• July 14, 2022
  • Catagory remote work

How SMBs can begin to implement zero trust

By : Justin Folkerts

We’ve already talked a lot about the benefits of zero trust for securing your organization, but if you’re a small or medium-sized business looking at how to implement zero trust, it can be easy to get overwhelmed.

Your managed service provider (MSP) can be a great resource for implementing zero trust, and all things security, too. And while zero trust can greatly improve your security posture, it’s not the only thing you should be doing.

Implementing zero trust requires technical expertise and dedicated IT staff, and you’ll increase your odds of success if your break down your implementation in smaller, more manageable tasks. Different security vendors offer different frameworks, but regardless of the cybersecurity tools you deploy, implementing zero trust can be broken down into four elements:

  • A system for tracking everyone on your network, their location and what applications and data they are accessing
  • Selecting security tools, including next-generation firewalls, intrusion detection systems, and identity access management
  • Comprehensive guidelines that outline who can access your network and resources, when and from where
  • Network monitoring capabilities that track and log all traffic, both external and internal, that can establish a baseline to make it easy to spot suspicious activity and remediate it

A zero-trust model will greatly reduce your overall risk by limiting the impact and severity of a cyberattack. Even if you fall prey to an attack, implementing zero trust will reduce the cost to your business, including penalties related to regulatory compliance. Zero trust also increases visibility for your IT staff because it enables them to see who is on the network and granularly segment access – even employees are strictly managed to only access resources that are related to their responsibilities. In addition, what they are allowed to access requires multifactor authentication.

Implementing zero trust shouldn’t be your only strategy for securing your organization, but it has a high success rate of mitigating the damage caused by threat actors, especially social engineering attacks. A managed service provider can help you get started with the four key elements of zero trust as well as determine what other tools and polices can improve your security posture.

  • May 12, 2022
  • Catagory remote work

Disruption is an opportunity for improving security

By : Justin Folkerts

The pandemic has been a challenge from security perspective, but it can also be viewed as an opportunity to review your best practices, your cybersecurity tools, and the role of a managed service provider.

The move to remote work two years ago was quite sudden, and left many organizations caught off-guard. If they were in the process to moving to more cloud-based services, the pandemic accelerated that migration. It also brough to light security challenges that could not be ignored because the number of endpoints suddenly grew exponentially with the bulk of their employees working from home.

As Dell’Oro Group Mauricio Sanchez recently pointed out in a blog post about the top five demands and challenges faced by CISOs, the massive disruption of pandemic compounded the rate of technology and threat change, and provided an impetus for looking at security problems in new ways and drove investment that would not have been possible in a non-pandemic environment.

While small and medium-sized businesses rarely have a C-level executive in charge of security or even a CIO, there are lessons they can take from observing the cybersecurity trends affecting large enterprises.

Relationships matter

Sanchez notes that the security vendor landscape is highly fragmented, so if a CISO is trying to sort through many options, don’t feel bad as an SMB if you’re feeling a little lost about what to implement and who to work with.

It’s important not to be tempted by new and shiny security products simply because they are new and shiny. The products and services you choose should be guided by an understanding of what needs to be protected in your organization, both on-premises and through your distributed workforce. Vendors do have a role in helping you secure your organization by developing security controls and technologies that will benefit you, but bi-directional communication essential.

For smaller organizations, it’s often best to engage with a managed service provider who can keep abreast of the rapidly evolving landscape of threats and available cybersecurity products. They can help navigate the options, evaluate your current security posture, and implement and manage what works best depending on the nature of your business.

Consider Zero Trust, but remember it’s a strategy, not a product

The shift to remote work has given Zero Trust increased traction, but whether you’re a big enterprise with a CISO or a smaller organization with limited IT resources, don’t confuse tactics and strategy.

As Dell’Oro’s Sanchez notes, Zero Trust is a valuable strategy but it’s not a product you can buy. Having a coherent strategy and understanding what needs protected will help you avoid wasting your IT budget on products do very little to improve security. Simply buying “zero trust” product could create a false sense of security, he says, and ultimately lead to your business being compromised.

Even if you’re confident that they are the right fit for your organization, buying the latest and greatest security solutions only go so far if you don’t have a firm handle on the fundamentals. A managed service provider with security expertise can help you best understand how a Zero Trust strategy can be implemented, and what tools you need to support it.

  • April 28, 2022
  • Catagory Managed IT Services

How an MSP can help secure your business

By : Sanjeev Spolia

Many businesses turn to a managed service provider (MSP) to solve a specific problem but may not always be aware of the breadth of capabilities their MSP has to offer, including security.

The cloud is a great enabler of many of these services, and it allows you to scale up your security protections as needed without a great deal of capital investment or dedicated IT staff. Because your MSP is helping multiple businesses with their security needs, they benefit from economies of scale and so do you. They are also able to keep pace with trends in IT security, whether it’s available tools, best practices, or new threats, and apply them to the security services they offer you.

If you’ve not fully explored what your MSP has to offer, you should consider evaluating your security posture and looking additional capabilities they have to offer.

Cloud backup and disaster recovery

Whether you’re the victim of a cybersecurity attack, data breach or natural disaster that disrupts your primary systems, having a disaster recovery and backup strategy protects your assets, saves your critical and confidential data, and keeps your business running even after your network is compromised. Backup was one of the first services to move to the cloud, and if there’s one service you should outsource to an MSP, it should be cloud backup and recovery – your MSP can step in quickly if you need to restore your primary system so you can keep your employees productive and your customers happy.

Network security

Your network is comprised of servers, computers and other hardware, and software applications, and your company’s data flows through all of them. Without it, your employees can’t share information or communicate. Not only will a data breach or cyber attack impair your ability to operate, but they could lead to revenue loss, regulatory consequences, and damage to your reputation. Your MSP can help defend your network endpoints, including desktops, laptops, and mobile devices, and provide high-quality help-desk service.

Penetration testing

A penetration test (“pen test”) evaluates the security of your IT infrastructure by safely looking for vulnerabilities. Your MSP will try to systemically compromise servers, network devices and other potential points of exposure, and then report back with their findings and recommendations. A pen test can act as an audition for MSP to demonstrate they can find problems, help you remediate any issues, and implement ongoing security services they can manage for you.

Proactive 24/7 monitoring services

Even without a cyberattack, network infrastructure can falter. Your MSP can provide real-time monitoring of organization’s network infrastructure and act immediately any issue that arises with instant troubleshooting to avoid disruptions to workflows and business operations. Around-the-clock monitoring maximizes business uptime, prevents performance or service interruptions, and provides peace of mind that your network is safe and sound.

If you’re concerned about your security posture but don’t know where to begin, your MSP should be your first call. And if you don’t have one, selecting one should heavily depend on their ability to show how well they evaluate your infrastructure, their recommendations to secure it, and references from other customers who’ve enjoyed uninterrupted operations as one of their customers.

  • March 31, 2022
  • Catagory Document Management

Assess your hybrid office for effective print security

By : Justin Folkerts

The need for printer security has waned during the remote work era, but as more employees return to the office, consider reviewing your fleet and how you’re managing it.

Protecting hard copies is especially important today given privacy legislation and other regulatory frameworks that outline how businesses must handle Personally Identifiable Information (PII), which is subject to the Personal Information Protection and Electronic Documents Act (PIPEDA) or the General Data Protection Regulation (GDPR).

Just as critical is that your employees may be printing sensitive business information, including financial data or other proprietary intellectual property that gives you competitive advantage in your industry. Many security teams today are more focused on making sure data doesn’t leak through corporate firewalls or via a remote worker, but with office life returning to normal, corporate data can be compromised or stolen in hard copy.

A managed print services strategy contributes to better endpoint security and controls access to any printed materials, which have the same potential to lead to a security or compliance breach if the wrong person gets a hold of a stack of paper that contains sensitive information.

Older printers are holding you back

An assessment of your current print infrastructure will likely reveal there’s room for upgrades. Older, legacy print technology is not only a security threat, it’s also a barrier to productivity, collaboration, efficiency.

Older devices are likely to break down more frequently, which means you’re pulling IT resources away from strategic projects for frequent break / fix incidents such print jams and toner shortages. This impairs employee productivity, too, in the form of slower outputs in terms of pages per minute. Software compatibility issues are also amplified if your office workstations are being modernized at a faster pace. Older printers are also less energy efficiency and costing you more in electricity.

High electricity consumption also means your business isn’t as sustainable is it could be. Retiring your older printers as part of a managed print assessment can help you evaluate how much you really need to print and establish greener practices to reduce waste. A more modern, efficient printer fleet can reduce paper use and improve ink and toner management, which also contributes to sustainability, as modern toner cartridges can be recycled and turned into new ones, and overall consumption can be reduced.

People will always want to print

Even organizations that are aiming for a paperless office will always have some hard copy output – accounting for human behavior is an essential part of any managed print services strategy. As offices get busy again, there’s going to be the potential for the wrong person to grab documents from a printer they shouldn’t have and walk out the door with them. So long as people are inclined to print out information in hard copy, if only for their own personal convenience, there will be a need to secure paper documents.

In the meantime, legacy print technology is costing you more money than necessary by having an impact on your budget, efficiency, productivity, and sustainability, while also posing a security risk. Just as a leaked email or hacked database can put the future of a business in a severe jeopardy and disrupt operations, so too can a stolen printed document.

A managed print services strategy beginning with a thorough assessment bolsters your endpoint security with printed output in mind.

  • March 17, 2022
  • Catagory cybersecurity

 Key Cybersecurity Trends for 2022

By : Justin Folkerts

As we wrap up the first quarter of the year, some trends are emerging around cybersecurity that affect businesses of all sizes.

Not surprisingly, these trends are being driven by the impact of the pandemic, as remote work continues, and organizations look to establish a new normal of flexible work hours and hybrid teams.

Cybersecurity is getting more expensive

The cost of securing the organization is going up, and so is the cost of not having robust security. According to a report released last year, the global average cost of a data breach surpassed 4 million U.S. dollars. These costs are attributable to lost revenue and lost customers, fines for non-compliance, and even ransomware payouts. For larger organizations, it’s the cost of doing business, but for smaller ones, it can mean the end. Investing in cybersecurity is also expensive, but it’s an investment that pays off in the long run.

People are the deciding factor

Social engineering remains a preferred tactic of bad actors when it comes to gaining access to systems, stealing data, and disrupting systems. Ransomware continues to be one of the most popular types of attacks, and remote work has made it easier for threat actors to target vulnerable users. This means training employees with sufficient security awareness is more critical than ever so they can spot a phishing email and understand the need to adhere to security policies. Given that passwords remain integral to managing access, there’s an increase in adoption of biometrics to add an additional layer of security to turn people into their own password by using their individual characteristics to facilitate access.

The bad guys are getting smarter

Threat actors see the benefit of honing their skills because it makes them more successful, especially when the motivation is money. Whether it’s remote work or other circumstances, they’re always looking for new avenues with vulnerabilities they can exploit. As organizations adopt new ways of working, including flexible hours and workspaces for employees, cybercriminals are going to look for windows where they can access data and disrupt systems.

One trend that’s been clear since before the pandemic is that security can not be just an issue for IT to manage. If organizations are to implement effective cybersecurity, they need the support of the C-suite who can lead by example and provide budgetary support with and understanding that cybersecurity impacts the bottom line.

  • October 29, 2021
  • Catagory Security

Security Policy Must Keep in Mind How People Work in the Hybrid Office

By : Sanjeev Spolia

If the hybrid workplace is here to stay, then security policy must put people first—understanding how the human element plays are role in protecting data is essential, but so is making sure any security measures don’t get in the way of their productivity.

People can be part of the problem but also part of the solution—cultural changes that go hand and hand with security policy can positively influence employee behaviours to make your hybrid office more secure.

Humans make mistakes

Quite often, people put the organization at risk and violate security policy unintentionally. Privileged users can unknowingly let their credentials get compromised, which allows threat actors to access systems and sensitive data. Although it’s usually an accident, occasionally a disgruntled employee may compromise the organization intentionally.

Human beings also fall for phishing scams, both on their personal devices and corporate workstations; in the hybrid office, this device can be one and the same. Scams that employ socially engineered malicious messages that encompass tax-themed phishing, dodgy downloads, fake payment and delivery, and invoice phishing, have become even more common during the pandemic and will likely continue apace in the hybrid office.

Some people are just plain careless, despite security policy guidance, by letting credentials lapse or not using multifactor authentication. Cybersecurity technology isn’t effective on its own without keeping people in mind. Yes, they need to be held accountable, but you must also meet them where they are. The hybrid office means your employees are moving between their work and personal lives more fluidly, including the devices they’re working in—this must be reflected in your security policy.

Remote work is here to stay

Meeting people where they are means your security policy outlines how they can help to keep their organizations securie without getting in the way of their productivity. Your security policy should assume that the hybrid office is here to stay for the foreseeable future and understand the impact of continued remote work.

IT teams must be prepared to support remote workers, who are likely to have less traditional schedules as they embrace flexibility, and adopt collaboration tools to work across different departments, including human resources as they onboard new workers who will be working remotely, on-site or a combination of both. The hybrid office has also meant a shift to “hoteling” as employees come to work a few hours a day or a couple of days week without their own dedicated workspace.

Remote work always had implications on security policy, even before the pandemic, but there has been an increase in malware incidents, data breaches and other poor security behaviors as more people work from home. Despite this spike, it’s important keep security simple for employees and engage regularly with through awareness training so they can help protect their hybrid office from threat actors.

A clear and concise security policy allows employees to be productive no matter where they are working so that security is not a barrier to productivity.

Sanjeev Spolia is CEO of Supra ITS

  • September 30, 2021
  • Catagory Security

Cybersecurity Attacks Target Remote Work Technology: Things You Can Do

By : Justin Folkerts

Remote work technology continues to be a prime target for cybersecurity attacks.

Recent research released by Tenable in collaboration with Forrester found that nearly three quarters of organizations have traced recent cyberattacks that have impacted their businesses to vulnerabilities in remote work technology. Even before the pandemic began, the traditional perimeter around enterprise IT infrastructure had become rather porous due to increased mobility of workers and cloud adoption. With a hybrid workforce that has fully embraced remote access tools, cloud services, and personal devices, that perimeter is pretty much gone.

The Tenable / Forrester research found that 80 per cent of security and business leaders say remote work has put their organizations at higher risk because IT teams lack visibility into remote employee home networks as more than half of remote workers use a personal device to access work data. This has meant three quarters of cyber attacks are targeting remote employees. Threat actors are also exploiting third-party software providers or leveraging vulnerabilities in those products, with 65 per cent respondents linking those compromises to recent cyberattacks. 

For small and medium-sized businesses, it can be challenging to invest a great deal of money in security technology and dedicated IT staff, but there several core things that can help to better protect remote work technology from cybersecurity attacks.

  • Use a Virtual Private Network (VPN): Implementing a VPN for anyone accessing corporate data and applications via the Internet provides an additional layer of security via multi-factor authentication and should be required for anyone looking to access valuable company intellectual property and other sensitive data.
  • Use complex passwords: Many employees opt for simple passwords they can remember and use them for more than one application or website, which means once a hacker guesses one of them, they have access to a great deal of private information. Since these can be difficult to remember, consider implementing password encryption software that stores usernames and passwords without the need to know what they are because the information is encrypted from the start.
  • Educate everyone: Having the right technology in place only goes so far; you need a culture where all employees understand the need for complex passwords, log in via VPNs, and recognize phishing attacks and other suspicious emails. In addition to employee training, set aside a budget for your cybersecurity team to attend webinars and other courses that help them keep up with an ever-changing threat landscape.
  • Keep everything up to date: Whether it’s hardware or software, getting behind upgrades and patches is sure fire to create vulnerabilities that threat actors will support. While much of this can be automated, you should have a program in place to verify all necessary updates are done on schedule.
  • Pick a reputable cloud service provider: A great deal of security misconfigurations that lead to data breaches are the result of connecting with the many cloud services available to businesses today. Make sure your chosen providers have a solid track record on the security front and understand what they’re responsible for securing and what must be done at your end.

Keeping ahead of cybersecurity attacks has always been a challenge and the remote work era hasn’t made it easier. Consider seeking out a managed security services partner who can help you evaluate your security posture, implement new technologies and policies, and automate where possible so that your business is a less appealing target for threat actors.

  • September 16, 2021
  • Catagory Security

Stay mindful of security misconfigurations as remote work continues

By : Justin Folkerts

Security misconfigurations continue pose to a threat to organizations, and remote work hasn’t helped. However, how you configure cloud security is just as critical as end user behaviour.  

The shift to remote work not surprisingly has led to a spike in cyber attacks just as organizations were spurred by the pandemic to accelerate adoption of the cloud. These conditions mean security misconfigurations can have an even bigger impact on overall security posture.

Threat actors are drawn to security misconfigurations

As remote work continues and endpoints flourish for other reasons, such as IoT and edge computing deployments, it’s essential to have a full inventory of all your internet-connected digital assets, whether it’s the laptops of your remote workforce or the cloud applications they’re accessing. Threat actors are working hard to compromise all your digital assets, and security misconfigurations for a single cloud application can give them an opening to gain broader access to your infrastructure.

Security misconfigurations are ultimately a form of human error, which are generally a bigger threat to your organization than technology flaws and failures. Among the ones to be mindful of are forgetting to remove unused access permissions, setting up incorrect access, or creating overly permissive rules. Even before the massive shift to remote work, network infrastructure even small and medium businesses have become increasingly dynamic with the adoption of the cloud and mobile technologies.

Having strong policies as a baseline combined with automation can help you avoid security misconfigurations that lead to costly data breaches.

Automation requires visibility

Automation is essential if you want to stay ahead of threat actors, but you to have visibility into the devices, assets, and processes before you do it.

One thing you must watch out for is shadow IT, whether it’s software or hardware. Employees or even lines of business sometimes find their own solutions out of expediency without understanding their impact and the doors that are open to hackers due to security misconfigurations. These either need to be excised from your organization or made officially part of your digital asset inventory. You need to fully understand what your inventory is and conduct regular updates, especially as remote work continues, and employees come and go.

Having the right people in place can also help you avoid security misconfigurations, whether it’s cybersecurity specialists or making sure all employees have a solid understanding of good security hygiene. However, there’s only so much internal talent development can do given all the pressures faced by an IT team today, and good security people are in high demand.

Given these challenges, you should consider tapping into the expertise of a managed security services provider that can help you evaluate your infrastructure, develop strong policies, and implement automation so you can mitigate the impact of security misconfigurations.

  • July 30, 2021
  • Catagory Security

Hybrid workplace security must account for the human element

By : Sanjeev Spolia

The hybrid workplace may be the new normal, but the high number of data breaches due to the pandemic don’t have to be. The solution is recognizing that people can be the cause of security incidents but also play a part in preventing them.

The “human element” is involved in as much as 85 percent of all data breaches, according to Verizon’s 2021 Data Breach Investigations Report. That’s actually good news—it means there are cultural changes that can be made to influence employee behaviours that will improve hybrid workplace security.

People still fall prey to scams

There are several areas where security is vulnerable because of how people behave, often without any intent to put cybersecurity and data privacy at risk.

The first is around privilege abuse, according to the Verizon study, wherein users have access to IT systems, data and applications that over time leads to compromised credentials that allow threat actors to access sensitive information. In most cases, the privileged user isn’t intentionally looking to cause their organization harm and the data exposure is accidental. However, a disgruntled employee can cause a lot of damage.

In the meantime, employees still fall for phishing scams, and the number of instances where people fall for these socially engineered malicious messages rose significantly during the pandemic, according to Verizon’s analysis. Examples of these scams include payment/delivery scams, invoice phishing, tax-themed phishing, and downloads. Remote workers are more likely to fall for phishing scams, which makes their prevention especially critical for improving hybrid workplace security.

Many data breaches are accidental, but these accidents shouldn’t be confused with carelessness, which can include credentials that aren’t regularly updated or failure to use multifactor authentication. Cybersecurity technologies only go so far without having a standard of behaviour throughout the organization. Employees must be held accountable—effective hybrid workplace security depends on culture as much as technology.

Meet people where they are

The hybrid workplace solidifies the need for every employee to do their part to foster company-wide security rather than putting on the onus on a small group of IT experts to implement and manage cybersecurity technologies. This where the human element becomes part of the solution, not just the potential cause of data breaches.

While it’s critical that remote workers do their best to secure their home office environment, it can be overwhelming for them. Communication and training go a long way to helping them develop good security habits, as well as streamlining the process as much as possible. It’s also important to remember that in the hybrid workplace not all remote employees are the same. Some are experienced road warriors and power users who innately understand they need to secure their mobile endpoints, while other users have got a tad complacent over the years because they’re always online.

Employees who have traditionally worked in offices and felt comfortable leaving their workstation unsecured for a few minutes may not fully appreciate that hybrid workplace security requires a shift in behaviour. There are also always employees who value efficiency over all else, so if they perceive security measures as a barrier to productivity, they will always find shortcuts and workarounds.

Make people part of the solution

Hybrid workplace security needs tools and processes with a short learning curve for all employees to they can be easily adopted and understood as an enabler.

Balancing the human element and technology is critical to securing the hybrid workplace due to its inherent flexibility—employees are shifting constantly between their work and personal lives throughout the day, and that includes the devices they’re working on. Each device along with the software and operating systems they’re running now fall under the purview of corporate security.

From a technology perspective, it means technologies such as Identity and Access Management (IAM) tools are more essential than ever, as are robust security protocols and employee training. However, these must be seen as an enabler, not a roadblock to getting things done. The least technologically savvy employee must be able to blend their daily task with good security habits without a steep learning curve.  

Hybrid workplace security requires the creation of a security-first culture that puts people at its centre by enabling them to improve their workflow while doing their part keep the business secure.

  • May 18, 2021
  • Catagory remote work

Remote Work Drives Zero Trust Security Adoption

By : Justin Folkerts

The Zero Trust model for security isn’t new, but it’s getting more attention due to the massive shift to remote work.

Also known as the Zero Trust Network or Zero Trust Architecture, it’s a model that was first created more than 10 years ago by then Forrester Research analyst John Kindervag. It has since become more mainstream thanks in part due to the evolution of security technologies, but also because remote work has made it more challenging to secure enterprise networks.

The ABCs of Zero Trust

Zero Trust isn’t just a suite of technologies you buy. It’s a security model based on the foundational belief that organizations shouldn’t automatically trust anything inside or outside its perimeter—every connection must be verified, whether it’s an endpoint, switch or IP address if the organization is to prevent breaches.

Even before the massive uptick in remote work last year, the Zero Trust model recognized that organizations already have an increasingly porous network perimeter—it was no longer a castle surrounded by a moat. The old model assumed everything already inside was cleared for access. The Zero Trust model is a paradigm shift in that it assumes everything is a threat it until it’s certified safe. It also recognizes that once a hacker gains access via a single vulnerable spot, they can easily move around the enterprise network and attain increasing levels of access.

Zero Trust combines technologies with governance policies as to segment access at a granular level, taking into account the user, their location, and other information to decide whether to authorize any user, device or application. It’s not enough to authenticate the user, even if it is the CEO or CFO, but also the device they are using to gain access to the enterprise network, and where they are physically. Even if the user can be authenticated, policy may decide that the location—a coffee shop Wi-Fi hotspot, for example—isn’t secure enough. Or, it may decide that the user can’t access the network with a personal device, only one that was issued by the organization.

While technologies such as multifactor authentication, analytics, encryption, and file system permissions all play a role in a Zero Trust architecture, governance policies and good habits are just as critical to realizing its benefits, and that includes remote work environments.

Applying Zero Trust to Remote Work

For organizations to truly benefit from a Zero Trust model in the era of remote work, the same mindset must be brought into the home.

Whether they’re accessing the Internet for work or personal reasons, users need to apply a Zero Trust approach that keeps the wrong people out. And it’s more than just security awareness training or a strong password policy. Users at home should always be questioning every interaction online, including emails and texts with links, and communications that seem out of character by the sender, even if it appears to come from an official source. Phishing attempts and other attacks rely heavily on complacency, so a Zero Trust requires vigilance out of habit.

A common threat to enterprise network security in the remote work era is sharing passwords across work and personal devices and granting access to corporate devices to family members for personal use. The average person may think this is harmless, but a Zero Trust model requires that every employee think about their behaviour from a security perspective. Careless uses of a corporate device by a family member could compromise the enterprise network and lead to a data breach.

Zero Trust means password and device sharing a no-no. Every home user should have their own separate passwords and device as much as possible, and devices should either be for personal use or corporate use, not both.

These habits and overall mindset are essential to successfully applying a Zero Trust approach to security in the organization, regardless of where employees are doing their work. Having the right technology is a critical enabler, but you need the right governance policies and employee engagement if you’re to fully secure your business.