Closing the Security Gaps: Employee Passwords

July 25, 2016/in Email Security /by James Wagner

In our lives, passwords are the keys to everything we do, from logging in to our personal online banking to paying our bills.

Infоrmаtiоn about our реrѕоnаl lives, buуing hаbitѕ, credit ԛuаlitу аnd lifеstyle are valuable tо those whо саn рrоfit frоm it.

For corporations, that data hаѕ еvеn greater wоrth.

Intangibles such as intеllесtuаl рrореrtу, сliеnt liѕtѕ, mаrkеt ѕtrаtеgiеѕ, pricing and соmреnѕаtiоn, along with copious amounts of personal data on each customer, often account for the majority of the vаluе оf thе mоdеrn enterprise.

Therefore, the passwords we use at work – to access email, data files, and networks, are crucial protection points between us and hackers.

Wеаk оr compromised раѕѕwоrdѕ are the easiest wау fоr hackers to gаin еntrу intо a system.

Simрlе оr short раѕѕwоrdѕ саn bе еаѕilу diѕсоvеrеd through brutе force or “diсtiоnаrу” attacks which concentrate intense соmрutеr роwеr to break through.

A two letter раѕѕwоrd, fоr еxаmрlе, hаѕ оnlу 676 соmbinаtiоnѕ.

A password with еight lеttеrѕ оffеrѕ mоrе safety with 208,000,000 combinations.

Enterprise Security Starts with Personal Password Requirements

Anyone who accesses your network, whether employee, client, vendor or other stakeholders, should be required to use complicated passwords to access everything from databases to email.

Idеаllу, a password ѕhоuld соnѕiѕt оf 8 or more characters and should be comprised of a mixture of uрреr аnd lower case lеttеrѕ, ѕуmbоlѕ аnd numbеrѕ.

Miсrоѕоft security hаѕ еnсоurаgеd the concept оf thе “Pаѕѕ Phrase” as аn аltеrnаtivе.

A рhrаѕе such as,”TheLastGoodBookUBoughtCost$25!” hаѕ all of thе needed еlеmеntѕ but is also еаѕу tо rеmеmbеr, since being able to remember the password is the key reason employees tend to create simple passwords.

Human Failsafes

Policies should be in place to govern passwords used to access company data of any kind that prevent:

Sharing passwords
Writing them down
Storing them on a computer or phone

It might seem like it would be common sense, but having a policy in place that spells it out is worth the effort.

People are the biggest security risk.

We are wired to respond to phishing attempts to gain access that play on our fears and worries.

We also are busy, forced to remember many passwords, and tend to use the same ones again and again. We’re also trusting and apt to share a password.

Layered Security

To mitigate the risk, lеаding firms аrе аdорting a dеfеnѕе strategy utilizing thrее еlеmеntѕ tо bеttеr ѕаfеguаrd thеir infоrmаtiоn.

Thе thrее lауеrѕ оf аuthеntiсаtiоn consist оf:

A strong password or passphrase
A crypto-key, smartcard, or token
Biometrics (fingerprint, etc.)

Protecting data is a never-ending battle as hackers become more and more sophisticated.

Companies must take strong stances on every point of entry that might create risk, including employee passwords.

Employee password security policies are essential to business continuity.

How Does IoT Security Affect Your Business?

July 22, 2016/in IoT Security /by James Wagner

Businesses and organizations are just beginning to realize the importance of IoT security – and the daunting task of ensuring that security is in place.

IoT is affecting everything in our lives, from cars that drive for us, to refrigerators that text us at work and tell us to pick up milk on the way home.

Companies have effectively and successfully used IoT for innovative marketing and strategy.

But even as we recognize the importance of remaining on the cutting edge, every business leader must also address the risk that comes with embracing each technological evolution if security is not keeping pace.

We must have comprehensive security to keep up with the coming ubiquity of IoT.

What is IoT?

The Internet of Things (IoT) is the term used to describe the variety of objects in our everyday lives that are now capable of communicating over wireless connections from one device to another, such as from your smartphone to your thermostat.

The IoT Risk

With every device that connects wirelessly to the internet, another opportunity is provided for hackers to violate privacy, steal data, gather information to conduct phishing attacks, and more.

It seems that cybercriminals are always one step ahead.

The big problem businesses face from IoT is that, in order to remain competitive, many businesses have been forced to jump into IoT or are considering doing so without having a fully developed security protocol in place.

Many IoT devices are sold with old or unpatched operating systems and software installed.

Consumers or end business users fail to change the manufacturer password on these devices.

Everything communicated over these devices creates risk.

How Does IoT Security Affect my Business?

There are two issues businesses must face with IoT security:

If you are developing IoT products, your products should meet strict security standards. This means using the most updated operating system, fully patched software, segmented network, and restricted access. Devices should be designed to require consumers to change the manufacturer password in order to begin using them.
If you have employees who bring their own devices to work, and those devices communicate with IoT devices that are not secure and also communicate with your network, you are introducing a level of risk not worth taking in your organization. Mobile device management along with IoT security policies become essential.

Security Risks Are Everywhere

Smart TVs.

Baby monitors.

Fitness devices.

Household appliances.

Each of these represents a risk to security – one that has been an ongoing concern since the initial concept and development of IoT was first discussed in the 90s.

The proliferation of IoT devices puts every organization and every consumer at a higher level of risk.

We all need to be part of the conversation and the solution to this growing problem.

Shadow IT: What You Don’t Know Can Hurt You

June 28, 2016/in Cybersecurity /by James Wagner

What Is Shadow IT?

Shadow IT is the use of non-sanctioned programs and applications by your employees, often on the devices they are bringing to work to complete their tasks.

This presents a challenge for every business leader.

And the experts only cloud the issue, with some saying that Shadow IT is inevitable because it is so widespread.

Others calling the practice a security nightmare.

The truth is likely somewhere in the middle.

Why Shadow IT Proliferates

Think about your organization:

Are you providing your employees with the most innovative solutions to make their work easier?

If you’re not, or if your technology is out of date, you’re more likely to be at risk.

Your employees will take matters into their own hands and obtain the application software they believe will help them complete their jobs more quickly and efficiently.

The solution, of course, is to provide your employees with the tools they need to do their jobs well.

Employ secure, licensed software applications that give your employees the ability to be efficient and to collaborate.

The other way to help improve your control over Shadow IT is to have an open-door policy with your employees, allowing them to suggest new programs and apps that may help.

The Benefit of Shadow IT

Shadow IT incidents occur when employees feel hindered by the existing solutions to do their jobs or collaborate effectively.

Employees who take the initiative to find innovative solutions can be an asset.

They have the right mindset but the wrong approach.

You can embrace that mindset, however, and provide a path for employees to recommend new solutions.

Often, the solutions discovered by employees will have an enterprise-grade version or comparable enterprise-grade solution available that you can offer.

The Cost of Shadow IT

The cost of Shadow IT may be immeasurable since there is often no way to adequately measure the risk your company assumes when an employee uses unlicensed software.

Not only could such use result in a compliance issue, but if the Shadow IT introduces malware or viruses into your network, the result could be catastrophic.

Shadow IT can also hinder collaboration.

If two team members are trying to collaborate on a project yet one is using unsanctioned software that is incompatible with what the other team member is using, the disparity could slow things down.

Detecting Shadow IT

You will find it difficult to deter that which you can’t trace. So how do you detect and thwart existing Shadow IT?

One of the simplest solutions is to monitor your outbound traffic, to identify unauthorized applications.

Example: Dropbox may not be a secure or sanctioned solution for your organization, so if you see traffic to Dropbox, you can assume an employee is illicitly using it to store or share data. It’s a simple matter from there to identify why the employee is using it and to provide a secure solution in its place.

Reducing the Risk of Shadow IT

To reduce the risk of Shadow IT, communicate with your team:

Establish policies regarding the use of unsanctioned programs and apps
Create clear BYOD policies
Do not allow employees to use their expense accounts to cover the cost of personally obtained programs or applications
Monitor outbound traffic and thwart Shadow IT as it arises
Provide secure, enterprise-grade solutions to the problems employees are trying to fix with Shadow IT

Shadow IT may be here to stay, but it does not have to put your organization at risk.

It takes both a cultural shift and clear policies to address the issue.

As technology fundamentally changes how we do business, serve customers, and meet compliance standards, business leaders must re-evaluate whether their current IT strategies are meeting their needs.

The ITeam is committed to helping Calgary- and Alberta-based businesses develop proactive IT strategies that keep them competitive. Contact us to learn more.

The ITeam Ranked Among Top 501 Managed Service Providers

June 22, 2016/in News /by James Wagner

The ITeam ranks among the world’s most progressive 501 Managed Service Providers (MSPs), according to Penton Technology’s 9th-annual MSP 501 list and study. The top MSP 501 companies ranked this year include organizations from around the world and from diverse technology and business backgrounds. Collectively, they amassed $9.82 billion in sales in 2015 and increased their oversight of technology devices to more than 5.6 million.

The complete 2016 MSP 501 list is available at MSPmentor. With more than 100,000 service providers throughout North America, being among the top 501 MSP companies is an honor. The ITeam is committed to partnering with our clients to achieve their goals.

“On behalf of Penton and MSPmentor, I would like to congratulate The ITeam for its recognition as an MSP 501 honoree,” said Aldrin Brown, Editor in Chief, MSPmentor. “The managed service provider market is evolving at a rapid pace and the companies showcased on the 2016 MSP 501 list represent the most agile, flexible and innovative organizations in the industry.”

The 2016 MSP 501 list is based on data collected by MSPmentor and its partner, Clarity Channel Advisors. Data was collected online from March through April 2016. The MSP 501 list recognizes top managed service providers based on metrics including recurring revenue, growth and other factors. In addition to a ranking on the MSP 501 list, every company that participated in the study has been assigned a score reflecting its intrinsic value. The measure, known as the Total Service Provider (TSP) score, evaluates an MSP’s mix of revenue from various activities, including consulting, cloud, reselling and managed services.

With over 20 years of experience serving Calgary and Alberta-based business, The ITeam continues to thrive on providing the most comprehensive IT support and services to Alberta and Calgary businesses, serving as a virtual IT department and providing access to Calgary’s leading On Demand and managed technical IT support. Contact us to learn more.

About Penton

Penton is an innovative information services company that empowers nearly 20 million business decision makers in markets that drive more than 12 trillion dollars in purchases each year. Our products inform with rich industry insights and workflow tools; engage through dynamic events, education and networking; and advance business with powerful marketing services programs. Penton is the way smart businesses buy, sell and grow. Headquartered in New York, Penton is privately owned by MidOcean Partners and Wasserstein & Co., LP. For additional information on the company and its businesses, visit www.penton.com or follow us on Twitter @PentonNow.

Top 3 Threats to IT Security Compliance

May 17, 2016/in Compliance /by James Wagner

Organizations have a lot to worry about in terms of IT security.

Are the right backup and recovery systems in place?

Are employees fully educated about email security?

Are two-factor verification and multilayer security being employed?

Thinking about IT security can be overwhelming, and that’s even before considering how you and your clients must meet industry and government regulations.

From PCI compliance to C-SOX to HIPAA, PIPEDA, PHIP A, and HITECH keeping customer and patient data safe is a crucial aspect of IT security for Canadian companies.

And maintaining compliance can be challenging, especially as BYOD becomes more common.

The ITeam has identified the top three threats that must be addressed:

Shadow IT

There is no bigger threat to your IT security than unknown apps.

These third-party apps represent one of the largest threats to compliance and security.

There is no control over which apps employees are using to get their work done in the most expedient way possible.

From file-sharing on unsecured platforms to communicating outside of network-secure email, the risks are real.

How to address the risk

Shadow IT is often the result of delayed implementation of streamlined services that make work easier for your employees.

So speed up the evaluation and implementation process of services, apps, and platforms that make it easier for your teams to collaborate and communicate.

Talk to your employees to identify where hang-ups are, and then resolve them.

Establish clear policies about the use of unapproved apps and software.

Shift as much of your organization’s IT infrastructure as possible to secure hosted services, so that secure access can occur anywhere.

Mobile Devices

As many as 75 percents of employees use personal devices for work-related activities, consequently storing sensitive information on their phones, whether this is endorsed by the organization or not.

And while there is a risk that these devices may be lost or stolen, it’s more likely that any threat to compliance will come from the employee using an unsecured mobile network or public Wi-Fi to share and send files, check email, and use unapproved apps.

How to address the risk

Mobile Device Management, a specific layer of security and policy protocols that govern mobile device usage in your business, should be developed, monitored, and revised regularly to keep up with new threats as they appear.

Human Error

The biggest risk to your organization is the people in it.

From the employee who is baited by a phishing email to an outside vendor who has access to your network, human error is the cause of most compliance issues.

How to address the risk

Education and training are the foundation for preventing IT security breaches in your organization.

Regularly update employees about new malware and phishing threats, and provide them with ongoing training to maintain awareness about IT security.

Update your security policies often, and require your employees to sign agreements acknowledging security policies and agreeing to abide by them.

Establish no-tolerance policies with regard to compliance; do not let an employee’s desire to take a shortcut to create a costly compliance issue.

IT security compliance requirements will vary from one industry to another.

If your organization takes an aggressive stance toward protecting customer data, requires employees to comply with strict network and data access policies, and remains vigilant about updating software, apps, and security monitoring platforms, IT security is possible.

As technology fundamentally changes how we do business, serve customers, and meet regulatory compliance standards, business leaders must reevaluate whether their current IT strategies are meeting their needs.

Do you understand your organization’s IT needs?

Are you making a rapid shift to cloud-based services and need to identify your core compliance issues?

Are you concerned about security and want to gain a more in-depth understanding of how secure your data and email are?

The ITeam is committed to helping Calgary- and Alberta-based businesses develop proactive IT strategies that keep them competitive. Contact us to learn more.