Any data you collect, you must protect. You might not think your business is big enough (or noteworthy enough) to be targeted by hackers, but the truth is, those are the reasons you are a target. It is estimated that by 2020, more than 24 billion devices will be connected to the Internet, so it is imperative that you follow simple, yet crucial, steps to ensure your data and information are kept safe.

Here are some variables you--and the other people on your network--need to be aware of. 

Phishing

Phishing attacks are some of the most prevalent attacks being made in 2019. Basically, users will send you an email that seems to be from a user the recipient might know. If a user interacts with that email by clicking on a link or downloading an attachment, the phishing scam is a success. A successful phishing scam is a huge problem for your business. 

You will want to train your staff on how to spot and avoid phishing attacks. Phishing attacks have been developed to be subtle and admittedly easy to miss. There are, however, several tell-tale signs that an email is legitimate. Hackers know that the weakest link in any business or organization is the employees. Do your employees know how to recognize an out of place email? It is crucial that you take the time to train your employees the art of phishing identification. 

Secure Passwords

Passwords are the standard in which most people use to keep files secure and to authenticate access to devices, platforms, programs, etc. Understanding what makes a strong password can go a long way toward securing your IT resources. Some best practices include:

• Creating strong, unique passphrases
• Changing passwords frequently
• Using Upper and Lowercase letters, numbers, and symbols

Multi-factor Authentication 

Multi-factor authentication, often rolled out as two-factor authentication, puts an additional step between you, and potential threats to your network or data. You use a password to unlock a 2FA/MFA platform that requires you to get a randomly-generated code from a third-party device to gain access. Since you need a third-party device/account to open the application, account, or device protected by 2FA/MFA, that account is more than twice as secure. 

Applications and Software Updates

In order to say ahead of security attacks, the software you use cannot have vulnerabilities. As a result, patching and updating software is essential to comprehensive security. If you are going to remain secure you will want to be sure to stay up-to-date on your updates. 

How Do I Know If My Systems are Safe?

So, you want to know if you are safe from a cyberattack? To put it lightly: nobody is. By associating security preparedness with cybersecurity and routinely taking proactive, preventative measures to enhance your security position, you reduce the chance that your organization will have to suffer from downtime, data loss, and reputation damage that a data breach would bring your company.

If you would like more tips; or, if you would like to talk to one of our experts about network security, call us today at (604) 513-9428.

May

May 2, 2019 - Citrix

Conferencing and digital workplace software company, Citrix, revealed that hackers gained access to the company’s network between October 2018 and March 2019. Data stolen included Social Security numbers, financial information, and data of current and former employees.

May 3, 2019 - AMC Networks

1.6 million users of AMC Network’s Sundance Now and Shudder streaming services had their data left exposed through a database that was left unsecured. Names, email addresses, subscription details were compromised. 

May 9, 2019 - Freedom Mobile

Freedom Mobile, a Canadian mobile provider had an estimated 1.5 million customers’ personal and financial information left exposed on a third-party server. The types of data left exposed included names, email addresses, mailing addresses, dates of birth, and credit card information.

May 13, 2019 - Indiana Pacers

The legal team behind the National Basketball Association’s Indiana Pacers was the victim of a major phishing attack. Employee and customer names, addresses, dates of birth, Social Security numbers, passport numbers, driver’s license numbers, medical insurance information, card numbers, digital signatures and login information. No number of affected individuals has been given by the team.

May 14, 2019 - WhatsApp

WhatsApp has experienced a security flaw that provided access to an Israeli government surveillance agency, NSO Group. NSO Group had limited access to the microphone, camera, and WhatsApp message text of the app’s 1.5 billion users. 

May 20, 2019 - Instagram

Facebook-owned Instagram, fell victim to a data breach that exposed more than 49 million Instagram influencers, celebrities, and brands’ Instagram information when an Indian-based social media marketing company left it exposed. 

May 24, 2019 - Canva

The 139 million users of Canva, a cloud-based graphic design tool, had their names, usernames, and email addresses exposed when hackers infiltrated their server. 

May 24, 2019 - First American Financial Corporation

First American Financial Corp., a leading title insurer for the U.S. real estate market, had 885 million customers’ Social Security numbers, bank account numbers, mortgage and tax records, wire transaction receipts, and driver’s license images compromised for all customers as far as back as 2003.

Other May breaches: Inmediata Health Group, Uniqlo, Wyzant, Flipboard, Checkers (the fast food chain).

June

June 3, 2019 - Quest Diagnostics

Almost 12 million patient records have been compromised when hackers took control of the payments page of AMCA, a major payment vendor for Quest Diagnostics. Data such as financial account data, Social Security numbers, and health information (ePHI) were left exposed.

June 4, 2019 - LabCorp

In the same hack, LabCorp announced that 7.7 million of its customers were impacted. 

June 6, 2019 - Opko Health

In the same attack, Opko Health had 422.600 customer and patient records compromised. 

June 10, 2019 - Emuparadise

The gaming website Emuparadise had their users’ IP addresses, usernames, and passwords exposed in a data breach. 

June 11, 2019 - Evite

More than 100 million users of the Evite event planning app have had their information put up for sale on the dark web. Information that was stolen included names, email addresses, IP addresses, and cleartext passwords. Some even had their dates of birth, phone number, or postal address exposed.

June 11, 2019 - Total Registration

Kentucky-based Total Registration, a facilitator of scholastic test registrations had their entire service compromised. Victims, who were mainly students who had registered for PSAT and Advanced Placement tests, had their names, dates of birth, grade level, gender, and Social Security number exposed. 

June 12, 2019 - Evernote

A security vulnerability in Evernote’s Web Clipper Chrome extension gave hackers access to the online data of over 4.5 million users. Exposed data includes authentication, financial, all private communications, and more.

June 20, 2019 - Desjardins

Over 2.7 million individuals and 173,000 businesses had their data stolen by a single Desjardins employee. Canada’s largest credit union, the hack resulted in the exposure of names, dates of birth, social insurance numbers, addresses, phone numbers, and email addresses of customers

Other June breaches: Oregon Department of Human Services, U.S. Customs and Border Protection, EatStreet, Dominion National

July

July 17, 2019 - Clinical Pathology Laboratories

Due to the AMCA breach that affected Quest Diagnostics, Opko Health, and Labcorp, Clinical Pathology Laboratories had 2.2 million patients’ personal and medical information exposed with an additional 34,500 patients’ credit card or banking information breached. 

July 18, 2019 - Sprint 

A still unknown number of Sprint customer accounts were hacked through Samsung.com’s “add a line” website. Some exposed information included names, billing addresses, phone numbers, device types, device IDs, monthly recurring charges, account numbers, and more. 

Other July breaches: Maryland Department of Labor, Los Angeles County Department of Health Service, Essentia Health, Fieldwork Software, Los Angeles Personnel Department

August

August 5, 2019 - Poshmark 

The online marketplace, Poshmark, has announced that they’ve been hacked. Usernames and email addresses of an unreported amount of clients have been exposed in the breach. Poshmark has nearly 50 million users.

August 5, 2019 - Stock X

The online fashion-trading platform had its over 6.8 million user accounts exposed. Data that was out there included customer names, email addresses, usernames and passwords, shipping addresses, and purchase histories. 

August 9, 2019 - CafePress

A data breach at CafePress, a custom t-shirt and merchandise company, exposed the names, email addresses, physical addresses, phone numbers, and passwords of over 23.2 million customers. 

August 15, 2019 - Choice Hotels

Hackers left over 700,000 guest records exposed in a coordinated extortion attempt on the Choice Hotel chain. Stolen information included names, addresses, and phone numbers. 

August 16, 2019 - Biostar 2

VPNMentor and independent security researchers uncovered a data breach containing over a million individuals’ facial recognition information as well as the unencrypted passwords and usernames of 27.8 million individuals exposed from Biostar 2, a biometric security platform. 

August 27, 2019 - Hostinger

Hostinger, a web hosting company sent out an email to their 14 million clients who had their information hacked through an API server. As a result, first names, usernames, email addresses, IP addresses and hashed passwords were exposed.

Other August breaches: Presbyterian Healthcare Services, State Farm, MoviePass

Before your business has its network breached, data stolen, and reputation irreparably harmed, call the security professionals at Coleman Technologies to do a full security assessment. We can help you keep your data and reputation intact. Call us today at (604) 513-9428 to learn more. 

Here’s what we know:

Capital One has admitted that the personally identifiable information (PII) of over 100 million American and Canadian credit applicants’ information has been exposed. The company did admit that no credit card account numbers or authentication credentials were compromised in the hack. They also go on to mention that in 99 percent of the files, social security numbers were not compromised. The largest category of information that was accessed were individual and small business credit applications that span from 2005 to 2019.

The perpetrator, Paige Thompson of Seattle, Washington, was a former software developer for Amazon Web Services (AWS), which took advantage of a firewall misconfiguration to gain access to the information, AWS confirmed Monday. The flaw came as a result of a setup error and not a flaw within the massively popular AWS.

The breach happened on March 22 to 23, 2019. Thompson was apprehended as a result of being reported to Capital One for storing incriminating evidence on her Github and Slack accounts. Capital One contacted the FBI on July 19, 2019 and after a short investigation, Thompson was arrested and indicted by the Western District of Washington.

The CEO of Capital One, Richard Fairbank released the following statement:

“While I am grateful that the perpetrator has been caught, I am deeply sorry for what has happened. I sincerely apologize for the understandable worry this incident must be causing those affected and I am committed to making it right.”

For a full report of the event, visit: https://www.capitalone.com/facts2019/

Capital One has said that it will inform you if you have been a victim of this massive attack, but if like many of us, too much is at stake to wait for the company to reach out to you, you can take some immediate steps to safeguard your personal information.

• Check your accounts - Account monitoring and fraud detection should be a major part of any action you take to secure personal information.
• Change passwords - One great way to at least feel more secure after a major hack like this is to immediately change your passwords.
• Freeze your credit report - One option you can take to protect yourself is to freeze your credit report, this won’t let any credit reporting services check your credit, meaning if someone were to try to take money out in your name that the banks wouldn’t be able to authorize credit.
• Avoid scams - A big part of keeping any data secure is to not give unauthorized parties access to it. That means avoiding phishing attacks and other scams.
• Continued vigilance - Vigilance over your account information, your personally identifiable information, and your overall financial health is more important than ever. As mentioned above, credit monitoring and fraud detection services give users tools to combat unauthorized access.

Keeping yourself and your business secure online is more difficult than ever. To learn more about data security, subscribe to our blog.

Before we get too deep, we want to emphasize that there are two primary categories for threats to your business: external and internal.

External

External threats are those that come from outside your business’ network. The majority of threats will fall into this particular category, and it contains a lot of big names that you have likely heard in the past. Here are a couple of examples of threats to your business, as well as what they can lead to:

• Viruses/Malware: these are malicious bits of code or full-blown software programs that can be customized by hackers to perform a certain role. It would take far too long to list off everything that can be done with these kinds of threats, as the options are literally limitless.
• Ransomware: Sometimes malware will encrypt the user’s files and demand payment for the decryption key. Without access to important files, businesses might crumble under the pressure, losing both money due to the payment and a little bit of dignity in the process. In cases like this, it’s important to never pay the ransom, as it only serves to fund further attacks.
• Spam: Hackers like to send countless emails with threats attached to them, hoping that someone will download them and expose their organization’s network to threats. Spam can be prevented for the most part, but if left unchecked, your business could wind up installing threats on your network by accident.

Internal

Internal threats can come from the most unlikely sources, as even the most well-meaning employees could accidentally expose your business to potential threats. Furthermore, there could even be more sinister forces at work with employees potentially trying to actively sabotage operations. Here are some ideas for threats and what could happen from them:

• Phishing Attacks: Your users are your weakest link. While you might think that you have an understanding of adequate security practices, they may not, leading hackers to utilize underhanded tactics to leverage this to their advantage. Phishing attacks convince users to click links, download attachments, or provide credentials/sensitive information.
• Account Hijacking: Let’s say an employee’s account is hijacked by an external threat. You might see account activity from your employee, but how do you know that it’s not someone else using their account? Data could be stolen, or worse.
• Access Control: Have you ever fired an employee? Have they ever resented you for it? Chances are they may have felt the urge to go into their old accounts and cause some trouble. These internal threats could lead to embarrassing situations, as well as a loss of control over certain types of data. It’s up to you to cut off access as soon as you can.

Does your business need help maintaining security and keeping track of the countless threats out there? Coleman Technologies can equip you with the best security measures on the market. To learn more, reach out to us at (604) 513-9428.

The Internet of Things is essentially a massive network of connected devices. Some of them have not traditionally taken advantage of network connectivity, but now depend on it. The more obscure examples of Internet of Things devices include kitchen appliances and other oddities, whereas the more usable devices include watches, wearables, connected vehicles, smart homes, and more. Some Internet of Things devices can even communicate with others, sending data and using it for a certain functionality. It all coalesces into a security disaster waiting to happen.

To prepare for this, you need to implement what’s called an Internet of Things policy within your workplace. Here are some ways you can keep the Internet of Things from devastating your business.

It’s Impossible to Stop Them All

One of the most valuable lessons of dealing with Internet of Things devices is that it’s impossible to keep tabs on every single device that enters your office. If you assume that each employee has a smartphone, a laptop, and at least one or two other minor devices, it all adds up. Therefore, you need to prepare for the worst by expecting it.

You Need to Do Your Best

The best way to protect against the Internet of Things is to be prepared for them. Implementing security measures is key, and the best ones for this situation include a Unified Threat Management system (UTM) and a Bring Your Own Device policy (BYOD). What this enables is the ability to eliminate threats and keep them from entering your network in the first place, including from your employees’ personal devices. It also helps to have a password-protected network so that passing devices don’t automatically connect to your wireless network.

Working with a managed IT provider like Coleman Technologies can make it easier to manage all of the devices that make their way to your business’ network. To learn more about what we can do for your organization, reach out to us at (604) 513-9428.

Profitable Types of Data

Believe it or not, even a small business with a handful of clients has data worth stealing. You’re in business to make money, and by virtue of this fact, you likely collect and store financial information. In fact, you collect a ton of valuable data. The type of data that hackers are looking for.

In addition to all of the financial details you collect, there is also all of the contact information regarding leads, clients, and customers. With so many emails and phone numbers stored on your infrastructure, hackers can have a field day. They will have all the information they need to steal funds, distribute malware, and create unpleasant situations for your business.

The Unpredictability Factor

Not all hackers have any specific goal in mind when they hack you. Sometimes all they want to do is make your life miserable. The unpredictability associated with hackers is one of the most dangerous parts of them, as they can take advantage of any overlooked vulnerabilities to create a problematic situation for you.

The Impact of Security Negligence

If your business falls victim to a hacker, it’s certain to affect your business' operations. In some cases, it could be subject to compliance fines that could break your budget and put your business at greater risk. Furthermore, you could lose access to important data that makes your business work, threatening its future and all but guaranteeing that recovery can never happen. Therefore, the importance of protecting your network can never be overstated.

Coleman Technologies can help your business implement the security solutions needed to maximize protection from threats. To learn more about what we can do for your organization, reach out to us at (604) 513-9428.

Outdated software is an issue that all businesses have to deal with. The fact that so many organizations don’t routinely update their software solutions is pretty telling. For one, many businesses simply don’t have the resources at their disposal to make sure maintenance is performed on a regular basis. Granted, unless a business has taken substantial steps toward upgrading away from software that has reached its end of support date, they will have to suffer the consequences.

What Does “End of Life” Mean?

End of Life, also known as End of Support, is a term that is used to identify software that is not updated or patched after a specific period of time has passed. Certain Microsoft products can utilize the Extended Security Update, but only for a maximum of three years, meaning it’s more efficient and cost-effective to upgrade away from your old systems before they reach the end of support date.

What You Need to Do

How would your business be affected by a potential security breach? Since you won’t be receiving security patches or updates, you’ll need to consider this possibility. Following a major security breach, you’ll be forced to upgrade your systems anyway, so not only will you have those costs, but you’ll have to deal with the fallout of a data breach. It’s never too early to start taking preventative measures and think about the future of your infrastructure, as well as who will be responsible for the management, maintenance, and upgrading of your business technology.

Before Windows SQL Server 2008’s End of Support date arrives, consult this list of upcoming end of support dates and take the necessary steps to upgrade your technology. It’s better to do so now than wait until it’s too late.

We Can Help

Worrying about your business’s IT infrastructure is something that you simply don’t have time for. A managed service provider like Coleman Technologies can help you achieve affordable and accessible technology support, including the updates and patches needed to maintain network security. We can even help monitor your infrastructure for potential End of Support software that will soon be outdated. To learn more, reach out to us at (604) 513-9428.

The GDPR

Prior to the implementation of GDPR, individual data privacy was mostly left up to the individual. In non-EU circles, this is still mostly the case, but GDPR has made issues related to this much more noticeable, such as the way this personal information can be used for corporate financial gain. GDPR was a response to these organizations failing to properly utilize user data. This included people having their personal information like names, addresses, email addresses, and even medical/financial information being utilized by advertising companies or worse. The largest corporate technology companies were using the data of individuals to turn a massive profit--a practice that seemed to be unfair to consumers.

EU member states have been legislating their own data protection laws prior to the establishment of GDPR. The United States has yet to jump on board this trend, though. With GDPR, organizations are seeing themselves as members of the global economy with strict new guidelines to adhere to. The GDPR is essentially an amalgamation of the laws that had previously existed, requiring all businesses to report certain types of personal data breaches within 72 hours to a supervised authority mandated by EU member nations.

This case was a landmark in that businesses were forced to remain more cognizant of how important data management is for the people who take advantage of their services. Before GDPR, many organizations failed to protect the data of their customers, staff, and vendors. In a way, GDPR forced them to begin thinking about data management, training staff, and investing in security.

One Year In

The results of GDPR have been mixed, to say the least. Over 59,000 personal data breaches have been identified by companies notifying regulators. The sanctions for failing to comply with GDPR mandates carry fines of up to €20 million, or up to 4 percent of total revenue from the previous year (whichever is larger), leading to a more targeted and strategic approach to data security, as well as more prompt reporting of when data breaches occur. To take a look at the results the GDPR had in its first eight months, download the DLA Piper GDPR data breach survey, here.

Overall, the GDPR provided a substantial boost to data breach reporting speed. The mandate gave organizations up to 72 hours to notify breached parties, so there were fewer instances of breaches going years before being revealed to the general public. The GDPR has also resulted in nearly doubling the amount of reported incidents.

The fines resulting in these breaches being reported, however, is considerable to say the least. Fines totaling up to €55,955,871 have been levied against the companies responsible for the 59,000 reported incidents, with most of this being struck against Google. A French GDPR calls this year as more of a transitional phase rather than an indicator of the long-term effectiveness of the measure.

Effects Abroad

U.S. companies that do business in Europe aren’t safe from the measures initiated by GDPR, but organizations have started to change up their approach to data privacy. Many legislators are pushing for similar measures to GDPR, and CEOs like Apple’s Tim Cook have labeled data privacy a “fundamental human right.”

Unfortunately, this viewpoint seems to be in the minority of major American tech company leaders. Still, this hasn’t stopped states like California from implementing its own data privacy law. Other states like Colorado, Massachusetts, and Ohio were inspired to pass their own data privacy laws. Perhaps the federal government will consider acting to fill in the holes left by these data privacy laws.

What are your thoughts on GDPR and data privacy regulations? Let us know in the comments.

Let’s explore some of the risks that the IoT can present.

The Security Issues of the IoT

The Internet of Things has added utility to many devices, expanding their potential in ways that would otherwise be impossible. This has only been further augmented by the access to personal devices that many employees enjoy through Bring Your Own Device policies.

However, these benefits have come with an assortment of considerable risks alongside them. Devices that are a part of the IoT are notoriously vulnerable to many cyberattacks, which means that they could potentially be used as a point of access to your business’ network. From there, a cybercriminal has plenty of opportunities to create issues - whether that’s by stealing your data, hijacking your devices to be used in a botnet, or whatever their goal may be.

This problem is only exacerbated by the tendency for IoT devices to go without updates, whether through the negligence of the manufacturer or of the consumer. Without these updates, security flaws go unresolved, and the devices are thereby left vulnerable.

Consider how many devices are now manufactured that connect to the Internet. Smart watches and other wearables, smart speakers and televisions - really, almost anything with the word “smart” in its name - we have more or less surrounded ourselves with the Internet of Things. This includes the time we spend in the workplace, despite many of these devices not being visible on the network to IT. As a result, it has become almost impossible to track all the devices that attach to a network, which has developed into a new issue for businesses.

Shadow IoT

Thanks to the public demand for convenience and advanced functionality, more and more IoT devices are being manufactured all the time. If any of these devices makes its way into your office without the knowledge and approval of IT, you have a shadow IoT problem.

If you do, you aren’t alone.

In 2017, 100 percent of organizations surveyed by an IoT security firm were found to have consumer IoT devices on the network that qualified as shadow IoT. Another report, from 2018, stated that one-third of United States, United Kingdom, and German companies have over 1,000 shadow IT devices on their networks every day. Combine this with the security shortcomings discussed above, and you have a recipe for a cybersecurity disaster.

You may remember the Mirai botnet, which struck back in 2016. This botnet was built up of over 600,000 devices at its peak and focused primarily on IoT devices. Once these devices were identified by Mirai, they would be attacked and infected, adding more computing power to the botnet. Mirai is far from the only example, too… cybercriminals have been known to hack into IoT devices to gain network access, spy and listen in on conversations, and otherwise prove themselves to be a nuisance.

How to Minimize Shadow IoT

Clearly, shadow IoT isn’t a good thing for any organization. There are a few things you can do to help protect your business from the security issues that shadow IoT can cause.

• Accept IoT devices in the workplace. If your employees really want to use one of their devices at work, they’re going to. Instead of shooting down requests to bring in these devices, make it easier for your employees to do so through the proper channels - and make sure your employees are aware of these channels. Openness and cooperation can be effective tools as you try to get your team on the same page you’re on.
• Keep IoT devices separate. To better protect your network, you will want to consider utilizing a dedicated Wi-Fi network for IoT devices, configured to allow them to transmit the information they generate while blocking any incoming calls to them. This will help prevent threats from being transmitted to IoT devices.
• Seek out potential threats. Not all shadow IoT necessarily can be found on an organization’s network, as over 80 percent of the IoT is wireless. This means that you need to be monitoring your wireless signals for shadow IoT devices and networks.

Your business’ security is important - too important to be undermined by an insecure consumer device that was brought in without your knowledge. You need to get out ahead of shadow IoT, as well as the other threats that could do your business harm.

Coleman Technologies can help. Our professionals are well-versed in cybersecurity best practices and how to use them to your benefit. To find out more about what we can do for your business, reach out to us at (604) 513-9428.

Today’s world is driven by data. As a result, information systems have to be secured. That really is the bottom line. Business is all about relationships and without proper security protocols in place, there are some very serious situations that could completely decimate the relationships you’ve worked so hard to forge. While today’s hackers have a lot of different ways to breach an organization’s network, data breaches that occur as a result of lax security are unforgivable from a customer standpoint. Some organizations can spend more on security than others, but it with the landscape as it is today, it has to be a priority, no matter your IT budget.

Here are some of the regulations all business owners and IT administrators should know:

• GDPR: The European Union’s General Data Protection Regulation is as comprehensive a data protection law as there is. Its aim is to protect the citizens of EU-member countries from data breaches. The GDPR applies to every organization that processes personal information of people residing in the EU.
• GPG13: Known as the Good Practice Guide 13, it is the U.K.’s general data protection regulation for organizations that do business in the U.K.
• HIPAA: The Health Insurance Portability and Accountability Act puts several guidelines on how patients’ data is shared and disseminated by insurers and health maintenance organizations.
• SOx - The Sarbanes-Oxley Act requires corporate records to be kept for seven years to ensure that there is transparency in the accounting. For IT this means being able to have access to data to run reports when called upon.
• PCI-DSS - Payment Card Index Data Security Standard are regulations enacted to try and reduce fraud by protecting an individual’s credit card information.

That’s just a few of the regulations business owners and IT administrators have to be cognizant of. For business owners there are several more, like the federal and state tax codes, and the adherence to the Affordable Care Act. All these regulations seem pretty straightforward and necessary until you begin to roll them out for your business. Then they just get expensive. In the first-ever Small Business Regulations Survey conducted by the National Small Business Association, the numbers reported, although not comprehensive by any means, weren’t pretty. To put it frankly, the cost to the small businesses that reported, would sink as many or more new businesses.

“The average small-business owner is spending at least $12,000 every year dealing with regulations,” NSBA President Todd McCracken said, “This has real-world implications: more than half of small businesses have held off on hiring a new employee due to regulatory burdens.” The report goes on to state that the average regulatory costs to start a new business venture add up to a whopping $83,019. These figures don’t take in to account the dozens of man hours each year spent on these very complex problems. It should be stated that the NSBA has been a long-standing advocate of reducing regulations on small businesses.

Regulators are paid to be skeptical, but overall they are put in place for a purpose, as oversight to ensure sustained adherence to data protection laws. How much can they demand from a small business? The question begs for analysis, as to listen to entrepreneurs talk about them regulations are unnecessary, but as stated before, these regulations aren’t just implemented willy-nilly. They have empirical evidence of immoral or unethical wrongdoing attached to them. Moreover, it becomes clear that the financial pain these entrepreneurs are in is indefinite, which means that it is highly debatable. The truth is that each scenario needs to be seen in perspective in order to understand just how much certain regulations are costing a business.

One thing is certain: that the average small business pays more for their regulatory compliance programs than larger businesses in the same market do. That disparity is a main point of contention for many small business owners, as it directly affects a company's ability to compete. Some studies have seen organizations that have less than 20 employees charged nearly 60 percent more than slightly larger businesses. Getting into which regulations are onerous and which are necessary would take an examination of each one in detail, so it’s worth it to repeat that these regulations were bred out of situations where individuals were hurt, making them an important part of the oversight process.

To Comply or Not To Comply? That Is the Question
Small business owners who have been reprimanded or fined as a result of a lack of regulatory awareness have a tendency to get the message, but if an organization is notoriously noncompliant and has slipped past regulators, there is a tendency for them to stay the course; and, that course is filled with nothing good. Many european and multinational corporations are expecting to invest $1 million toward their GDPR compliance. Obviously this figure, despite being higher per user, will be substantially lower for small and mid-sized businesses. The cost, however, remains significant, and while an organization could probably get around it for a bit, when it hits, it could just sink the whole business.

According to Infosecurity Magazine, the average cost of compliance with GDPR is costing enterprises and average of $5.5 million, which comes in about a third of the estimate cost of noncompliance, $14.82 million. That’s a lot of cheddar. It stands to reason that if you are going to spend upwards of 10 percent of your yearly IT budget on ensuring your organization is compliant, that you meet the criteria under the regulation. The best way to do that is by finding affordable solutions that won’t take as big of a chunk out of your operational budget every year.

More than the capital, a business that doesn’t adhere to simple IT regulations probably isn’t adhering to other regulations. Would you want to do business with someone that you know won’t do what’s asked of them to protect YOUR data? Unreputable businesses that are looking to gain an edge by not meeting regulations will pay later for not spending now, end of story.

Compliance and Your Business
Finally, we get to your business. How are you going to plan for your compliance burden? The best way is to educate yourself on what exactly your business needs to plan for by looking at the regulatory mandates, sure, but more often seeking out organizations who have already insulated themself from the risks associated from noncompliance. This is where a managed IT service provider (MSP) can be a godsend. Since we take security compliance extremely seriously, and deal with multiple businesses that represent several vertical markets, we have the perspective that can provide a clear strategy on how to avoid problems staying compliant.

Moreover, MSPs like Coleman Technologies use extremely sophisticated monitoring, management, and reporting software to reduce risk and put our clients in the best position to prepare for any audits or assessments that need to be completed by regulators. Since the regulatory landscape is constantly changing, our IT professionals are in a unique position to serve as both IT administrator and regulatory consultant.

If you are searching for a way to control your compliance situation, look no further than the IT professionals at Coleman Technologies. We can deploy our strategies made up from tried and true industry best practices to virtually eliminate any risk your organization would have as a result of compliance concerns. Call us at (604) 513-9428 today to get started.

Before we go into depth about network and cybersecurity, we’d like to point out just why they are so important. You invest a lot of time and money into making your business what it is. You pay a lot of money for hardware, software, services, and time to give your business a chance to succeed. The act of protecting your business, its staff, vendors, and clients is one that should be taken seriously, because if any are compromised, your business is in trouble.

The Protection of Business Computing

Today’s business uses a computing infrastructure that is much larger and complex than most and includes considerations outside the physical confines of the network. Cloud services have become a very popular product for businesses and individuals alike. Cloud services are hosted in some other place, and by companies that have taken great diligence at securing their solution. For obvious reasons, you can’t guarantee that your cloud-hosted data is 100% secure, but logic suggests that a company offering computing services over the Internet would be in serious trouble if they were to have their security compromised.

These services all have dedicated access control systems that are designed to only let authorized users in. Some organizations also require their staff to utilize two-factor authentication to secure the solutions further.

This brings us to the perimeter of the network. Regardless of a company’s ineptitude with cybersecurity, there is typically some form of firewall that stands between the Internet and the company’s network. If the firewall is properly maintained with threat definitions, it will stop a good amount of unwanted traffic. It’s just not enough. With the immense amount of attack vectors threats are coming from nowadays, a stand-alone firewall is like a single sheet of flypaper in front of a window.

Going the Extra Mile

In order to keep their business’ data and infrastructure safe, many organizations have begun to utilize Intrusion Prevention Systems (IPS). These systems include Intrusion Detection Systems (IDS), software that attempts to block determined threats, and logs network traffic so that IT professionals can go in and see the current state of the network.

For years, this would have been enough technology to keep most threats out. Nowadays, however, it’s really just getting started being vigilant. If you consider your network to be like an onion, you need to understand that each layer needs to have its own set of security protocols that typically come in the form of a dedicated access control system and a firewall.  This way, every “layer” is protected from its perimeter, to the applications, to the databases that hold all your data. This tiered access control system is designed specifically for your needs and is in place to do one thing: protect your assets.

It also works to protect your business against the biggest digital threat on the Internet: phishing attacks.

A phishing attack is where someone outside your network tries to infiltrate it by passing off some form of correspondence as legitimate. It’s all a fraud. Verizon, who does an annual study of cybersecurity, found that around 90 percent of all network attacks are the result of successful phishing attacks. Unfortunately, there is no piece of software out there that will make phishing attacks completely benign. That is why training is so important.

Training Your Staff

Training your staff about phishing (and cybersecurity in general) has to be a priority. You’ve spent a lot of capital and time building what you have, and the thought of losing it because you bullheadedly forged ahead without getting your staff trained up properly could be thought of as shortsighted.

A phishing attack is now the preferred method of hacking. Since security systems have evolved to be hard to crack, hackers now look to use your staff’s legitimate credentials to gain access to your network, applications, and databases. By training your staff about phishing, specifically what to look for, how to react when they come across phishing attacks, and what the consequences of a phishing attack can mean for your company, you should be in a better position to protect your network, infrastructure, and data against the onslaught of outside phishing threats.

To learn more about how to secure your network, train your staff, and acquire the technology you need to protect your business, reach out to Coleman Technologies today at (604) 513-9428.

As we begin, it is important that we acknowledge that the Android operating system has been granted FIDO2 certification. In other words, the FIDO (Fast IDentity Online) Alliance has given the Android OS their seal of approval in regard to the authentication standards that the Alliance has set.

What Does This Mean?

In very simple terms, any Android device running 7.0 or higher with the latest Google Chrome update installed can be used as part of a two-factor authentication strategy - more specifically, as a security key. This includes the support that FIDO2 offers for onboard fingerprint scanners as a means of identity authentication. Currently, this authentication standard is only supported by Android, with no indication of Apple devices incorporating it.

In no uncertain terms, this all means that passwords may soon be phased out.

Abandoning Passwords

Passwords have been the standardized form of authenticating one’s identity for quite some time, despite the potential issues that are present with them. How often have we seen just how many ways a determined cybercriminal has to obtain a password? Between insecure databases filled with credentials and unfortunately successful phishing schemes, millions of accounts have been exposed - and that isn’t even taking all the times an insecure password was guessed into account.

The biggest weakness that any password has is the fact that it can be shared at all, that someone other than the owner can use it. Over any other reason, this is why FIDO2 is likely to become as popular as it is expected to be. When was the last time you successfully shared a thumbprint with someone, after all? Furthermore, FIDO2 keeps all of the information that is pulled from its biometrics onboard the device, keeping it safe from being stolen on the Internet.

As an added bonus, FIDO2 won’t allow the user to input their fingerprint’s biometric data into websites that don’t have sufficient security measures in place.

How to Use Your Android Device as a FIDO2 Security Key

In order to leverage your Android device as a security key, you need to make sure that it meets a few benchmarks. First and foremost, you’ll need to be running at least Android 7.0, with the latest version of Chrome installed. You will also need to have Bluetooth activated, and a Google account with two-step verification enabled.

This is somewhat simple to do. Logging into your Google account, access the Security section. Here, you’ll find the option to activate 2-Step Verification. After a short process, your smartphone will work as a security key.

Authenticating Google Sign-Ins with Your Phone

As long as you have enabled both Bluetooth and Location on your mobile device, any Google service you try to access will prompt you to confirm the sign-in attempt via your phone. This process is exceptionally simple - all you have to do is press Yes on your phone and wait. Once you’ve done so, you can confidently access your Google account, securely. As more developers adopt FIDO2, this enhanced security will only appear more often.

What do you think of this new authentication method? Share your impressions in the comments! While you’re there, let us know if there are any other tips you’d like us to cover!

What Are Biometrics?
Biometrics are a method of authentication that uses some sort of physical attribute or qualifier rather than a password or a key code. Some examples include fingerprints, voice patterns, typing rhythms, and so much more. They are easier to use than your typical passwords or key codes, and even better, they can be used in conjunction with traditional security measures and practices.

Let’s take a closer look at what some of these biometrics are, as well as the most practical way to implement them.

Biometric Types
There are two major categories for biometrics: physical identifiers and behavioral identifiers. Physical identifiers are by far the most common:

• Signatures: Signatures are one of the unique ways you can identify an individual, and you’ve surely seen this biometric used at least once somewhere or another. Whether it’s a transaction or an agreement, a signature can do much to guarantee someone’s authenticity.
• Fingerprints/Physiological Attributes: This particular biometric is often used to secure smartphones. Fingerprints can be used to determine the identity of the user, as well as various other physiological attributes, like palm scanning, retinal scanning, and facial recognition.
• Voice: Voice-based authentication is common all over the place these days, whether it’s a personal user issuing commands to a virtual assistant or a business using voice authentication to navigate automated answering systems.
• DNA: The technology to implement DNA sequencing into authentication is still a ways off, but it’s closer than you might think.

There are other behavioral identifiers that are used for biometric authentication. While these methods are still in development, here are a few examples of them:

• Typing Patterns: People all write in different ways, and the same goes for typing. Therefore, this can be used to determine the authenticity of the user based on their keystrokes and the pressure applied to the keys.
• Navigation and Engagement: In a similar fashion, the way that people navigate applications and systems can also determine identity. Mouse movements are quite showing, as well as how we hold devices.

Reliability (and Risks) of Biometrics
Biometrics are proving problematic to an extent, mostly because they can be inconsistent. Voices can vary depending on the user’s health or age, and faces can change based on a clean-shaven (or bearded) face, a haircut, or a pair of glasses. There are ways to work around this system, and with biometric authentication, there is much that needs to be taken into account.

Security is a Major Concern
This kind of data needs to be heavily protected, as it not only exposes sensitive information, but personal information as well. These kinds of credentials are also not easily changed, as they are heavily based on physical traits. For these reasons, biometrics may take some time to be adopted as the norm.

What are your thoughts on biometrics? Let us know in the comments.

As a result of this increase in phishing attacks, endpoint security has grown much more focused, but the issue with phishing isn’t necessarily an issue with the strategies surrounding your technology--rather, it’s an issue relating to your organization’s users and their tendency for failure. Now, we know this sounds a little harsh, but it’s been proven time and again that employees need security training on how to handle credentials and other sensitive information. Let’s take a look at a couple different types of attacks you can be exposed to, and what you can do to keep your organization from becoming just another company that has suffered from a data breach.

Deceptive Phishing
Deceptive phishing is one of the most common types of phishing scams, and it aims to fool unsuspecting users into handing over sensitive information. This happens when the hacker sends a message to users that impersonates an actual person or company that the organization has some sort of relationship with. These hackers use deceptive phishing to convince users to hand over information like passwords, usernames, account numbers, etc. Since official credentials are being used to access these accounts, it doesn’t immediately become a security concern.

For the most part, these deceptive phishing messages are either ignored by the users, caught by filtering technology, or disregarded when they’re accessed. Unfortunately, the handful that actually do fool the end user are worth the hundreds-of-thousands that are sent to others. To keep your business from making this fatal mistake, you need to focus on increasing awareness of what makes phishing attacks so much different from your average legitimate email.

Some of the telltale signs of phishing messages include misspelled words, problems with sentence structure, and suspicious attachments or URLs. Always hover your mouse over a link before clicking on it to determine its location, and never download an attachment unless you know who’s sending it. Another thing to look out for is any financial institution or vendor demanding payment or access to your account--there are other, more official methods of outreach for methods such as these; and no bank or similar institution will ever, ever ask you for passwords.

Spear Phishing
Spear phishing attacks are targeted attempts against a specific user. For example, someone who sees a message from a coworker might let their guard down, but this doesn’t necessarily mean the message is safe. It just means that some hacker managed to find a way to mimic the sender in a way that is extremely convincing. Spear phishing attacks will often know the target’s name, title, company, work phone number, and much more--all to seem as authentic as possible so the user will click on a malicious attachment or URL.

Even social media isn’t safe from this trend. LinkedIn, for example, is one of the most common places where spear phishing is leveraged. It might be used for connecting with other business professionals, but it’s not hard for a hacker to imitate a business professional. We aren’t saying that you need to avoid social media like the plague, only that you should approach it with some sensible caution.

Pharming
That being said, more people are learning about these attacks by the day, meaning that some hackers have ceased these types of attacks for fear of their efforts being for naught. Instead, they turn to a practice called pharming, which is using an organization’s DNS server to change the IP address associated with the website name. This gives them a way to direct users to malicious websites to steal their legitimate credentials.

To prevent this from happening, it’s very important that you tell your staff to be sure they are entering their credentials into a secured site. The best way to make sure this happens is to look for the “https” in the hyperlink, as well as a padlock icon next to the address. It also never hurts to have an antivirus solution on each endpoint within your organization.

Coleman Technologies can help your business stay as secure as possible. To learn more, reach out to us at (604) 513-9428.

Why Your Employees Need Training
The most notable reason to provide training for your employees starts from their first day on the job, when they might need to be educated on how to use the solutions your organization depends on. This might be time-consuming, but it is critical if you want to save time in the long term. Training employees as soon as possible will mean you’re not leaving employees to figure it out for themselves.

Even more experienced employees will need training every now and then. The average employee will only retain about 40 percent of what is covered during their introduction to a topic, making education a critical part of maintaining operational productivity. Since technology is changing often, you should take some time to improve your training processes.

Training Options
There are many different ways to approach employee training, but one common factor among them all is pairing a new employee with an experienced one to teach them a thing or two about the process. On-the-job training is a practical way to make sure that instruction is taught by someone who knows what they are doing, and it can even help develop relationships between your workers.

On the other hand, when a new technology is introduced to the workplace, your entire staff might need to know how to use it. In cases like this, you can use webinars to help employees “self-teach” themselves on how to use it. Avoid holding all of this training in a single session, though, as it’s better to spread it out so as to avoid a situation where your employees are stuck in training for a week at a time. Some organizations have had success in splitting their teams up into internal groups to help employees learn as much as possible.

If Your Team Needs Help…
A help desk solution is a perfect way to supplement what your employees already know with what they need to know. You can provide your staff with access to trained technology professionals who can provide assistance when it’s needed. Coleman Technologies can help your business get started with technology training and support. To learn more, reach out to us at (604) 513-9428.

Birth of the Internet

The first Internet was born on college campuses. It was built by intellectuals, for academics, without the massive list of considerations that now accompany software development. It spread quickly, of course, and somewhere, pretty early on, it was decided that by being able to support commerce, the Internet could become one of the west’s greatest inventions.

This came to fruition in 1984 when the first catalogue was launched on the Internet. This was followed by the first e-store (at books.com) in 1992, and the first software to be sold online (Ipswitch IMail Server) in 1994. Amazon and eBay launched the following year and the Internet has never been the same.

By then, the academic uses for the Internet had multiplied, as well. By the time Amazon launched, many colleges and universities were offering students access to the Internet as an important part of their continuing education. Boy, was it ever.

Today, you’ll be hard pressed to find a classroom (outside of the poorest school districts in the country) where every classroom isn’t Internet-ready.

College Internet Needs and Cybersecurity

This stands true in university and college circles, as well. Campuses today are almost completely connected. You’ll be hard pressed to find a place on a modern campus that, as long as you have security credentials to do so, you can’t gain access to an Internet connection. In a lot of ways, it is the demand for access that makes network security a major pain point for the modern college. Firstly, having to protect computing networks from a continuously variable amount of mobile devices is difficult. Secondly, the same attacks that plague businesses, are also hindering IT administrator efforts at colleges.

Colleges themselves aren’t doing anyone any favors. According to a 2018 report, none of the top 10 computer science degrees in the United States require a cybersecurity course to graduate. Of the top 50 computer science programs listed by Business Insider only three require some type of cybersecurity course. Moreover, only one school out of 122 reviewed by Business Insider requires the completion of three or more cybersecurity courses, the University of Alabama. Regardless of the metric, it’s clear that learning cybersecurity is not a priority for any school.

Are There Cybersecurity Problems Specific to Colleges?

The short answer is no. That’s why it's so important to get people thinking about cybersecurity any way they can. No industry can afford to have the skills gap between people that hack and the people looking to stop them grow any wider. This is why, no matter what you do (or plan on doing) for a living it’s important to understand what your responsibilities are and how to get them into a place that can help your organization ward off these threats from outside (and sometimes inside) your network.

Many colleges have turned to companies like Cyber Degrees to help them not only educate the people utilizing the college’s networks to why cybersecurity awareness is important, but also help people understand that with the rise of cybercrime and hacking-induced malware, that cybersecurity has become a major growth industry with many facets. In 2015, the Bureau of Labor Statistics found there were more than 200,000 unfilled cybersecurity jobs in the U.S. With curriculums not prioritizing cybersecurity, and with threats growing rapidly, imagine how many are unfilled today. As demand rises for competent individuals to fill a multitude of jobs in the computer-security industry, colleges need to do a better job prioritizing cybersecurity training.

For the business looking into protecting itself, look no further than the cybersecurity professionals at Coleman Technologies. Our knowledgeable technicians work with today’s business technology day-in and day-out and know all the industry’s best practices on how to keep you and your staff working productively, while limiting your exposure to risk. Call us today at (604) 513-9428 to learn more.

Numbers are still coming in as far as how widespread this issue is. As of Monday, cybersecurity firm Kaspersky Lab said potentially thousands of Asus computers were infected, but on Tuesday that number has potentially broken a million.

How Could My Asus Laptop Get Hacked?

This type of attack is called a Supply-Chain Compromise and is one of the most frightening kinds of cybersecurity threats out there. Asus’s software update system was compromised by hackers, putting a backdoor into consumer devices. The scariest part is that this backdoor was distributed last year and it’s just being noticed now.

The good news is this has given Asus plenty of time to plug up the security holes on their end, but if you own an Asus device there is still a chance that it is infected with malware from the initial attack.

What Do I Do Now?

First and foremost, no matter what brand of computer or laptop you have, you need to make sure you have antivirus, and that antivirus needs to be licensed and kept up-to-date.

If you have an Asus device, Asus has released an update in the latest version of their Live Update Software. They’ve also patched their internal systems to help prevent similar attacks from happening in the future. You’ll want to make sure you have Live Update 3.6.9 installed.

Asus has also released a security diagnostic tool that will check your system to see if it has been affected. Click here to download the tool.

We HIGHLY encourage you to reach out to Coleman Technologies if you are running any Asus hardware. It’s better to be safe than sorry.

 What You Need to Know About Cybersecurity

In order to completely understand cybersecurity, you first need to understand what it is, and what you need to protect. Your organization needs to have a cybersecurity structure that covers the following subjects:

• Your Network - Network security strategies typically protect the network and infrastructure from intrusion-whether that be direct intrusion or via the dispersal of malware.  
• Your Applications - Whether your applications are hosted in the cloud or in your own onsite servers, application security protects programs that have access to all your data.
• Your Data - Data security strategies are created to add additional layers of protection to any data you can’t afford to have shared or stolen.
• Your Disaster Recovery - Systems that are deliberately set up to protect your digital assets in case of a disaster need their own protection.
• Policies - In order for you to properly protect your network and infrastructure from your staff, you need to have some very forthcoming policies set out so there are expectations attached to your cybersecurity initiatives.

Let’s take a look at the security makeup of a well-protected business:

The Perimeter

There are several layers to any effective cybersecurity strategy. The outermost layer of any major computing network is, by definition, the parameter (although security professionals today have more considerations to make than ever before). It is essentially the moat around the castle. It typically includes:

• Outside firewalls
• Intrusion Detection System/Intrusion Prevention System (IDS/IPS)
• Data loss prevention
• Secure DMZs
• Antivirus & Anti-malware

One qualification that should be explained is that many organizations look to cloud-hosted solutions to improve organizational collaborative capabilities, reduce capital costs, and to add useful and scalable computing resources, among other benefits. Some IT professionals have stopped using the moat and castle analogy since with cloud systems in tow, the actual perimeter of the network reaches inside the very place that perimeter security is securing against.

In cybersecurity circles, the dedicated secure perimeter strategy has been replaced by the “Zero Trust” strategy. This system is one where validation is paramount. This also makes it very resource intensive. If everyone is a possible threat - which they are - building near-impenetrable defense requires this type of diligence.

Network Security

This layer is what many businesses prioritize. Think of your network as a thoroughfare to all of your applications and data; and, while you still need to design and implement a strategy to protect those systems (more on that later), keeping your network free from obstructions and potential dangers is a must. An organization’s network security includes:

• Access control
• Message security
• Wireless security
• Remote access
• Content filtering
• IDS/IDP
• Additional firewalls
• Software patching
• Data Backup

Network security is crucial for any business because once someone gets access to the network, unless applications, databases, and the like are individually protected, any infiltrator worth his/her salt will be able to corrupt and/or steal the information they are seeking to corrupt/steal from there. This is why it is important that every person in your organization is aware of, and in constant compliance of, static rules that govern your organization’s network security strategy.

Sure, most of the heavy lifting is going to be done by your IT technicians, whether they are employees of your organization or outsourced experts. Putting in place the strategies and products necessary to keep the network safe from the outside, and providing the staff training that’s needed to keep it secure from the inside, are both critical parts of a business’ network security strategy.

Furthermore, in order to really secure your network from harm, you, without question, need to back up your data. Ensuring that you have a workable copy of your business’ day-to-day data is essential for it to stave of ruin in the case it is inundated with a disaster: malware attack or otherwise.

End Points

To the average employee, endpoint security is simply just a part of network security, but for the conscientious organization, ensuring there is endpoint security in place to protect any device that is remotely connected to the business’ network. These include IoT devices, smartphones, and other network attached devices that infiltrators could use to gain access to the computing network. Some of the technology used to protect endpoints include:

• Antivirus & Anti-malware
• Encryption
• Access control
• Device Firewall
• Virtual Private Networks
• Password managers
• Endpoint detection and response (EDR)
• IDS/IPS

Since a lot of organizations subscribe to a Bring Your Own Device (BYOD) strategy, there are often a lot of devices that have to be protected so that the network can be. Today, larger enterprises are routinely attempting to circumvent any attempts at infiltration, but smaller organizations typically use strategies like two-factor authentication to ensure that the people--and devices--that can access network-attached data are safe for employees to access that data on.

Applications

Application security, again, is often seen as an element of network security, but ensuring that all the software that you utilize is properly updated and has had any potential vulnerabilities patched is an important part of securing your applications. The most pronounced strategy used to secure software is patch management, which, like its name suggests, is the act of patching potential vulnerabilities as to not leave holes in your network.

Data

Finally, we get to data. Securing data is often the least priority since most of the other security protocols put in place are put there to do exactly that...protect data. If an organization thinks it needs additional security on its data, however, there are some options that can help keep specific data secure. These include

• Identity & Access Management (IAM)
• Drive encryption
• Data classification

Since every piece of security that you deploy is put in place to protect your organization’s data from theft or compromise, there is a whole other side to data security: education. In order to ensure that your employees don’t put your organization’s cybersecurity efforts at risk, you need to be able to properly train your staff on the best practices of individual data security, and how to approach the outside threats they very well might encounter. Knowledge of how to handle phishing emails and messages, social engineering, and other nefarious practices will always be a benefit to the organization, so prioritizing employee engagement in mitigating threats is essential to any business cyber security strategy.

How does your organization stack up? Do you prioritize cyber security training? Do you secure every layer of your business’ IT infrastructure? If there is any doubt, call the IT experts at Coleman Technologies to talk about how you can better protect your business from data loss, theft, and malware attacks. To learn more call us today at (604) 513-9428.

What’s At Stake?
Imagine a scenario where your business has allowed an external entity entry to your network. What kind of sensitive documents are found on it? Think about all your trade secrets being stolen and sold somewhere on the black market, and that’s not even considering the repercussions of any personally identifiable information being stolen. And when your business has a reputation of network security being poor, you might start having trouble finding people who are willing to work with you. Plus, the fines associated with security breaches could be enough to force your business to file for bankruptcy.

Security Solutions for Business
Generally speaking, the most common security measures you will see for small businesses are enterprise-level solutions that are accessible, yet powerful at the same time. Among these are Unified Threat Management, Virtual Private Networks, and Mobile Device Management. All of these services provide some level of security for businesses that need it, but in different parts of operations. They are all equally important, though, and you should consider each of them to optimize network security.

• Unified Threat Management: A UTM solution combines four enterprise-level solutions into one tool, providing a plethora of protection from online threats. A UTM includes a firewall, antivirus program, spam blocking system, and content filtering solution, all to minimize the chance of threats infiltrating your network and eliminate the ones that do.
• Virtual Private Networks: VPNs are critical to keeping your data secure while accessing it outside the protection of your network. VPNs offer encrypted access to data found on your network, eliminating the possibility of onlookers stealing data while it’s in transit.
• Mobile Device Management: With so many mobile devices in the workplace, it’s no surprise that users are taking data with them while out of the office. Without proper measures in place, data could be put at risk. Mobile device management allows your organization to control consenting devices through the use of whitelisting and blacklisting applications, remote wiping, and user access control. This creates a safety net that your business can fall back on if a device is ever lost or stolen.

Implementing the right security measures can be challenging, to say the least. Coleman Technologies can help your business implement useful new additions to your security infrastructure. To learn more, reach out to us at (604) 513-9428.

What is Encryption?
Encryption is a security measure meant to thwart any would-be hackers from using your stolen data to further their ambitions. Think about it like this; without encryption, hackers would gain access to your files, plain as day. Encryption provides a measure that keeps hackers from using your organization’s data even if they were to gain access to it. It essentially scrambles data to everyone who doesn’t have the decryption key, rendering it useless.

One particular technology that uses encryption to a considerable degree is a virtual private network, or VPN. A VPN can connect your employees to your infrastructure regardless of their location in a secure way. Think of it like this; the connection between your employee’s device and your network is normally a clear tube that can be observed by anyone ambitious enough to look for it. Rather than leave it as is, encryption makes the tube opaque--enough to obscure what’s inside so it’s not quite clear for any unwanted onlookers.

Why is it Important?
You can imagine the immense importance of encryption in today’s data-oriented business world. If you’re not taking every measure possible to secure your data, you could be making a huge mistake. Encryption in particular is important for assuming the absolute worst. You can never know when your data will be stolen, so it’s best to take preventative measures to ensure that it will cause a minimal amount of damage should it occur. If your encrypted data is stolen, it will simply be unusable without spending far too much effort to get the data into a readable state.

Coleman Technologies can equip your business with encryption services that you can count on to keep your data as safe as can be. To learn more, reach out to us at (604) 513-9428.