Keeping on topic with how our country is fairing, I thought I would touch on one of the many elephants in the room that often goes unnoticed or is ‘conveniently’ forgotten about. That elephant is named Disaster Recovery, and an organization might be called a ‘Dumbo’ if they don’t have a Disaster Recovery Plan in place. What Constitutes a Disaster? First, what constitutes a disaster in the IT world? A disaster in the IT world is defined by many different categories: Natural Disasters Hardware Error / Thefts Virus / Malware Attacks On-site Disaster (i.e. fire) Power Outages Server Room Environment Issues (i.e. Air conditioner breaks) Unexpected Updates and Patches Human Error All of the above seem to be happening on a daily basis. The question is no longer if this is going to happen to an organization, it’s WHEN is it going to happen to an organization? There’s plenty of natural disasters all year long, and they seem to continue to increase in severity. Thieves are getting more and more creative and are constantly thinking of innovative ways of hacking into even some of the most fortified infrastructures. Just ask Epsilon, Facebook, Sony, Yahoo, etc. Ransomware is nerve-racking to say the least. An organization could shell out hundreds, if not millions of dollars on the hope of possibly getting data back. Talk about a gamble! You’d have better luck at the Blackjack table. Power Outages seem to be more frequent now than ever. Rolling blackouts seems to be the trend in many states, and it’s only mid-June! And, then there is the human race and our ability to be create a cataclysmic mistake because he or she might have been having a bad day. We’ve all been there, and we all know that sometimes the slightest little thing will set us off and put a constraint on our ability to focus on the smallest of details. Even worse, there are many times where an organization knows they need to do something as soon as possible, but instead they try to wish it away or the problem will go away by itself. Disasters are like a Cancer; they aren’t going away unless treated. Steps to a Disaster Recovery Plan Now, I am not here to sell insurance to you, but to create more awareness out there that if an organization doesn’t have a plan in place, many will be filing unemployment WHEN that day happens. Before that plan is created, it may be a good idea to have an overall Disaster Recovery Assessment which will look at a company’s Server, Storage and Network Infrastructure. What usually happens is that a specialized Engineer will be onsite and also remote-in to a specific infrastructure and document the existing environment. From that environment, an Engineer will provide recommendations based on best practices and a ballpark figure of what it’s going to cost to make sure that the Disaster Recovery Plan will minimize the pain from the actual disaster as much as possible. There are some organizations out there whose pride is bigger than their brains. Don’t let ego get in the way and be a know-it-all. The reality is that organizations don’t know-it-all. Employees have been doing the work of two or three people since the early 2000s. This Disaster Recovery Plan should not be added to their list of daily duties. Swallow the pride and get a team out there who specializes in Disaster Recovery. They know what to look for, ask the right questions, uncover a weakness or threat that has gone unnoticed and may even reduce the risk of a disaster that was right around the corner. I am not an alarmist, but a realist. It’s going to happen to every organization. How prepared are you if it happens tomorrow? Good luck sleeping with that floating around in your head tonight. Contact ProCern for an assessment of your current environment and for recommendations on Disaster Recovery solutions.
We are all winners when there is competition in the semiconductor industry A personal narrated history of the semiconductor market in my lifetime. For many years, I have been labeled by my friends and peers in the industry as being an AMD fanboy. In truth, I am a fan of competition and a free market to drive innovation and keep prices affordable for everyone. In this blog, we will dive into a little history about AMD. They are very relevant today not only in the PC market but in the Datacenter as well. Some history When people think of computer processors, typically the brand Intel comes to mind. They have been pioneers in the consumer and enterprise microprocessor industry for more than half a century. The company was founded in 1968 in California by Gordon E. Moore a chemist and Robert Noyce who was a physicist. Throughout much of the twentieth century advancements in computer processing could most notably be attributed to the Intel corporation. In the mid-1970s, something interesting happened in the microprocessor market. Another American company AMD or Advanced Micro Devices, known at the time to provide licensed second-source manufacturing for Intel and others started to develop and sell their own unique microprocessor designs. This was the catalyst for consumers and OEMs to have a choice in the marketplace for whom provided their computer processors. Until that time, Intel had solely provided or licensed others to make the processors for the IBM personal computer and other enterprise products. 1980s-1990s – AMD can compete … mostly Throughout the 80s and 90s, AMD was making licensed copies or clones of Intel processors with relative success. In 1996, AMD released its first in-house designed x86 processor. This competed with the Intel Pentium processors operating at 75-133Mhz. They weren’t developing anything revolutionary. They were providing a cheaper alternative to Intel and driving innovation to some degree. This is the era in which I became an AMD customer. At the time, I could not afford an Pentium based PC. I cobbled together components that I could afford to build my first computer. It was an AMD K6 266Mhz processor and had 16Mb of RAM. It wasn’t much but I could do my schoolwork on it and it played a few games. 2000-2010 – Things are looking up for AMD In the early 2000s, AMD released their socketed Athlon processors. They were true game changers as they supported features like on-die L2 cache and double data rate RAM. Later in 2003, they introduced to the market the first 64bit processor. Beating Intel to the punch and taking the innovation crown for a short period of time. In 2007, AMD introduced their first server class processor called the Opteron. The Opteron was a very powerful and viable alternative to Intel’s XEON processor. Budget conscious businesses had another option when choosing servers for their data centers which wouldn’t break the bank. During this time frame, multi-core processors were introduced to the marketplace. AMD pursued this trend with positive results. “At this time in my life, I was working in IT. I finally had some money to build the computers I wanted to build. Again, I chose AMD because of their price-to-performance ratio compared to Intel. My thought process involved simple mathematics. If I was able to achieve 90 percent of the performance of the Intel equivalent for 60 percent of the cost, then it seemed like a good choice. “ #lawofdiminishingreturns 2010-2015 – The Dark ages of which we do not speak During this time frame, AMD is handedly beaten by Intel by most legitimate metrics. They did not innovate or develop new core architectures but chose to pile on the physical processing cores. A strategy that failed them for the better part of a decade. The consumer products weren’t competitive. The server processors were relegated to budget options and entry level servers for small businesses. Although I owned many computers comprised of this architecture, it was a low point for me. I did lose some faith in the company. My concerns centered around the lack of competition in the marketplace. Monopolies are good for no one except Mr. Monopoly whoever that may be. 2016-Today – The enlightenment and salvation In 2016, AMD introduced the Ryzen or Zen microprocessor architecture to the world. This revolutionary microarchitecture displayed IPC (instruction per clock-cycle) gains of almost 52 percent compared to the previous Bulldozer architecture. AMD was back in the game in a big way. In the consumer market, AMD sells processors that were faster than Intel offerings and twice the price. In the enterprise, AMD has continued to increase core counts with this newest architecture. It has extinguished some of Intel’s market share in the Datacenter. TODAY AMD has released its second iteration of the Zen architecture called Zen 2. The enterprise offering is called 2nd Gen EPYC. This architecture is truly displacing the Intel offering because it can compete on more than one level. The IPC is on par and often exceeds the Intel equivalent. The core counts far exceed what Intel has by offering a 64 core/128 thread processor named EPYC 7742. This processor by itself could facilitate a virtual environment for most small to mid-sized businesses. The processor is so revolutionary that virtualization/hypervisor companies are changing their licensing models in fear that a single socket host would undercut their profits from licensing. Who offers it? Hewlett Packard Enterprise, a company who has always been an advocate and an ally to AMD. They sell consumer devices outfitted with the newest AMD RYZEN processors based one ZEN 2 architecture. The servers utilize the newest 2nd Gen EPYC processors based on the same microarchitecture. These solutions offer better performance. Pricing is competitive to the point where they displace any Intel offering. As an unabashed AMD fanboy, I urge you to look at the metrics and decide for yourself. In almost any computing workload, AMD is a competitive and cost effective option. Contact ProCern today for more
Containers – What are they? First, let’s begin with what containers are. There are a number of mature container technologies in use today, but Docker has been the long time leader. To many, the name “Docker” is synonymous with “container,” so looking at their explanation would be a good idea. “A container is a standard unit of software that packages up code and all its dependencies so the application runs quickly and reliably from one computing environment to another. A Docker container image is a lightweight, standalone, executable package of software that includes everything needed to run an application: code, runtime, system tools, system libraries and settings.” Even among IT professionals, there seems to be some confusion for people who haven’t actually used this technology. Most of us have heard of containers. We may have them powering applications in the workplace, yet still don’t really understand them. People that have mostly wrapped their heads around what virtual machines are, might still have trouble understanding container technology. A Portable Application Virtual machines run on virtualized hardware, which can cause a pretty significant performance hit for RAM/CPU/Disk/ and other virtualized resources. An operating system needs to be installed on the virtual machine. This can take up a large amount of disk space and system resources used by the operating system. This adds up quickly, especially with a lot of virtual machines. Operating systems also need to boot up before they can run applications. This can introduce quite a bit of delay. Containers simply put just run applications on a virtual operating system. They don’t need to boot up, and can be spun up in seconds. This still may be about as clear as mud for some, so I’ll break this down to a very basic level. A container is just a portable application. That might be a bit basic of an explanation, but it is still pretty accurate in my opinion. A different use case for containers Designing microservices, that run on multiple clouds, at scale, and orchestrated by something like Kubernetes is outside the scope of what I’d like to cover in a blog post. There is also a lot of material out there on this topic. Instead, I’ll propose a more obscure use case – running legacy software. It isn’t pretty, but the reality is that sometimes legacy systems are still a thing. Some easy examples to pick on are legacy PBX(phone system) applications or building control applications. Those don’t normally generate revenue, but losing control of your phone system or HVAC system could definitely be an issue. A more extreme example would be revenue generating, line of business applications that just have no suitable replacement. Maybe there is a suitable replacement, but the cost is just too prohibitively expensive when your old system still works great. Perhaps there are licensing cost changes, or having to buy large quantities of new IP phones to run on a modern PBX just isn’t in the budget. Some of these just cannot run on anything past End Of Life Windows versions such as Windows 2003, 2000, or even NT(YIKES!!!). The software vendor that designed these might have gone out of business, and these systems just never got around to being replaced because they just work and generate revenue. WINE in a Linux container Among many other problems, running end of life software, on end of life operating systems, is a HUGE security issue. It is difficult, if not impossible to prevent an attack using known exploits that are simply un-patchable. What is a better way? You can run Windows applications using WINE (originally a backronym for “Wine Is Not an Emulator”), in a Linux container! This solves a lot of security issues related to the operating system. The “What happens if my 15 year old server dies?” also is solved. If you really wanted to, you could even put that antiquated application in the cloud. Configuring WINE is also out of scope for what I’d like to cover in this post, but there is plenty information out there. Rather than pick on out of business software vendors, I “containerized” a few Windows applications that are freely available which I have actually encountered being used for actual business use. We can just pretend that they are no longer supported, and have no suitable replacement for demo purposes. These applications are: PingInfoView (a ping monitoring tool) notepad++ (a text editor used by some systems/network/software engineers) To tie it all together visually, here is a screenshot demonstrating these running on my CentOS Linux laptop: To demonstrate that these are actually running as containers, please take notice of the container ID listed at the top of the application window(8b5f36fff598 and 5cd664be8a7b). These are listed in the output of “docker ps” and shown in the filtered output of the Linux process monitor “top.” These could be easily moved to another machine running different distribution of Linux, and perhaps into a random server on your favorite cloud host. I hope you enjoyed this example of a fun, not so common container use case. Need help designing your infrastructure to power your applications? The friendly engineers at ProCern have the expertise to help. Contact us today!
Increased Vulnerability Identifying what connects to the network is the first step to securing your enterprise. Control through the automated application of wired and wireless policy enforcement ensures that only authorized and authenticated users and devices are allowed to connect to your network. At the same time, real-time attack response and threat protection is required to secure and meet internal and external audit and compliance requirements. Laptops, smartphones, tablets and Internet of Things (IoT) devices are pouring in the the workplace. The average employee now utilizes an average of three devices. The addition of IoT increases the vulnerabilities inside the business adding to the operational burden. Wired and Wireless Devices The use if IoT devices on wired and wireless networks is shifting IT’s focus. Many organizations secure their wireless networks and devices. Some may have neglected the wired ports in conference rooms, behind IP phones and in printer areas. Wired devices – like sensors, security cameras and medical devices force IT to think about securing the millions of wired ports that could be wide open to security threats. Because these devices may lack security attributes and require access from external administrative resources, apps or service providers, wired access now poses new risks. As IT valiantly fights the battle to maintain control, they need the right set of tools. Tools that can quickly program the underlying infrastructure and control network access for any IoT and mobile device – known and unknown. Today’s network access security solutions must deliver profiling, policy enforcement, guest access, BYOD onboarding and more. They should offer IT-offload, enhanced threat protection and an improved user experience. Mobility and IoT are Changing How We Think About Access Control The boundaries of IT domains now extend beyond the four walls of business and the goal for organizations is to provide anytime, anywhere connectivity without sacrificing security. How does IT maintain visibility and control without impacting the business and user experience? It starts with a 3-step plan. Identify – what devices are being used, how many, where they’re connecting from, and which operating systems are supported. This provides the foundation of visibility. Continuous insight into the enterprise-wide device landscape and potential device security corruption. Which elements come and go gives you the visibility required over time. Enforce – accurate policies that provide proper user device access, regardless of user, device type or location; this provides an expected user experience. Organizations must adapt to today’s evolving devices and their use, whether the device is a smartphone or surveillance camera. Protect – resources via dynamic policy controls and real-time threat remediation that extends to third-party systems. This is the last piece of the puzzle. Being prepared for unusual network behavior at 3 AM requires a unified approach that can block traffic and change the status of a device’s connection. Organizations must plan for existing and unforeseen challenges. With their existing operational burden, it’s not realistic to rely on IT and help desk staff to manually intervene whenever a user decides to work remotely or buy a new smartphone. Network access control is no longer just for performing assessments on known devices before access. HPE Aruba Networking ClearPass The stakes are high. It’s surprising that more companies have not embraced secure NAC to prevent malicious insiders from causing damage to the enterprise. The uses cases are many-control devices connectivity, simplify BYOD, secure guest access leads to the same answer, HPE Aruba Networrking ClearPass. Over 7,000 customers in 100 countries have secured their network and their business with HPE Aruba Networking ClearPass. They have achieved better visibility, control and response. Shouldn’t you? Contact ProCern to find out how you can secure your network.
There was a time when IT was the gatekeeper of everything enterprise and ruled with a combination of strict policies and purpose-built technologies. There was no need for technologies like ClearPass. Those days are over. Today, billions of Wi-Fi enabled smartphones and tablets are pouring into the workplace. Users are armed with more than three devices or more, and each contains over 40 business and personal apps. Users have far more flexibility to connect their own smartphones and tablets to the network and download the apps of their choice. The expectation is that the mobility experience just works whether you are at home or in the office. The boundaries of IT’s domain now extend beyond the enterprise, and the expectation is that users can connect from anywhere. The goal is to provide anytime, anywhere connectivity without sacrificing security. How does IT maintain visibility and control? As a foundation, IT must have a firm understand of these three things: Where devices are being used How many devices are being used per user Which operating systems are supported. The next key is for IT to decide what happens when users and devices are not in compliance. The ClearPass Policy Management Platform The ClearPass Policy Management Platform from HPE Aruba Networking, takes a fresh approach to solving the mobility challenge – an approach that provides IT a simple way to build a foundation for enterprise-wide policies, strong security, and an enhanced user experience. From this single ClearPass policy and platform, contextual data is leveraged across the network to ensure that users and devices are granted appropriate access privileges, regardless of access method or device ownership. Mobility policies need to include user roles, devices types, available MDM data and certificate status, location, day-of-week, and time of day. ClearPass Benefits Policies and AAA services that support any wireless, wired, and VPN environment. Network privileges based on real-time contextual data-user roles, device types, location, and time-of-day. Built-in device profiling that identifies device types and attributes for everything that connects. Real-time troubleshooting tools that help solve connectivity and user issues quickly. Built-in integration that allows you to build a coordinated defense effort where everything works as one solution. Providing a seamless mobility experience for today’s mobile workforce has created a host of new challenges. ClearPass solves these challenges by providing a platform that delivers policy control, workflow automation, and visibility from a single cohesive solution. By capturing and correlating real-time contextual data, ClearPass enables you to define policies that work in any environment: wireless, wired, or VPN.
Are Windows updates necessary? Applying updates every month is not something system administrators look forward to but they are necessary and extremely important in the times we live in. Most updates each month include security updates. Security issues are the worst possible type as they may be exploited by malware or hackers. These types of situations are regularly identified in various parts of Windows – ActiveX, IIS, Internet Explorer and .Net Framework are just examples. Other updates address other bugs and issues in Windows. Even though they are not responsible for security vulnerabilities, they might impact the stability of your Operating System. Last, but not least, Windows Updates sometimes come with new features, while patching some known issues – and the best example for this is IIS and Internet Explorer. The code that makes up the Windows operating system contains security loop holes, errors, incompatibilities, or outdated software elements. In short, Windows isn’t perfect, we all know that. The latest Windows security patches fix the vulnerabilities and errors in Windows and associated software, and they occasionally add new features. This essentially summarizes why you should regularly run a Windows Update. Security issues are regularly identified in various parts of the Windows operating system, including the main platform. Even if you do not run the respective software, it is a risk not to patch it, simply because it is installed on your system. Note that these updates are required, even if you are running anti-malware or anti-virus software, as that software may not sufficiently protect you from Windows security issues. Consequences to Not Installing Updates Potential consequences of not installing security updates are damaged software, loss of data, or identity theft. Every year, malware causes damage of millions of dollars worldwide. The main reason is that users don’t install critical software or operating system updates, allowing malware to exploit loopholes that exist in every software ever developed. Vulnerabilities can potentially be exploited within hours of them becoming publicly known. So once a security update is available, you should plan to install the fix to protect your system from malware attacks. Some ways to control and monitor the deployment of Microsoft updates in a corporate environment is with products like WSUS or System Center Configuration Manager(SCCM). Here is a list taken from Microsoft of some common types of updates available each month. Critical Updates Critical Updates are a widely released fix for a specific problem that addresses a critical non-security-related bug. Security Updates Security updates are a widely released fix for a product-specific, security-related vulnerability. Security vulnerabilities are rated by their severity. The severity rating is indicated in the Microsoft security bulletin as critical, important, moderate, or low. Monthly Rollups Monthly Rollups are relatively new. They are a tested, cumulative set of updates. They include both security and reliability updates that are packaged together and distributed over Windows Update, WSUS, System Center Configuration Manager and Microsoft Update Catalog for easy deployment. The Monthly Rollup is product specific, addresses both new security issues and non-security issues in a single update and will proactively include updates that were released in the past. Security vulnerabilities are rated by their severity. The severity rating is indicated in the Microsoft security bulletin as critical, important, moderate, or low. This Monthly Rollup would be displayed under the title Security Monthly Quality Rollup when you download or install. This Monthly Rollup will be classified as an “Important” update on Windows Update and will automatically download and install if your Windows Update settings are configured to automatically download and install Important updates. Service Packs A service pack is a tested, cumulative set of all hotfixes, security updates, critical updates, and other updates. Additionally, service packs may contain additional fixes for problems that are found internally since the release of the product. Service packs may also contain a limited number of customer-requested design changes or features. Non Critical Updates While non critical updates are not responsible for security-relevant vulnerabilities, they may still be very annoying as they potentially impact the performance and stability of Windows. So the main reason for installing general updates is to avoid or resolve Windows issues and hopefully have a smooth running System. Testing Microsoft will test the latest updates prior to release on the second Tuesday of each month. Unfortunately, there are an infinite number of hardware and software configurations that could exist on a Windows computer. Testing all possible computers systems would be almost impossible.When a Windows update causes a problem it’s likely due to a software or driver that has issues with the update, not the update itself. It is very important to create a group of desktops and servers for testing the latest updates. Once the updates are applied to the test, computers monitor and document any irregularities in behavior of the test systems. Although Microsoft updates rarely cause a problem it has been known to happen thus the reason for a test group of computers. If all is well after at least a week with the test group, it is relatively safe to deploy the tested updates to production. Even after testing, there is no guarantee a problem won’t arise but it’s not worth the risk you may be taking of not applying these security patches. Conclusion It is critical to install security updates to protect your systems from malicious attacks. In the long run, it is also important to install software updates, not only to access new features, but also to be on the safe side in terms of security loop holes being discovered in outdated programs. And it is in your own best interest to install all other updates, which may potentially cause your system to become vulnerable to attack. Questions about your unique environment? End your IT frustration today. Discuss your situation with ProCern IT Engineers today.
The Dark Web is a hidden crisis for long-term care. Yes, you read that correctly. In today’s interconnected world, healthcare information is a lucrative target for cybercriminals, especially on the dark web. While many in the healthcare industry are aware of the general dangers, the full extent of how and why cybercriminals exploit healthcare data still needs to be understood. This article will delve into the importance of healthcare information on the dark web, the specific risks to elderly patients’ data, and the critical steps long-term care facilities can take to prevent breaches and effectively respond if one occurs. The Dark Web’s Appetite for Healthcare Information Healthcare information is precious on the dark web for several reasons. Unlike credit card data, which can be quickly canceled and replaced, healthcare data contains long-lasting and deeply personal information. Healthcare data includes medical histories, social security numbers, insurance details, and personal identification information, making it a rich resource for a variety of malicious activities: Identity Theft: Cybercriminals can use stolen health records to create false identities, apply for loans, and open bank accounts. Insurance Fraud: With access to healthcare data, fraudsters can file fake insurance claims, obtain prescription medications, and receive medical services under false pretenses. Financial Exploitation: Detailed personal and financial information can be used to commit financial fraud, including unauthorized purchases and bank account takeovers. Medical Blackmail: Sensitive health information can be used to blackmail individuals, threatening to expose private medical conditions unless a ransom is paid. Social Engineering Attacks: Comprehensive healthcare records can be used to craft convincing phishing attacks and social engineering schemes, further compromising security. Why Elderly Healthcare Data is a Higher Risk Elderly patients are at higher risk for several reasons: Extensive Medical Histories: Elderly patients typically have a long history of medical treatments, diagnoses, and medications. This comprehensive medical data is valuable for identity theft and medical fraud. Multiple Insurance Policies: Older adults often have multiple layers of insurance coverage. These policies may include Medicare, Medicaid, supplemental private, and long-term care insurance. Each policy adds to the richness of the data set that cybercriminals can exploit. Stable Financial Backgrounds: Elderly individuals often have more established financial situations, including savings, retirement accounts, and home equity, making them attractive targets for financial fraud. Vulnerability to Fraud: Older adults may be more susceptible to scams and less familiar with modern cybersecurity practices, increasing their risk of exploitation. The Importance of Protection in Long-Term Care Facilities Due to these elevated risks, long-term care facilities must prioritize protecting their residents’ healthcare data. Preventing Data Breaches Robust access controls are crucial. The dreaded multi-factor authentication and role-based access controls ensure that only authorized personnel can access sensitive data. Data encryption for healthcare data, whether in transit or at rest, makes the information unreadable to unauthorized users. Remember to keep all systems updated with the latest security patches to protect against vulnerabilities. Continuous training on cybersecurity and best practices, recognizing phishing attempts, and using strong passwords are vital in protecting your organization. And this flows into the physical security measures teams should take. Ensure physical security of sensitive data by controlling access to areas where data is stored, using lockable filing cabinets, and securing devices with sensitive information. If you know someone with a Post-it note on their computer monitor with their password on it, this is a physical security vulnerability. Yes, having advanced security solutions like firewalls, intrusion detection, prevention systems, and antivirus software helps to defend against cyber threats, but you should regularly audit and assess risks. Conduct frequent security audits and risk assessments to identify and mitigate potential vulnerabilities. Responding to a Breach Despite best efforts, breaches can occur. If one occurs, an excellent first step is isolating affected systems to prevent further data loss. You’ll then need to identify the scope of the breach and determine what data was compromised. Promptly inform the affected individuals and relevant authorities as required by law. Investigate thoroughly to understand how the breach occurred and implement measures to prevent future incidents. Of course, you’ll also need to regularly update your security policies and incident response plans to address any new threats and vulnerabilities. Exploiting healthcare information on the dark web is a significant threat, particularly for long-term care facilities and their elderly residents. By understanding the value of healthcare data to cybercriminals and implementing robust security measures, facilities can better protect sensitive information and respond effectively to breaches. We are committed to helping healthcare providers safeguard their data and uphold the highest cybersecurity and physical security standards at ProCern.
Stranger Danger I’m sure all of us when were younger were taught Stranger Danger. We needed to be cautious of any strangers we met while walking to and from school or in any new places. Today, the strangers that some of us fear the most are of the cyber kind. They can steal our livelihood, identity and more with a few clicks. Businesses are becoming victims of this Stranger Danger every day. Cyber crime rose by over 600% during the pandemic. It is estimated by 2025, the cost of cybercrime worldwide for companies will be $10.5 trillion. Unfortunately the pandemic amplified cybercrime due to the uncertainty around remote working and how to protect your business. Many businesses are not prepared for cyber attacks and do not educate their employees on best practices to help prevent these attacks from happening. The month of October celebrates cybersecurity awareness. Education is the one of the biggest tools going forward to fight the Cyber Stranger. Current State of CyberSecurity There are some staggering stats surrounding businesses today and the safety of their data. The numbers are only increasing as new threats appear and businesses do not offer the appropriate resources to combat this problem. A study by Accenture reports that 43% of cyber attacks target small businesses, and under a sixth are equipped to prevent those attacks. On average, it takes a company 197 days to discover a cybersecurity breach. Needless to say, the longer it takes to discover a security breach, the more a company’s reputation and assets suffer. A few more stats: Globally, 30,000 websites are hacked daily. 64% of companies worldwide have experienced at least one form of a cyber attack. There were 20M breached records in March 2021. In 2020, ransomware cases grew by 150%. Email is responsible for around 94% of all malware. Every 39 seconds, there is a new attack somewhere on the web. An average of around 24,000 malicious mobile apps are blocked daily on the internet. Common Types of Cyber Attacks 64% of companies worldwide have experienced at least one form of cyber attack in the past year. What are the most common ones that businesses and their employees see? Phishing: A type of online scam that involves sending an email or other virtual communication impersonating a source that would usually be seen as reputable, such as a bank or an internet service provider. 91% of all cyber attacks start with a phishing email. Malware: Malicious software that gets downloaded onto devices without one’s consent. It causes devices to crash or can allow hackers to view computer activity, access files, and steal information. 27% of malware infections originate from infected USBs. Man-in-the-middle (MITM) attack: This occurs when a user intercepts communication between two people, or between one person and a machine. For example, a hacker might guide a user into a fraudulent site that appears to be the user’s bank’s website to collect their data. According to Netcraft, 95% of HTTPS servers are vulnerable to these attacks. CyberSecurity Best Practices A recent survey found that 61 percent of employees failed a basic quiz on cybersecurity fundamentals. With the average company spending only 5 percent of its IT budget on employee training, it’s clear that education is an opportunity for many organizations in the future. Here are just a few best practices to follow: Avoid Pop-ups, unknown emails and links: Malware infections are among the most common cybersecurity threats organizations face. Having up-to-date virus scan and spam detection software is a great safety net, but it’s also critical that all users are trained to understand the dangers of clicking on unusual links, pop-ups or emails. Use strong password protection and authentication: It’s important to require all users to create strong, difficult-to-guess passwords and credentials for their accounts and change them often. Consider multifactor authentication (MFA), which requires an additional token of identifying code to access systems. 63% of data breaches result from week or stolen passwords. Enable firewall protection at work and at home: Firewalls are important gatekeepers, restricting traffic in, out or within a private home or business network. Back up data: Regularly backing up critical data is key to defeating ransomware and to business continuity in general. Control physical access: Preventing access or use of desktops, laptops and mobile devices should be a high priority as these can be easily stolen or lost. Make sure such devices are set to lock when unattended and grant only limited administrative privileges for such hardware. Minimize data transfers: Be mindful of how many devices contain important data and try to make transfers as minimally as possible. Verify download sources: Before making any downloads, scan the website you’re downloading from to ensure that it’s verified, and only click on legitimate download links. Keep software updated: Update software whenever updates are available is a great way to protect against cyber attacks. Encrypt where possible: Encryption tools can be used to protect data from unwanted individuals. When encryption isn’t possible, password protection is a great alternative. Be sure to choose passwords with a mix of letters, numbers, and characters, and to update your passwords regularly. User activity monitoring and behavior analytics: This can give insights on when there is suspicious activity around your data. These tools can help you prevent data theft in real-time. Practice robust and continuous employee awareness programs: Even with the best technology in place, human error is often the weakest link. Constant education programs is the most important best practice when it comes to cyber resilience. Human error is responsible for 90% of all security breaches. What Will You Do Next? Cyber threats are not going away and will continue to be a major concern for all businesses no matter the size. Contact ProCern to find out how our solutions can provide extra protection. Reach out to find out about our assessments which may discover holes in your current IT environment. Want to find out how knowledgeable your employees are on the topic of cyber security? Take this quiz from the Cyber Readiness Institute to find out how cyber ready they are.
Active Directory is often compared to the central nervous system of the human body. The central nervous system consists of the brain, spinal cord, and nerves running throughout the body. Just as the central nervous system coordinates and influences every activity of all parts of the human body, Active Directory is a database that coordinates the servers, client computers, printers, shared files, and other resources, as well as securing network resources in a Microsoft Windows network. Active Directory accomplishes these tasks by providing a hierarchy of management elements enabling administrators to organize resources, advertise these resources accordingly, and control the users who access them.Medical doctors suggest a checkup or physical at least once a year, as well as personal monitoring of your health. Even if you are healthy, the purpose of these visits is to screen for diseases, asses risk of future medical problems, encourage a healthy lifestyle, update vaccinations, and maintain a relationship with doctors in case of an illness.The comparison to Active Directory here can also be made. Proper monitoring and periodic checkups can keep the database functioning smoothly and without issues. It can definitely benefit from checkups, or health checks. The purpose of an Active Directory health check could be for the same reasons listed above: Screen for Diseases Verify trust relationships View replication failures between domain controllers View queued replication events between domain controllers Display replication partners and results of replication events Provide a summary of the replication state and health of the forest Analyze the state of all domain controllers in the forest and report problems Review results of Microsoft Best Practice Analyzer on domain controllers Asses Risk of Future Medical Problems Discuss Microsoft Server Roadmap. Are you using the latest version? When will the next version be released? When will the oldest version no longer be supported? Meet with Active Directory stakeholders. Will the layout and design of database be affected by any projects or applications in the future? Encourage a Healthy Lifestyle Discuss current administrative practices surrounding Active Directory. What is the process to add, change, or delete users or resources, etc.? Discuss and recommend monitoring strategies around Active Directory Discuss and recommend auditing strategies of Active Directory Review objects (users, computers, etc.) to check for stale/out-of-date resources, or illegal objects Update Vaccinations Validate patch levels on domain controllers Validate anti-virus/malware on domain controllers Discuss security around the database Maintain a Relationship with Doctors in Case of an Illness Good to have a relationship with an infrastructure provider, like ProCern, when issues arise and advanced assistance is needed Good to have an independent third-party, like ProCern, doing the health checks. You aren’t allowed to prescribe your own medication, are you? Just like the human body, proper monitoring and care can assist in keeping Active Directory healthy. Active Directory and the Windows network can only benefit from these periodic “doctor” visits. database design and implementation, based on Microsoft best practices. Contact ProCern to find out more about our IT Health Check.
Ransomware In May 2017, the National Health Service of England and Scotland was hit with the largest ransomware attack at that time. The attack affected an estimated 200,000 computers across 150 countries. The estimated economic loss ranges from hundreds of millions to four billion dollars. This attack, dubbed the WannaCry ransomware attack, catapulted network security to the top of many organization’s priority list. It brought to light the amount of damage that could be done by a malicious virus. What is Ransomware? Ransomware is a type of malicious software, or malware. It is designed to deny access to a computer system or its data until a ransom is paid. It is typically spread through phishing emails or by visiting an infected website. The virus works by encrypting all the data on the user’s hard drive. Then, it requests a payment, usually in the form of cryptocurrency, to be sent to the hackers. However, there is no guarantee the user will recover their files if they pay that ransom. Ransomware can be devastating for users and organizations. Currently, we are seeing a lot of government agencies, education organizations, and healthcare organizations targeted by these attacks. What precautions can you take? In order to protect your user’s and organization’s data, there are a number of precautions you can take. Most of which are best practice even without the threat of ransomware. First, keep all applications and operating systems up to date. Outdated apps and OS’s are the target of most attacks. This was the case in the WannaCry attack. Second, train users to avoid phishing emails. These are emails designed to look legitimate at first glance but have links that redirect you to an infected site, or attachments that download the malware directly. Phishing emails and sites are also associated with social engineering attacks designed to steal credentials. It is always a good idea to train users to never click on links or open attachments in unsolicited emails. Next, backup your data on a regular basis. Backing up your data is a good idea for a myriad of reasons. It can really save you in the case of a ransomware attack. Best practice would be to keep 3 copies of your backups, with one offline and another in a geologically separate location. These backups should also be regularly tested. A great way to control what is installed on your organization’s computers is access control. Restricting privileges may not allow malware to be installed on a system without an administrator’s approval. This will limit the spread of the malware through a network. Similarly, another useful tool for fighting malware is a spam filter on your emails. A strong spam filter will prevent most phishing emails from making it to users’ inboxes. It will authenticate inbound emails to prevent spoofing. What to do when you’ve been infected by ransomware The first thing anyone should do when infected by ransomware is to contact law enforcement immediately. You should report the infection to the FBI’s cyber task forces and internet crime complaint center. Currently, the FBI does not recommend paying any ransom. While it could cost organizations large sums of money to be down for any length of time, there is no guarantee that paying the ransom will restore your data. There are numerous cases of this happening. Some victims who have paid the ransom have even been targeted again. Other victims have even been asked to pay more after the original ransom to get all their data back. Paying may inadvertently encourage this criminal business model. This makes it more prevalent in the future. Once you have found out that you are infected, you should isolate any infected machines immediately. In addition, one should take any unaffected machines offline so they don’t get infected. Same goes for backups. They should be taken offline immediately to stop the ransomware from spreading into your backups. From there, you should follow your organization’s incident response plan. Follow any instruction given to you by law enforcement. There will never be any way that you can guarantee you won’t fall victim to one of these attacks. Malware is always evolving, just like security practices are. It will always be an arms race between hackers and security experts. Your best bet is to always follow best security practices, and to always have a plan to recover from any successful attacks. Where to report Activity FBI Cyber Task Force Internet Crime Complaint Center United States Secret Service Electronic Crimes Task Force Local Field Offices Contact ProCern to have an assessment done on your current infrastructure. Ask us about helpful hints to help keep your data secure.
Using Aruba Dynamic Segmentation will help keep the Boogeyman away One reality terrifying most business owners is the thought of someone compromising their network and their data. Companies spend gratuitous amounts of money and time to protect themselves from cyber threats. They configure edge firewalls and multi-factor authentication mechanisms to protect their most sensitive data in the cloud. The thing that is often left untouched and overlooked are the data ports which are physically accessible to the public. If the business operates in a public or shared office space, the risk of intrusion from an unprotected or unmanaged port is astounding. Aruba Networks have developed a technology that can now extend the same role-based firewall policies that are applied to the enterprise wireless to the wired ports. By enforcing the same role-based policies, administrators can simplify the deployment and management while also staying consistent across the network. Is this a new threat? In truth, the threat has always existed. The difference is that now more than ever, IOT devices require a hard-wired connection to function. This is because many of them do not support the same security and encryption standards we enforce on the wireless network. Some devices simply require the low voltage power supplied from the switch port to function. These devices include security cameras, lighting controllers, intelligent HVAC devices and some printers or scanners. Another common scenario is when there is a need for a wired port for a special event. The port is configured for one purpose but then it is forgotten about. Then, anyone who plugs into that port has whatever access it was originally configured for. The reality is that these devices and circumstances are not going away any time soon. The best way to protect the network and the switch ports is to secure and isolate the clients and the devices from your sensitive networks and services. What have engineers and administrators done about this attack vector? From a management perspective, port security has always been the bane of network engineers and administrators. It has never been very practical or scalable to deploy. One must define clear attributes to distinguish each device from another. Then, you tell the switch port to change the network the device it is connected to or to simply block the port all together. Often the unique attributes used to distinguish these devices are easy to counterfeit. Deploying the configuration on only the public facing ports takes planning and insight. This often falls through the cracks after the initial deployment. Furthermore, the deployment of these settings must be done on each switch in the environment that may be connected to from a public facing port. HPE Aruba Neworking’s Dynamic Segmentation takes a different approach. It unifies policy enforcement and delivers the same seamless experience that people come to expect of wireless connectivity. How does it work? The technology leverages many of the same security and profiling mechanisms that exists in the HPE Aruba Networking wireless world. It applies them to the switch port adding a scalable security solution without the complexities of deploying another costly security product. It works by treating a HPE Aruba Networking network switch like an access point. The switch tunnels the switch port traffic to the Aruba mobility controllers. It profiles the connected devices in the same manner it would a wireless client. If the device passes certain authentication criteria, then it is granted the same access as if it were on the wireless network. If the device has certain attributes but does not pass specific authentication criteria, than it is treated differently. It will be assigned the same role and given the same privileges as it would on the wireless network. In isolating these devices or unknown users, we can better protect the environment at large while not limiting the connectivity some users may need. What else can HPE Aruba Network Dynamic Segmentation do? By tunneling the traffic to the mobility controllers, Dynamic Segmentation provides greater visibility of the traffic from IOT devices and guests users on your network. You can enforce a captive portal with email registration for guest users. This can add some accountability to a visiting contractor or guest speaker. If an employee brings in a consumer device from home and plugs it in, you can distinguish what the device is, where it is plugged in and what it is communicating with. The most valuable use-case for this technology lies in the constant struggle of BYOD and onboarding of employee devices. If an employee chooses to use their own computing device and company policy allows it, you can check the security posture of the device before granting it access to any resources on your network. Ideally those users would have a policy enforced that would allow them to reach only the least sensitive resources and the internet. Why should network/security engineers and administrators be excited about Dynamic Segmentation? Unlike traditional port security which normally rely on 802.1x and radius authentication to authorize access on a single VLAN, Dynamic Segmentation does not require unique network segments to be defined to physically separate users. HPE Aruba Networking uses the term VLAN sprawl to describe the never-ending creation of new VLANs and subnets to create new layer 2 boundaries to physically segment user and device traffic. With this solution, all the unknown devices and users could reside on the same network segment. Because the traffic is tunneled, all the traffic is subject to deep packet inspection, stateful firewall policies, layer 7 application visibility including web content filtering. Most IT professionals usually wouldn’t believe that their wireless controllers are capable firewalls. They would be wrong where Aruba is concerned. Overall, the solution will simplify your efforts at securing the network edge and unifying security into one manageable platform. Why spend time configuring and deploying a solution that you would have to duplicate with the wireless infrastructure? Save yourself from that spooky nightmare. To learn more, contact ProCern.
The business of IT, that is. Data Protection, Fault-tolerance, Disaster Recovery, and Business Continuity are issues all IT Professionals deal with on some level throughout their career. As important as all four of these are to a business, until recently, only the first two have really been given any attention. In fact, Data Protection and Fault-tolerance are considered to be fundamental components of any professionally run IT environment. The basic level of Data Protection is, of course, defined by file backup and recovery solutions. When we talk with our clients about Data Protection, these discussions typically start with questions about the software used and the type of media employed to store the backups. For Fault-tolerance, the conversation revolves around discussions of redundancy in your hardware, clustering, and RAID levels. In contrast to Data Protection and Fault-tolerance, Disaster Recovery and Business Continuity have, for years, been part of the annual budgeting discussion but usually end up in the “nice to have” pile and are set aside until the next budget cycle. The cost and complexity of these solutions ended up being too expensive and require too many resources to implement. However, within the past 3 to 5 years, we have seen many of our clients elevate the Disaster Recovery and Business Continuity conversations from the “nice to have” to a “must implement” discussion. There are many factors contributing to the change, but I would contend the two biggest reasons are: The extreme dependence most businesses have on the digital world. Reverting to legal pads and cigar boxes simply aren’t options for many businesses today. The technology has made implementation of Disaster Recovery and Business Continuity easier and more affordable to accomplish than ever before. With the ubiquity of virtualization today, discussions about all of these issues has changed significantly. Where once we drew well defined lines between the solutions for Data Protection, Fault-tolerance, Disaster Recovery, and Business Continuity, we are now starting to see those lines blur. To be clear, each of these issues still addresses distinctly different solution requirements. However, technology is allowing us to combine some of these requirements under one toolset.Even though one solution may cover multiple requirements defined by Data Protection, Fault-tolerance, Disaster Recovery, and Business Continuity, it’s important to go into discussions of these issues understanding the major differences between them. Data Protection – These solutions are focused on protecting files and databases from corruption or deletion. In either event, Data Protection solutions should be able to restore a file or database from a point in time. While the file or database may not contain the most recent updates, it is still better than not having it at all. Fault-tolerance – As the name implies, these solutions allow part of the hardware or software to fail without losing the entire device or application. For hardware this is accomplished through redundant power supplies and fans. It also includes the implementation of RAID on the disks or clustering for operating systems or hypervisors. Fault-tolerance is usually a protection against a local failure. Disaster Recovery – Again, as the name implies, these solutions provide the ability to recover from a disaster. In general, these solutions replicate data and applications to another location or Disaster Recovery Site. The Disaster Recovery Site will typically have compute, network and storage resources to be able to bring part or all of a production environment online in a predetermined period of time; usually defined by hours. The key here is what that period of time will be and to what point in time the data will be recovered. These are more commonly referred to as the RTO and RPO. Business Continuity – While Disaster Recovery is designed to bring a business back on line in hours or a few days, Business Continuity is designed to keep a business running in the event of a disaster or, at the very least, have the business running again in minutes and with the most up-to-date data sets. As I mentioned earlier in this post, technology today has made implementation of solutions to these four issues far easier than it used to be. However, defining the requirements and navigating through the many solution options can still be a daunting task. At ProCern, we have Solution Architects with decades of experience, who are ready to help our clients design solutions to protect their Business. With all the options available today it is important to have a partner with the expertise to design, acquire, and implement these essential solutions.In addition to experienced Solution Architects, ProCern partners with some of the most respected names in the industry to provide the hardware and software needed to implement a Business Protection plan.