most corporate networks have what is essentially an open floor plan. Employees can reach whatever they need without going through different doors (technically speaking, routers or firewalls). This "flat" network enables an adversary who gains access to a user's computer to roam freely on a search for valuable data, then stage an attack against the relevant servers to steal it.

Do you underestimate security threats?

Today, the world is flooded with cybersecurity news. Whether it’s a headline splashed across the media about your favorite retailer being hit by hackers or your local council falling victim to ransomware, there is no escaping the “cybercrime pandemic.”

Even despite this recent surge in cyberattacks, there are still a worrying number of organizations that don’t see themselves as a target. These organizations have a false sense of security that they are of no value or interest to cybercriminals — they are too small, too unknown or even too secure to be hit.

However, this misconception just makes them easier to hit. Overconfidence in security or not seeing yourself as a target leads to companies letting their guard down, which in turn creates opportunities for hackers. So, what are other most common security misconceptions we hear about from organizations, how do they put them in danger and, most importantly, how can they be resolved?

1. We are not a target for cybercriminals.

First and foremost, everyone is a target for cybercriminals. It doesn’t matter how big or small you are or how much or how little data you hold; cybercriminals will still see you as a target. This is an issue we hear about a lot when approaching new customers. However, once we have carried out an open-source background check, they are often surprised by the results.

We find fake social media accounts where CEOs and brands are being impersonated, often sending out malicious links in their posts. We also find a lot of other content online that shows the company has already been hit by attackers. 

Trojan Horse for Malware

The graphics card inside your computer is a powerful tool for gaming and creative work, but it can also potentially serve as a Trojan horse for malware. Cybercriminals are finding ways to exploit graphics cards and their VRAM to inject malicious code into your system. The approach is claimed to have worked during a proof-of-concept hack on both discrete and integrated GPUs from AMD, Intel, and Nvidia.

Because antivirus software today cannot scan the graphics card’s own video RAM, known as VRAM, hackers are now targeting GPUs to carry out their dirty work. On the other hand, conventional methods used today that target the system’s main memory would trigger the antivirus software.

According to Bleeping Computer, a brief description of the hack was posted on a hacker forum, where one seller was trying to sell his proof-of-concept method to exploit the VRAM on GPUs. The seller stated that the method worked on Intel’s integrated UHD 620 and 630 graphics, as well as discrete solutions including the AMD Radeon RX 5700 and Nvidia GeForce GTX 1650. It’s unclear if the attack would also work on other GPUs, like the recent Radeom RX 6000 series from AMD and theGeforce RTX 3000 series from Nvidia, both of which have seen high demand and short supply.

Make sure your router and devices are secure

If you want to add a bit more security to your device or simply make it easier to remember what you need to put in, you should look into changing your Wi-Fi router's password. Routers come with default passwords that are easy for anyone to guess or look up. Instead, you should change it to something more secure so that nobody can mess with your settings. Here's how to change your Wi-Fi router's password.

How to log into your router

1. First, you need to log into your router's web-based interface.

2. Connect to your router with your PC or mobile device.

3. Visit 192.168.0.1 or www.routerlogin.net.

4. A prompt will show up for login info.

5. Enter the username and password that's on the bottom of your router or what it says in the manual.

Industrial businesses were the second most targeted sector in 2020 and new research from Positive Technologies shows that an external attacker could penetrate the corporate network at 91 percent of them.

In addition, Positive Technologies penetration testers gained access to the industrial control system (ICS) networks at 75 percent of these companies. Once criminals have obtained access to ICS components, they can shutdown entire production lines, cause equipment to fail, or incidents that could cause serious harm.

Olga Zinenko, senior analyst at Positive Technologies, says, "Today, the level of cybersecurity at most industrial companies is too low for comfort. In most cases, Internet-accessible external network perimeters contain weak protection, device configurations contain flaws, and we find a low level of ICS network security and the use of dictionary passwords and outdated software versions present risks."

Spam Can Be the Root Cause of Many Business Problems 

The average worker in 2020 received a whopping 121 emails per day. More than four-of-every-five of those emails were spam. Email spam has long since been a problem for the small and medium-sized business. For years spam protection meant turning on your filter inside your email program.

Today’s email-based threats demand more attention.

If spam is a major problem for your business—and if you don’t have protection already, it likely is—now is the time to do something about it. The professional IT experts at Bluetek IT Solutions have an answer to help you reduce the strain that spam puts on your business: our comprehensive Spam Protection service.

Spam Doesn’t Just Deliver Malware

The phishing attack is the number one scam carried out on businesses today. What if the company that gets hit with ransomware or other malware could go back and keep that email from getting through to the person who fell for the scam? Today, Bluetek IT Solutions offers spam protection that can keep those attacks out of your employees’ inboxes. This not only eliminates the threat of a malware attack but also saves time. Here are the main benefits of deploying spam protection:

• It saves the time of your IT staff, who probably spends too much time on email security and maintenance as it is. 
• It saves the time of your employees. Spam plies up in their inboxes, which in turn stymies their productivity as they have to spend more time ascertaining what emails are actionable and which are disposable. 
• It keeps threats at bay. 
• It keeps your email server from being overloaded with emails that are either nefarious or at the least, a waste of time. 

Spam protection serves as a critical part of any threat protection strategy.

Stop Phishing in Its Tracks

Spam Protection Significantly Reduces Exposure to Phishing 

Phishing is the number one method for stealing credentials, disseminating malware, and gaining unauthorized access to your business’ network. If you combine a strong training regime with a comprehensive Spam Protection service from Bluetek IT Solutions, you can put a major dent into your business’ potential exposure to email-based threats. More than that, our Spam Protection service provides decision-makers the peace of mind that their staff isn’t being constantly exposed to situations where one wrong move could mean major problems for your business.

The password isn’t nearly as secure as it used to be. Hackers have begun to take advantage of extremely powerful solutions designed to brute force their way into accounts by using software to rapidly guessing thousands of passwords per second, making it extraordinarily difficult to prepare yourself for them.

What’s the best way to guarantee that passwords aren’t going to be the downfall of your company? A great start is by taking a close look at password best practices and two-factor authentication.

Data security isn’t a matter to be taken lightly, as too many businesses have found out the hard way. Unfortunately, there are far too many simple ways to correct common security issues - enough that it’s foolish not to do so. We’ll review a few ways to fix security issues, after discussing one of, if not the, most egregious security failings in modern history.