Your phone rings. As soon as you say “Hello”, the caller identifies himself as a tech support staff member from a well-known tech company. He tells you that he has detected a serious problem on your computer, which you need to fix immediately.Sound familiar? Most likely it does, as tech support scams have been around for many years. However, some scammers are now borrowing a technique used by hackers. In addition to calling, tech support scammers are sending phishing emails, according to Microsoft security researchers. By adding phishing emails to their tackle box, tech support scammers can reel in more victims.

How the Scams Work

Unlike the phone calls, the phishing emails do not mention that you have a computer problem. In true phishing fashion, the emails use spoofing and other techniques to get you to click a link. For example, the researchers found that some emails were made to look like notifications from online retailers (e.g., Amazon) and professional social-networking sites (e.g., LinkedIn).If you click the link, you are sent to a malicious website that mimics the legitimate one that supposedly sent you the email. The site will then deploy various scare tactics to trick you into calling a fake customer service hotline. For instance, the site might display a pop-up message that says you have a malware infection, an expired software license, or some other problem.If you call the hotline, the scammers will try to con you into some action, such as paying for unnecessary tech support services or allowing them access to your computer. If you do the latter, they could potentially install malware on your computer or change settings that will allow them access to your machine at a later time.

How to Protect Your Business

Like other phishing emails, the tech support phishing emails are being sent to the masses, including employees at companies worldwide. Therefore, you need to protect your business from this threat. A three-pronged strategy works well:

• Try to snag phishing emails before they reach your employees. Keeping email filtering tools up-to-date will help weed out phishing emails and other types of spam. Most email applications include filtering tools, but you can also purchase advanced filtering solutions.
• Educate employees. You should educate employees about phishing emails, as some will likely reach their inboxes. For example, teach them about the elements commonly found in these emails, such as generic greetings and requests to update or verify passwords and other types of information. In addition, show them how to check for deceptive links in the main body of an email and for a spoofed email address or name in the “From” field. Do not forget to let employees know what to do if they receive a suspicious email or see a questionable tech-related message pop up on their computers.
• Implement safeguards in case an employee falls for a tech support scam. Despite your best efforts, an employee might fall for a tech support scam, so you need to take certain precautions. For example, you should use security software in case the scammer installed malware on the employee’s computer and keep applications up-to-date so known security vulnerabilities are patched. It is also important to regularly perform backups and make sure they can be successfully restored.

The Specific Steps

The specific steps needed to implement this three-pronged strategy will vary, depending on your business’ needs. We can help you decide on the best course of action as well as provide more recommendations on how to protect your business from tech support phishing emails and other types of phishing attacks.

We’re happy to report that none of our clients were affected by the much-publicized and devastating WannaCry Ransomware infection that brought many companies and organizations to its knees last week.   This is largely due to how our Managed Service Plan protects and prevents the very weakness exploited by this attack.   Using a combination of multi-vendor/multi-point threat management, system updates, network security best practice and training of our customer’s staff on how not to fall victim to cyber crime and phishing emails, we can prevent disruptions and expensive downtime.  If you want to know more about how this plan can help you, please don’t hesitate to contact us!

Wireless networks are popular in small and mid-sized businesses because they are easy to set up and convenient to use. However, if a wireless network is not properly secured, hackers within range can access it and infiltrate your network.

Here are eleven ways you can lock down your business’s wireless network and keep hackers at bay:

1. Use a Strong Password for Your Wireless Router’s Administrator Account

Many wireless routers ship with a default password for the administrator account. It is important that you change the default password to a strong one that is at least eight characters long. The password should include uppercase and lowercase letters as well as numbers (but not in a predictable pattern). When possible, you should also include special characters, such as percent signs and asterisks.

2. Change Your Wireless Router’s SSID

A wireless network’s name is called a service set identifier (SSID). Many vendors ship their wireless routers with the same default SSID. Keeping the default SSID might signal to a hacker that your wireless network is not properly configured and vulnerable to attack. Because of this, you should change your network’s SSID to a unique name.

3. Make Sure Your Wireless Router’s Firewall Is Enabled

Most wireless routers have built-in firewalls, but sometimes they ship with the firewall turned off. You need to make sure that your router’s firewall is turned on. This is a good time to also check your firewall’s settings. Your IT service provider can help you determine whether your firewall is properly configured.

4. Use WPA2 for Wireless Communications

Every wireless router offers encryption. Encryption scrambles your data and makes it unreadable, except by the recipient. Three common encryption protocols are Wired Equivalent Privacy (WEP), Wi-Fi Protected Access (WPA), and Wi-Fi Protected Access 2 (WPA2). Using WPA2 is best because it employs the hardest-to-crack encryption algorithm. If you have an older router that does not support WPA2, you can use WPA. Do not use WEP as it is outdated and easily hacked.

5. Disable WPS If You Are Using a Consumer-Grade Wireless Router

It is not uncommon for businesses to use consumer-grade wireless routers. These routers often include Wi-Fi Protected Setup (WPS), which provides a user-friendly front-end for encryption protocols such as WPA2. With WPS, users can connect a device to a wireless network by simply pushing a button or entering a personal identification number. However, hackers can exploit a vulnerability in WPS to gain access to wireless networks. So, if your wireless router supports WPS, disable it.

6. Disable Your Wireless Router’s Remote Management Feature

Many wireless routers have a feature that lets you manage them from a remote location. Unfortunately, it often leaves routers susceptible to attacks. For this reason, you should disable remote management if you do not need to use this feature.

7. Make Sure Wi-Fi Sense’s Network-Sharing Functionality Is Disabled on Windows 10 Devices

Windows 10 and Windows 10 Mobile include a feature called Wi-Fi Sense. Besides helping users find open Wi-Fi hotspots, this feature lets them share their Wi-Fi networks, without sharing those networks’ passwords. Users can share their Wi-Fi networks with their contacts from Facebook, Skype, and Outlook.com. However, users cannot specify individuals within a group (e.g., within Facebook) — the network is shared with all the contacts in that group.

Although the contacts can only use the network to get online, you might not want your employees sharing your business’s wireless network. If that is the case, you need to make sure Wi-Fi Sense’s network-sharing functionality is disabled on your Windows 10 and Windows 10 Mobile devices.  Go to Settings, Network, WiFI and adjust these settings.  This is one of the reasons we do not recommend connecting your Windows 10 computer to a Microsoft account.

8. Consider Using MAC Address Filtering

Each device that is able to connect to a Wi-Fi network has a unique ID called a Media Access Control (MAC) address. You can configure your wireless router to check the MAC addresses of devices trying to connect to it, allowing connections only from the devices it recognizes. Admittedly, it takes time and effort to enter the MAC addresses of all the devices allowed to access your wireless network, but your network will be more secure.

9. Keep the Wireless Router’s Firmware Updated

Every wireless router has firmware. Firmware is software that gives the device its functionality. Like any other type of software, firmware sometimes has bugs or security vulnerabilities. When you keep your wireless router’s firmware updated, known bugs and vulnerabilities are fixed, making your router more secure.

10. Log Out of the Wireless Router’s User Interface

Most wireless routers have a browser-based user interface, which people use to configure router settings. If you leave this interface open and someone gets access to your computer, your router is vulnerable. Thus, you should always log out when you are finished configuring the router.

11. Protect the Computers That Access Your Wireless Network

Despite your best efforts, hackers may still infiltrate your wireless network. For this reason, you need to use anti-malware software on all the computers that access your wireless network. In addition, you need to keep those computers’ operating systems and applications updated so that known bugs and security vulnerabilities are patched.

If you don’t feel comfortable performing these steps yourself, please don’t hesitate to contact us or call at 720-205-5250

Cloud computing is now the norm — 95 percent of businesses worldwide are using at least one cloud service, according to a 2016 study. While there are many services that fall under cloud computing, businesses often use the cloud to store data. Although security experts note that storing data in the cloud is a relatively safe practice, businesses should still take certain measures to protect their files.

Here are five things you can do to help keep your business’s data safe in the cloud:

1. Review Your Cloud Service Provider’s Security Policy

Most cloud service providers explain their data security systems and methods in detail in their security policies. You need to review your provider’s policy (or the policy of any provider you are considering), looking for key items such as:

• How frequently your data is being backed up
• Where the backup files are stored
• Whether your data is encrypted when it is being stored
• Which cloud storage facility employees have access to your data

The best cloud service providers are audited, certified, or both, by independent agencies. These credentials ensure that their security policies are up to standard. If a provider lacks these credentials or you are uncomfortable with how your data is being handled, you might want to find another provider.

2. Protect Your Account with a Strong, Unique Password

An essential element in keeping your data secure in the cloud is to use a strong password for your account. At the minimum, your password should be eight characters long, with uppercase and lowercase letters. It also needs to contain numbers that are not in a predictable pattern (e.g., 5678). If possible, include special characters, such as a question mark or ampersand.

Equally important, the password must be unique. Cyber criminals know that people reuse passwords, so once they obtain a password for one account, they will try it for other online accounts.

If your cloud service provider offers two-step verification (also known as two-factor authentication), consider taking advantage of it. Two-step verification provides an additional layer of security to prevent unauthorized access to your account.   Please see our article on password creation that will help you design a secure, unique password that is easy to remember.

3. Make Sure Your Cloud Service Provider Is Using an Encrypted Connection

All data that you upload to or download from the cloud passes over the Internet. Thus, you need to make sure your connection to the cloud service provider is encrypted so that your data will be protected in case a cyber criminal intercepts it. An easy way to see if a connection is encrypted is to look for a small lock icon either to the left or right of the URL in your web browser’s address bar. If you do not see this lock icon when you connect to your cloud service provider, it is time to find another provider.

4. Create Your Own Backup Files

Your cloud service provider is likely backing up your data (and the data of all its other clients) as part of its security measures. However, no backup system is foolproof. A backup file might become corrupted, for example. Thus, you should periodically back up your data as well. One way to do this is to download the data from the cloud to your computer, which you can then back up in the same way you would back up any other data on it. Having your own backup files provides you with an extra layer of protection.

5. Train Your Employees

Employees who access your cloud service play an important role in protecting your data in the cloud. To fully understand that role, they need to know what a cloud service is, how it operates, and their responsibilities in keeping the data secure. The importance of good security habits also needs to be discussed during employee training. For example, they need to know why reusing passwords is dangerous.

We have several solutions that can help you get to the cloud, back it up, secure it, and train you on how best to use it.  Please don’t hesitate to contact us for any questions you have

If your business uses email as part of its communication strategy, you need to have an email policy. While creating this policy is not a fun or easy job, it is a crucial one. Knowing why you need an email policy can help motivate you to get started, and knowing the types of information to include can make it easier to complete.

Why You Need to Create an Email Policy

There are many reasons why an email policy is a necessity. First and foremost, it gives you a way to present employees with the rules they need to follow when using the company email system. For example, you can let employees know that they should not use it to send and receive personal emails. You can also present the rules about using personal computing devices (e.g., smartphones, desktop computers) to send and receive work emails.

Besides laying down the rules, an email policy provides an excellent way to let employees know that their emails can be read at any time. Even if you do not plan on regularly monitoring and reading their emails, you need to protect your right to do so. If you do not forewarn employees and then later read their emails, they could sue you for violating their privacy, even if they are being investigated for workplace misconduct (e.g., harassment). Although employees tend to lose these lawsuits, you will still have to spend time and money defending your business in court.

Another situation in which an email policy can help with legal matters is when employees are caught using your email system for inappropriate or illegal actions. Having a policy that explicitly states employees must not use the company email system for inappropriate or illegal purposes can minimize your business’s liability for their actions.

What You Should Include in Your Email Policy

Your email policy needs to be unique to your business, but there are some elements commonly found in most email policies. A good place to start is to make sure that your email policy discusses the following:

• Content that is not allowed in emails (e.g., offensive comments, sensitive data in plain text)
• The rules governing when sensitive data can be emailed and how to securely do so
• How often passwords for company email accounts must be changed
• Whether employees are allowed to use the company email system for personal emails
• The ways in which employees should and should not access the email system when they are out of the office (e.g., use the company’s virtual private network, but not public Wi-Fi hotspots or public computers)
• What personal devices (if any) employees can use to receive and send work emails
• How employees must not use the email system for inappropriate or illegal purposes
• The ways in which employees’ emails might be monitored and read (e.g., using email filtering software to check messages, manually reading emails)
• Whether emails are archived and, if so, for how long
• Whether there are mailbox storage limits
• What disciplinary action will occur if an employee breaks an email policy rule

You might also want to cover the best and worst email security practices in your email policy. For instance, you might provide guidelines on how to create strong passwords and a list of risky email behaviors, such as opening attachments in emails from unknown senders.

Do Not Reinvent the Wheel

When creating your email policy, you do not have to reinvent the wheel. There are many sample email policies you can customize to your business. Plus, you can tap into your IT service provider’s expertise when you are creating this important document.

Technology can assist you in enforcing the policy rules you set in place.  Talk to us today about how email management, loss prevention, encryption, and archiving can help!

Cyber criminals have stolen $3.1 billion from businesses since January 2015 — not with high-tech ransomware or stealthy spyware, but rather with low-tech emails. The U.S. Federal Bureau of Investigation (FBI) refers to these attacks as Business Email Compromise (BEC) scams. Since January 2015, more than 22,000 businesses worldwide (including businesses in all 50 U.S. states) have reported falling victim to a BEC scam. There are likely many more businesses that were swindled but did not report it.

Although using emails is a low-tech approach to stealing money, these emails are well crafted. Each BEC email is polished and specific to the business being victimized. The cybercriminals spend a good deal of time creating each email in the hope that its legitimacy will not be questioned.

How Cyber criminals Create the BEC Emails

The cyber criminals behind the BEC scams are digital con-artists. Like regular con-artists, they first study their victims. They identify the individuals and information necessary to carry out the scams. As part of this research, the digital con-artists sometimes send out phishing emails that request details about the businesses or individuals being targeted. Alternatively, the phishing emails might install malware that obtains sensitive business information, such as financial account records. The cyber criminals also use social engineering techniques to get information. For instance, they might visit social media websites (e.g., LinkedIn, Facebook) or call the company.

After the digital con-artists have the information they need to scam a business, they create the BEC email. They try to get both the wording and graphical elements to look like a legitimate email from that business (or from an organization it does business with, such as a supplier). They know that the closer the match, the harder it will be to spot the scam.

The Five Variations of the BEC Scam

When the FBI analyzed the reports of the 22,000+ BEC victims, it discovered that there were five main variations of the BEC scam:

1. Posing as a business executive, the digital con-artist requests a wire transfer. A cyber criminal hacks or spoofs the email account of a business executive and then uses that account to send an email requesting a wire transfer. Typically, the email is sent to the employee responsible for processing these requests. On occasion, the email is sent directly to the financial institution. The FBI found that the digital con-artists often send these emails when the executives are on business trips.
2. Pretending to be a business executive, the cyber criminal requests employees’ personal information. Using a spoofed or hacked email account of a business executive, the digital con-artist sends an email to the staff member responsible for maintaining employees’ personal information (e.g., human resources or accounting staff). In the United States, this variation of the scam was used to get employees’ W-2 tax information.
3. Posing as a supplier, the cyber criminal requests an invoice payment. The digital con-artist usually selects a supplier that the targeted business has used for a long time. After learning who is responsible for processing supplier payment requests at the targeted business, the cyber criminal will send that person a legitimate-looking payment request. The email tells the employee to wire the invoice payment to an alternate, fraudulent account. Occasionally, the invoice payment request is made by fax or phone instead of email.
4. Pretending to be an employee, the digital con-artist requests invoice payments from vendors. After identifying who works with vendors at the targeted business, the cyber criminal hacks that employee’s personal email account, using it to request invoice payments from vendors. This scam is most successful when employees use their personal email accounts for business and they have the vendors listed in their contact list.
5. Posing as a lawyer or law firm representative, the cyber criminal requests a fund transfer. The digital con-artist emails or calls an executive or another employee in the targeted business, claiming to be handling confidential or time-sensitive legal matters. The cyber criminal tries to pressure the person into transferring funds quickly or secretively.

How to Avoid Falling Victim to a BEC Scam

Knowing about the five BEC scam variations is one of the best ways to avoid falling victim to them. Thus, you need to educate employees at all levels about the scam scenarios so they can spot BEC emails. In addition, employees should be taught how to spot phishing emails since cyber criminals will use them to gather information prior to creating the BEC emails.

Besides training employees, you should take the following measures to avoid being swindled by a BEC scam:

• Do not use free web-based email accounts (e.g., Hotmail, Gmail) for your business.The FBI found that digital con-artists often target businesses using these email accounts.
• Consider using two-step verification for business email accounts. If you set up two-step verification (also known as two-factor authentication) for these accounts, they will be much more difficult to hack.
• Be careful about what you post on your business’s website. For example, do not post job descriptions or hierarchal information, as this information might prove helpful in determining the best person to target in a BEC scam.
• Ask employees not to post too many details about their jobs on social media websites. Digital con-artists scour these sites for information about businesses and their employees.
• Use anti-malware software and regularly update the operating systems and applications on your business’s computers. Some cyber criminals use phishing emails that install malware to get information for BEC scams. This malware often relies on known vulnerabilities of the operating system or applications to get onto a computer system.

Please share this with your co-workers so that everyone in your organization can be aware of these scams!

Jeff Lorenzen,  Computer Superheroes, 720-205-5250, jeff@computersuperheroes.com