This post originated at IT Services Info & News | Ascensha. Ascensha is a Portland, OR IT company that manages and develops network infrastructure for Oregon small businesses.

In a business world where virtually every aspect of commerce is based in some form of information technology, particularly the World Wide Web, it’s imperative for organizations to confidently navigate the Internet without fear of information compromise. Clearly, failing to adequately secure sensitive business and client information will spell disaster for your organization. So, how confident are you in your organization’s IT security?

Below, we’ve provided five vital questions to help determine the strength of your own organization’s information security.

1. Do you have a written web security policy, and is it enforced?

Without a written and enforced policy, you cannot offer any assurance of information security. Strict guidelines are necessary not only for the safety of your clients, but for the safety of your business and its employees as well.

2. Is the IT department responsible for policy enforcement?

Because they shouldn’t be. Don’t make your IT department the “bad guys” on this one. Enforcement needs to come from the top.

3. Are you regularly monitoring web activity?

This is an absolute must, and there’s simply no excuse with the plethora of monitoring technologies available today. Regularly monitoring web activity is your key to effective information security.

4. Do you allow employees to download programs?

If you do, stop. This is one of the main proponents of malware invading organizations’ networks. Only your expert IT staff should have authority to download software and other programs.

5. Are you blocking access to known harmful web sites?

If you’re not, you’re setting your business and employees up for failure. Blocking known malicious web sites will allow you to be proactive in the fight for information security.

Using these five basic questions as a guide will help set your organization on the right path to IT security success. Incidentally, if you’re a small business without an IT department, consider the many advantages of letting local computer consultants manage your network security.

[photo: laurakgibbs]

Additional Resources:

Eliminating Small Business Security Threats

Recognizing Five Small Business Security Threats

Is password protection enough?

bookmark to:

This post originated at IT Services Info & News | Ascensha. Ascensha is a Portland, OR IT company that manages and develops network infrastructure for Oregon small businesses.

As wireless technology and portability of electronic devices has developed over the years, so has an entirely new set of vulnerabilities regarding information security. With more and more devices that contain sensitive information leaving company property, physical security is dramatically less effective as now those devices are more likely to be lost or stolen. In fact, more than 345 million records containing personal information have been reported compromised since 2005, and the actual number is undoubtedly much higher since only about half of the states in the U.S. are required to report such incidents (see privacyrights.org).

Is your organization doing enough to protect its valuable information?

For instance, if an employee loses his cell phone that contains privileged contact information for his clients, or if his company laptop with client records and profiles is stolen, what guarantee do you have that information stays safe? If you think simply password protecting your systems is enough to thwart even the dullest of criminals, think again. According to a recent whitepaper, there are at least three fairly simple ways of bypassing a password protected computer. Briefly, they are:

1) Using an alternative boot device. Installing a new copy of the operating system on a machine will grant you access to any data residing on the hard drive.

2) Using an alternative boot device and an alternative boot program. Instead of booting to the same operating system, a thief could boot to a different OS that allows it access to information the original would not.

3) Moving a hard drive to an alternative computer system. By physically removing the hard drive from a computer, a criminal can attach it to another machine as an external drive, and all the data appears as if he had successfully logged on to the original machine.

As you can see, simply employing the use of a password, though important, is not enough to effectively protect your company devices. For real information security solutions, you need to turn to IT security experts. In an age where even criminals are becoming tech savvy, your business depends on staying a step ahead of the game.

[photo: the_english_guy]

Additional Resources:

Is your IT security effective?

Eliminating Small Business Security Threats

IT Security: Back to Basics

bookmark to:

This post originated at IT Services Info & News | Ascensha. Ascensha is a Portland, OR IT company that manages and develops network infrastructure for Oregon small businesses.

A new report released last week revealed some telling statistics on the security of certain “critical infrastructure” industries like power plants, sewer/water systems, and oil/gas companies. In a survey of 600 IT security executives from companies in 14 countries, more than half have already suffered major attacks from malicious organizations. Another 40 percent expect to be infiltrated with a large-scale attack within the next 12 months.

Is your organization prepared to combat such an attack?

The report, commissioned by McAfee, Inc. and authored by the Center for Strategic and International Studies (CSIS), further divulged that a majority of companies suspected opposing governments to have a hand in the attacks and that recession-induced cutbacks have increased the risk of vulnerability. Additionally, a number of executives expressed their feelings of unpreparedness for such an attack.

Furthermore, the report stated that the risk of cyber-attacks is rising, noting that over one-third of executives said the vulnerability of their sector rose within the last year in spite of increased legislative action. Only 20 percent of executives believed their sector would remain safe over the next five years. Clearly, with only 20 percent of IT experts confident in their security measures, IT security needs to be taken more seriously.

Hopefully, a report with findings such as these will encourage companies with IT departments to recognize the legitimacy of IT security and allocate more resources to provide effective information security for their organizations. And if you’re a small business without an IT staff, it’s time to seriously consider trusting a reliable IT security firm to keep your organization safe.

[photo:mark i geo]

Additional Resources:

Keep Your Computer Secure In This Bad Economy

IT Security: Back to Basics

Eliminating Small Business Security Threats

bookmark to:

This post originated at IT Services Info & News | Ascensha. Ascensha is a Portland, OR IT company that manages and develops network infrastructure for Oregon small businesses.

In the previous post, we identified five major information security threats to small businesses. Today, we want to address how business owners can prevent and eliminate these threats from materializing. If you’re a small business owner, implementing the following practices will dramatically increase your information security.

Here’s how to eliminate risks associated with:

1. Compromised passwords. Password protection is the most basic and widely accepted means of security, which means it is also a huge vulnerability. To prevent passwords from being stolen, never show or tell anyone your password, do not store passwords in obvious places (especially near or on your computer), and change passwords often.

2. Trojan horses. The best defense against these malicious viruses is education. Since trojan horses are user-initiated, it’s important that employees are taught how to identify potential threats. For instance, simple practices like not opening unfamiliar attachments or visiting foreign links will significantly reduce this risk.

3. Wireless attacks. The simplest solution is to ditch the wireless networking. Unfortunately, that may not be the easiest. Still, security increases nearly ten-fold when companies utilize physical wires to operate their network. There have been a number of instances, however, when employees will set up their own wireless network with a personal router. Be wary of this practice as it could reverse everything you’re trying to accomplish.

4. An inside job. This particular threat is a tough one. On one hand, your hiring and screening processes must be intensely thorough, and on the other, much time and effort must be put in to making sure your employees remain happy and satisfied. Additionally, use a hierarchy for granting access privileges to sensitive information, which is any information, really. Only those people who are absolutely trustworthy and require the information should be allowed to access it.

5. Default settings. Hackers prey on these default settings since they make it easier for them to compromise your security. If you or your employees don’t understand how to customize and adjust settings on your systems and machines, let a knowledgeable computer technician walk you through the process.

Implementing the suggestions mentioned above will help eliminate some of the major security threats many organizations face today. If you find that your business is ill-suited to keep up with the demands of IT security, consider trusting a local IT consulting firm to support your organization.

[photo: CarbonNYC]

Additional Resources:

Recognizing Five Small Business Security Threats

IT Security: Back to Basics

Protecting Your Business Against Scareware

bookmark to:

This post originated at IT Services Info & News | Ascensha. Ascensha is a Portland, OR IT company that manages and develops network infrastructure for Oregon small businesses.

Did you know, in the U.S. alone, an identity is stolen every four seconds? For small business owners, that particular statistic might not raise any immediate concern — that is, until you realize how those identities are stolen. The fact is criminals have to retrieve information from somewhere, and more often than not, that somewhere is your business. As such, how do you protect your business against identity theft?

Whether its online or offline, one breach of information security could have your customers’ sensitive data compromised. Thankfully, identity theft prevention expert Scott Mitic has some immensely practical tips for your small business when it comes to keeping your customers safe.

According to Mitic, businesses should:

1) Collect only information you need from your customers. Let’s face it: the more information you have, the greater the risk and the greater the damage.

2) Invest in software and hardware to protect your customers’ data. Additionally, every business should have a privacy policy outlining its solution that’s easily accessible to its customers.

3) Limit access to sensitive information. Not everyone needs to know everything. Grant access to customer records only to those employees who absolutely require it.

4) Secure your physical workplace. It’s a common practice for identity thieves to physically steal information from your office. Lock doors, cabinets, mailboxes, and computers.

5) Properly dispose of information when you no longer need it. Even if you don’t think information is sensitive, it’s best to be conservative and play it safe.

For small businesses, identity theft is a very real threat. Assure your customers that your organization takes information security seriously and does everything it can to eliminate the risk of compromising sensitive information. Consider seeking the help of an information security specialist if you’re unfamiliar with ID theft prevention solutions.

[photo: Don Hankins]

Additional Resources:

Identity Theft Preys on [Your Business]

Protecting Your Business Against Scareware

IT Security: Back to Basics

bookmark to:

This post originated at IT Services Info & News | Ascensha. Ascensha is a Portland, OR IT company that manages and develops network infrastructure for Oregon small businesses.

As more organizations are looking to cut costs, it seems like every area of business is coming under close scrutiny, and the IT department is no exception. Specifically, one aspect of information technology that is increasingly difficult to evaluate financially is network security. Yet, provided your company takes the right steps, network security doesn’t have to be a burden, and it can actually free up funds to invest elsewhere.

ZDNet recently featured a live webcast from a security company that identified a number of ways to reduce the cost of network security. While I didn’t agree with everything they recommended, I did find a point or two that were useful. For instance, the whole premise of the presentation revolved around simplicity, that is, simplifying your security. And while utilizing “simple” network security may sound counter intuitive, it really is the best return you get for your investment.

So, what does simple look like?

Simple means you’re not using valuable time and resources to maintain or troubleshoot your security systems. Likewise, operating your network security shouldn’t require intensive training either. Also, simple means all your security solutions are in one place — not spread out across a number of different applications or services (also referred to as “point solutions”).

Basically, “simple” security solutions save your business money because you’re increasing productivity. Time once devoted to operating and maintaining your systems is now being diverted down more profitable avenues. And here’s the roadblock for many: simplifying may mean investing more upfront, but the increased efficiency in the long-term will more than make up for it. Consult your local IT professionals to see how you can simplify your organization’s network security.

[photo: Don Hankins]

bookmark to:

This post originated at IT Services Info & News | Ascensha. Ascensha is a Portland, OR IT company that manages and develops network infrastructure for Oregon small businesses.

A study released this week from the SANS Institute revealed that many organizations worldwide are not concentrating on the IT security threats that pose the greatest risks. Instead, they are diverting their attention to threats of less importance. When information compromise has the potential to devastate an organization, a problem like this one should be swiftly remedied. Is your company focusing on the right threats?

The study uses data from thousands of organizations during March to August 2009 and shows that the majority of these companies are focusing their patching and scanning efforts on operating systems when, in fact, more threats are web-based. According to the study, “On average, major organizations take at least twice as long to patch client-side vulnerabilities as they take to patch operating system vulnerabilities.”

“Attacks against web applications constitute more than 60% of the total attack attempts observed on the Internet. These vulnerabilities are being exploited widely to convert trusted web sites into malicious websites serving content that contains client-side exploits,” the study says. The study then provides a detailed example of an HTTP client-side exploitation, explaining step-by-step how a hacker infiltrates an organization’s intranet via a trusted third-party site (Facebook, YouTube, Flickr, etc.) and proceeds to compromise critical company data.

The study also reports that more than 80 percent of web application vulnerabilities being discovered are SQL injection and Cross-Site Scripting flaws in open-source and custom-built applications. Furthermore, it says that “most web site owners fail to scan effectively for the common flaws and become unwitting tools used by criminals to infect the visitors that trusted those sites to provide a safe web experience.” In an age where Internet commerce can make or break a business, that last statement should stir organizations to begin focusing their efforts on the right place — the Web.

With information security a priority for customers and employees alike, don’t trust your network security with anyone but IT professionals. Talk with security experts today to ensure your time and resources are going where they’re most needed.

[photo: Matt Glaman]

bookmark to:

This post originated at IT Services Info & News | Ascensha. Ascensha is a Portland, OR IT company that manages and develops network infrastructure for Oregon small businesses.

Welcome to the latest potential risk on the internet: clickjacking.  This attack occurs when a ‘hacker’ puts an invisible button on a web site that overlaps with existing buttons or links. When a user clicks on something thinking they are going to the links intended destination, canceling a purchase or hitting submit, they are actually hitting on the invisible button that may take them to a site with malware, makes a purchase rather than cancels or turns on an unneeded program.
The video below from CNET.com explains this serious and very real threat.

This is a new threat and one that can’t be fixed simply as it pretty much takes advantage of the way the web works, rather than a software hole.  Jeremiah Grossman, one of the researchers who first wrote about this threat and created the name clickjacker has offered a few suggestions for web users right now.  As this threat develops and security researchers study it more, additional tips may become available.  For now, consider these:

1. If using Windows and IE: Disable JavaScript to help protect against clickjacking. You can do this by going to <Tools>–>Internet Options–>Security

2. Firefox:  Firefox has the NoScript add-on that lets people selectively block scripts and has a ClearClick feature designed specifically to protect against clickjacking

3. Log-out of password protected sites when you are done to reduce your chances of clicking on something you don’t want to (shopping sites, social media sites, banking sites, etc)

Tips compiled from CNET.com article by Elinor Mills

bookmark to:

This post originated at IT Services Info & News | Ascensha. Ascensha is a Portland, OR IT company that manages and develops network infrastructure for Oregon small businesses.

I came across a helpful article this week concerning computer security. The author, Dennis O’Reilly, made protecting your personal computer seem simple.  I thought it may be a much-needed reminder for some of you readers in the ever-expanding world of complex technology.

O’Reilly believes staying safe on your computer doesn’t have to involve constant and consistent research or updates. In fact, he offers five easy-to-tackle tips for protecting your PC.

1. Use a firewall. That’s it. There’s no need to search high and low for the best and brightest firewall because that always changes. What you’re using now, or whatever firewall came with your operating system, will do the trick.
2. Use a free antivirus program. Again, there’s no need for all the hoopla of researching and purchasing the best software you can find. And if you ever don’t like the free version you’re using, O’Reilly says don’t hesitate to try another one.
3. Change your password often. It’s quite simply the easiest and most reliable form of computer systems security out there.
4. Use e-mail encryption. Perhaps this sounds daunting, but it’s simpler than you think. Some browsers and e-mail providers already provide the option — you just have to turn it on.
5. Update your browser. According to a recent study, using the most recent version of an internet browser lowers security risk.

While O’Reilly offers these tips for maintaining security on your computer, his advice is more suited for the individual and not the organziation. If you’re looking for effective information security for your business, using a local computer systems security firm is your most reliable option.

bookmark to:

This post originated at IT Services Info & News | Ascensha. Ascensha is a Portland, OR IT company that manages and develops network infrastructure for Oregon small businesses.

The Oklahoma Department of Human Services had a lot of explaining to do this month after an employee’s laptop, with roughly 1 million Oklahoma residents’ personal information tucked inside, was stolen. The department notified those that may have had their information viewed but was that enough?

What killed me was the DHS Director’s response in a news release – “The risk of the data being accessed is low because the computer uses a password-protected system.”

Oh really?  And what kind of password system?  Was the employee diligent in creating good passwords? Was the password changed regularly? What has come to light is that the data on the laptop, though password protected, was not encrypted leaving it vulnerably sitting behind a meager password-protection.  Prying the hard drive out would suddenly render that information readable in any other system.

Let me be clear, I’m not writing this to cause alarm or to point fingers at the Oklahoma DHS.  I am just saying, companies HAVE GOT to understand that basic network security and system safe-guards are not always enough. If dealing with highly sensitive financial information or personal data, get an IT professional service to help you set-up a solid network that will protect you from disasters like this.  Computer support is available to you if you are willing to take the steps to get your company’s security safe.

More on computer security.

Photo of HP Pavilion 2415NR Laptop

bookmark to: