3 Reasons to prepare a business continuity plan if you haven’t done so already

A business continuity plan is the blueprint you need during an emergency to keep your business running smoothly. If you don’t already have one, here are 3 key reasons why you should focus on creating one ASAP.

It helps retain clients
As a business, if you have problems functioning, it will definitely affect your clients. For example, if your servers are down or your supply-chain mechanism is affected or your delivery process breaks, you won’t be able to fulfill your promise to your clients. Even worse, in some situations you may not even be in a position to communicate about the crisis to your clients adding to their frustration. A business continuity plan addresses these issues beforehand and can help reduce client dissatisfaction.

Salvaging brand image and reputation
There are certain events that end up affecting only your business. For example, ransomware attacks, virus attacks, data leaks, etc., Having a business continuity plan that caters for such events can be a blessing in times of such crisis.

Minimizing revenue loss
A business continuity plan can minimize the revenue losses that occur as a result of a crisis that interrupts your business operations.

In short, a business continuity plan helps minimize the impact of the crisis on your client relations, your brand image and your revenue by equipping you with a plan to handle the situation better.

Business continuity planning: A must-have, not a luxury

Business continuity planning is not an alien concept anymore. In recent times we have witnessed a lot of events that only serve to further intensify the need for business continuity planning. Examples include natural calamities like hurricanes, floods, wildfires, events like terror attacks or even pandemics like the recent Covid-19 outbreak.

While a business continuity plan cannot completely safeguard your business from all these events, it can certainly minimize the damage inflicted on your business. Top business consultants urge their clients to develop a business continuity plan as they consider it a part of the best practices for running a business. A business continuity plan can make the difference between survival and shutdown of a business during a crisis situation.

What is business continuity planning?
Business continuity planning is the process of creating a blueprint that helps your business respond and recover effectively from an unforeseen mishap. As discussed before, the unforeseen event could range from natural disasters to pandemics, or even accidents that affect just your place of business like a fire or even a cybercrime attack directed at your business in particular–basically, any event that can paralyze your business. A business continuity plan serves as a step-by-step guide that you can follow during an emergency to keep your business running smoothly.

True, a business continuity plan is not a sure shot method to survive a crisis, it won’t instantly eliminate the impact of the disaster, but it gives you the best chances of survival. If you are not sure of what a good business continuity plan entails , you can reach out to a reputable MSP to help you with the preparation and implementation of one.

Why do you need a top-down approach to IT security?

For any organization, its employees are its biggest assets. But, what happens when your biggest assets turn out to be your greatest threats or liabilities? That is how cybercrime can change the game. In a recent study, it came to light that employee actions account for about 70% of the data breaches that happen. This blog focuses on the first step you need to take as an organization to better prepare your employees to identify and mitigate cyber threats–adopting a top-down approach to IT security.

Being a victim of cyber-attack can prove disastrous for your business as it has the following repercussions.

Affects your brand image negatively: Business disruption due to downtime or having your important business data including customer and vendor details stolen reflects poorly on your brand.
It can cause you to lose customers: Your customers may take their business elsewhere as they may not feel safe sharing their PII with you.
Can cost you quite a bit financially: Data breach makes you liable to follow certain disclosure requirements mandated by the law. These most likely require you to make announcements on popular media, which can prove expensive. Plus, you will also have to invest in positive PR to boost your brand value.
It makes you vulnerable to lawsuits: You could be sued by customers whose Personally Identifiable Information (PII) has been compromised or stolen.

The organizational mindset needs to change and acknowledge the fact that IT security is not ONLY your IT department, CTO or Managed Service Provider’s (MSP) responsibility. You need to truly believe that IT security is everyone’s business, and that includes everybody working in your company, from the C-level execs to the newly hired intern. Everybody needs to understand the gravity of a cyberattack and its impact. Only then will they take cybersecurity seriously.

3 steps you can take to protect your data in the Cloud

Moving to the Cloud offers tremendous benefits for SMBs that range from lower IT costs to any-time access to data and certainly more reliability in terms of uptime. But, data in the Cloud is also vulnerable to security threats just like the data stored on physical servers. This blog discusses 3 things you can do to protect your data in the Cloud

Secure access: The first step would be to secure access to your data in the Cloud. So, how do you go about it? Safeguard your login credentials-your User IDs and passwords-from prying eye. Set strong password policies that are practiced across the board and educate your employees about good password hygiene. Also, do you have employees using their own devices to access their work-related applications and documents? Do you have staff working from home? Then, you also need to formulate strong BYOD (Bring-your-own-device) policies, so these devices don’t end up as the entry point to cybercriminals.

Educate your employees: What’s the first thing that pops into your head when someone talks about cybercrime? You probably picture some unknown person, a tech-whiz sitting behind a computer in a dark room, trying to steal your data. But, surprising as it may seem, the first and probably the biggest threat to your data and IT security in general, comes from your employees! Malicious employees may do you harm on purpose by stealing or destroying your data, but oftentimes, employees unwittingly become accomplices to cybercrime. For example, forwarding an email with an attachment that contains a virus, or clicking on a phishing link unknowingly and entering sensitive information therein or compromising on security when they share passwords or connect to an unsecured or open WiFi at public places such as the mall or the airport with a view to “get things done”, but, without realizing how disastrous the implications of such actions can be.

Choosing the right Cloud service provider: If you are putting your data in the Cloud, you need to make sure that it is in safe hands. As such, it is your Cloud service provider’s responsibility to ensure your data is secure and, accessible, always. But, are they doing all that is needed to ensure this happens? It is very important to choose a trustworthy Cloud service provider because you are essentially handing over all your data to them. So, apart from strengthening your defenses, you need to check how well-prepared they are to avert the threats posed by cybercriminals.

Complete Cloud security is a blend of all these plus internal policies, best practices, and regulations related to IT security, and of course, the MSP you choose to be your Cloud security provider plays a key role in all this.

Is the Cloud really risk-free?

The Cloud presents plenty of benefits that make it a very attractive choice, especially for SMBs who don’t want to be burdened with higher in-house IT costs, putting your data in the Cloud is not risk-free. Just as storing data on physical servers has its security threats, the Cloud presents certain security concerns as well. These include

Data breach: A data breach is when your data is accessed by someone who is not authorized to do so.
Data loss: A data loss is a situation where your data in the Cloud is destroyed due to certain circumstances such as technological failure or neglect during any stage of data processing or storage.
Account hijacking: Like traditional servers, data in the Cloud could be stolen through account hijacking as well. In fact, Cloud account hijacking is predominantly deployed in cybercrimes that require entail identity thefts and wrongful impersonation
Service traffic hijacking: In a service traffic hijacking, your attacker first gains access to your credentials, uses it to understand the online activities that happen in your domain and then uses the information to mislead your users or domain visitors to malicious sites.
Insecure application program interfaces (APIs): Sometimes, Cloud APIs, when opened up to third parties, can be a huge security threat. If the API keys are not properly secured, it can serve as an entry point for cybercriminals and malicious elements.
Poor choice of Cloud storage providers: A security lapse from the Cloud storage provider’s end is a huge security concern for businesses. It is very important to choose a trusted and experienced Cloud service provider who knows what they are doing.

Apart from the above, there are some common threats that apply to both the Cloud and traditional data storage environments such as a DDoS attack, or a malware attack where your data in the Cloud becomes susceptible because it is being shared with others and at other places.

Some Cloud security mechanisms that SMBs can invest in to keep their data safe

Cloud firewalls: Much like the firewalls you deploy for your local IT network, Cloud firewalls work to prevent unauthorized Cloud network access.

Penetration testing: Penetration testing is a sort of a Cloud security check where IT experts try hacking into the Cloud network to figure out if there are any security lapses or vulnerabilities that could serve cybercriminals.

Obfuscation: In obfuscation, the data or program code is obscured on purpose such that the system delivers unclear code to anyone other than the original programmer, thus mitigating any malicious activity.

Tokenization: Tokenization is the process of replacing sensitive data with unique identification symbols that retain all the essential information about the data without compromising its security.¹

Virtual Private Networks (VPN): Another, more commonly used mechanism is the VPN. VPN creates a safe passage for data over the Cloud through end-to-end encryption methodology.

Investing in a good Cloud security system is a must, but, in the end, you also need to remember that Cloud security is not only about antivirus software, firewalls, and other anti-malware tools. You need to pick the right MSP and work closely with them to implement a Cloud security solution that works for you.

¹https://searchsecurity.techtarget.com/definition/tokenization

Things to consider before switching to the Cloud

More and more businesses are switching to the Cloud to store their data and rightly so. The Cloud offers numerous benefits over the traditional, physical on site server. For example,

Anytime, anywhere access to your data: Information in the Cloud can be accessed from anywhere using an internet connection, unlike in the case of traditional servers, where you need a physical connection to the servers
Significant cost savings: You cut hardware costs, because the Cloud follows a ‘pay-as-you-use’ approach to data storage
SaaS compatibility and support: The Cloud allows the use of Software-as-a-Service since the software can be hosted in the Cloud
Scalability: The Cloud lets you scale up and down as your business needs change
24/7 monitoring, support, and greater access reliability: When your data is in the Cloud, the Cloud service provider is responsible for keeping it safe and ensuring it is securely accessible at all times. They monitor the Cloud’s performance and in the event of any performance issues, they provide immediate tech support to resolve the problem

Your big Cloud move: What to consider

If you are considering moving to the Cloud, you will find it helpful to sign-up with an MSP who is well-versed with the Cloud. They can advise you on the benefits and risks of the Cloud and also offer the Cloud solution that’s right for you. In any case, before you migrate to the Cloud, make sure you are dealing with a reputed Cloud service provider who has strong data security measures in place. You can even explicitly ask them what security mechanisms they have invested in to manage data access and security.

Yes, moving to the Cloud has it benefits, but it also has its challenges including security risks. Learn more in our next blog, “Is the Cloud really risk-free?”

Cyber-attackers have a range of motives and methods to steal information and are continuously finding ways to disrupt businesses and clear bank accounts. With technology becoming increasingly prevalent in our day-to-day lives, cyber risks are increasing as well.

Data poisoning attacks, a lesser-known type of cyber attack, can cause great damage to an organization that often goes undetected for a long time. Some cases can cause even more damage than common threats such as viruses and ransomware. In a cyber poisoning attack, incorrect data quietly slithers into your system and changes its overall functioning, which can lead to a data breach and loss of user trust.

What are Cyber Poison Attacks?

Cyber poison attacks alter the area where the computer system makes smart decisions. The attacker creates a loophole in the core data rule and trains the system to adhere to that rule so it can be exploited. As a result, the system’s data model is skewed and the output is no longer as originally intended.

For example, the access control for a particular file is only accessible to those in an organization above the VP level. An attacker might change the main parameter to include the manager level. In this case, the core data set is violated and the system will not detect an intrusion by someone at the manager level, even if they log in with their credentials.

Types of Poison Attacks

There are 4 main categories of poison attack methodologies:

Logic corruption – The attacker changes the basic logic used to make the system arrive at the output. It essentially changes the way the system learns, applies new rules, and corrupts the system to do whatever the attacker wants.
Data manipulation – The attacker manipulates the data to extend data boundaries that result in backdoor entries that can be exploited later.
Data injection – The attacker inserts fake data into the actual data set to skew the data model and ultimately weaken the outcome. The weakened outcome then serves as an easy entryway for the attacker into the victim’s system.
DNS Cache Poisoning – The attacker corrupts the DNS data and causes the name server to return an incorrect result.

The Most Common Poisoning Attack: DNS Cache Poisoning

Domain Name System (DNS) is the “backbone” of the internet that associates a unique IP address with each domain name. A DNS cache poisoning, also called a DNS spoofing attack, can take traffic away from a legitimate server and send it over to a fake one.

In the case of a DNS cache poisoning attack, the attacker enters false information into a DNS cache so that DNS queries return false information, usually a fake website. Anyone typing in the URL of the actual website is redirected to the fake one. This article explains more about what happens behind the scenes.

The fake website that users are redirected to could be a phishing site where the attacker attempts to capture the unsuspecting victim’s personal data or secure information. The visitor might think they’re logging into their bank’s website online, but are actually on the attacker’s phishing site and exposing their personal login credentials.

How To Protect Your Organization Against DNS Cache Poisoning

A DNS poison attack is particularly dangerous because it can quickly spread from one DNS server to the next. Below are some ways to protect yourself and your customers from becoming victims of this type of attack.

Cybercriminals try to corrupt your DNS server using theirs. You can prevent this by bringing a trained professional onboard for your DNS server set-up. An expert will know to set up your DNS server such that it has a minimum relationship with other, external DNS servers, thus limiting your attacker’s ability to corrupt your DNS server using theirs.

As a best practice, ensure that your DNS servers only store data related to your domain and not any other information. It is harder to corrupt the system when it focuses on a single element.

Another best practice is to ensure that you are up-to-date on all DNS security mechanisms and are using the most recent version of the DNS.

Ensure your site has, an SSL certificate and make sure it is HTTPS. Using encryption, a site with HTTPS protocol allows for a more secure connection between its server and the internet and is better at keeping cybercriminals out.

Having an SSL certificate also ensures your site’s name shows up alongside the URL in the address bar. This is an easy way for visitors to identify if they are on a genuine site or not, thus helping them steer clear of phishing attacks and clone sites.

Your users expect their data to be protected when visiting your website. Without the proper security measures in place, your organization may suffer long term consequences from a data breach.

Take the right steps to help your organization defend against cyber poisoning attacks. Click here to contact Wahaya IT Consulting and start developing a security plan for your company.

We often click links in emails, websites, and social media without a second thought. However, clicking a link can be a risk. Opening a malicious link without any network security protection can cause insurmountable damage to a business.

Network security is the practice of securing a computer network against the intrusion of unauthorized users. As attacks are continuing to target small businesses, network security protections are extremely important.

Criminals around the world keep coming up with new, sophisticated ways of stealing money and data. Their purpose is often to steal data or hold companies ransom. Businesses with inadequate IT systems are vulnerable targets.

Failure to implement proper network security measures can result in the release of sensitive customer information, such as credit cards and HIPAA protected information. This can also result in fines and legal consequences for the unsecured business.

What Does a Network Security Threat Look Like

It often starts with a dodgy link. Staff email accounts are the main entry point attackers target as they try to hack into IT systems. Without realizing it, an employee might receive a seemingly regular email. Just a simple link click on a suspicious link can let hackers into the business – it really can be as easy as that.

Other common threats include:

Viruses
Trojan horses
Insecure passwords
Spyware
Design flaws in the network

Having faith in your team is not enough. Sophisticated criminals often do research to pretend to be people they’re not. They can persuade even your most tech-savvy staff to click links that can leave your whole business exposed to real danger.

Mobile phones are also in danger of being attacked, regardless of how safe their operating systems claim to be. Notably, Twitter was also recently hacked, with speculations that it was the result of hackers targeting workers who had administrative privileges.

There is good news though – you can manage the risk with the right security measures in place. Wahaya IT Consulting works with businesses to keep their technology safe. We can also help train staff on how to spot potential threats.

Facts About Data and Network Security

Data you hold about your customers and how you run your business is one of the most valuable assets your company owns. As people become aware of the value of their personal data, they expect businesses to take extra care looking after it. But what happens when data ends up in the wrong hands? Here are three scary facts about data breaches:

As a small business owner, you are particularly vulnerable to data theft as 43% of cyberattacks target small businesses. (Source: Verizon)
Data breaches exposed 4.1 billion records in the first six months of 2019. (Source: RiskBased Security)
The average time to identify a data breach last year was 206 days. (Source: IBM)

The risks for not taking good care of your data are severe. If you don’t have a team monitoring your IT security, months can go by before you even become aware of a breach.

Find the Right Network Security Soltuion

The right network security solutions will protect your customers and your data. We keep our clients safe by monitoring their data security for them. Our customized network security solutions around your specific business help to reduce the likelihood of an attack.

Minimize the risk of one bad link derailing your business. Click here to contact Wahaya IT Consulting.

Defending against cyber attacks – Antivirus software and antivirus employees

There are two basic defenses you should have in place to defend against cyber attacks One is technological, the other is human. Together, the two can go a long way to protecting the integrity and security of your data.
Antivirus software and network protection – One of the risks you face these days is the one that is most likely to damage your brand. It is the one most likely to deeply undermine customer confidence and trust. That risk is a data breach. If you experience some form of data breach where your clients perceive their data has been compromised, your brand is damaged permanently. More importantly, you are likely liable for the financial consequences of a data breach. Make sure that your systems are protected by the latest antivirus software and that you are consistently updating it. New viruses appear every day, so outdated antivirus software is less likely to protect you.

Employee training – One of the tools for risk managers is risk avoidance. Avoid getting into trouble in the first place. Training employees about their responsibility for data security is critical. One of the primary ways that hackers and thieves gain access to corporate data is through employee error. Every employee should be trained on proper password behavior. Simple guidelines about changing passwords frequently and never sharing passwords are basic but important first steps. Additionally, employees need to be trained to identify fake websites and phishing scams. Opening emails with bad attachments and links is a principal source for entry into company accounts and databases. A managed service provider can provide tips and guidance on training your employees about data security.

In summary, small businesses need to be aware of the risks that exist out there and make plans so they are not caught flat-footed when disaster strikes. It is especially important for smaller firms to be aware of this because they are the least likely to have the deeper pockets to be able to rebound after a catastrophic event hits their business. A managed service provider is an excellent resource for developing a risk management plan for your IT infrastructure.

In the past several months, work from home (WFH) policies have become increasingly popular. The spread of COVID-19 has resulted in a temporary and sometimes permanent WFH environment for many companies throughout the country.

Working from home can be beneficial and many employers and workers are happily embracing the trend. Plus, with remote access solutions, it’s easier for businesses to safely operate from anywhere with a secure, remote connection. Here are some benefits companies see after making a WFH shift:

Improved Employee Satisfaction

Many employees appreciate the option to work from home at least part of the time. The flexibility to choose when to go into an office provides peace of mind to employees who might have to commute far in bad weather or need to deal with an unexpected illness. Most workers prefer organizations that allow a greater balance between life and work.

Increased Productivity

Increase worker productivity is a major potential benefit for a work from home policy adoption. Studies have shown that in many cases productivity improves when employees work from home.

It may seem that a house has many distractions, but the office may have more. Colleagues visiting, a loud office space, and impromptu meetings can steal away a lot of time. From home, some employees have the opportunity to focus on a task with fewer interruptions.

Less Time Spent Commuting

Anyone who sits in traffic or takes public transportation daily understands the merit of a shortened commute. It’s also greener: cutting down on daily commutes may have a net positive effect on energy savings. At the very least, employees will see a decline in transportation costs and time spent traveling to work.

Recruitment and Retention Improvements

Recruiting top employees remains a serious challenge, but limiting the candidate pool to a local area may mean a company is missing out on potential applicants. Studies by major consulting and recruitment firms are determining that the opportunity to WFH can be a key factor when applying for new jobs. Companies may also lose some of their own workers – the lack of work from home opportunities has been listed as a reason for seeking alternative employment.

Decreased Real Estate Costs

For companies and organizations who believe WFH will be their long-term model, this can mean eliminating office space, cutting considerable fixed-costs out of the bottom line equation.

There are many great benefits of working from home, however, relaxed data security and blurred office hours can become an opportunity for cyber threats. If you’re considering adopting a work from home policy, here are some factors that should be carefully considered:

Equipment and Maintenance

It should be outlined what equipment and utilities employers and employees are responsible for providing and maintaining. Will bandwidth be a reimbursable expense? Will laptops, phones, etc. be provided by the business or will this be a BYOD project?

If technology is provided by the employer, determine the employee’s responsibility to keep it maintained and install upgrades. If you have a BYOD policy, decide if employees required to bring their devices in for upgrades and security checks. Click here to learn more about adopting a BYOD policy.

Fair Labor Standards Act

When employees work from home, overtime laws are still applicable. The Fair Labor Standards Act (FLSA) created a framework for paying wages above the law’s definition of a 40-hour workweek that includes overtime pay for work performed beyond that threshold. Under FLSA, two basic classes of workers are defined: those employees who must be paid overtime when working in excess of forty hours (non-exempt employees), and those who are not required to be compensated for work done beyond the 40-hour limit (exempt employees).

The problem FLSA presents is that non-exempt employees must be paid for all work, including any work activity outside regular working hours. An example of the liability that is created for an employer are employees who respond to texts and emails from home outside “office hours.” This is compensable work and needs to be counted under the 40-hour threshold. Policies that protect you from any violation of FLSA should be articulated clearly in writing.

Be Aware of Organizational Silos

When developing a WFH policy, the above issue of FLSA points out that effective WFH planning and implementation requires collaboration, and not just between individual managers and employees. IT involvement may be necessary – determine who is supporting off-site technology and maintaining data security. It is a human resource issue-will performance measurements need to be tweaked? It may be a legal issue – certain types of data is governed by federal and state laws such as HIPAA and FERPA.

It is extremely important that companies take into consideration the data protection and legal implications before opting for a work from home setup. WFH policies can prove beneficial to both the employer and the employee if planned well and implemented properly.

No matter if you’re in the office or at home, networks need to be secure and maintained. MSPs like Wahaya can help ease the telecommuting transition with remote access solutions and business data continuity plans. Contact us to start setting up your business to operate from any time, anywhere!

IT Support News | Wahaya IT Consulting