Blog

Author Archive

How to Reduce Data Security Breaches Using an ‘Air-Gap’

 

Not all things need to be online. In fact, there are some systems and information that should never be online and instead be secured by a private offline network. This strategy is known as using an “air gap” between systems and the public Internet.

Improved Security Using Offline Systems

Using an offline network for critical path functions and data security reduces the risk of a data breach. This is an excellent strategy, however, it is not 100% secure. In any security review, the IT security experts look at outward-facing systems that connect directly with the Internet, opportunities to manage system networks offline to improve security, and the risk of “human engineering” hacking attempts. Human engineering security breaches come from the tricking people into doing something that allows a security breach. Using an air-gap strategy needs to be enhanced with increased personnel security, such as extensive background checks, limiting personnel access to systems, and physical security barriers to access sensitive data.

Offline Protection of Personal Data

Any organization that handles personal data, such as credit card information or medical records, has a severe obligation to make sure the data is protected. Access to this information should be managed on a need-to-know basis. For example, credit card data only needs to be used for secured transactions. If it is stored by a company that information should be stored offline and secured by encryption.

For medical records, there are severe penalties for data breaches under the Health Insurance Portability and Accountability Act of 1996 (HIPAA). In some cases, these penalties have been in the many millions of dollars. This means anyone handling such data needs to protect it like they are guarding the gold at Fort Knox. This is the kind of information that benefits from offline storage using a private network, with point-to-point information tunnels that pass data from one place to another only when it is encrypted in order to only permit authorized access to the data.

Conclusion

The risk of experiencing a data breach when there is unnecessary exposure of data to the public Internet can be better managed by taking the sensitive data offline.

Consult with Sentree Systems about how to manage an online presence combined with a private offline network for better security. Every business of any size can benefit from this approach.

Share

Posted in: Monthly Security Brief, Pillar Post, Tech News

Leave a Comment (0) →

Data Breaches in the USA – Is your business next?

The U.S. Department of Health and Human Services maintains a database that tracks every data breach of medical records where more than 500 records have been compromised. SafeticaUSA reports that, during 2016, the data breaches were caused by improper disposal of memory storage (2.3%), loss (5.4%), theft (19%), hacking (31.8%), and unauthorized access/disclosure of information (41.5%) by employees, which happens sometimes by accident.

Misuse of this information obtained by a data breach is rampant. Criminals can use this personal data in many nefarious ways including blackmail and identity theft. Businesses that do not protect personal and private data are liable for its misuse. They can face fines and civil lawsuits in the multiple millions of dollars.

The SafeticaUSA study noted that the average cost for a single data breach is $7 million and that 100% of businesses share business data in ways that are not safe. When employees leave a company, 87% of them take company data with them increasing risk exposure.

Indiana’s Data Security Record

In the SafeticaUSA study of medical record data breaches, which reviewed the occurrences in 2016, California was the state with the largest number of incidents, followed by Florida, Texas, and New York. Indiana came in fifth place by having 12 major data breach incidences during 2016. In terms of the number of compromised private records, the state of Indiana, with 257,174 records breached, was in tenth place on the list of states with the highest number of data breaches.

Conclusion

Data breaches are a serious problem that puts every business at risk. Personal medical records are very vulnerable and the dangers are increasing. Proactive strategies to reduce this risk include conducting a data security audit, implementing a data loss prevention solution, and advocating that the best practices are used for data security by affiliates, contractors, and business partners.

Contact Sentree Systems for a Cyber Risk Analysis to improve security and reduce the chance of a serious data breach.

Share

Posted in: Monthly Security Brief, Newsletter Topics, Pillar Post, Tech Tips for Business Owners

Leave a Comment (0) →

What is Encryption and How to Use it Effectively

When it is used properly, encryption is a valuable tool to help reduce data security breaches. Most business owners and C-level executives know something about the general topic of encryption; however, comprehensive data security reviews consistently show security problems that can be reduced by following the best-practice strategies regarding how to use encryption.

Using Encryption Effectively

Every organization benefits from encryption. Encryption is more effective when it is used comprehensively and always in place. During any part of the data processing, if the data is unencrypted, this creates a point of risk exposure. For example, if a user with authorized access uses an encryption key to decode some encrypted data and then leaves a copy of the unencrypted data on a laptop that they take home, suddenly the entire system is at risk. Encryption is made totally ineffective if an unencrypted copy of the database is on a laptop that can be hacked or stolen.

Avoiding a False Sense of Security

Just because data is encrypted, does not necessarily mean it is protected. There have been many examples of encrypted databases being subject to data breaches because even though the database was protected with encryption, those that had the encryption keys that are needed to read the data failed to protect their encryption key.

An example of this problem occurred in the loss of millions of dollars of cryptocurrency. This happened because the encryption keys, which are the proof of ownership of those assets, were hacked and stolen. They were kept in a database that was not secured. Since the ownership of cryptocurrency is semi-anonymous, protecting the encryption keys is the only way to control the assets. If the keys are lost or stolen the cryptocurrency is simply gone and nothing can be done about it.

Conclusion

To properly implement a comprehensive plan for using encryption effectively, one good strategy is to conduct an IT security review by Sentree Systems that focuses on implementing encryption on a network and protecting the encryption keys.

Share

Posted in: Monthly Security Brief, Tech Tips for Business Owners

Leave a Comment (0) →

Businesses of All Sizes Need to Protect their Data

Data security is a viable part of protecting the operations of any business. Think of this analogy. Even if you own a one-bedroom/one-bath home, which is the first home you ever purchased, this does not mean you be lackadaisical about home security. Having an alarm system with solid locks for windows and doors is just as important for your home as these things are in a luxury mansion.

Some might even say since your first home probably represents the biggest investment you have made so far in your life, it needs more protection than the luxury mansion owned by a wealthy family that already owns many other homes. The same logic applies to your business.

IT Security for All

It used to be that IT security was so expensive that only the larger businesses could afford it. Granted, even now, large businesses spend enormous amounts of money on data security efforts because protecting the data from security breaches is so important. However, just because a small business has a modest budget for IT services, this is no excuse for not having a service contract with a high-caliber security firm that specializes in IT data protection.

There are economies of scale that help keep the cost of IT protection modest when using a skilled firm. The security specialists concentrate on data protection. That is what they do best. They think about this 24/7 non-stop on behalf of their clients. Things that they notice affecting other small business clients are applicable for almost every customer they help.

Conclusion

Just because a business is small does not mean that IT security should be inadequate. Being a small business is not an excuse for having poor IT security policies. The cost for failed security measures can be the loss of the entire business. It is very unwise to risk this.

The key to success is NOT to rely only on in-house staff that does not have the time, energy, experience, and expertise to provide state-of-the-art IT security. Instead, outsource these tasks to a company like Sentree Systems and think of the investment as being similar to having a business insurance policy.

Share

Posted in: Monthly Security Brief, Tech Tips for Business Owners

Leave a Comment (0) →

Data Security Plans for 2018

The beginning of a new year is a great time to have a comprehensive data security analysis and to create a new strategic data security plan. There is plenty to be worried about when it comes to data security. Data security is something that needs to be constantly monitored in order to be effective. New threats are coming up every day.

Luckily, a small-to-medium-sized business does not have to go at this alone. In fact, having a service contract with a specialist in data security is probably one of the smartest things a business can do.

Here are a few significant things to consider when making a strategic data security plan for 2018:

Internal Security Breaches

It does little to stop a security breach if the entire focus is on external attacks and the security breach comes from within. Authorized users have been known to simply make copies of sensitive data files and walk out the door with them. Disgruntled employees can wreak havoc on data security when leaving a job.

Best practices include using high-quality background checks, restricting access to data on a need-to-know basis, and being able to immediately terminate access for any user.

Ransomware

Ransomware is a type of malware that when a user downloads it, it installs itself, and then encrypts the data on a system to lock the users out. An extortion demand is made for a payment in anonymous cryptocurrency like Bitcoins in order to get the encryption key to unlock the data. These extortion demands range from a few hundred dollars to millions. There is not even a guarantee that paying the ransom will get the data back.

Best practices to avoid this risk are to maintain real-time data backups that are made and then kept in protected storage offline. If a ransomware attack occurs, these backups can quickly bring the organization back to current working-status.

Two-Factor Authentication

All external-facing systems need to have a two-step authentication process using one-time use authentication code for the second step. The benefits of this strategy are significant in blocking unauthorized access. The way it works is an authorized user logs in with a complex password and then the second step sends a text message to a secured mobile device that is used by that person to complete the login process. If the mobile device is lost or stolen the second-step is canceled.

Sentree Systems Corp. is a highly-qualified data security consulting company that works with small businesses in Indiana, serving Indianapolis and the surrounding areas including Avon, Carmel, Fishers, Plainfield, and Noblesville Every business should assume they have either been attacked, are being attacked, or will be attacked. Fast detection and swift response are the small business owner’s only defense. Contact us today to learn more about these strategies at www.sentreesystems.com

 

See How Sentree Systems, Corp. can Help!!


Learn More!

Share

Posted in: Monthly Security Brief, Pillar Post, Tech News

Leave a Comment (0) →

Best Practices for Risk Management

Data Security is improved by taking a data-driven approach that addresses security issues that are uncovered by a review of security risk data. For example, allowing employees to continue to use software that has known vulnerabilities, which has not had the most recent security patch applied, is a risk that is unnecessary.

Here are a few tips to improve Data Security by using a data-driven approach:

Conduct a Security Assessment and Implement Its Recommendations

It is surprising when an organization goes to the trouble to conduct a security Assessment, which should be done on a regular basis and then does not implement the recommendations. Executives may think that since the security Assessment was done, the security is improved. A security Assessment demonstrates an Impact vs. Likelihood that your organization will have a compromise in the near future, but does not actually stop a breach from happening. It is important to take the next steps of implementing security upgrades as well.

Monitor Data Security News Alerts

By setting up Google alerts and keeping an eye on the latest Data Security News, helps increase awareness about security issues. An example of a Google alert is using the name of the software or IT service combined with the phrase “security flaw.” Moreover, there are industry security news systems that can be regularly checked for alerts such as the Security News notifications in the Security Education Companion.

Organizations that do not have sufficient internal staff for these Data Security issues do well by contracting with an outsourced IT data security company to monitor them on behalf of the organization.

Be Proactive About Advanced Persistent Threats

Advanced Persistent Threats (APT) are socially-engineered attacks that are occurring on a continual basis. Examples of APT attacks included phishing where websites are faked to get people to enter private information, email campaigns that cause people to download attachments that are malware, or websites that load malware when a person visits them.

Sentree Systems Corp. is a highly-qualified data security consulting company that works with small businesses in Indiana, serving Indianapolis and the surrounding areas including Avon, Carmel, Fishers, Plainfield, and Noblesville. Every business should assume they have either been attacked, are being attacked, or will be attacked. Fast detection and swift response are the small business owner’s only defense. Contact us today to learn more about these strategies at www.sentreesystems.com

 

See How Sentree Systems, Corp. can Help!!


Learn More!

Share

Posted in: Monthly Security Brief, Newsletter Topics, Pillar Post

Leave a Comment (1) →

ALERT: Death Threat Scams

What do email scams, death threats and bitcoin have in common? Together they are being used by scammers to steal money from innocent victims. This is by no means a new threat (it’s been around since 2006) but it’s one that’s getting some new recognition. The FBI recently issued a warning about the uptick in these scams and we know if the FBI is talking about it, it’s a big deal.

Threat: Death Threat Scams

Do You Need to Worry: Yup! Everyone is at risk. The scam goes a little something like this: recipient receives a threat via email and is ordered to pay in virtual currency (like bitcoin) or prepaid cards otherwise they or their family will be harmed. Keep in mind that this scam could also come in the form of a text message and they might be after more than just money – they may try to obtain your personal information, account numbers, etc.  

What Can You Do About It: Contact the police immediately and follow their advice. You should also file a complaint with the FBI’s Internet Crime Complaint Center (IC3.GOV).

 

 

Share

Posted in: Monthly Security Brief, Newsletter Topics, Tech News

Leave a Comment (0) →

How to Know if Your Vendors Have Good IT Security

Many small- to medium-sized businesses rely on third-party vendors for some of the critical-path IT functions of a business. When they do this, the responsibility for maintaining IT security is transferred to the vendor. This may increase the risk of potential damage caused by security breaches.

There have been many examples of serious security breaches at vendors that have done major harm to their clients. This is why conducting detailed due diligence is necessary to identify the security risks of using a third party vendor’s services or software tools.

Comprehensive due diligence for security risk analysis focuses on the following areas and specifics:

  • Historical record of problems and how the vendor dealt with security issues.
  • Upgrade policy and rapid response with security patches for vulnerabilities.
  • Use of encryption to protect sensitive data.
  • Vendor’s ability to view, share, or sell data to other parties. Any transfer of data to other parties adds additional security risk.
  • Does the vendor have a dedicated security team?
  • Do they conduct regular security audits and are those reports available to clients?
  • Specific security protocols must be in place if there is a legal requirement for data protection. Examples of this include attorney-client privilege in the legal profession, strict privacy rules under HIPAA for healthcare records, and student information under COPPA and FERPA rules.

IT security risk is a serious issue. Businesses that are not experts in IT security issues benefit strongly by using a specialist consulting firm to help with the due diligence requirements in this area.

Sentree Systems Corp. gives data security advice for clients in Indiana serving the communities of Indianapolis, Avon, Plainfield, Carmel, Fishers, Noblesville and others. We recommend conducting a detailed review of the Service Level Agreement (SLA) from any vendor and a security audit to help identify security risks. It is much better to know in advance of the existence of potential security risks and take steps to mitigate them, rather than being blind-sided by sudden damage from a security breach that is not expected.

Share

Posted in: Monthly Security Brief, Security Awareness Training, Tech Tips for Business Owners

Leave a Comment (0) →

Scam Of The Week: Massive Netflix Phishing Campaign

There is a massive scam campaign going on, this time a very well executed Netflix phishing attack.

The scam targets subscribers telling them that their account is about to be canceled. The well-designed, individualized fake email convinces customers to update their account information to avoid suspension. This results in stolen personal and credit card information.

The email has the subject line “Your suspension notification” and includes a link where the subscriber is taken to a fake Netflix page which requires their log-in information as well as credit card number.

The scam was detected Sunday and it targeted nearly 110 million Netflix subscribers. As mentioned, the fake site includes Netflix’s logo as well as popular Netflix shows like “The Crown” and “House of Cards” to make it seem legitimate.

Share

Posted in: Monthly Security Brief, Newsletter Topics, Security Awareness Training, Tech News

Leave a Comment (0) →

High Performance Risk Management

High Performance Risk Management

LOS ANGELES—Risk managers, whose job once focused on a basic “bucket of risks,” and making decisions about which risks are transferable and which ones the company should retain, have been “migrating along an evolutionary path which is allowing us to be more strategic,” Chris Mandel, senior vice president of strategic solutions at Sedgwick, said at the RIMS ERM Conference 2017 here.

He noted during the session, “The Trouble with ERM,” that risk managers now need to alter their focus. “The question for risk managers now is, how do we get our organizations to focus on long-term success and recognize the link between strategy and risk?” he said.

Erin Sedor, president at Black Fox Strategy, said that she found through personal experience the importance of connecting with the CEO and aligning with the company’s strategy when setting up a program. “You need to know what they are talking about and understand strategy,” she said.

Unable to find a satisfactory definition of strategy for ERM, Sedor came up with her own: “A strategic business discipline that allows an organization to manage risks and seize opportunities related to the achievement of its objectives.” She added that, unfortunately, enterprise risk is not a term that resonates with the c-suite, but strategy is.

She identified three major problems with ERM that can dampen its prospects:

  1. A limited view of the organization’s mission, growth and survival.
  2. Silos. Breaking through them is a nonstop process, no matter how a company tries to improve the situation—especially in the areas of risk management, continuity planning and strategy, which typically happen in very different parts of the company.

“It is important to link risk management and continuity planning in the strategic planning process, because that will get some attention and get the program where it needs to be,” she said.

  1. Size. Because ERM programs are notoriously huge, “The thought is that ERM will cost too much money, take too many resources and take too long to implement. And that by the time it’s finished, everything will have changed anyway,” she said.

Starting the process by “saying you’re going to focus on mission-critical,” however, can help get the conversation moving. “Because as you focus on that, the lines between risk management, continuity planning and strategic planning begin to blur,” she said.

Sedor described mission-critical as any activity, asset, resource, service or system that materially impacts (positively or negatively) the organization’s ability to successfully achieve its strategic goals and objectives.

She said to find out what mission-critical means to the organization, what is the company’s appetite and tolerance for mission-critical, and the impacts of mission-critical exposures on the organization. “Risk managers will often ask this question first, but you have to come to grips with the fact that not every risk is a mission-critical risk,” she said. “And not everything in a risk management program is mission-critical.” Using that context helps in gaining perspective, she added.

When viewing risk management, continuity planning and strategic planning from a traditional perspective, strategic planning is about capturing opportunity and mitigating threats; risk management is the identification, assessment and mitigation of risk; and business continuity planning is about planning for and mitigating catastrophic threats.

Looking at them from a different vantage, however, strategic planning is planning for growth; risk management allows you to eliminate weaknesses that will impede growth, which is why it’s important; and continuity planning will identify and mitigate the threats that impact sustainability. “That is how they work together,” she said, adding, “You are also looking at weaknesses that when coupled with a threat, will take you out. Those are your high-priority weaknesses. Using a mission-critical context makes it all manageable.”

At this point, if a risk manager can gain enough leverage to talk to executives throughout the organization about what mission-critical means to the company, its impact, and then about tolerances and creating a more integrated program, “all of a sudden you’ve talked about ERM and they didn’t even know it. They thought you were talking about strategy,” she said.

Similar Posts:

Share

Posted in: Newsletter Topics

Leave a Comment (0) →
Page 1 of 25 12345...»
Real Time Web Analytics