Posts Tagged


Avoid security breaches: How to protect your data

Data security breaches at major corporations seem to be perpetually in the news. The hacks range in size and scope, but it’s no secret that firms hit by hackers often suffer serious consequences.

What can you do to help prevent your organization from becoming tomorrow’s cyber-breach news headline? Here are 18 pointers:

  1. Educate all employees on the importance of protecting data. Explain the need to avoid risky behavior such as downloading music or videos from rogue websites. Once employees understand that criminals want the data with which the employees work, their thinking changes in ways that can make the organization’s data much safer than before.
  2. Understand what data you have and classify it. You cannot secure information if you do not know that it exists, where it is stored, how it is used, how it is backed up, and how it is decommissioned. Make sure you know those things about all of your sensitive information. Because not all data is equally sensitive, make sure to classify data according to its level of importance.
  3. Do not give every employee access to every system and piece of data. Create policies governing who has physical and/or electronic access to which computer systems and data, and implement procedures, policies, and technical controls to enforce such a scheme. Authorize people to access the data that they need in order to do their jobs but do not provide them with access to other sensitive data.
  4. Consider moving sensitive information and systems to a cloud provider. Unless you have an adequate information security team, the odds are pretty good that a major cloud provider will do a better job than you at securing your system and information against various risks.
  5. Enable remote wipe. All portable electronic devices on which sensitive information will ever be stored should have remote wipe capabilities enabled.
  6. Give everyone his or her own access credentials. Ensure that each person accessing a system housing sensitive information has his or her own login credentials.
  7. Ensure that everyone uses proper passwords to access such systems. People like to use easy-to-remember passwords; without policies and technology to enforce the selection of proper passwords, organizations are at risk of having passwords such as “1234” being the only line of defense against unauthorized access to sensitive information. So, craft proper policies and implement technology to ensure that the policies are properly enforced.
  8. Go multi-factor. For accessing systems with especially sensitive information, consider implementing some form of strong, multi-factor authentication.
  9. Deal with BYOD. Make sure that you have policies and technology in place to address the many risks created by employees, contractors, and guests bringing personal devices into your facilities and connecting to corporate networks. All access to the Internet from personal devices or devices belonging to other businesses should be achieved via a separate network than is used for company computers.
  10. Encrypt sensitive data when storing it or transmitting it. There are many commercial and free tools available to do this – some operating systems even have encryption capabilities built in. As you probably suspect, if you are not sure if something should be encrypted, encrypt it.
  11. Backup. Backup. Most people and businesses do not backup frequently enough, and many (if not most) will not realize the danger of their mistake until it is too late.
  12. Keep your backups separate from production networks. If ransomware gets onto one of your production networks, it could corrupt any backups attached to that network. Maintain offsite backups in addition to onsite backups.
  13. Create appropriate social media policies and enforce them with technology. As so many organizations have learned the hard way, policies alone do not ensure that employees do not leak sensitive information or make otherwise inappropriate social media posts; implement technology to help with this task. Remember, many serious breaches begin with criminals crafting spear-phishing emails based on overshared information on social media.
  14. Comply with all information security regulations and industry standards. Consider such regulations a baseline – but not rules that if adhered to will offer adequate protection. GDPR, for example, is a regulation for which many businesses still need to prepare.
  15. Use appropriate security technology. Do not just buy the latest and greatest. Acquire and utilize what you actually need by defining functional and security requirements and selecting security controls accordingly. On that note: All computers and mobile devices that handle sensitive information or ever connect to a network to which devices that house sensitive information connect need have security software installed.
  16. Ensure that technology is kept up to date. Besides keeping security software current, make sure to install patches to server and client-side operating systems and software. Many major vendors have automatic update services – take advantage of these features.
  17. Keep IoT devices off of production networks. Treat Internet of Things devices as if they were a special class of risky BYOD devices – and keep them on their own networks. Only purchase IoT devices that have proper security capabilities such as the ability to be patched and to have default passwords changed upon installation and activation.
  18. Hire an expert to help you. There is a reason that businesspeople go to doctors when they are ill and don’t try to perform surgery on themselves, or utilize the services of lawyers if they are being sued or accused of a crime. You need experts on your side. Remember, the criminals who are targeting your data have experts working for them – make sure that you are also adequately prepared.

While there are no guarantees when it comes to information security – even the most security-conscious organizations still face some level of risk – by following these 18 tips, you can greatly improve your odds of fending off hackers who seek to steal your organization’s confidential information.

Joseph Steinberg is a recognized cybersecurity thought leader, and emerging technology influencer (with a focus on AI and blockchain-related offerings). He has led businesses and divisions within the information-security industry for nearly two decades, has been calculated to be one of the top 3 cybersecurity influencers worldwide, and has written the official study guide from which many CISOs study for their certification exams.

Originally published at

Copyright © 2020 IDG Communications, Inc.

Source link

Protect your data to protect your business

The most important thing your business provides isn’t a service or a product. It’s trust. And it comes from letting your customers and employees know that you’re protecting your business—and their data—against cyberattacks.

Building a foundation for trust isn’t easy. Cyberthreats continue to grow in number and complexity as businesses shift more of their operations online and enable anytime/anywhere access to information to support an increasingly remote workforce. This ongoing digital transformation exposes more systems and data to potential attacks – increasing risk for your organization.

Addressing this challenge requires a new approach to protecting business information. “The assumption that everything’s on-premises and protected behind a firewall has largely disappeared,” says Robert Crane, principal at CIAOPS, a technology consultancy that specializes in helping businesses improve their productivity by using technology and smart business practices. “But some businesses are still locked into that old-world thinking.”

Inaction can lead to increased risk. A Techaisle study found that although 85% of small and midmarket firms say security is a top concern, just 32% have tested their responses to breaches or security incidents to ensure effective protocols in a crisis.

“Everyone’s aware that security is important. But in a lot of cases, they don’t appreciate it until they’ve been bitten,” says Crane. “You insure your car, your building, your employees—and you need to do the same for your IT. Security software is the insurance to prevent you from losing millions of dollars because of phishing or some other attack.”

Security “insurance” includes keeping your entire technology environment, including business applications, up to date. Putting off upgrades creates unnecessary risk, because outdated systems expose your company to a wide array of security threats, such as malware and phishing attacks. Businesses should be wary of increased security vulnerabilities that arise with an unsupported operating system that will no longer be patched to protect against new threats.

Microsoft has built comprehensive security capabilities into Microsoft 365 to help you defend against advanced cyberthreats and simplify IT management with a single, integrated solution. Specifically, Microsoft 365 gives you the ability to defend against advanced threats with the following capabilities:

  • Advanced Threat Defender (ATP) Safe Links, which helps employees avoid malicious websites by scanning any links they click in emails and documents in real time to block unsafe destinations. ATP Safe Links also protects against sophisticated malware by performing advanced analysis of email attachments in a sandbox environment to detect newly developed malware.
  • ATP antiphishing intelligence, which enables security teams to deploy policies that use machine learning models and impersonation detection to further protect against advanced phishing attacks.
  • Azure Multi-Factor Authentication, which enables teams to configure advanced policies that disable access from untrusted locations or bypass multifactor authentication from trusted places such as your office network.
  • Windows Defender, which enforces malware protection across all Windows 10 devices and protects files in key system folders from unauthorized changes made by ransomware.

In an age of uncertainty and heightened risk, establishing and maintaining trust with customers and employees is even more critical to success. Modern technology can help protect your most important assets.

Download the Business Leader’s Guide to Microsoft 365 Adoption

Copyright © 2020 IDG Communications, Inc.

Source link

Data confirms: Given control, users opt for just one Windows 10 upgrade per year

After Microsoft gave all customers control over when they upgrade Windows 10, the majority of users decided they didn’t need a twice-annual refresh, data shows.

According to metrics vendor AdDuplex, once Microsoft let users of Windows 10 Home and Windows 10 Pro determine the cadence of OS upgrades, each upgrade’s increase siphoned more users from the version of 12 months before than it did from the upgrade’s immediate predecessor.

For example, Windows 10 version 1903 climbed from 11.4% of all versions in July 2019 to 33% in August. Of the 21.6-percentage point increase, 20.6 points — representing 95% of the total — came at the expense of Windows 10 1803, the feature upgrade issued a year earlier. Just 1 percentage point, or about 5%, of the declines that fueled the increase of Windows 10 1903 originated with Windows 10 1809.

The implication: Left to their own devices, users left Windows 10 alone for a year, the maximum time Microsoft allowed them to run any individual Windows 10 Home or Windows 10 Pro version.

Given a choice, Windows 10 users rejected Microsoft’s longtime contention that operating systems should be updated on an aggressive tempo — necessary, the Redmond, Wash. firm said, to keep up with constant technology change.

First, a brief recap of what Microsoft did last year

AdDuplex’s numbers were no surprise. Computerworld — and many other media outlets, as well as analysts and pundits — had predicted that Windows 10 Home and Windows 10 Pro users would, given the chance, reject the twice-annual upgrade cadence Microsoft had established.

That cadence was established in April 2017 and committed Microsoft to releasing two Windows 10 upgrades each year, one in March, another in September. Prior, the tempo had been unpredictable — Microsoft delivered only one upgrade the year before, for instance — which enterprise customers found untenable.

Under that scheme, Microsoft decided when each Windows 10 Home PC and each unmanaged Windows 10 Pro PC was upgraded to a new version. (By unmanaged, we mean devices not handled by IT administrators.) Those machines, especially the ones running Windows 10 Home, went through the refresh process at six-month intervals because their users were not able to defer, much less decline, an upgrade.

However, 11 months ago Microsoft threw that practice out the window. Instead, it let users of Home and Pro decide when to pull the upgrade trigger through a new “Download and install now” option. Each release would be publicized, but users would choose when to migrate to a new version.

There would be one catch: Citing the need to keep PCs up to date, Microsoft announced that when “Windows 10 devices are at, or will soon reach, end of service, Windows Update will continue to automatically initiate a feature update.” At some point, then, Microsoft would revert to its earlier behavior of automatically downloading and installing a feature upgrade.

It became apparent that Microsoft would begin these forced upgrades — labeled that to differentiate them from those the user initiated — approximately four months before the version in question was due to exit support. (Windows 10 Home and Windows 10 Pro were allotted 18 months of support, with the clock starting at release.) Microsoft would replace the version then powering the PC with the most recent Windows 10 release.

Because of this timing, if users didn’t call on the “Download and install now” option, Microsoft’s mandated upgrades resulted in a once-a-year refresh.

Here’s an example: A PC that ran Windows 10 1803, which launched in April 2018 and received support until November 2019, was not upgraded by its owner. Instead, Microsoft began to forcibly refresh 1803 systems in July 2019. By that time — and through the end of Microsoft’s we’ll-upgrade-that-for-you campaign in November — the newest version, the one with the most support remaining, was Windows 10 1903. That version debuted in May 2019 and is slated to exit support in December.

When Windows 10 1903 gets close to retirement — say, four months prior, or around mid-August — the latest version will be Windows 10 2004, the upgrade that will release at any moment.

The data highlights how upgrade practice changed

The pattern of versions’ increases and decreases changed dramatically when Microsoft modified its upgrade policies.

Windows 10 1803, for example, like the upgrades that preceded it, grew its share of the total at the expense of its immediate forerunner, Windows 10 1709.

From November 2017 to December, Windows 10 1709 increased from 20.4% to 53.6%, a jump of 33.4 percentage points. The vast majority of that gain came from Windows 10 1703, which plummeted from 63.5% to 33.7%, for a fall of 29.8 percentage points, representing 89% of 1709’s increase, during the same stretch. The version two back from 1709, 2016’s Windows 10 1607, contributed just 2.9 percentage points, or only about 9% of 1709’s growth.

That had been the original framework when Microsoft compelled upgrades every six months. Each Windows 10 refresh gained share by cannibalizing the version prior; as the former grew, the latter shrank.

Giving users control of upgrade timing, though, made the majority of them lazy: They let Microsoft do its forced upgrade a year later. Like the earlier example of Windows 10 1903, the most recent version, Windows 10 1909, also illustrated the new normal. Rather than drain the immediate predecessor (1903), 1909 assembled most of its growth from the year-before’s 1809.

From January to February, Windows 10 1909 went from 15.2% to 22.6%, a 7.4-point boost. Most came from Windows 10 1809, which slumped from 22% to 16.4%, a fall of 5.6 percentage points, or about 76% of the total in the same month-to-month period. The upgrade just one back from 1909 (last May’s 1903) declined just eight-tenths of a percentage point from January to February. Assuming 1903’s slip went to 1909, the former represented a paltry 11% of the latter’s increase.

There’s no reason to think the next upgrade, Windows 10 2004, will be any different. When it gains users, they’ll largely be yanked from 1903 by Microsoft, especially from mid-August to the end of the year, the last four months of 1903’s support.

It’s unclear if Microsoft anticipated this shift when it changed the upgrade rules for Windows 10 Home and unmanaged Windows 10 Pro; the company has not as much as hinted at its expectations. That’s understandable, as to do so would be to acknowledge that its rapid development and release rhythm, core to its Windows-as-a-service mantra for Windows 10, has not been completely accepted by customers.

True, annual upgrades remain approximately three times more frequent than pre-Windows 10 editions of the OS. But they’re only half that of the intended pace.

To come up with its Windows 10 version numbers, AdDuplex mined data from third-party Windows Store apps that used the Lithuanian company’s SDK.

Copyright © 2020 IDG Communications, Inc.

Source link

U.S. Air Force to pilot blockchain-based database for data sharing

The U.S. Air Force (USAF) is planning to test a blockchain-based graph database that will allow it to share documents internally as well as throughout the various branches of the Department of Defense and allied governments.

The permissioned blockchain ledger comes from a small Winston-Salem, N.C. start-up, Fluree PBC, which announced the government contract this week. Fluree is working with Air Force’s Small Business Innovation Research AFWERX technology innovation program to launch a proof of concept of the distributed ledger technology (DLT) later this year.

The ledger could include intelligence gathered during military operations and supply chain parts tracking.

fluree architecture revised Fluree

A diagram of the core components of Fluree

“Fluree is effectively a database. We call it a data management platform because it also plays the role of an application server in certain contexts,” said Brian Platz, Fluree co-founder and co-CEO. “It also even allows you to embed data into Web apps so you can quickly build them.”

Fluree ensures secure communications and data integrity by combining transactions into immutable time-stamped blocks and locking in each block via advanced cryptography. Users who are authorized on the blockchain gain access through a private-public key infrastructure.

The DLT platform also allows certain features to be turned on or off, such as full decentralization with Byzantine Fault Tolerance or a plain database without cryptography for use in internal project or app development, Platz said.

The USAF requires interoperability for its units around the globe; the platform can also search and ingest data from existing legacy systems and data stored on third-party Wikis through the use of the SPARQL query language and the Resource Description Framework (RDF) for data interchange standard.

The USAF declined to answer questions about the project.

Fluree’s platform, FlureeDB, was selected because like all blockchains, it’s peer-to-peer architecture is highly scalable, uses data encryption, offers semantic data standard formatting and data stored on it that is immutable.

fluree schema explorer Fluree

Fluree’s graph voyager that can explore a data schema

“We’re trying to allow a blockchain-backed security to power an entire application, which you really can’t do today unless the app is really trivial or it’s a cryptocurrency,” Platz said. “Anyone using blockchain in the enterprise is building a traditional application and then some part of that is hooking into Ethereum or some blockchain platform like that.”

Smart contract rules on the blockchain also allow the permissioned DLT to be configured to restrict who can view information according to their security clearance and project involvement.

The USAF wouldn’t be the first government agency to consider blockchain. The DoD has been testing it for supply chain and logistics management, and the Federal Reserve is considering it for a real-time payment service, according to Avivah Litan, a vice president of research at Gartner.

The U.S. government is actually ahead of other sectors, such as healthcare, in testing blockchain, Litan said. “I’ve seen a few use cases,” she said. “They’re not the slowest sector.

“Fluree has a pretty clever structure,” Litan said. “It’s an intriguing use case for intelligence sharing because it’s cryptographically secured and immutable, so no one can change it. You’re always worried about an enemy or insider intercept. You still have to worry about bad actors getting a hold of someone’s account and writing data that way, but it’s still harder than it is with conventional systems.”

Copyright © 2020 IDG Communications, Inc.

Source link

CERN bails on Facebook’s Workplace, cites cost and data management concerns

Research organization CERN will replace Facebook’s Workplace collaboration application with an open source alternative, citing concerns around the management of user data following changes to Workplace’s payment plan.

CERN, the European Organization for Nuclear Research, began a free trial of the enterprise social network in 2016. It has since been testing the app with staff, including corporate HR and IT teams. Approximately 1,000 members of CERN’s staff have a Workplace account, with around 150 active weekly users on the platform. 

However “reactions were not always positive,” CERN said in a blog post this week. explaining the move. “Many people preferred not to use a tool from a company that they did not trust in terms of data privacy.”

While CERN had accessed the app as part of a free trial, it was told to either begin paying for the service or use a free version after Facebook announced new payment plans in July 2019. CERN said the move to a free version would remove admin rights and involve handing data to Facebook. 

“Losing control of our data was unacceptable, as was paying for a tool that was not part of our core offering for the CERN community; therefore, we will end the trial of this platform,” the organization said.

CERN now plans to use an open-source tool, Mattermost, for instant messaging, alongside several other internal communications tools already available for staffers. It has requested that all content hosted on Facebook’s servers be removed.

A Facebook spokesperson said the company is “sorry” about CERN’s decision: “Last October, we announced an update to our pricing and packaging. As part of this we started renewal conversations with some of our customers and we’re sorry CERN [is] no longer trialing Workplace. 

“We make it easy for Workplace customers to upgrade and downgrade based on their organization’s needs,” the spokesperson said. “Each pricing tier comes with different features and terms, all of which adhere to our strict security and privacy standards. We serve thousands of highly-regulated companies, like banks and governments, and have industry-standard security certifications like SOC2, SOC3, ISO27001 and ISO27018.

“We also offer our technology for free to global charities, educational institutions and emergency services organizations through our Workplace for Good program.” 

Workplace has two paid plans: the Workplace Enterprise tier costs $8 per user per month, while  Workplace Advanced, a paid option (at $4 per user per month), has limits on certain features such as storage and the number of people who can join group calls. It has a payment option aimed at frontline workers, which costs $1.50 per user per month. 

There are 3 million paid Workplace customers, according to the most recent data on the app. That number includes deployments at large enterprise such as Nestle and the Royal Bank of Scotland. 

However, concerns have arisen in the past about how controversies around handling of data in Facebook’s consumer business might affect its enterprise operations. A survey by CCS Insight last year showed that 42% of employees felt their trust in Facebook had decreased in the last 12 months.

“There are clearly trust concerns among CERN’s staff about using a tool developed and hosted by Facebook, and this is something we’ve seen become an increasing issue over the last couple of years following the Cambridge Analytica scandal,” said Angela Ashenden, a principal analyst at CCS Insight. 

“Overall, the Workplace team has done well to manage the impact of this on its enterprise business, but it’s inevitable that there will be some fallout as a result, as we’ve seen here.”

She added that, while the Workplace free trial attracted a lot of interest from a range of companies and helped to kick-start its traction in the collaboration market, a move to a revenue model was inevitable, with most organizations accepting they have to pay for enterprise-grade security, governance and full control.

Raúl Castañón-Martínez, senior analyst at 451 Research, said that CERN’s decision points to data management concerns among large organizations.  “It is notable that CERN explained that their decision was based on not having control of their data, even after they discontinued their use of Workplace,” he said. 

“This highlights that … SaaS services like Workplace might not be a good fit for every company; this is further reinforced by the fact that CERN stated they are relying on services like Mattermost, which does provide companies with full control of their data.

“It is also notable that several members publicly stated that they did not trust Facebook in terms of data privacy. While Facebook has stated that its enterprise solution functions as a separate entity to their consumer services, they could benefit from expanding their efforts to address these concerns.”

Copyright © 2020 IDG Communications, Inc.

Source link