Businesses Are Dangerously Avoiding Critical IT Security Updates

 How good is your IT staff at staying current when it comes to applying all the latest security patches? Unfortunately, the answer for most businesses is, "probably not as good as you think."

According to research conducted by Bitdefender, a staggering 64 percent of un-patched vulnerabilities discovered on corporate networks in 2020 involve bugs that date back to 2018 and before.

This mind blowing statistic has serious implications for your company, no matter what business you're in, and no matter how large or small your firm might be.

What the key finding means, in a nutshell, is that of the US businesses with one or more un-patched piece of code running on their network, there are fixes available for nearly two thirds of them. Worse, those fixes have literally been available for years. Not taking advantage of them is, from the perspective of a hacker, like leaving a neon sight above the front door of your business that reads, "we don't lock up at night - please, come in and steal from us!"

 

 

Everyone in the industry knows and understands that keeping up with all the latest patches for the software deployed across even a small network can be both frustrating and time consuming. It's certainly not one of the more glamorous aspects of the job.

Even so, it is absolutely critical, and it pays to do a periodic survey of all the software installed on your network and how long it's been since a security patch was applied. If you're looking for an inexpensive way to bolster the security of your company's network, making sure all the latest software security updates are installed should be your first stop.

Even if that's all you wind up doing, taking that one simple step will dramatically improve the overall security of your network, and that's a very good thing.

Call SpartanTec, Inc. now to know how our managed IT services Wilmington NC can help your business.

SpartanTec, Inc.
Wilmington, NC 28412
(910) 218-9255
http://manageditserviceswilmington.com

Serving: Myrtle Beach, North Myrtle Beach, Columbia, Wilmington, Fayetteville, Florence

All About Security Risk Assessment

Cyber Threat Risk Webinar

Identify security risks and understand general network usage.

July 21st  11:00 am EST
Register Here

A security risk assessment will identify, evaluate, and execute important security controls in applications. It concentrates on the prevention of application security vulnerabilities and defects.

Performing a risk assessment lets an organization check the application portfolio as a whole, from the perspective of the cybersecurity attacker. It will support manager when creating a well informed resource allocation, tooling, as well as decisions concerning security control implementation. Therefore, performing an evaluation is an important part of the risk management process of an organization.

Understanding The Process Involved In Security Risk Assessment

Factors like resources, growth rate, size, as well as asset portfolio will have an effect on the depth of the models for risk assessment. Organizations will perform generalized assessments when time or budget constraints are encountered. But generalized assessments do not offer the in-depth mappings between associated online threats, identified risks, assets, impact, as well as mitigating controls.

When generalized assessment consequences do not offer sufficient correlation between these aspects, a more detailed evaluation is required.

Security Risk Assessment Model: 4 Steps To Ensure Success

1. Identification – figure out all technology infrastructure’s critical assets. Then evaluate sensitive data that’s been created, stored, or sent by these assets. Don’t forget to make a risk profile for every one of them.
2. Assessment – use a method to evaluate the identified risks for critical assets. Once in-depth assessment has been performed, find out how you can efficiently and effectively spend resources and time for risk mitigation. The assessment method should evaluate the correlation between threats, assets, mitigating controls, and vulnerabilities.
3. Mitigation – create a mitigation approach and execute security controls for every risk.
4. Prevention – execute tools as well as processes to lower the vulnerabilities and threats from happening in the resources of your firm.

The Common Problems Solved By A Security Risk Assessment

An organization will be allowed to do the following thanks to a comprehensive security risk assessment:

• Come up with risk profiles for every asset.
• Identify assets within the company.
• Know what data is stored, sent, and created by these assets.
• Evaluate asset criticality in relation to business operations. This involves the general impact to reputation, revenue, as well as the possibility for the exploitation of the organization.
• Assess the asset’s risk ranking and prioritize them for evaluation.
• Apply specific mitigating controls for every asset according to the assessment results.

It is crucial to know that a security risk assessment Wilmington is not a single security project. Instead, it is a regular activity that must be performed at least once every two years. It will provide a firm with an updated snapshot of the risks and threats to which they’re exposed.

Call SpartanTec, Inc. for more information about security risk assessment or if you need to help of IT experts to secure your network against potential online threats.

SpartanTec, Inc.
Wilmington, NC 28412
(910) 218-9255
http://manageditserviceswilmington.com

Cities Served:
Wilmington, Silver Lake, Sea Breeze, Carolina Beach, Eagle Island, Leland, Wrightsboro

Cybersecurity Tips For Working From Home

Social distancing is one of the most crucial measures to lower the spread of COVID-19. Businesses are also doing everything they can to keep their employees safe and that includes instructing or encouraging them to work from home. But, transferring from a secure office setting to working remotely could open up various security risks. Apart from that, nasty hackers and cybercriminals are already using the virus as a subject for their phishing scams in hopes that their victim would click through and give out their passwords and other information.

Considering the rapid rise in remote working, ENISA, a European cybersecurity agency, has provided a few recommendations for businesses that move to teleworking due to COVID-19. The agency said that it noticed a rise in the phishing attacks that use the coronavirus topic as a front. The agency suggests that workers try not to mix leisure and work activities on the same device and be especially careful in opening emails concerning the coronavirus. These days, cybercriminals are exploiting the crisis so watch out for scams and phishing emails.

ENISA also warned that remote workers have to be cautious of emails that ask to renew or check their passwords as well as their login credentials, even if they look like they come from a trusted source. It is important to verify the email’s authenticity especially if it comes from people you don’t know and they’re asking that you open files or connect to links. Phishing messages create a sense of urgency to force you to click a link. You should also be careful of emails that come from people you know. Double-check everything and don’t click on any link if you are unsure what it’s for.

Security Tips For Remote Workers

• Make sure that you have a secure Wi-Fi connection. Although most Wi-Fi has been secured correctly, a few older installations may not be and that means people close by could snoop your traffic.
• Install an antivirus program and update it regularly.
• All of your security software must be updated. You should check browser add ons, privacy tools, as well as other patches on a regular basis.
• You should have a backup strategy set in place and don’t forget to use it if the situation calls for it. Regularly back up important files so you don’t have to worry about losing data in case of a ransomware attack.
• Always lock your screen especially if you are working in a shared space. If possible, avoid working in shared or co-working spaces at this time and follow social distancing to avoid spreading the virus.
• Use a secure connection.
• Install encryption tools.

Security Tools For Employers

• Provide feedback to employees on how they need to react when they face problems. They need to know who to call. They also need to familiarize themselves with emergency procedures.
• Prioritize the support of solutions for remote access.
• Offer virtual solutions
• Provide enough support when there is a problem.
• Create a clear procedure that will be followed in case of a security breach.
• Restrict access to sensitive information and systems when needed.

Get your free work from home guide here.

Call SpartanTec, Inc. in Wilmington if you need the help of IT experts in making sure that your network is safe and your remote workers are safe from online threats as they work from their homes.

SpartanTec, Inc.
Wilmington, NC 28412
(910) 218-9255
https://spartantec-wilmingtonnc.business.site/

Cities Served:
Wilmington, Silver Lake, Sea Breeze, Carolina Beach, Eagle Island, Leland, Wrightsboro

Companies Lose An Average of $200,000 On Cyberattacks

Cybercrime is a type of criminal activity that’s becoming increasingly prevalent these days. What’s even more worrying is that cyberattacks are set to cost companies all over the world as much as $5.2 trillion in just five years.

Cybercriminals love to target small businesses and 43% of online attacks are aimed at them. The problem is a meager 14% of these firms have made the effort to protect themselves against such attacks. If you are a small business owner, you need to prioritize information security.

IT experts guarantee that every modern company’s state of the art perimeters will be breached eventually. Therefore, for small businesses, it’s no longer about if these security threats will happen but when they will take place.

To make things worse, the results of cyber attacks rise and such incidents now cost small businesses an average of $200,000. About 60% of the businesses that were breached have gone out of businesses six months after they were attacked.

The number of occurrences of these cyberattacks has gone up as well with over 50% having of the total number of small businesses suffered a breach within the past year. Plus, 4 out of 10 small companies having suffered multiple cyberattacks.

Even though this is already the case, 66% of the executives of small businesses still think they won’t be targeted by cyber criminals. Moreover, six out of ten don’t have any cyber defense plan of any kind, which means there’s a great need for improved education and industry awareness.

The damage that is brought upon a compromised company becomes worse because it usually takes about 101 days before company owners and business operators detect that they were hacked.

The costs that these compromised businesses need to cover can also pile up quickly. Aside from the attorney’s fees and other ancillary costs that you have to deal with, you will also be faced with the issue of losing customer confidence and loyalty as well as business relationships.

There are 30.2 million small businesses in the U.S. right now. If they wish to be protected from most, if not all types of online threats, they need to set in place a comprehensive IT security strategy.

• Make backups and duplicates of files and data every day.
• A network firewall, anti-virus, and tools for information encryption should be installed and updated regularly. They will scan and counteract harmful programs and viruses, and keep sensitive data safe and secure.
• Employees should only be given access to files, folders, and applications they need to use to do their job.
• Staffers must be trained regularly, every three months at least, and inform them of the latest cybercrime trends and online threats.
• Test the ability of your employees to detect scammers. You should also check how they respond to fraudulent requests.
• Perform tests for ongoing vulnerability and conduct risk assessments on installed applications and computer networks.
• Install cyber analytic tools that could scan user accounts, applications, networks to detect and halt any suspicious activity before they spread.

Why Companies Need Threat Intelligence?

Please remember that cyber threats may come from internal and external sources. With the increasing number of sensitive data that businesses handle these days, the best cyber defenses today are multipronged.

Call SpartanTec, Inc. and let our team of IT experts help you set up measures to protect your business from cybersecurity threats.

SpartanTec, Inc.
Wilmington, NC 28412
(910) 218-9255
https://spartantec-wilmingtonnc.business.site/

Cities Served:
Wilmington, Silver Lake, Sea Breeze, Carolina Beach, Eagle Island, Leland, Wrightsboro

Malware And Viruses On Apple/Mac Systems Are On The Rise

For most of Apple's history, the company has been able to cast itself as a safer alternative to Windows-based computers.Hackers tended to focus the bulk of their efforts on Wintel boxes (Windows processors), rather than Apple machines. That has been changing in recent months. According to research conducted by Malwarebytes, over the past twelve months, there has been a significant upsurge in the number of attacks made against Macs.

To give you a sense of the scope and scale of the increase, in prior years, the average number of detections per Mac clocked in at 4.8, while the number of detections per Windows-based PC was 5.8. In 2019, the average number of detections per Windows-based PC remained unchanged, while the average number of detections per Mac spiked to 11, more than doubling in a single year.

The researchers note, however, that the types of threats Mac users face are very different from the threats presented against Windows-based PCs, and are generally not dangerous. For instance, the most common infections Mac users suffer from are adware programs that display unwanted ads to infected recipients.

Naturally, there are cases of ransomware, keyloggers and banking trojans that target Macs. However, they are relatively less common than similar infections on Windows-based PCs.

If you're a Mac user, don't breathe a sigh of relief just yet though. The Malwarebytes research team concludes by warning us. They say although the attacks against Macs are currently less destructive than the attacks made against Windows-based PCs, that could change at any moment. There's nothing whatsoever keeping the hackers from swapping out adware in preference for a much more threatening piece of code.

All that to say, whatever type of computer you use day to day, it pays to keep your guard up. Nobody is truly safe.

Be proactive when it comes to securing your systems. Consult SpartanTec, Inc. now and let our team of IT experts help you in protecting your network and systems from malware, viruses, and all other kinds of online threats. 

SpartanTec, Inc.
Wilmington, NC 28412
(910) 218-9255
https://spartantec-wilmingtonnc.business.site/

Cities Served:
Wilmington, Silver Lake, Sea Breeze, Carolina Beach, Eagle Island, Leland, Wrightsboro

Beware Of Documents Asking To Enable Content

If you work in the financial sector, be advised that there's a large scale botnet-driven malware campaign underway. It has been targeting firms in both the US and the UK.

The malware at the heart of the campaign is Emotet, which began life as a banking trojan, but it has morphed into something quite different in recent times.

It's now a full-fledged botnet and its creators are leasing it out to anyone who can pay.
Make no mistake, the latest configuration of Emotet isn't a threat to be taken lightly. Last year, it accounted for almost two thirds of malicious payloads delivered via phishing attack. The malware was heavily used throughout much of 2019, suffered a marked decline during December, and then came roaring back to the fore in January of 2020.
While the major thrust of this latest campaign is aimed at financial institutions, a small number of attacks have been made against companies in the media, transportation, and food industries.

The campaign is being conducted largely by phishing emails that contain a Microsoft Word Document that pretends to be an invoice for a service recently rendered. The email subject line varies but in all cases it mirrors the invoice and/or bank details.

Naturally, if a recipient attempts to open the invoice, he or she will get a popup box indicating that Macros must be enabled in order to properly view it. If the recipient clicks the button to enable macros, the malicious payload will be installed.

This is time tested and a reliable method of getting malicious code onto target machines. It's been around for years, but it's still in use because it's so effective. Make sure your employees are aware of the threat and stay vigilant. If the early indications mean anything, 2020 is going to be a very trying year.

Call SpartanTec, Inc. in Wilmington to protect your network against malware and other threats that may trick you or your employees to grant access to sensitive business information. 

SpartanTec, Inc.
Wilmington, NC 28412
(910) 218-9255
https://spartantec-wilmingtonnc.business.site/

Cities Served:
Wilmington, Silver Lake, Sea Breeze, Carolina Beach, Eagle Island, Leland, Wrightsboro

New Malware Can Spy On You In Scary Ways

There's a new strain of malware in the wild. It is targeting Android devices and disguised as an innocuous chat app.

Researchers at Trend Micro have discovered it in two different apps so far:  Chatrious and the Apex App.  Chatrious has since vanished from Google's Play Store, but at the time this piece was written, the Apex App is still available for download.

If you have either of these, you should delete them immediately.

In both strains unearthed so far, when a user downloads the app and launches it, the program will quietly connect to a command and control server. It will then begin rooting around in the device the app is installed on, collecting contact lists, text messages, call logs and any files stored locally on the device.

In addition to that, the malware can activate the device's microphone to create audio recordings to be sent to the command and control server, and it is capable of taking screenshots of anything displayed on the device.

The app has only been found on the Play Store at this point. However, an analysis of the code reveals that the person or group behind it has already built in hooks that would make it capable of attacking iOS and Windows-based machines. The researchers fear that this malware is in an early stage of development.  What they found in the code points to this being the leading edge of a much larger and more widespread attack.

In addition to its being a potentially devastating piece of malware, the researchers indicated that this code would be perfect for conducting highly advanced cyberespionage campaigns. That is, given that high ranking corporate and government employees have such a wealth of information on their phones and almost always keep them close at hand.  The ability to make recordings of things going on in the immediate vicinity of the infected device could lead to no end of trouble.

In any case, if you have either of the apps mentioned above installed on your phone, delete them immediately.  Trend Micro has promised further updates about this latest malware threat as they get them.

Amp up your cybersecurity measures with the help of SpartanTec, Inc. in Wilmington. Call us now and let our team develop the most suitable IT security strategy for your company.

SpartanTec, Inc.
Wilmington, NC 28412
(910) 218-9255

https://spartantec-wilmingtonnc.business.site/

Cities Served:
Wilmington, Silver Lake, Sea Breeze, Carolina Beach, Eagle Island, Leland, Wrightsboro

Ransomware Continues To Be A Problem For Some

It's been the better part of two years since the outbreak of the Wannacry ransomware epidemic.  Unfortunately, all this time later, some companies are still dealing with the fallout.  According to the latest research, Wannacry is still infecting hundreds of thousands of computers around the globe.

As grim as that sounds, it's not all bad news. After all, the malware has been rendered harmless by the now famous "kill switch" discovered by Kryptos Logic security researcher Marcus Hutchins, who found a glaring flaw in the design of the software. The flaw allowed him to register a domain and encode it with instructions that would keep the ransomware component of Wannacry from activating and actually encrypting files.

That, however, did nothing to get rid of the malicious code infecting legions of PCs around the world. Sadly, much of the code remains in place on infected machines, silently lurking in the background. Kryptos Logic is uniquely positioned to know, since they control the kill switch domain and have continued to monitor traffic to it since building the kill switch on it.  To this day, their site continues to be pinged by new IP addresses as the now toothless infection continues to spread.

It's not hard to see why the removal of a piece of malware that has been rendered suddenly toothless takes a lower priority for busy, and often harried IT security professionals.  Leaving the code in place on infected machines is not without risk, however.
It is possible, however unlikely, that the hackers who built the program to begin with could find a way to get around the kill switch.  If that should happen, then we'll be facing the full fury of the epidemic all over again, something no one in the field of digital security wants to contemplate.

The bottom line is simply this:  If you were impacted by Wannacry when the outbreak initially occurred, it's worth double checking to make sure that all traces of the malicious code are gone from your network.  Better safe than sorry.

Staying clear of ransomeware can be tricky. Call SpartanTec, Inc. of Wilmington today to rid yourself of this hazard.

SpartanTec, Inc.
Wilmington, NC 28412
(910) 218-9255

https://spartantec-wilmingtonnc.business.site/

Cities Served:
Wilmington, Silver Lake, Sea Breeze, Carolina Beach, Eagle Island, Leland, Wrightsboro