Keeping sensitive data and critical tech safe from cyberattacks is crucial for businesses like yours. Your survival and growth depend on how well your organization can withstand cyberthreats. That’s where cyber risk management comes into play.
Businesses with solid cyber risk management strategies can build formidable cyber defenses and reduce risks without compromising business growth. Besides enhancing security, it also ensures your business stays compliant.
In this blog, we’ll share the core principles of cyber risk management and show you how integrating it with a simple but effective security framework can help you achieve strategic success.
Key Characteristics of Risk-Based Cybersecurity
Risk-based cybersecurity helps organizations focus their efforts and resources on the most critical risks. This approach aims to reduce vulnerabilities, safeguard what matters most to you and ensure you make informed decisions.
Here are the key characteristics of risk-based cybersecurity:
Risk reduction: By proactively identifying and neutralizing threats, you can reduce and minimize the potential impact of a cyber incident.
Prioritized investment: By identifying and assessing risks, you can concentrate your investment efforts on areas that need your attention most.
Addressing critical risks: Dealing with the most severe vulnerabilities first can help you strengthen your business security. That is why it is important to conduct vulnerability assessments regularly, at least every quarter if not more frequently.
All Databranch Comprehensive Care and Foundation Security clients have scheduled automatic patching and Windows updates on their devices to assist with vulnerability management. Visit us here to learn how we can help take this off your IT plate.
Cyber Risk Management Frameworks
Cybersecurity risk frameworks act as a guide that helps businesses achieve the full potential of a risk-based approach. Here are several ways frameworks can help you enhance your current cybersecurity posture:
- Takes away the guesswork and give businesses a structured way to assess their current cybersecurity posture.
- Helps organizations systematically focus their investments on addressing the most critical and relevant risks.
- Provides organizations with the right guidance that helps build security, which is crucial for building customer trust.
- Are built using controls that have been tried and tested. They essentially help businesses implement effective security controls.
- Designed to help organizations achieve compliance with government and industry regulations.
NIST Cybersecurity Framework
The National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) is a popular, user-friendly framework that empowers business leaders like you to boost organizational cybersecurity. Think of it as a valuable tool created by top security experts to help you protect and secure your digital assets.
Here’s how the NIST CSF supports a risk-based approach:
- It helps you understand your risk by identifying what is most valuable to you.
- It gives you a high view of people, processes, technology, information and other business-critical aspects that need to be secured from threats so your business can operate successfully.
- It helps you prioritize your risks based on their impact on your business.
- It helps you allocate your resources where they matter most and ensures you maximize your investment.
- It promotes continuous monitoring and helps you adapt to evolving threats.
Secure your Future
Safeguarding your business from cyberthreats is critical for the survival and growth of your business. Don’t leave your business security to chance. Partnering with Databranch as your managed IT provider, means your business will have the security of knowing that your network is being monitored and maintained on a 24/7 basis.
Download our infographic, “Assess Your Cyber-Risks in 7 Critical Steps,” and strengthen your defenses against lurking cyber dangers.
Read More
You wouldn’t think a child’s toy could lead to a breach of your personal data. But this happens all the time. What about your trash can sitting outside? Is it a treasure trove for an identity thief trolling the neighborhood at night?
Many everyday objects can lead to identity theft. They often get overlooked because people focus on their computers and cloud accounts. It’s important to have strong passwords and use antivirus on your PC. But you also need to be wary of other ways that hackers and thieves can get to your personal data.
Here are six common things that criminals can use to steal your information.
Old Smart Phones
People replace their smartphones about every two and a half years. That’s a lot of old phones laying around containing personal data.
Just think of all the information our mobile phones hold. We have synced connections with cloud services. Phones also hold banking apps, business apps, and personal health apps. These are all nicely stored on one small device.
As chip technology has advanced, smartphones have been able to hold more “stuff.” This means documents and spreadsheets can now be easily stored on them. Along with reams of photos and videos.
A cybercriminal could easily strike data theft gold by finding an old smartphone. Make sure that your company is properly cleaning any old work phones by erasing all data. You should also dispose of them properly. You shouldn’t just throw electronics away like normal garbage.
Wireless Printers
Most printers are wireless these days, this means they are part of your home or work network. Printing from another room is convenient, but the fact that your printer connects to the internet can leave your data at risk.
Printers can store sensitive documents, such as tax paperwork or contracts. Most people don’t think about printers when putting data security protections in place. This leaves them open to a hack. When this happens, a hacker can get data from the printer and they could also leverage it to breach other devices on the same network.
Protect printers by ensuring you keep their firmware updated. Always install updates as soon as possible and you should also turn it off when you don’t need it. When it’s off it’s not accessible by a hacker.
How does your company handle patching their devices? If you don’t know, chances are it’s performed nearly enough. All Databranch Comprehensive Care and Foundation Security clients have scheduled automatic patching and Windows updates on their devices. Visit us here to learn more about how we can help take this off your IT plate.
USB Sticks
Did you ever run across a USB stick laying around? Perhaps you thought you scored a free removable storage device. Or you are a good Samaritan and want to try to return it to the rightful owner. But first, you need to see what’s on it to find them.
You should never plug a USB device of unknown origin into your computer. This is an old trick in the hacker’s book. They plant malware on these sticks and then leave them around as bait. As soon as you plug it into your device, it can infect it.
Old Hard Drives
When you are disposing of an old computer or old removable drive, make sure it’s clean. Just deleting your files isn’t enough. Computer hard drives can have other personal data stored in system and program files.
Plus, if you’re still logged into a browser, a lot of your personal data could be at risk. Browsers store passwords, credit cards, visit history, and more.
Need help disposing of your old office devices? Reach out to Databranch today for assistance, we can help clean your computer to make it safe for disposal, donation, or reuse.
Trash Can
Identity theft criminals aren’t only online. Thieves are known to sort through trash in search of documents containing personal information. Be careful what your employees throw out in the trash.
It’s not unusual for garbage to enable identity theft. It can include voided checks, old bank statements, and insurance paperwork. Any of these items could have the information thieves need to commit fraud or pose as you.
A shredder can be your best friend in this case. Your company should shred any documents that contain personal information, for yourself and your clients. Do this before you throw them out. This extra step could save you from a costly incident.
IoT Devices
Smart lightbulb, thermostats, and security cameras… all toys that hackers love. Even Mattel’s Hello Barbie was found to enable the theft of personal information and a hacker could also use its microphone to spy on families.
These futuristic gadgets make life easier and can be found in many offices. Owners might think they’re cool, but they might also forget to consider their data security. After all, it’s just a smart printer. But that often means they can be easier to hack, so cybercriminals will zero in on these IoT devices knowing they aren’t going to be as hard to breach.
You should be wary of any new internet-connected devices you bring into your office. Install all firmware updates and do your homework to see if a data breach has involved the toy.
Schedule an IT Security Audit
Don’t let the thought of identity theft keep you up at night. Contact us today at 716-373-4467 x115 or info@databranch.com to schedule a chat about IT security audit. Databranch also offers Dark Web Monitoring where we scan the dark web based on your domain and find all accounts that have been involved in a breach. Request a free Dark Web scan below to get started.
Article used with permission from The Technology Press.
Read More
Buyer beware – software programs or tools that claim the ability to conduct a risk assessment by scanning your network with little to no human interaction should raise concern!
These tools will generally do a nice job discovering vulnerabilities that exist in your technology environment, but vulnerabilities are not risks by default.
Is you business familiar with vulnerability assessments and their benefits? If not, visit our website here to learn more about the benefits and how they can enhance your cybersecurity posture.
What is Needed
Risk requires the presence of a vulnerability PLUS the action of threat actor.
To illustrate this concept using an example from the tangible world, lets visualize a car. The car is parked, and the doors are unlocked. A premature conclusion would be to state that the doors being unlocked translates to risk. If you apply critical thought however, you will discover that the unlocked doors are simply a vulnerability that could be exploited.
You would need more information to determine actual risk. Is there anything valuable in the car? What is the crime rate associated with the place the car is parked? What would the impact be if someone gained access to the car? Who would attempt to gain access to the car? Are there other compensating controls in place, like a security camera? The same logic applies to the digital world.
The presence of vulnerabilities like unpatched computers or misconfigured devices will contribute to the likelihood of a risk event occurring, but it is shortsighted to say that vulnerabilities equal risk. That statement simply is not true.
A risk assessment requires critical thought to occur beyond the discovery of vulnerabilities by software tools. It requires critical thinking and the use of logic and reason. All of which made capable by the involvement of qualified human beings during the risk assessment process.
Relying on the arbitrary risk statements and scores created by software tools that simply discover vulnerabilities in your network, can lead to a false understanding of your actual risk profile. This can then easily lead to the wasteful allocations of resources – intended to reduce risk – but end up remediating a vulnerability instead.
What Happens After the Assessment?
Typically, a vulnerability assessment can be completed in a day or two. The results of a vulnerability assessment are documented and provided to the stakeholder complete with recommendations around remediating any weaknesses found.
Security shortcomings found during a vulnerability assessment can almost always be fixed. Many times, the fixes are very easy to accomplish. Roughly 60% of all reported cybersecurity breaches occurred because the bad actors exploited common vulnerabilities and exposures (CVE).
This means that roughly 60% of all reported cybersecurity breaches could have been prevented if the victim had simply conducted a vulnerability assessment and made small improvements to their cybersecurity posture that would have eliminated a substantial amount of risk.
Interested in setting up a vulnerability assessment? Contact Databranch today at 716-373-4467 x115, info@databranch.com , or fill in the form below to set up a meeting with one of our experienced team members.
Not only will we help with the assessment, but our team of highly trained engineers will help your business prioritize based on your specific business needs.
Content was provided courtesy of CyberStone.
Read More
Companies both large and small share this one cybersecurity problem. They have computers that are still running older operating systems. Staff might use these devices only occasionally or the company may be running customized software that won’t run on newer OS versions.
The problem is that when the OS becomes outdated, the system is open to cyberattacks. When Microsoft or another developer retires an OS, it means that it is no longer supported. No more feature updates and no more security patches for newly found vulnerabilities.
The latest operating system to lose all support is Windows 8.1. Microsoft released the OS in 2013, and it was officially retired on January 10, 2023. Microsoft issued the following warning for companies:
“Continuing to use Windows 8.1 after January 10, 2023 may increase an organization’s exposure to security risks or impact its ability to meet compliance obligations.”
Here are a few facts you should know about what this retirement of Windows 8.1 means.
The OS Will Still Technically Work
When an operating system reaches its end of life, it doesn’t just stop working. Thus, many companies go on using it without realizing the security risk. Technically, the OS will work as it did the day before retirement. But it’s a lot less safe due to the loss of support.
Your System Will No Longer Receive Security Patches
Software and OS vulnerabilities are sought out and exploited all the time. This is what hackers do for a living. The vulnerability cycle usually begins with hackers finding a software “loophole.” They then write code to exploit it that allows them some type of system access.
The software developer learns of this, usually once hackers start breaching systems. They write code to fix that vulnerability. Developers then send the fix to users via an update that they install. This protects the device from one or more hacker exploits.
When an OS reaches its end of life, these fixes are no longer made. The developer has moved on to focus on its newer products. So, the vulnerability remains. It leaves a device vulnerable to hacks for days, months, or years afterward.
Approximately 61% of security vulnerabilities in corporate networks are over five years old.
Visit us here to learn more about penetration testing and how it helps identify the vulnerabilities in your business.
Options for Upgrading
If you have a computer that is still running Windows 8.1, you have two options for upgrading. You can opt for Windows 10 or Windows 11. If the computer is running such an old OS, there is a chance your system may not meet the requirements for one or both. In this case, you may need to buy a new device altogether.
Microsoft states that there is no free option to upgrade from 8.1 to Windows 10 or 11. Some of the advantages you gain when upgrading include:
- Better built-in security
- Faster processing
- Capability for more modern features (like facial recognition)
- Improved accessibility features
- Updated productivity tools (like snap layouts in Windows 11)
What Happens If I Don’t Upgrade?
Security & Compliance Issues
Your data security is at risk if you stay on Windows 8.1. Without any security updates, any vulnerabilities will stay unpatched. This leaves your system highly vulnerable to a breach. One hacked system on a network can also cause the breach or malware infection to spread to newer devices.
If you have to comply with a data privacy regulation, like HIPAA, you’ll also run into issues. Data privacy rules dictate making reasonable efforts to protect data. Using a device with an outdated OS jeopardizes meeting compliance.
Slowed Productivity
The older a system gets, the slower it will get. Staff that must work on outdated software often complain that it hurts productivity. 77% of surveyed employees were frustrated with outdated tech. Employees dealing with outmoded systems may also quit. They are 450% more likely to want to leave and work elsewhere.
An outdated operating system can hold your staff back. They miss out on modern time-saving features. They can also run into problems with bugs that will no longer get fixed.
Incompatibility With Newer Tools
Software and hardware developers aren’t looking back. Once Microsoft retires an OS, they aren’t prioritizing its compatibility. In fact, some may not want their product to be compatible with it because of the liability.
When you have issues using modern software and hardware it hurts your business. You become less competitive and begin to fall behind. Staying on an outmoded OS keeps you stuck in the past.
Get Help With Your Windows Upgrades
All Databranch Comprehensive Care and Foundation Security clients have scheduled automatic patching and Windows updates on their devices. To learn more about how we can help take this off your IT plate or help your organization upgrade to a system with a supported operating system, call 716-373-4467 x 115, email info@databranch.com or visit us here to learn more.
Article used with permission from The Technology Press.
Read More
Software vulnerabilities are an unfortunate part of working with technology. A developer puts out a software release with millions of lines of code. Then, hackers look for loopholes that allow them to breach a system through that code.
The developer issues a patch to fix the vulnerability but it’s not long before a new feature update causes more. It’s like a game of “whack-a-mole” to keep your systems secure.
Keeping up with new vulnerabilities is one of the top priorities of IT management firms. It’s important to know which software and operating systems are being attacked.
Without ongoing patch and update management, company networks are vulnerable while these attacks are completely avoidable. 82% of U.S. cyberattacks in Q1 of 2022 were due to exploiting patchable vulnerabilities.
What new vulnerabilities are lurking in products from Microsoft, Google, Adobe, and others? We’ll go through several. These were recently noted in a warning by the Cybersecurity and Infrastructure Security Agency (CISA).
Make Sure to Patch Any of These Vulnerabilities in Your Systems
Microsoft Vulnerabilities
Microsoft vulnerabilities include those in three of its products. Internet Explorer (IE) is one of them. Microsoft discontinued IE in June of 2022. You should remove this from any computers that still have it installed.
You’ll see the acronym “CVE” used in the vulnerability names. This is an industry-standard naming structure. It stands for Common Vulnerabilities and Exposures.
Here is a rundown of these vulnerabilities and what a hacker can do:
- CVE-2012-4969: This Internet Explorer vulnerability allows the remote execution of code. This is a “critical” vulnerability because of the damage it enables. Hackers can release this via a website. Thus, formerly safe sites can become phishing sites when hackers exploit this loophole.
- CVE-2013-1331: This is a flaw in the code for Microsoft Office 2003 and Office 2011 for Mac. It enables hackers to launch remote attacks. It exploits a vulnerability in Microsoft’s buffer overflow function. This allows hackers to execute dangerous code remotely.
- CVE-2012-0151: This issue impacts the Authenticode Signature Verification function of Windows. It allows user-assisted attackers to execute remote code on a system. “User-assisted” means that they need the user to assist in the attack. Such as by opening a malicious file attachment in a phishing email.
Google Vulnerabilities
Google Chrome and applications built using Google’s Chromium V8 Engine are also on the list. These applications are targets of the following vulnerabilities.
- CVE-2016-1646 & CVE-2016-518: These both allow attackers to conduct denial of service attacks. They do this against websites through remote control. This means they can flood a site with so much traffic that it crashes.
- Those aren’t the only two code flaws that allow hackers to crash sites this way. CVE-2018-17463 and CVE-2017-5070 are two others that both do the same thing. Like all these others, they both have patches already issued that users can install to fix these holes.
Adobe Vulnerabilities
People use Adobe Acrobat Reader widely to share documents. It makes it easy to share them across different platforms and operating systems. But it’s also a tool that’s on this list of popular vulnerabilities.
- CVE-2009-4324: This is a flaw in Acrobat Reader that allows hackers to execute remote code via a PDF file. This is why you can’t trust that a PDF attachment is going to be safer than other file types. Remember this when receiving unfamiliar emails.
- CVE-2010-1297: This memory corruption vulnerability. It allows remote execution and denial of service attacks through Adobe Flash Player. Like IE, the developer retired Flash Player. It no longer receives support or security updates. You should uninstall this from all PCs and websites.
-
Netgear Vulnerability
Netgear is a popular brand of wireless router. The company also sells other internet-connected devices. These are also vulnerable, due to the following flaws.
- CVE-2017-6862: This flaw allows a hacker to execute code remotely. It also enables bypassing any needed password authentication. It’s present in many different Netgear products.
Cisco Vulnerability
- CVE-2019-15271: This is a vulnerability in the buffer overflow process of Cisco RV series routers. It gives a hacker “root” privileges. This means they can basically do anything with your device and execute any code they like.
Patch & Update Regularly!
These are a few of the security vulnerabilities listed on the CISA list. You can see all 36 that were added here.
How do you keep your network safe from these and other vulnerabilities? You should patch and update regularly. Work with a trusted IT professional to manage your device and software updates. This ensures you don’t have a breach waiting to happen lurking in your network.
Automate Your Cybersecurity Today
Patch and update management is just one way that we can automate your cybersecurity. Contact us today at 716-373-4467 x 115, info@databranch.com or fill out the form below to learn how else we can help by scheduling a consultation today.
Article used with permission from The Technology Press.
Read More
Benjamin Franklin once said, “An ounce of prevention is worth a pound of cure.” This age old advice is easily applied to the digital world we live in today. Computers, applications and networks are under constant attack by hackers who are extremely motivated by big financial gains.
An effective patch and vulnerability management program has the ability to stop most hackers dead in their tracks. It greatly reduces the risk associated with the exploitation of a neglected or un-patched computer system.
Year after year, we learn that the vast majority of successful cyber-attacks have exploited unpatched computers and / or unpatched applications. What is even more interesting is that most of the patches for these compromised systems had been available to install for months, if not years prior to the cyber-attack.
There is no doubt that the combination of routine vulnerability scanning and the timely installation of system patches will make it much more difficult for a hacker to compromise your computer systems and information.
Here are 7 steps to help you build an effective patch and vulnerability management program:
Inventory Systems and Applications
Before we attempt to patch computers, operating systems and applications, we first must know of their existence. It is important to maintain an inventory of all computing assets. If possible, use inventory software to assist with the task but at the least, make sure the inventory is completed using manual means.
Monitor for Vulnerabilities
Vendors will release patches at regular intervals as new vulnerabilities are discovered. You must know when new patches are available to install otherwise, you risk not installing patches in a timely manner – or installing them at all. Good mechanisms to use for monitoring vulnerabilities include a combination of:
- Checking the vendor website and subscribing to mailing list
- Regular vulnerability scanning
- Checking vulnerability databases, such as the National Vulnerability Database
- Relying on an enterprise patch management tool.
Click here to learn more about our Security Assessment and to request your Free Baseline Security Assessment.
Selecting Patches to Apply
Deciding which patches are ultimately installed is typically based on the criticality of the patch, importance of the system being patched, the resources required to install the patch and assurance of post install system functionality. It is good practice to at a minimum, install all “Critical” and “Security” patches.
Testing
Prior to installing patches, it is important to install patches in a test or non-production computing environment. This will assure that the installation of the patch will not cause any adverse outages or system disruption when it is ultimately installed in a production computer environment.
Verify Backup
Despite the testing efforts completed in the previous section, it is still conceivable that the installation of a patch will create unanticipated issues or outages. For this reason, it is important that you verify the system or application being patched has recent data backup that can easily be restored if needed.
Automate Patching
The National Institute of Standards and Technology (NIST) recommends that patch installation should be automated using enterprise patch management tools or alternative options. Manually installing patches is expensive and inconsistent. Where possible, be sure that systems are automatically updated according to your patch management program parameters.
Verify Installation
The installation of a patch should always be confirmed by either re-scanning the system with a vulnerability scanner and / or reviewing log files.
Patching Equals Prevention
All Databranch Comprehensive Care and Foundation Security clients have scheduled automatic patching and Windows updates on their devices. To learn more about how we can help take this off your IT plate, call 716-373-4467 x 15, email info@databranch.com or visit us here to learn more.
Article curtesy of CyberStone.
Read More
