Posts Tagged

Office

Get the March Windows and Office patches installed, but watch out for known bugs

It’s been another Keystone Kops month, with a reasonably stable Patch Tuesday, followed by a hasty Patch Thursday to cover a security hole Microsoft accidentally blabbed, then the usual buggy “optional, non-security, C/D Week” patch, finishing with a fix for yet another bug introduced by earlier patches.

Plus ça change …

Along the way we got a quiet fix for a bug in Windows Defender. And a warning about yet another bad-font-takes-over-your-PC security hole. Microsoft has toned down its original warning about that Type 1 Font Parsing security hole, and now says it’s mostly a less-severe problem with Windows 7 and related servers.

All the while, in spite of loud sirens from many corners, there have been exactly zero emergencies, where a Microsoft patch fixed a hole that’s being widely exploited.

Which means it’s a good time to make sure you have the March patches installed, in preparation for what awaits in WFH April. Here’s how to do it.

Make a full backup

Make a full system image backup before you install the latest patches.

There’s a non-zero chance that the patches — even the latest, greatest patches of patches of patches — will hose your machine. Best to have a backup that you can reinstall even if your machine refuses to boot. This, in addition to the usual need for System Restore points.

There are plenty of full-image backup products, including at least two good free ones: Macrium Reflect Free and EaseUS Todo Backup

Install the latest Win10 March Cumulative Update

If you haven’t yet moved to Win10 version 1909 (in the Windows search box type winver and hit Enter), I recommend that you do so. The bugs in version 1903 are largely replicated in 1909 and vice versa, so there’s very little reason to hold off on making the switch — although, admittedly, there’s almost nothing worthwhile that’s new in version 1909. I have detailed instructions for moving to 1909 here.

To get the latest March Cumulative Update installed, click Start > Settings > Update & Security. If you see a Resume updates box (screenshot), click on it.

1903 updates paused Woody Leonhard/IDG

That’s all you need to do. Windows, in its infinite wisdom, will install the March Cumulative Update at its own pace. If you don’t see a Resume updates box, you already have the March Cumulative update and you’re good to go.

If you see a come-on for the “optional, non-security, C/D Week” patch KB 4541335 (screenshot), simply ignore it. There’s absolutely nothing in that patch that you need or want, and it’s causing all sorts of problems.

1909 optional update available 2 Woody Leonhard/IDG

There’s a reason why Microsoft is discontinuing these step-in-the-mess “optional” patches.

When your machine comes back up for air, don’t panic if your desktop doesn’t look right, or you can’t log in to your usual account. You got bit by the “temporary profile” bug, which we’ve known about — and complained about — for more than a month. We have three separate threads on AskWoody about solving the problem (1, 2, 3) and if you need additional help, you can always post a question. (Thx @PKCano.)

Also, don’t be overly surprised if you discover that, after installing the March patches, your internet connection disappears when you connect to a virtual private network. Yep, that’s another bug introduced by this month’s patches. For a change, Microsoft has actually documented the bug — and released a fix. You should only install the manual-download-only patch of a patch KB 4554364 if you’re getting knocked offline when connecting to a VPN. If your internet stays connected, simply ignore this warning. You’ll get updated in April. At least, theoretically.

While you’re mucking about with Windows Update, it wouldn’t hurt to pause updates, to take you out of the direct line of fire the next time Microsoft releases a buggy bunch of patches. Click Start > Settings > Update & Security. Click “Pause updates for 7 days.” Next, click on the newly revealed link, which says “Pause updates for 7 more days,” four more times. That pauses all updates for 35 days, until early May. With a little luck that’ll be long enough for Microsoft to fix any bugs it introduces in April. And the March stragglers, for that matter.

Patch Win7, Win8.1, or associated servers

If you’ve paid for Win7 Extended Security Updates and you’re having trouble getting them installed, Microsoft has a new article called Troubleshoot issues in Extended Security Updates that may be of help. We’re also fielding questions on AskWoody. 

0patch continues to provide patches for Win7, going so far as to fix the announced new font parsing bug, which Microsoft itself hasn’t even fixed as yet. 

If you’re running Win7 and haven’t been able to get Extended Security Updates working (there are lots of reported problems!), @abbodi86 offers a script that’ll let you install the latest Win7 security patches, bypassing the ESU restrictions.

Several high-profile security guri, including Patch Lady Susan Bradley, have called on Microsoft to open up its March 2020 Win7 patches to everybody, particularly considering the number of people who are working from home, on older machines, through no fault of their own.

Windows 8.1 continues to be the most stable version of Windows around. To get this month’s puny Monthly Rollup installed, follow AKB 2000004: How to apply the Win7 and 8.1 Monthly Rollups. You should have one Windows patch, dated March 10 (the Patch Tuesday patch). No, you don’t want the Preview of Monthly Rollup.

After you’ve installed the latest Monthly Rollup, if you’re intent on minimizing Microsoft’s snooping, run through the steps in AKB 2000007: Turning off the worst Win7 and 8.1 snooping. If you want to thoroughly cut out the telemetry, see @abbodi86’s detailed instructions in AKB 2000012: How To Neutralize Telemetry and Sustain Windows 7 and 8.1 Monthly Rollup Model.

Thanks to the dozens of volunteers on AskWoody who contribute mightily, especially @sb, @PKCano, @abbodi86 and many others.

We’ve moved to MS-DEFCON 3 on the AskWoody Lounge.

Copyright © 2020 IDG Communications, Inc.



Source link

Microsoft to shift SMBs’ Office subscriptions to ‘Microsoft 365’ brand

Microsoft today announced name changes to the Office 365 subscription plans in the Business line, substituting “Microsoft 365” instead.

The Redmond, Wash. developer did not touch subscription plans aimed at enterprise, education and government.

Plan names will automatically change on April 21, Microsoft said in an online statement. Prices of the plans will not change.

  • Office 365 Business Essentials, the lowest-priced plan in the Business line, will become Microsoft 365 Business Basic.
  • Office 365 Business, the middling plan in the trio that provides the Office applications and OneDrive, but no other services, will become Microsoft 365 Apps.
  • Office 365 Business Premium, the most capable and most expensive subscription plan of the three, will become Microsoft 365 Business Standard.

Microsoft will change the moniker of Microsoft 365 Business to Microsoft 365 Business Premium to fit it into the Business line as the top-dollar $20 per-user per-month plan. That subscription adds security and management tools to Office 365 Business Standard, née Premium. (Currently, this is the lowest-priced plan in the Microsoft 365 line. After the name changes, though, it will fall somewhere in the middle.)

Finally, the orphan of Office 365, the Office 365 ProPlus deal, which like Office 365 Business limits the bits to the Office applications and OneDrive, will get the same Microsoft 365 Apps nameplate. (Microsoft said if it needed to differentiate the two, it would append “for business” and “for enterprise” on the offerings.)

Subscription label changes aside, everything will remain untouched. “There are no price or feature changes to plans at this time (emphasis added),” Microsoft said in a short Q&A embedded in the announcement.

What’s the frequency, Redmond?

As to why Microsoft will upend its Office 365 line with a rebranding project, the company had two reasons.

“We want our products to reflect the range of features and benefits in the subscription,” the company noted, again in the Q&A. Specifically, Microsoft pointed to past additions to Office 365 Business Essentials and Business Premium plans, notably the Teams collaboration, video conferencing and online meeting software, as justifying a step up in naming.

“Second, we’re always looking for ways to simplify,” the company continued. “This new approach to naming our products is designed to help you quickly find the plan you need and get back to your business.”

Microsoft’s second reason was the weaker of the two.

Ever since the 2017 introduction of Microsoft 365 as a subscription plan label, Microsoft has had an identity problem, with that line and the much older Office 365 crossing streams. Just what was Microsoft 365? How was it different — better than, by price anyway — from the original?

Initially, Microsoft 365 was an über-suite, an über-subscription, for it started with Office 365, then added more, most importantly a subscription to Windows 10. Microsoft 365, then, was Office 365 + Windows 10. (It was more, but those pieces were the most important.)

Microsoft could be applauded by bringing more of its subscriptions under the Microsoft 365 moniker – that’s clearly the name that will rule all at some point – but the brand remains scatter-brained. Some subscriptions are for consumers, as Microsoft also today announced an Office 365-to-Microsoft 365 name change for its Personal and Home deals; others are for business but sans Windows 10; yet more are for enterprises wishing for the kitchen sink, Windows included.

That’s not a brand, that’s just a mob.

And a large swath of Microsoft’s plans will remain, at least for now, tapped as Office 365, including all the enterprise-, education- and government-aimed subscriptions, ranging from Office 365 A1 to Office 365 E5. To crowd those plans under a Microsoft 365 umbrella will take some doing, as the company will have to figure out how to untangle the duplicate x3 and x5 suffixes.

Copyright © 2020 IDG Communications, Inc.



Source link

How businesses can save money when everyone needs Office to work from home

Companies have scattered to the wind, once-formidable armies of workers enclosed in glass buildings now sundered, each employee at his or her own outpost, whether kitchen table, home office desk or lap in a quasi-quiet corner.

Flinging employees off the workplace carousel may have been as simple as a single “Go home” order, but ensuring that those workers can do their work from home and be productive at it (or even partially productive), takes work – a lot of work.

The suddenness of the exodus from the office may also have left management, IT and even employees unprepared for the shift. Core and work-critical tools, Microsoft Office among them, may be missing. But money doesn’t grow on trees, not in times of cholera or coronavirus.

Getting Office to sent-home employees won’t be simple. If the firm has stuck with on-premises, perpetually-licensed solutions, beginning to hybridize infrastructure by moving some of it to the cloud will be rough. And if IT hasn’t had a lot of experience dealing with remote workers, there’s a steep learning curve ahead.

But there are ways to cut costs and save money when the first order of business is to get everyone working on business. Computerworld has compiled several of the best options, some for shops that rely on Office 2010, 2013, 2016 or 2019, others for enterprises partly or completely in on Office 365.

Stay healthy. Stay in business.

If your company relies on Office (perpetual)

Office’s perpetual version is the one that a firm purchases once with an up-front payment, typically as part of a volume licensing deal. That payment provides the rights to run the suite as long as one wants, long after Microsoft stops serving security updates if you’re willing to take risks. It can be installed on just one PC or Mac, and so is tied to that device, not to its current user.

That means if these devices stayed at the workplace when employees were sent home to work, there are no Office licenses available for the worker to install on his or her personal laptop.

Subscribe to Office 365 E1 or Office 365 Business Essentials

These two plans – the former for firms of all sizes, the latter only for companies that purchase 300 or fewer seats – are among the least expensive Office 365 subscriptions. Office 365 E1 runs $8 per month per user (when paid for in a single lump sum for an entire year; more on that later). Office 365 Business Essentials costs $5 per user per month (again, when bought in an annual lump sum).

Neither plan provides the desktop Office applications found in Office perpetual, instead offering the web versions of Word, Excel, PowerPoint and Outlook. Both also provide Teams, Microsoft’s collaboration/video conferencing software, which many businesses have begun using – or are using much more often now – to communicate and meet with now-at-home employees.

(Note: Check out “More Teams for free” below for an even better deal on Office 365 E1.)

The idea here is that these Office 365 licenses are considerably less expensive than purchasing, say, a second Office 2019 license for an employee to use during the crisis. And while the web apps are not the equal of the desktop applications, they should serve for the unknown-but-not-infinite time workers will work from home.

Pay on a month-by-month basis

No one knows exactly when it will be prudent to return to working in large groups. Even experts are wary of guessing.

With that in mind, it seems smart to pay for “bridge” Office 365 plans like Enterprise E1 or Business Essentials on a month-by-month basis, not in a lump sum for a full year.

Office 365 Business Essentials, for example, costs $6 per user per month when paid month-by-month (and thus with only a monthly commitment). If the work-at-home stretch for employees needing the plan runs nine or fewer months, then, month-by-month payments will save money over the annual rate and commitment.

Partake of free-trial offers

Small businesses that were mulling moving to Office 365 and its always-updated/rent-not-buy model before the COVID-19 pandemic upended everything – and are still pondering the change – should take advantage of Microsoft’s free one-month trials.

Office 365 Business Premium, a subscription plan that includes the desktop Office applications – Word, Excel, PowerPoint and Outlook for both Windows and macOS; Publisher and Access for Windows only – costs $12.50 per user per month (when paid for in an annual lump sum) or $15 per user per month (when paid on a month-to-month basis). Microsoft offers a 30-day free trial to the plan for up to 25 users.

The designated administrator can start the trial here.

If your company relies on Office 365

Organizations already armed with Office 365 – the by-subscription service whereby customers pay Microsoft an ongoing fee annually or monthly for the right to run the suite and numerous services – have an edge when their workers get spread from here to Timbuktu. That’s because the subscription is licensed per user, not per device, allowing each employee to install the applications on multiple devices, including personal hardware they have at home. (There are many more reasons to give Office 365 the advantage here, but that’s enough for now.)

Get the Office each worker can use

Not everyone who has been suddenly told to work remotely will have a PC or Mac at home. But virtually everyone has a smartphone.

“The first challenge of shifting to working remote – especially on short notice – is being disconnected,” Yana Terukhova, who leads product marketing strategy for Excel, wrote in a March 19 post to a company blog.

She then ticked off the mobile apps licensed to most users of Office 365, including the Outlook email app for iOS or Android, and the new Word-Excel-PowerPoint combo app for the two operating systems.

Even entry-level Office 365 plans, such as Office 365 Business Essentials, which costs $6 per user per month when paid on a month-to-month basis, include rights to iOS and Android Office apps.

Depending on the employee’s role in the organization, a personal smartphone may be all someone needs to do the job – or a large portion of it.

Get Teams for free for employees without it

Although Teams is included with most Office 365 Business and Office 365 Enterprise plans, there are exceptions, including Office 365 Business and Office 365 ProPlus. And then there are the employees who aren’t assigned an Office 365 license because of their work roles.

The company needs a way to communicate with everyone on the payroll.

Microsoft has a program called “Microsoft Teams Exploratory” that lets employees with an Azure Active Directory-managed email address request a Teams license. (The request must be initiated by the user; it cannot be claimed by an administrator for a user.) The no-charge license will be good until the company’s next enterprise agreement anniversary or subscription renewal, during or after January 2021.

More information, including how administrators can manage the Teams license, can be found in this support document.

More Teams for free

Another way to equip employees with Teams – and other Office bits, including commercial rights to the web and mobile apps – is with a Microsoft free offer of Office 365 E1. The deal, which Microsoft first mentioned earlier this month, awards E1 for a six-month stretch.

The lowest-priced Enterprise plan – $8 per user per month when paid for in an annual sum – includes Teams, as well as online storage (OneDrive), email (Exchange), and the web versions of Word, Excel, PowerPoint and Outlook. Also part of the plan: Mobile Office apps for iOS and Android.

This offer is aimed at enterprises or other organizations with existing relationships with Microsoft sales or a reselling partner. “Contact your Microsoft partner or sales representative,” said Jared Spataro, a Microsoft executive, in a March 5 post to a company blog.

Microsoft has also waived the usual requirements for its FastTrack support for the free Office 365 E1 trial. FastTrack will assist customers getting workers on board E1 from March through August of this year, the company said.

Tell workers to self-install Office on their PC or Mac

When employees suddenly at home freak out that they can’t work without Office, then get on the horn with the also-working-from-home help desk asking what to do, the answer may not cost the company a dime. That’s because an employee already covered by an Office 365 plan can self-install Office on his or her own Windows PC or Mac machine.

IT staff erscan point users to this support document, which describes the steps of signing on to office.com, downloading and installing the suite.

Copyright © 2020 IDG Communications, Inc.



Source link

This month’s Windows and Office security patches: Bugs and solutions

It’s been another strange patching month. The usual Patch Tuesday crop appeared. Two days later, we got a second cumulative update for Win10 1903 and 1909, KB 4551762, that’s had all sorts of documented problems. Two weeks later, on Monday, Microsoft posted a warning about (another) security hole related to jimmied Adobe fonts.

Predictably, much of the security press has gone P.T. Barnum.

The big, nasty, scary SMBv3 vulnerability

Patch Tuesday rolled out with a jump-the-gun-early warning from various antivirus manufacturers about a mysterious and initially undocumented security hole in the networking protocol SMBv3.

Later that day, Microsoft released a broad description of the SMBv3 security hole in Security Advisory ADV200005 – apparently trying to close the door after the cow escaped. And the crowd went wild. How could Microsoft tell these antivirus vendors about a forthcoming fix, then fail to deliver the fix – and not warn the AV folks in time to pull their press releases? Tales of impending doom ran rampant.

Then, on Thursday, we saw another cumulative update for Win10 versions 1903 and 1909. KB 4551762 patches the SMBv3 security hole and, being a cumulative update, includes all earlier patches. The rush was on to install the patch-of-a-patch, but we started seeing all sorts of problems: errors on installation; random reboots; performance hits; and the return of our old profile-zapping bug, which leaves folks with empty desktops and hidden files.

Here’s the punch line. (Tell me if you’ve heard this one before.) After all the sturm un drang, researchers (notably including Kevin Beaumont) discovered that they couldn’t effectively use the security hole to take over a system:

“Windows Defender, which is enabled by default, detects exploitation even if unpatched.”

As of this writing, I don’t know of any real-world attacks using the SMBv3 vulnerability. Certainly, one will appear sooner or later, but it isn’t a big deal right now.

The big, nasty, scary Adobe Type Manager font bugs

Yesterday, Microsoft released another Security Advisory. ADV200006  — Type 1 Font Parsing Remote Code Execution Vulnerability describes a security hole in the way Windows handles fonts. We’ve seen a lot of those in Windows over the years. This one came with the usual zero-day language, advising that Microsoft has seen “limited targeted attacks that could leverage un-patched vulnerabilities.” The advisory shows that every version of Windows – going back to Win7 – is vulnerable.

Once again, the blogosphere went nuts. Microsoft’s warning meeeeeeelions of Windows users that their systems are under attack!

Yeah. Sure.

When Microsoft says it’s seen “limited targeted attacks,” that means some well-heeled hacking group is using the security hole against a very specific target – usually a government agency or a high-stakes corporate group. For normal people, in normal situations, it’s not a big deal.

We’ve seen these “sky-is-falling” scenarios play out over and over again in the past year or so. Some security holes (e.g., for EternalBlue/WannaCry and BlueKeep) need to be plugged shortly after the patches are released. But in the vast majority of cases, waiting a week or two or three to install the latest crop of Windows and Office patches just makes sense.

Windows Defender ‘Items skipped during scan’

Many – but not all – Windows 10 users report that a manual scan by Windows Defender triggers this “Items skipped during scan” notification (screenshot).

Windows Defender items skipped during scan 2 Microsoft

It appears to be a bug. According to Lawrence Abrams at BleepingComputer:

“It seems that in the older Windows Defender engines network scanning was enabled by default… [in newer versions of the engine] you can see that the Windows Defender preferences show that network scanning has now been disabled by a newer engine. It is not known why Microsoft decided to make this change, but the alerts appear to just indicate that network scanning was skipped.”

Günter Born originally reported on the bug. He has come up with a manual workaround to enable network scanning.

Other developments

More on the patching front:

  • Microsoft has announced that it’s extending end-of-life for Win10 version 1709 Enterprise (and Education) to Oct. 13, 2020.
  • Abbodi86 has discovered a way to install the latest Windows 7 security patches, even if you haven’t yet set up Extended Security Updates. Many people, including Patch Lady Susan Bradley, are asking Satya Nadella to offer Win7 Extended Security Updates to all “genuine” Win7 customers, particularly because of the increase in work-from-home.
  • In the same vein, there’s a lot of discussion about throttling back on Windows auto updates, specifically to help keep work-from-home systems stable. Many advocate holding off on the inevitable Win10 version 2004 update. No indication that Microsoft has heard the pleas.

If there ever were a time for Windows patching stability, this is it.

We’ll keep pushing on AskWoody.com.





Source link

Don’t let the coronavirus make you a home office security risk

Welcome to life working at home, where the only one standing between you and all kinds of malware, ransomware and other security foul ups is, well, you.

Sure, the tech support desk will try to help you, but it’s not like they can stop by your desk and install a patch for you anymore. It’s a brave new scary world and we’re all trying to do the best we can. So, here, are six tips on how to keep your computer safe.

We hate to say it but all too many computer problems are, as they say in tech support land,  “Problem exists between chair and keyboard (or PEBCAK).” That is, little old you. No one’s asking you to become a security guru and win the next Pwn2Own competition. But you must learn a little bit about how to keep your computer safe and you must be warier of potential threats.

You see, there really are people out there who want to grab your password, steal your data and your company’s data, and infect your computer with ransomware while they’re at it. Or, to be more precise, there are automatic botnet systems out there spending every second of the day pounding on your virtual door.

It’s nothing personal. Just like the coronavirus, though, these really are out to get you. So, you need to act accordingly.

Enable automatic updates (usually)

If you, or your corporate IT staff, haven’t done it before, turn on automatic software updates for your operating system and programs.

Everyone says that, but let me add a caveat: If you use Windows for your desktop operating system, learn what your business’s recommendations are for Windows update. You may not want to update Windows at all.

You see lately Windows 10 has a truly lousy patching record.  This included machines not booting properly; your desktop vanishing into the ether; and the File Explorer Search box went haywire for a while. Microsoft has even delayed retiring Windows 10 1709, known to you as the 2017 Fall Creators Update by six months. That’s just so people don’t have to update their older Windows 10 systems and possibly run into problems.

Given all this, do you really want to update, run into a problem, and then try to troubleshoot it on your own? No, I didn’t think so.

Instead, I suggest you pause Windows 10 updates for now. To do that with a business edition of Windows 10, you do this by going to Settings > Update & Security > Windows Update > Advanced Options. Once there, under the “Choose when updates are installed” heading, select Semi-Annual Channel. This delays major feature updates by about four months, when all the bugs should be worked out. Under the quality update heading, change the deferral period to 30 days from its default of zero. These are the Patch Tuesday patches.

If you’re running a Windows 10 Home and it’s Windows 10 1903 (aka the May 2019 Update, or newer) you can also delay patches. To do this go to Settings > Update & Security > Windows Update, and look for the “Pause updates for 7 days” button. With this, you can keep delaying it in 7 day chunks for up to 35 days.

Everything else, just go ahead and update. There may even be programs you rely on hiding in your system that need patching but do a poor job of alerting you. For these, you can use SUMo or  PatchMyPC or to track other programs software on your PC that may need an update..

Finally, if you go to a random website and it tells you must update Adobe Flash or some other program before you can use it and you can download it from a link they provide, DON’T DO IT. Often this is a corrupted website trying to put malware on your computer.

Anti-viral software: Who needs it?

You wouldn’t know if from all the ads, but viruses are among the least of your security worries these days. There are all kinds of malware out there, but the traditional virus or worm? Not so much.

That said, while you can use one of the latest and best antivirus programs for most of us Microsoft’s own free Windows Defender Security Center is all you’ll need. If you want more check out, Norton Security Premium or AVG Internet Security,

If you use a Mac, you may think you’re safe. Nope. While you’re far less likely to run into malware than your Windows-using colleagues, there are viruses out there with your Mac’s name on them. For overall protection, we recommend Sophos Home Premium. If you just want good free antivirus protection give AVG Antivirus for Mac‘s free tier a try.

Desktop Linux user? You don’t really need an antivirus program. It’s not that Linux’s security is perfect — nothing is in this world — but it’s better than the rest. There’s never really been an effective Linux desktop virus.

Password management

We all hate passwords and want to move on. Well, maybe someday two-factor authentication (2FA) will be perfected. But, we’re not there yet. In the meantime, here are some simple suggestions on how to use passwords safely and efficiently.

First, use passphrases, like “I-Hate-Coronavirus!!,” which you can remember instead of easy to guess passwords like “abcdef,” the ever popular “password,” or your birthday. Nor, should you use memory unfriendly passwords such as “Gog$^Yack4.” Your memory and your security will thank you.

You should also use a password manager. With most of us having to deal with dozens of sites and services requiring passwords, no one can remember all of them. The answer’s a password management program.

Password managers enable you to manage your login credentials across all your devices while keeping your passwords secure. They can also automatically fill in web forms for you. Many web browsers, such as Edge, Firefox, and Google Chrome include this functionality

If you don’t trust Microsoft, Mozilla or Google with your data, or you want non-internet password management, you need a standalone password manager. The best of these are LastPass and 1Password.

Of course, if 2FA is available on services you use all the time. Use It. Yes, it can be a nuisance entering in a PIN from a text message or the like, but it makes them orders of magnitude more secure.

Bad guys gone phishing

The single biggest security problem you’re most likely to run into is phishing. There are two kinds of phishing. In the older type, scammers use email or text messages to trick you into giving them your personal information. Once they have your passwords, account numbers, or Social Security number, you can kiss your privacy, credit score and possibly your job good-bye. In the other, you’re encouraged to download or open a file or click on a link, which will infect your computer with malware.

In either case, they often look like they’re from someone or a company you trust.  They often tell you a story to trick you into making a fatal mistake. This can include the following: Saying they’ve noticed some suspicious activity or problem, there’s a problem with your account, you’re eligible for a refund or you need to pay a (fake) invoice. 

There’s already been a significant rise in coronavirus phishing messages. You can be sure they’ll be many more proclaiming a cure, an urgent message from the CDC, and the like.

Phishing messages also disguise themselves with personal information. They’ll include your home address, your pets’ names and so on. Don’t buy it. It’s easy to find your personal information on the internet. Just consider for a moment how much to tell people about yourself on Facebook and the other social networks.

You can spot phishing messages with several tell-tale signs. If you look closely at the address instead of being from a real address, say [email protected] it will be from [email protected]. They also often open with a generic solution such as “Hi Dear” instead of your real name.

When you get a phishing message, delete it. Never reply to it or open any link or attachment within it.

Finally, another phishing variant is the Microsoft support call scam.  In this one, you’ll get a call from someone claiming to be from Microsoft or a partner and that an automatic scan of your PC has shown a problem and they’re here to help all for one low price No, no they’re not. Microsoft will never call you out of the blue. At the very least, you’ll lose a few bucks and the worst you may find your computer and all your company’s files locked up with ransomware,

Virtual private networks: VPNs still a necessity

These days a lot of our front-line business programs, such as Office 365, Google Docs, and QuickBooks Online use a software-as-a-service (SaaS) cloud model. For these, you don’t need a VPN. But, a lot of our in-house applications still are humming away in our data centers and server rooms. That means, you’ll need a VPN to safely get to them.

If your company hasn’t set up a VPN for you, tell them to set one up right now. Otherwise anything you send between your home and your office is vulnerable to be spied on.

Picking a VPN isn’t your job — you may be acting as a chief security officer, but you aren’t paid like one nor do you have the technical expertise.

If you’re running a small business, you need to pick a small-office/home-office (SOHO) VPN now, Some of the best, easy-to-deploy choices are ExpressVPN, StrongVPN, or TunnelBear

Backups: Your last chance for survival

Last, but never least, you may not think of backups as part of security, but they are. They’re the last safety belt to save you from disaster when everything else has gone wrong. As long as you have a good backup, even if your files are frozen by ransomware and your machines are working more for a botnet than they are for you, you can still wipe everything and start fresh.

Again, this is something your IT department should be handling for you. But, in the rush to get you out the door and working from home. it may have been neglected.

The quickest, easiest way to back up your business PC from home is to use a cloud backup service. Once your company’s sysadmins catches up they’ll also find it easier to get at your backups if they’re on the cloud rather than if you’re using an old-style DVD or even tape backup system. Ones to consider are Acronis, Carbonite, and IDrive. A more home Mac and Windows friendly solution is Google’s Backup and Sync.

Secure at home

Keeping your work safe from home isn’t easy. Butit’s not rocket science either. Just follow these tips and you should be OK.

After all, I’ve been following them for more than 30 years of working from home without a single security incident. If I can do it, you can, too.

Welcome to life working at home, where the only one standing between you and all kinds of malware, ransomware and other security foul ups is, well, you.

Sure, the tech support desk will try to help you, but it’s not like they can stop by your desk and install a patch for you anymore. It’s a brave new scary world and we’re all trying to do the best we can. So, here, are six tips on how to keep your computer safe.

We hate to say it but all too many computer problems are, as they say in tech support land,  “Problem exists between chair and keyboard (or PEBCAK).” That is, little old you. No one’s asking you to become a security guru and win the next Pwn2Own competition. But you must learn a little bit about how to keep your computer safe and you must be warier of potential threats.

You see, there really are people out there who want to grab your password, steal your data and your company’s data, and infect your computer with ransomware while they’re at it. Or, to be more precise, there are automatic botnet systems out there spending every second of the day pounding on your virtual door.

It’s nothing personal. Just like the coronavirus, though, these really are out to get you. So, you need to act accordingly.

Enable automatic updates (usually)

If you, or your corporate IT staff, haven’t done it before, turn on automatic software updates for your operating system and programs.

Everyone says that, but let me add a caveat: If you use Windows for your desktop operating system, learn what your business’s recommendations are for Windows update. You may not want to update Windows at all.

You see lately Windows 10 has a truly lousy patching record.  This included machines not booting properly; your desktop vanishing into the ether; and the File Explorer Search box went haywire for a while. Microsoft has even delayed retiring Windows 10 1709, known to you as the 2017 Fall Creators Update by six months. That’s just so people don’t have to update their older Windows 10 systems and possibly run into problems.

Given all this, do you really want to update, run into a problem, and then try to troubleshoot it on your own? No, I didn’t think so.

Instead, I suggest you pause Windows 10 updates for now. To do that with a business edition of Windows 10, you do this by going to Settings > Update & Security > Windows Update > Advanced Options. Once there, under the “Choose when updates are installed” heading, select Semi-Annual Channel. This delays major feature updates by about four months, when all the bugs should be worked out. Under the quality update heading, change the deferral period to 30 days from its default of zero. These are the Patch Tuesday patches.

If you’re running a Windows 10 Home and it’s Windows 10 1903 (aka the May 2019 Update, or newer) you can also delay patches. To do this go to Settings > Update & Security > Windows Update, and look for the “Pause updates for 7 days” button. With this, you can keep delaying it in 7 day chunks for up to 35 days.

Everything else, just go ahead and update. There may even be programs you rely on hiding in your system that need patching but do a poor job of alerting you. For these, you can use SUMo or  PatchMyPC or to track other programs software on your PC that may need an update..

Finally, if you go to a random website and it tells you must update Adobe Flash or some other program before you can use it and you can download it from a link they provide, DON’T DO IT. Often this is a corrupted website trying to put malware on your computer.

Anti-viral software: Who needs it?

You wouldn’t know if from all the ads, but viruses are among the least of your security worries these days. There are all kinds of malware out there, but the traditional virus or worm? Not so much.

That said, while you can use one of the latest and best antivirus programs for most of us Microsoft’s own free Windows Defender Security Center is all you’ll need. If you want more check out, Norton Security Premium or AVG Internet Security,

If you use a Mac, you may think you’re safe. Nope. While you’re far less likely to run into malware than your Windows-using colleagues, there are viruses out there with your Mac’s name on them. For overall protection, we recommend Sophos Home Premium. If you just want good free antivirus protection give AVG Antivirus for Mac‘s free tier a try.

Desktop Linux user? You don’t really need an antivirus program. It’s not that Linux’s security is perfect — nothing is in this world — but it’s better than the rest. There’s never really been an effective Linux desktop virus.

Password management

We all hate passwords and want to move on. Well, maybe someday two-factor authentication (2FA) will be perfected. But, we’re not there yet. In the meantime, here are some simple suggestions on how to use passwords safely and efficiently.

First, use passphrases, like “I-Hate-Coronavirus!!,” which you can remember instead of easy to guess passwords like “abcdef,” the ever popular “password,” or your birthday. Nor, should you use memory unfriendly passwords such as “Gog$^Yack4.” Your memory and your security will thank you.

You should also use a password manager. With most of us having to deal with dozens of sites and services requiring passwords, no one can remember all of them. The answer’s a password management program.

Password managers enable you to manage your login credentials across all your devices while keeping your passwords secure. They can also automatically fill in web forms for you. Many web browsers, such as Edge, Firefox, and Google Chrome include this functionality

If you don’t trust Microsoft, Mozilla or Google with your data, or you want non-internet password management, you need a standalone password manager. The best of these are LastPass and 1Password.

Of course, if 2FA is available on services you use all the time. Use It. Yes, it can be a nuisance entering in a PIN from a text message or the like, but it makes them orders of magnitude more secure.

Bad guys gone phishing

The single biggest security problem you’re most likely to run into is phishing. There are two kinds of phishing. In the older type, scammers use email or text messages to trick you into giving them your personal information. Once they have your passwords, account numbers, or Social Security number, you can kiss your privacy, credit score and possibly your job good-bye. In the other, you’re encouraged to download or open a file or click on a link, which will infect your computer with malware.

In either case, they often look like they’re from someone or a company you trust.  They often tell you a story to trick you into making a fatal mistake. This can include the following: Saying they’ve noticed some suspicious activity or problem, there’s a problem with your account, you’re eligible for a refund or you need to pay a (fake) invoice. 

There’s already been a significant rise in coronavirus phishing messages. You can be sure they’ll be many more proclaiming a cure, an urgent message from the CDC, and the like.

Phishing messages also disguise themselves with personal information. They’ll include your home address, your pets’ names and so on. Don’t buy it. It’s easy to find your personal information on the internet. Just consider for a moment how much to tell people about yourself on Facebook and the other social networks.

You can spot phishing messages with several tell-tale signs. If you look closely at the address instead of being from a real address, say [email protected] it will be from [email protected]. They also often open with a generic solution such as “Hi Dear” instead of your real name.

When you get a phishing message, delete it. Never reply to it or open any link or attachment within it.

Finally, another phishing variant is the Microsoft support call scam.  In this one, you’ll get a call from someone claiming to be from Microsoft or a partner and that an automatic scan of your PC has shown a problem and they’re here to help all for one low price No, no they’re not. Microsoft will never call you out of the blue. At the very least, you’ll lose a few bucks and the worst you may find your computer and all your company’s files locked up with ransomware,

Virtual private networks: VPNs still a necessity

These days a lot of our front-line business programs, such as Office 365, Google Docs, and QuickBooks Online use a software-as-a-service (SaaS) cloud model. For these, you don’t need a VPN. But, a lot of our in-house applications still are humming away in our data centers and server rooms. That means, you’ll need a VPN to safely get to them.

If your company hasn’t set up a VPN for you, tell them to set one up right now. Otherwise anything you send between your home and your office is vulnerable to be spied on.

Picking a VPN isn’t your job — you may be acting as a chief security officer, but you aren’t paid like one nor do you have the technical expertise.

If you’re running a small business, you need to pick a small-office/home-office (SOHO) VPN now, Some of the best, easy-to-deploy choices are ExpressVPN, StrongVPN, or TunnelBear

Backups: Your last chance for survival

Last, but never least, you may not think of backups as part of security, but they are. They’re the last safety belt to save you from disaster when everything else has gone wrong. As long as you have a good backup, even if your files are frozen by ransomware and your machines are working more for a botnet than they are for you, you can still wipe everything and start fresh.

Again, this is something your IT department should be handling for you. But, in the rush to get you out the door and working from home. it may have been neglected.

The quickest, easiest way to back up your business PC from home is to use a cloud backup service. Once your company’s sysadmins catches up they’ll also find it easier to get at your backups if they’re on the cloud rather than if you’re using an old-style DVD or even tape backup system. Ones to consider are Acronis, Carbonite, and IDrive. A more home Mac and Windows friendly solution is Google’s Backup and Sync.

Secure at home

Keeping your work safe from home isn’t easy. Butit’s not rocket science either. Just follow these tips and you should be OK.

After all, I’ve been following them for more than 30 years of working from home without a single security incident. If I can do it, you can, too.



Source link