Blog

New Ransomware Threat Hitting US Businesses

On September 19^th, Barracuda announced that they have been tracking an “aggressive” new ransomware threat. The ransomware attack appears to have originated largely in Vietnam, although other sources have been traced back to India, Columbia, Turkey, and Greece.

This latest attack, following right on the heels of WannaCry and Petya, has been identified by Barracuda researchers as a Locky variant with a single identifier. The significance of the single identifier is worth noting: since there are no unique identifiers for each victim, it’s impossible for the attackers to determine who has paid a ransom and who hasn’t. This indicates that the criminals have no intention of sending decryption keys to the victims who pay the ransom.

This threat should not be ignored. Barracuda monitored over 20 million attempted attacks within the first 24 hours of identifying the threat, and that number has been growing steadily since.

We’ve already seen a few businesses in Omaha affected by this attack, so we wanted to remind everyone of the importance of a reliable, robust data backup system.

Here’s what you need to know:

These ransomware attacks are mainly coming through via email.

Current reports show that these attacks are coming in the form of spoof emails, usually branded with “Herbalife” logos or disguised as a “copier” file delivery. Though cybersecurity experts are working to stop this attack, the attackers are using randomly-generated payload files to stay ahead of anti-virus updates.

• The latest variants include:
  Email with ‘Emailing – .’ as the subject line. One example is: ‘Emailing — 10008009158.’
• Email with a paragraph with legal wording to make the email seem legitimate.
• Email with “payment is attached” in the subject line to entice people to click on it.

While some businesses are losing days of productivity due to encrypted workstations and servers, our clients who have chosen to protect their data and infrastructure with a reliable backup and business continuity solution are experiencing ZERO downtime. A proper business continuity strategy makes all the difference in these situations, and Datto has proven an essential part of such a strategy.

These unfortunate attacks are becoming more frequent and more difficult to contain. If your business hasn’t already been targeted, we urge you to consider the value of your data and the importance of your network’s integrity. Can you afford to lose days or weeks to a ransomware attack?

You don’t have to.

If you have any questions about this latest ransomware attack or would like to know more about business continuity solutions, InfiNet Solutions offers complete business continuity and cybersecurity experts at (402) 895--5777 or [email protected].

Cybersecurity is a key topic for our healthcare tech professionals, especially as the cost of data breaches continues to rise. As I tell all of my clients, only a layered approach to security will provide a framework for complete protection.  

Did you know that millions of records of data are impacted by data breaches every year? — And few industries are impacted as much as healthcare.

The sheer volume of personally identifiable healthcare information makes healthcare organizations like yours a prime target for cybercriminals—Especially since the going price for these details is $50 per record!

HHS has identified more than 200 data breaches so far in 2017, with each representing the PHI of a minimum of 500 individuals. Every breach requires notification of the individuals affected. The costs of remediation are taxing the resources of overworked healthcare professionals throughout the country.

Is Your Data Vulnerable?

As you know, your caregivers need access to patient data to do their jobs.  However, even the most rigorously-trained may forget and leave their computer unmanned for a few moments, potentially exposing PHI to dishonest individuals.

Your nurses, doctors, and administrators need quick access to the most detailed and personal information in order to provide the highest possible quality of care—And if this access is provided on an unsecured workstation or on personal devices such as mobile phones or tablets, the information can easily be laid bare for all to see.  The result?  You’ll pay the price.

Digital Records and Devices Are Essential But Pose a Risk to Your Organization.

EMRs and EHRs provide portability to an individual’s healthcare that your doctors and providers can track information over time.  They’ve proven to be much more efficient than using the traditional paper records of the past.

A person’s EHR contains a great many details that can easily be passed between different medical practices, hospitals or other healthcare providers—And, as helpful as this is, information can be lost or exposed if connections lack the proper security.

Lost laptops and mobile phones are also a critical concern as someone could quickly grab a device that’s been left out for only a moment. If you allow your staff to BYOD (Bring Your Own Device) you face an additional hurdle as individual phones or tablets accessing your intranet or medical records may be easier to hack than computer devices in your facility.

A Data Breach It Can Have a Far-Reaching Impact on Your Patients.

If you experience a data breach and immediately notify those affected, they can usually protect their personal accounts. However, if the notification isn’t received or acted upon, they may find themselves spending weeks, months and even years trying to untangle the web of fraudulent credit accounts and charges.

Identity theft causes an average of $2,500 in out-of-pocket costs to each person whose data has been misappropriated—a staggering sum that most American families would find difficult to recover from. This is especially distressing as fewer than one-third of the individuals a healthcare organization attempts to notify, receives the intended notification.

A Data Breach = Lost Business and Legal Fees

Studies show that more than 90 percent of individuals whose data is exposed due to a data breach move to a different healthcare provider—while others file lawsuits, change insurance providers and take actions against the organization that was the target of the cyberattack.

Unfortunately, consumers don’t typically report the data breach to the organization where the breach occurred—which can make it even more problematic for smaller healthcare providers to determine the cause of the breach, or even discover that an attack has happened.

Healthcare providers are trusted with a great deal of information. This can cause a strong negative reaction from those they serve when they find that the details of their personal health and life have been obtained by cybercriminals. The best way to maintain positive relations with your patients is by implementing stringent security protocols to ensure data integrity and preservation.

So, What’s the Lesson Learned?

Attacks will continue to grow in sophistication as your information systems grow in complexity, resulting in a perfect nexus of data that are ripe for attack. To avoid paying the price of a data breach, you must implement a sound basis for your IT operations that only a layered approach to security can provide. Contact us and we’ll be happy to explain what this is.

InfiNet Solutions
(402) 895--5777
[email protected]

Make sure you are!

OCR’s new enforcement head is watching you more closely, and changes are coming in 2018!

Federal HIPAA administrators are ready for action: they’re on the lookout for organizations that aren’t staying up to date with changing regulations. Learn what it takes to stay safe and compliant.

Have you ever had a teacher or boss who went out of their way to make an example of someone? –Catching them in the act of something what was wrong or against the rules?

That’s exactly what the new head of the Office of Civil Rights is doing in his search for a “big, juicy, egregious” breach case. He’s out to make an example of one unlucky organization! This means it’s incredibly important for you to review your HIPAA compliance procedures.

The Increasing Complexity of HIPAA Regulations

Healthcare entities are always focused on patient-centered care, but now they’re increasingly distracted by ever-changing HIPAA regulations and compliance.

The life-saving treatment of patients is being helped with new technologies, but with a renewed focus on keeping patient data private, healthcare providers are more overwhelmed than ever. And, it’s the smaller practices that are staggering under the administrative burden of rules and regulations imposed by the federal government.

Costly and complicated IT systems are required to keep pace with the HIPAA information requirements, and interoperability of data standards continue to be serious barriers to full compliance.

The Continually Changing Requirements

Even though the Health Insurance Portability and Accountability Act was enacted on August 21, 1996, there continue to be changed to the requirements added on a regular basis. Major regulatory changes are coming in 2018 that will fundamentally change the way you can record a patient’s medical condition.  This will likely lead to many incorrect filings and compliance issues.

There’s been a 700% increase in the number of codes that must be used to record and report medical procedures, and it’s causing a spike in compliance issues as doctors attempt to make sense of the new conditions. The sheer volume of rules and regulations now exceeds the IRS codes, and are many times more complicated.

The Importance of HIPAA Compliance

All that said, HIPAA is an important part of keeping patient data secure, including PHI (Protected Health Information). Handling of this personally-identifiable information is dictated by a HIPAA rule that allows for release of relevant information to health care professionals tasked with the patient care, while providing higher level of security, data integrity and confidentiality.

Standards are applied to three different types of entities under HIPAA: health care providers, health plans and health care clearinghouses. Protected health information can be in writing, oral or electronic format – All three data types are covered under compliance guidelines.

If HIPAA standards and guidelines aren’t followed, there’s a strong possibility that your healthcare practice or organization will be found in default of government policies and required to pay a stiff fine and could incur additional penalties.

Evolving Threats

The Office of Civil Rights (OCR) is the enforcement agency for HIPAA compliance, and Roger Severino was named director of the regulatory agency in March 2017.

Severino has stated publicly that he is focused on finding new ways to safeguard patient health information that could be released via leaks such as ransomware, physical security breaches or cybersecurity lapses. He’s not being forthcoming about where his search for an egregious error will begin, simply that he will be reviewing all avenues where problems could occur.

With enforcement actions in 2017 exceeding $2.5 million to date due to a stolen laptop computer, it’s unlikely that he will have to look very far or very hard to find a case of sufficient magnitude for his needs.

Organizational Impact

Data breaches themselves can be incredibly expensive due to the requirements for notification of affected individuals. When you add in any damage to consumer trust, the cost of creating a remedy for the breach and compliance costs, the impact can be significant on any size organization.

The OCR is not simply looking for large offenders, they are also actively targeting smaller businesses and practices that may not have the benefit of support from a large technology or office staff to maintain compliance.

The growing threats in the cybersecurity landscape have caused enforcement agencies to continuously look for ways to encourage compliance.

If you have concerns about whether your organization is fully compliant with HIPAA standards, contact InfiNet Solutions at (402) 895--5777 or via email to [email protected]. We specialize in creating standardized practices and procedures that will help you maintain conformity with federal guidelines such as HIPAA.  

Some terrific new features are about to arrive for Microsoft’s SharePoint Online and OneDrive solutions.  They’re sure to take your productivity to a bold new level.  

To say that technology has changed the way businesses operate is something of an understatement, even if they weren’t “techie” businesses to begin with.

SharePoint Online makes it easier to store, share and manage digital information.

OneDrive for Business is a similar option and allows you to store, sync and share work files from anywhere, on any device, at any time.

Both use a collection of cloud and web-based resources that would have seemed like something out of a science fiction film even a decade ago!

Thanks to solutions like these and others, suddenly “productivity” and “geography” are no longer as closely tied together as they once were. If you’re in the middle of an important product launch, but also happen to be halfway around the world, you no longer have to wait until you’re back in the office to get things done. You can be just as productive while sitting in an airport lounge waiting for your flight to take off as you can at your desk in the office.

The best part of all is that because these options are cloud-based, they’re being updated all the time to become even more valuable than they already were. For example, in just a few short weeks, Microsoft is going to begin adding support for special characters like “#” and %” to both SharePoint Online and OneDrive for Business that enterprise users, in particular, will no doubt be thrilled about.

The Addition of “#” and “%”—What’s the Story?

Early in 2017, Microsoft announced that they were adding support for special characters like “#” and “%” for file and folder names across the document libraries that you’re already creating in SharePoint Online and OneDrive for Business. This is something that we’ve long been clamoring for and will begin rolling out in October.

This will give you the ability to create, store and sync files containing these special characters with greater ease than ever before – regardless of whether they’re used as a prefix or suffix in a particular file or folder name.

This is a small but essential change, as it gives you a greater level of control over how files and folders are created in line with your own in-house organizational practices. Other solutions and even other operating systems have long supported characters like “#” and “%” in this way, so their addition to SharePoint Online and OneDrive for Business is a welcome addition.

Savvy users are no doubt already aware that this feature has actually been available in an “opt-in” capacity since earlier in 2017. Starting in October, this feature will be turned on by default for those already using these solutions. The total global rollout is expected to be completed around March of 2018, along with Office 365 Roadmap ID 14656.

Do You Need More Time to Prepare?

Because this feature will be enabled by default in just a few short weeks’ time, some may need more time to prepare their in-house methods for the adjustment. Thankfully, this feature also has administrative controls that allow you to disable it at will, and enable again.

If you and your team need additional time to prepare for the change, go into the administration panel on your deployment and configure the feature to be “off by default” by the end of September 2017. Then, when the global rollout completes, you can go back in and enable it whenever you’re ready.

Guest Compatibility

Another new feature that’s slowly making its debut involves guest compatibility for Teams, something that affects not only SharePoint Online and OneDrive for Business, but all the apps in the Office 365 productivity suite. Now you can add guest accounts for your pre-configured Teams at will so they can work under the same policies and protections as regular members.

This is perfect for people who want to bring a client or a new employee into the fold on a temporary basis, giving them access to certain resources in a limited capacity without making them a full-fledged member. Teams was originally launched in March of 2017 as Microsoft’s alternative to other workplace communication applications, with Slack being perhaps the most prominent example.

With the already robust feature set and support for options like special characters, and more being added all the time, it’s easy to see why SharePoint Online and OneDrive are widely used by businesses and other professionals all over the world.

If your business in Omaha needs assistance with SharePoint Online, OneDrive, or other Microsoft solutions, please don’t delay. Contact InfiNet Solutions today at (402) 895--5777 or [email protected]. We can help you accomplish your goals with the right IT solutions.

The Equifax breach may have affected 143 million Americans.  When you consider that there are 247,813,910 adults living in the United States, that’s over 50%.  The odds are pretty good that you’ve been affected.

Your private information may now be in the hands of criminals, with ongoing consequences as they sell your data to others.

If you’re affected, items like your Social Security number, birth date, address and driver’s license number could be used to steal your identity, credit card numbers and more.

Equifax discovered the “unauthorized access” on July 29^th.  An investigation is ongoing, and so far, they’ve found that the breach jeopardized credit card numbers for about 209,000 consumers and personal identifying information for approximately 182,000.

Equifax set up a Website — https://www.equifaxsecurity2017.com  that you can visit to see if you’ve been impacted by the breach. They invite you to enroll in TrustedID Premier, a 3-bureau credit monitoring service (Equifax, Experian and Trans Union) which is operated by Equifax. You’ll be asked to provide your last name and the last six digits of your Social Security number, and based on this they’ll send you (or so they say) a message indicating whether your personal information was impacted. Regardless of whether your information may have been impacted, the company says it will provide everyone the option to enroll in TrustedID Premier until Nov. 21, 2017.

The Problem with Equifax’s Solution

Some are advising against enrolling in Equifax’s offer: http://frequentmiler.boardingarea.com/2017/09/08/is-the-equifax-cure-worse-than-the-hack/)

Plus, the Trustedid.com site Equifax promoted for free credit monitoring services was only intermittently available due to the high volume of traffic following the announcement about the breach.

And the site won’t necessarily tell you whether you were affected. Many haven’t received a yes or no answer to the question of whether they were impacted, but instead the message said that credit monitoring services weren’t available, and to check back later in the month.

Equifax says you’ll get free service for one year. The fact that they’re offering you their own identity protection services doesn’t seem quite right—To me it appears to be a conflict of interest. Typically, credit monitoring is free for a period of time, and then the company will try to upsell additional protection. And, why should we now trust Equifax to do anything right security-wise after this incident?  Think about this.

Whose Fault Is This?

Who’s responsible? Equifax. The fact that the criminals obtained such a large amount of confidential data from the Equifax website implies that they didn’t update the security for their Internet-facing Web applications. This may have been due to a lack of security leadership at Equifax, as they were in the process of looking for someone to fill the role of VP of Cybersecurity.  Nevertheless, this is no excuse.  They could have hired an outside Managed Service Provider to ensure they were protected.

This isn’t the first time Equifax or another major credit bureau has experienced a breach impacting a significant number of Americans:

• In May 2017, criminals exploited lax security at Equifax’s TALX payroll division, which provides online payroll, HR and tax services.
• In 2015, a breach jeopardized the personal data on at least 15 million consumers.
• Earlier, Experian granted access to its databases to a Vietnamese man posing as a private investigator in the U.S. In reality, he was running an identity theft servicethat let cyber thieves look up personal and financial data on more than 200 million Americans.

Three top executives at Equifax sold millions of dollar’s worth of stock during the time between when the company says it discovered the breach and when it notified the public and investors. (Sounds fishy?  I think so.)

The executives said they didn’t know about the breach when they sold their shares. Bronstein, Gewirtz & Grossman, LLC, a law firm in New York, announced that it’s investigating potential insider trading claims against Equifax.

Equifax will be target of multiple class action lawsuits as a result of the breach, but there’s no guarantee is will result in any money for affected consumers.

What Should You Do?

You can assume that all your personal information has already been jeopardized in this breach, and that it’s been sold many times over to other cybercriminals.

Here’s my advice:

Sign up for credit monitoring if you can. (Note: It’s typically not possible to sign up for credit monitoring services after a freeze is in place.)

Place a security freeze on your file with Equifax and the other major credit bureaus.  Businesses should also do so with Innovis, a bureau that runs credit checks on businesses. The security freeze will block any creditors from viewing or pulling your credit file, unless you unfreeze it. With a freeze in place on your credit file, ID thieves won’t be able to get lines of credit in your name, and the freeze will help to protect your credit score because each credit inquiry lowers it.

More information on how to file a freeze is available here.

Protect Your Business and Internet-Facing Websites.

Just because you own or manage a business that’s much smaller than Equifax, you could be targeted by these same criminals.  Ensure your IT security is robust and up to date.  If you need assistance, contact our security experts at InfiNet Solutions in Omaha. (402) 895--5777 [email protected] This is the best that you can do for your business and customers.

Here is a description of how Mobile Device Management Platform is being used to boost security in small and big firms all around the world.

Mobile device management (MDM) is a term used to administer mobile devices such as tablets, smartphones, laptops, and desktop computers. MDM is usually implemented using third party software.

Why it is Necessary.

MDM is used to ensure that employees are productive and that they do not breach company policy. Most organizations use the MDM platform to control the activities of their employees that might have an effect on their operations. Such a platform is mainly concerned with segregating corporate data, securing documents, emails, and enforcing corporate policies. Most of the areas it deals with are to do with the security of an organization. The implementation can be on-premises or via the cloud.

Some of its functionality can include the configuration settings of applications on mobile devices. In recent years, providers of MDM platforms have added desktops and laptops to the list of devices they manage.

By protecting and controlling the data and the settings on applications for all devices connected to a network, MDM can cut down support costs and the risks a business is exposed to. The primary goal of an MDM platform is to optimize security in an organization while cutting down cost. With mobile devices flooding the market and a part of business operations, having a tool that lets you monitor the device is necessary.

Find the Balance with MDM.

Data security and preventing data leaks have been the main driving force for MDM platforms. In recent years, a lot has been achieved in this area. The various MDM platforms can manage the security of devices without reducing functionality. The MDM works for both corporate-owned devices and personal devices. With a robust control of your security, you can prevent the loss of sensitive data that could have an impact on your competitiveness.

Have some Clear Goals in Mind.

As you search for an MDM platform, you will discover that there are many of them out there and they all have unique approaches to managing the security of your data. All of the approaches will have their weaknesses and their strengths. However, you need to understand the goals you have before making your choice. One of your main goals should be to secure your data while providing a simple and efficient user experience for users of the network.

Improve the Security of Your Data.

When an organization decides to implement an MDM, security is usually their primary goal. Some of the measures that an organization can take to improve security are to enforce encryption and a passcode. Additionally, it should have a means to wipe the device if it is stolen or lost. These are the basic features offered on a standard MDM platform. However, some advanced MDM platforms such as Maas 360 also have some extra features. For instance, it can restrict copy pasting, taking screenshots, blacklist, and whitelist apps, and even limit the access time of some apps by the time of day.

With the rise of infections amongst mobile devices, it is important to get only the best. It is estimated that there are 16 million infected devices around the world at any given time.

Some of the Measures an Organization Can Take to Secure Mobile Devices.

While an MDM platform is great, users still need to take some steps to ensure that they are secure. Here are some of the things organizations can do to stay safe:

• Hold seminars to educate employees about app security. Inform employees about the dangers of downloading third party app and the risks of having weak device permissions on a device.
• Restrict employees to downloading applications from authorized sources only. This can be sources such as Google Play, the App Store, and the organization’s app store. The rule needs to be enforced at all times when possible.
• Act quickly if something goes wrong. It is important to have automated policies for mobile devices when it is discovered that a device is compromised or has a malicious app installed.

Keep Work Data separate from Personal Data.

If an organization decides that it will make use of an MDM platform, employees may raise issues to do with the privacy of their data. For instance, they may wonder if the organization will now have access to their private emails, their photos, and texts. On some of the most sophisticated MDM platforms such as MaaS360, it is possible to create user environments that keep personal and work data separate.

This is known as containerization. In essence, the MD creates a sandbox where all company activities are supposed to take place. When the employee leaves the sandbox or has their device stolen, a selective wipe can be done to ensure that all corporate data is removed from the device. Personal data will not be affected by the wipe. It is important that all employees understand the importance of MDM platforms in securing organizational data.

The Benefits of Central Management.

Whether the IT department runs the MDM platform or the work is outsourced, the ability to manage everything from a central point is ideal for efficiency. It also eliminates the cost and headache of trying to manage each device individually.

Picking the MDM.

While many SMEs continue to embrace MDM, many of them know that a one size fits all solution is not possible. Besides that, with evolving security threats, it is important to choose a platform wisely.

Get the right experts to help you make your choice. They can help you make just the perfect choice for your security needs. Besides that, they can contribute to managing the MDM for you. Trying to choose from among the top vendors of MDM platforms by yourself can prove to be quite a nightmare.

Summary.

Employee’s devices are here to stay, and they will continue to play a crucial role in the workforce. It is thus up to businesses to come up with a way to manage them before they cause a major security breach. MDM platforms are the perfect tool to ensure that an organization can reduce the risk of leaked data.

Do you know about NIST and what their guidelines can do to benefit your business?  If not, it’s time to get educated.

The National Institute of Standards and Technology (NIST) promotes U.S. innovation and industrial competitiveness by advancing measurement science, standards, and related technology through research and development.  They support greater development and application of practical, innovative and secure technologies to enhance our country’s ability to compete more effectively on the world stage.   

What does this have to do with your business? — If you adopt NIST standards, your business will be more competitive and secure.

The next time your IT team advises you to comply with NIST, listen. While you may think that overarching IT authority will limit your company’s effectiveness, the exact opposite is true. Governance and innovation are not mutually exclusive concepts when it comes to your business.

Risk, Compliance and Regulation

NIST provides standards and metrics for maintaining organizational effectiveness and information security.  By adopting these policies along you’ll reduce confusion and provide your IT and business teams more time to focus on process optimization and growing your business.

However, even the most innovative, NIST-compliant organizations can’t innovate and compete if they use aging technology systems. To operate productively and lead the force in innovation requires a peak-performing, secure IT infrastructure, along with the adoption of NIST compliance controls.

Creating a framework for governance can be difficult as complexities evolve and IT assets are being introduced at an expanding rate. When risk isn’t adequately controlled and governance rules aren’t followed, you open yourself up to of both foreign and domestic hackers who have the resources to find holes in your security practices. This is why you need the assistance of an IT Managed Services Provider who is versed in NIST best practices.

NIST recognizes the critical need for cybersecurity standards and best practices for organizations like yours.  Following NIST’s cybersecurity standards can enhance your ability to address current and future computer and information security challenges. 

Big Data and Security

The heavy reliance on data translates into more opportunities for hijacking information as it moves between locations—And the additional endpoints in today’s businesses add risk factors that are difficult, if not impossible, to control. The vast quantity of data points from online sales transactions, social media and mobile activities make organizations like yours a primary target for cybercriminals interested in learning more about your expansive network of individuals.

Governance provides a way to secure data and provide customers and employees with a higher level of comfort knowing that their personal information is being protected.

Federal Information Processing Standards

NIST has created a set of guidelines called Federal Information Processing Standards (FIPS) that are the gold standard of managing data for U.S. federal agencies. Since these standards are endorsed by the U.S. government, any contractors and companies in their employment must actively be engaged in maintaining these specifications and best practices.

These stringent security measures ensure that anyone doing business with the U.S. government is in full compliance with all other standards including HIPAA, FISMA (Federal Information Security Modernization Act) and Sarbanes Oxley (SOX).

NIST Compliance Examples

While this is not a full overview of what brings an organization into NIST compliance, below are a few of the steps you can take to comply with standards for FISMA:

• Security controls must be continuously monitored.
• Baseline controls must be documented in a written plan, with risk assessments to refine the standards.
• Security professionals must document any data protected under FISMA.
• Any information systems used for processing must be authorized, with full security controls applied.
• Ongoing performance monitoring is crucial to maintaining full compliance.

Becoming NIST compliant may be challenging for smaller IT teams, but there are myriad benefits if you do this. Even if you aren’t actively conducting business with the U.S. government, these regulations may help stop aggressive cyberattacks and protect your customers from being the victim of a data breach.

Alternatively, NIST compliance does not ensure that your organization will be safe from cybercriminals, internal attacks or simple negligence — but it can help. Monitoring of NIST and other standards by a competent Managed Services Provider is one way you can provide a higher level of security than can be provided by internal IT teams.  

Innovation and competitiveness can only flourish when your IT systems are fully supported, structured and secure. When your IT teams aren’t spending their time chasing outliers or managing non-compliance issues, they can better support the growth of your business.

Let InfiNet Solutions help your organization in Omaha find the ideal measure of governance to support your competitiveness, innovation and security. Contact our IT Process and Security Professionals at (402) 895--5777 or via email [email protected] to learn more about how you can accelerate your company’s growth potential.

You may have heard of the dark web, but do you really know what is going on in this special part of the Internet that you need software to access?

What if somebody told you that there was a huge portion of the Internet that few people have ever been to? That right now, there is a place online that you can’t get through via your Firefox or Google Chrome web browser that houses 7500 terabytes of information? A place that has between 400 and 550 times more public information than the “regular” Internet, spread out across more than 200,000 different sites?

This may sound like fiction, but it is very much a reality. The above statistics are referencing something called the dark web and if you’ve never taken the time to learn about it, now would be an excellent time to start.

What is the Dark Web?

Technically, the dark web is just a blanket term used to describe either A) a part of the web that requires special software to access, or B) any website that hasn’t been indexed by Google. As the vast majority of all online interactions essentially begin with a search engine, a site that doesn’t appear – even when you search for it by name – on an engine like Google essentially doesn’t exist at all.

But these sites do exist and they’re a lot seedier than you were likely even imagining.

To the first point, certain areas of the dark web are only accessible via specialized applications. Tor, Freenet and I2P are some of the most prominent example. Tor is a name you’ve likely heard before in reports on the dark web on your local news, as it is the most popular of these applications in large part because it is also the easiest to use.

The Implications of the Dark Web

The major appeal of the dark web comes by way of anonymity – applications like Tor promise total secrecy and complete anonymity as they don’t connect a “user” and a “server” through traditional means. Instead, they use what are commonly referred to as Tor relays – specially configured computers that act as nodes. As a message moves from one node to another, it is encrypted in such a way that only the machine that sent it and the machine it is being sent to can decode it.

Pass a message across enough of these nodes and it becomes incredibly difficult – if not downright impossible – to decrypt.

Because of this greater degree of anonymity and secrecy, the dark web is incredibly popular among people with malicious intentions. But it isn’t just cyber attackers who are making use of these resources – everyday criminals, pedophiles and even certain terrorist groups regularly communicate via these means.

Just one frightening example of the “worst” that the dark web has to offer comes by way of its “Assassination Market.” This is exactly what you think it is – a place where users can pay money with the specific intention of having someone assassinated.

The dark web is home to many of these markets, in fact, where illegal goods like drugs and firearms are sold. In an effort to remain as anonymous as possible even in the middle of a transaction, Bitcoin has quickly become the favored currency among its users.

Where the dark web suddenly becomes relevant to small and medium-sized business owners, in particular, has to do with its intersection with cyber crime.According to one study conducted by the Norwich University, the total amount of revenue generated by criminal activities on the dark web exceeds $100 million per year. People are regularly using it to develop, share and test new cyber attacks before they have a proper “launch” against targets all over the world.

When you consider the fact that the cost of a single data breach now costs businesses an average of $3.62 million as of 2017 (breaking down to about $141 per compromised record), you can begin to get an idea of why the dark web has become incredibly popular among people who wish to do you harm.

Also making things incredibly difficult is the progress (or lack thereof) that law enforcement agencies are having in penetrating the dark web’s murky waters. Thanks to the aforementioned way that the dark web operates, it’s very difficult to simply “bust” someone planning a massive cyber attack. Even Bitcoin makes tracking illegal funds much easier said than done. Also complicating matters is the fact that a significant number of the sites listed on the main index of dark websites are scams – meaning that they only look like they’re fronts for illegal activity.

Still, the good news is that while the dark web certainly makes the job of agencies around the world more difficult – stopping these people is certainly not impossible. In recent years many agencies have had a large amount of success in both bringing down some of these illegal websites and arresting the users behind them. Ross Ulbricht, for example, was the person who created perhaps the most well known drug market in the history of the web – Silk Road. Though a feature film has been planned about his life, he’ll have to watch it from behind bars as he is currently incarcerated.

If you think that the dark web doesn’t have the potential to affect your employees, your customers and ultimately your business, you’ll definitely want to think again. Part of staying protected in terms of cybersecurity and the digital age involves staying aware. Knowing as much as possible about what people are up to in the so-called “dark” or “deep” web puts you in a better position to fend off new cyber attacks before they have a chance to do some real damage.

If you’re in Omaha and would like to find out more information about this or any other essential IT topic, or if you just have any specific questions that you’d like to discuss in a little more detail, please don’t delay – contact InfiNet Solutions today by phone at (402) 895--5777 or by sending us an email to [email protected].

Phishing attacks are deadlier than ever. Here’s how to train your employees to watch out for them. 

Phishing schemes send duplicitous emails to businesses in an attempt to infect computers with malware. They’re successful when an employee clicks a suspect link/attachment, or gets tricked into giving up financial information.

When it comes to data security, phishing threats get less attention than more “active” malware attacks—And that’s too bad, because today’s phishing schemes are deadlier than ever.

Gone is the broken grammar from Nigerian princes. It’s been replaced with professional, detailed messages containing legitimate-looking logos and intelligent language.

They’re so good that even tech experts get fooled.

A successful phishing attack could cost your company anywhere from thousands to millions of dollars. Protect your business—Here are eight tactics to put in place.     

Encourage Suspicion.

Studies reveal that employees fall for phishing scams because they’re trained to always be “nice.”   As a result, they comply with email requests from “clients” without any question. Experts advise taking a suspicious approach to all emails. If an email message “feels wrong, listen to your gut.” Train your employees to follow their instincts when it comes to suspect emails.

Scrutinize URLs and Addresses.

You should always carefully examine all email addresses and URLs. With phishing emails, they tend to be a bit “off.” The URL won’t match the directions given in the message, or it won’t be the real web address, rather a similar one. The same is true of email addresses, and company logos, watermarks, and signoffs. If you simply glance at this information, you may be fooled.  If you take closer look, you’ll realize it’s a counterfeit. Train employees what to look for if they come across an unexpected email, and to always pay attention to the details.

Think About the Message and Logo.

Phishing scams can be very subtle. Advanced phishing attempts may take over email clients to send messages from what appear to be very reputable sources. This is why it’s essential to stop and think before taking action—especially when money or sensitive information is involved.

Train your employees to examine the message. Is it unusual? Is it unexpected given what they know about the project or client? If they get a message that says, “Wire $5,000 right away for patent rights or we will lose this market,” this should raise warning bells—Why didn’t this person make a call or explain this in person? Any emails that focus on a disaster or emergency like this should be immediately suspected.

If You Don’t Know the Person, Stay Away from the Email.

Don’t recognize who the email is from? Then don’t do anything. This policy protects employees from phishing emails that get through your spam filters. If the email is from an address they don’t recognize, they should ignore the message. If necessary, they should forward it to the appropriate account manager and ask if it’s legitimate. It’s always worth taking a little extra time to confirm messages, rather than falling for a phishing scheme.

Call for Confirmation.

It’s amazing how many people don’t do this, even with extraordinary requests. Successful phishing emails depend on you not calling the sender and asking what’s going on. Calling the sender can destroy the most careful phishing attempts. (At the highest level, phishing may include fake phone numbers or rerouting, but this is quite rare.)

To get around this, phishers may include a message that says, “I will be out of the office today, but this request requires your immediate attention. Please don’t try to contact me, just download/click link/send money/ or (do some other stupid thing).”  If you see a message like this, the first thing you and your employees should do is pick up the phone and call, especially when important data is involved.

Stay on Top of the Latest Phishing Schemes in Your Industry.

Phishing schemes vary between industries (based on how much money can be conned out of particular businesses). Research the phishing schemes trending in your industry, and what warning signs to look for. A variety of services offer intelligence reports for this very purpose.  You can also visit security zines and forums that focus on your industry. These are typically updated with the latest cyberattacks.

Block Access.

Eventually, companies reach a size where trusting employees to avoid phishing attacks becomes very difficult. It’s important to use strong firewalls and updated security filters to block access to any dangerous or illegitimate sites (the same goes for downloads, etc.). This is essential to mitigate damage once phishing emails are opened. Phishing scams can’t hurt your business if they can’t upload malware.

Adopt Email Authentication Standards.

Email authentication standards are improving all the time. They provide an excellent way for companies to stop spoofing attempts both to and from your organization. Basically, it authenticates senders and makes sure that an email really did come from that sender.  This tactic also makes it more difficult to spoof emails from your company. The current standard is DMARC (Domain-based Message Authentication, Report and Conformance). So, if your business is a target of phishing scams, look into adopting this standard for added protection.

An issue worth noting is that DMARC is relatively new and underused.   It may not be compatible with all software and services. So, this is the time for a serious consultation with your IT experts to discuss implementing authentication. The process is highly effective, and worth your time.

Need help protecting your business in Omaha from phishing attacks? InfiNet Solutions is ready to help. We specialize in data services and security, and can find the right approach for your business. Contact us at [email protected] or call us at (402) 895--5777 for a no-obligation, complimentary consult.