Your Framework for Your Memory

Inside each family, there are smaller groups of tools. Each family below lists those groups, with some example tools available now (June 2026) and where they fit. We do not endorse any of these tools, nor do we recommend or advise against any of them, although we do use many of them. The product names are here to make the differences between the families easier to recognize.

Family 1 – Analysts: AI tools that Analyze

For tools in this family, you chat with the AI. It can research a topic, summarize a long document, write a draft, pull out the key points, and work inside projects you have set up. For non-technical professionals, this is the most visible way to use AI as of June 2026. Think of this family as an analyst on your team. It studies things, reports back and then you decide what to do.

You will notice that many tools you already use have a built-in chat helper. When you ask that built-in helper to research or summarize, it behaves like a Family 1 Analyst, even though the chat feature is embedded in another program. The makers tend to label these helpers “Assistants.” A real human assistant can take action for you, and that is where the next family comes in.

• General chat analysts: Claude, ChatGPT, Gemini, Perplexity, Microsoft Copilot. Microsoft sells Copilot in three tiers: the free Copilot, the individual Copilot Pro, and the business Microsoft 365 Copilot that natively accesses your company data, works inside several Microsoft Office apps, and, for now, lets you choose which AI model answers, including Anthropic’s Claude and OpenAI’s models alongside Microsoft’s own.
• Customized analysts: Claude Projects & Skills, Custom GPTs & GPT Projects, Gemini Gems, Perplexity Spaces, Microsoft 365 Copilot Agents, Microsoft Copilot Notebooks

Family 2 – Assistants: AI tools that Take Action

You delegate tasks to AI, and it completes them. You can give these “task agents” selective access to your files, your mouse, and your screen, and they have connectors to other programs you use. Your instructions to a task agent can let it move a file, send an email, write a row in a spreadsheet, add a record to a database, notify your team, and more. Instead of dragging a dozen documents into a Family 1 Analyst and asking it to do a task, your task agent can find the dozens of files itself and do the work using those files, based on your instructions.

While using AI in Family 1 carries privacy and security risks, Family 2 requires even more attention. Don’t be afraid to use these tools, but approach them carefully and put safeguards in place. You must accept some risk in order to use these tools. “Cloud task agents” that run in the cloud put you at risk if an attacker can find a way to exploit weaknesses in them by using techniques such as “prompt injection” to trick your AI task agent into working for them. One goal threat actors have is to trick your task agent into sending them sensitive information. Once you start using “on your machine” task agents that might have access to your local computer, including accessing some files on your drives and the ability to imitate you by moving the mouse and clicking the mouse buttons, based on what it “sees” on your screen, your risk increases. If your AI behaves irrationally, or an attacker is able to take control of it, you’re more exposed.

• Cloud task agents: ChatGPT Agent, Gemini Spark, Perplexity Computer, Microsoft Copilot Cowork (cloud task agent) run in the cloud. As with everything in all these families, be aware of privacy and security risks.
• On-your-machine task agents: Claude Cowork, Perplexity Personal Computer, OpenClaw, NanoClaw, and Microsoft Scout. Be especially aware that if you use these task agents running on your machine, they can pose enormous security risks in some cases. Scout, built on the open-source OpenClaw project, is experimental as of late June 2026.

The difference in Family 2 compared to Family 1 is that here you end up with a completed task, something a task agent did for you based on your instructions right then.

Family 3 – Tools that let you create workers

This family is where you build highly skilled workers who can start on their own at an event, such as when an email arrives or at a set time of day. You manually start the Family 2 tools. Family 3 helps you produce task agents that can start automatically, without you needing to be present.

There are two kinds of workers you can make here. The first is a workflow in which you lay out every step yourself, so the result is predictable and repeatable. You have the option to add or not add AI to your workflow, and the difference is massive. AI reasons on its own, so you will not always get the same result if you use AI within a workflow. When you add an AI step to a workflow, it can return different results each time, and that variation can disrupt the operation of the otherwise predictable steps that follow. Workflows can be composed of steps that do not have to use AI at all, so the workflow is predictable, which is essential for work that must be accurate every time, such as exact statistical or financial calculations.

The second type of AI in Family 3 is a task agent builder. Instead of writing out every detailed step, you give the worker a goal and let it work out the steps on its own. You design a worker that you will not tell what to do; you just give it an outcome to achieve. Because you don’t define the steps exactly, a task agent may produce different results each time you use it.

Both kinds run automatically when an event occurs, such as an email arriving, and both let you hand off tasks you used to do manually. The difference is whether you want to define the steps or let AI choose its own steps to achieve your result. The first can be predictable if you leave AI out of the steps, and the second can be fluid, flexible and adaptable, but be prepared that you might not always get a result you expected.

• Workflow automation: Zapier, Make.com, n8n, Gumloop, Microsoft Power Automate
• Agent builders: Zapier Agents, OpenAI Agents SDK, Botpress, StackAI, Microsoft Copilot Studio. (OpenAI’s no-code Agent Builder, which used to accompany the Agents SDK, is being retired on November 30, 2026.)

Family 4 – Tools that let you write programs

With these tools, you explain a program in plain English, and the AI writes it for you. This activity is called vibe coding. AI helps you add features and upgrade your program whenever you want, without you needing to learn how to program. Experienced developers use this family too, to speed up their own work.

There are two kinds here. The first kind, called app builders, write the program and host it for you in their cloud, so you stay in plain English from start to finish. You won’t need to understand much about how programs work on the backend.

Other tools, called agentic coding tools, write code you can run wherever you like, giving you more power and showing you more of the moving parts. You’ll have an opportunity to get a little deeper into what is going on, and the AI tool can help you through the process. Having the flexibility not to be locked into a specific vendor’s cloud can be appealing in some cases.

• App builders: Base44, Lovable, v0, Replit, GitHub Spark. GitHub Spark, which Microsoft owns, is still in preview as of late June 2026.
• Agentic coding tools: Claude Code, Codex App, Cursor, GitHub Copilot.

Terminology

Now that we have covered the families as a framework, here are some terms in case any of them are new to you.

Agent. The term “Agentic AI” refers to AI that can take action, and the word “agent” always benefits from a descriptor next to it, such as “coding agent” for an agent that writes code, “task agent” for an agent that performs tasks, and so on.

Embedded AI. This is when software you already own has AI features built in, such as a chat helper in your email or a spreadsheet. Usually, embedded AI is a feature you enable, not a separate tool.

Connections. Connectors provide access. This is how programs connect to other programs you use, online services, databases, and everything else. For AI to work in the real world, and to reach the data sitting in your databases and elsewhere, you need connectors. You may see the terms API and MCP; I will cover them in a future article. They are the backbone of most connectors that provide access. Access by itself is not enough, though. The tool also needs to know what to do with that access, which leads to the next term below, skill.md. Connectors carry a significant risk if a threat actor compromises one. We call this “east-west” security because it involves data flowing between programs, as opposed to the traditional “north-south” security that protects your data and systems via a firewall. Using connectors bypasses firewall protection because your SaaS applications can communicate with each other without the conversation ever passing through the traditional firewall at your network perimeter, where your network connects to the outside world. This east-west traffic is harder to see and control than traditional perimeter traffic, and it should be on your CISO’s radar, especially if workers set up connections without their knowledge or approval. Threat actors target connectors. I will cover service-to-service, API, and MCP security inside and between environments in more detail in a future article.

SKILL.md. This is a file that teaches AI how to do a task the way you want it done. The skill file often includes instructions on how to work with another program you have connected to, and it can also hold your own process, such as your style, checklist, or standards. The connector gives the AI access; the skill file gives it the know-how to do a great job. As an aside, the “md” in the file name stands for “markdown,” and md files are saved as plain text you can read and edit in a basic app such as Notepad or TextEdit. People often say “skills” out loud, while the file itself is usually named SKILL.md. Just as you train a new worker at your organization, you can use a skill file, along with related markdown files, to train your task agents and other AI tools.

AaaS. Agent as a Service is a way you can pay for task agents to perform specific tasks for you. Their features fit in Family 2 above, and they are useful when you just want to pay for a result. For example, you might pay a monthly fee for a task agent to run your lead follow-up and clean up your sales pipeline.

Loops. Looping is a recursive process in which the AI plans, acts, observes, and refines, then repeats the cycle, starting with refined planning. Each pass through the loop can improve the result. Keep in mind that more loops do not always mean a better answer; the gains usually are higher during the first rounds. As of now, a loop can drift in the wrong direction if it is unsupervised and runs too many times. Looping also uses a lot of computing power, known as “compute,” which can mean a high token cost, the next term.

Tokens. Companies such as Google, OpenAI, and Anthropic charge you to use their models, and the unit they use to measure usage is called a token. To give you a rough idea, a token is about three-quarters of a word in the English language. If you are using a Family 1 chat tool for a monthly fee, you usually are not billed by the number of tokens you use, but you might find yourself temporarily restricted if you reach a specified limit. The other families may have features that result in your getting charged per token. You use more tokens when you run more activities, open larger files, and run processes more often. You are charged for both what you send to the model and what it sends back to you. The topic of saving money with AI while being charged per token deserves special attention, because some companies are finding AI is becoming very expensive for them. I will write an article about that soon, probably next week.

Conclusion

You now have a shared vocabulary and, more importantly, a framework for filing AI tools into families. Share this with your friends so that, as new AI tools arrive, and they will keep arriving quickly, they can file each tool into its family and help keep their sanity while everything else keeps changing.

The post An Executive’s Guide to Demystifying and Understanding the Four Families of AI Tools appeared first on Foster Institute.

EXECUTIVE SUMMARY

New Business Email Compromise (BEC) attacks targeting wire transfers cost organizations billions annually. Threat actors have developed new techniques to bypass even sophisticated email protection filters in organizations like yours and can use new AI deepfakes as a new way to bypass voiceprint protection at the banks.

This article reveals these new threats. So that you can have more wire transfer security in one document, this article covers several key components to have in your organization’s wire transfer process to help protect against new and old threats. It also includes some new protective changes your IT Team can implement in your computer systems and processes, including ways to protect against both existing and new threats.

The losses can be devastating – one organization lost hundreds of thousands and a top executive. Review your wire transfer policy today, and conduct a tabletop exercise this quarter. Your organization’s financial survival may depend on it.

It is Time to Update Your Wire Transfer Process Policy and Procedure Documentation

Fraudulent wire transfers, part of an attack referred to as Business Email Compromise (BEC), are very frequent and expensive for organizations that fall prey to these attacks. The FBI IC3 reports that BEC costs organizations billions of dollars each year. I want to help you avoid being a victim.

Something new that’s related to wire transfer fraud: The threat actors have a new technique that successfully bypasses spam filters. We’re receiving concerned email questions, as we should be, like this one from a very savvy IT Pro who wrote in frustration: “The email bypasses one of our main filters for external mail.” The “main filter” he is referring to is a very expensive email protection service that is very effective at preventing external phishing. At least it was, until now. Attackers found a way through not just his, but any systems not protected by the new technical fix we gave him right away, which is included below. Your protection may be vulnerable too. The need for you to know what to fix is the primary reason I penned this article.

In another new development, Sam Altman, CEO of OpenAI, which makes ChatGPT, is warning the Federal Reserve: Fraudsters can use improved AI-generated voice to completely defeat voice-print authentication. He says that threat actors will be able to call a bank, pass the voice recognition test for access to their victim’s accounts, and move money wherever they want.

One of our customers got compromised. When one of their vendors called asking about hundreds of thousands in unpaid bills, the company realized they’d been paying a fraudster for a year.

Our customer had a strict protocol: The vendor must fill and sign a specific form, then, following separation of duties, one person approves the change and another updates the routing and account numbers. Unfortunately, fraudsters breached the victim company’s email and easily identified the process by tracking a legitimate request.

The hackers breached the email system of one of the victim’s largest suppliers. They immediately sent an email from that company to the person who approves transfers and another directly to the person who changes the routing and account number using a forged approval signature.

It was almost impossible to catch that, and they only found out after a year when the large vendor contacted them, saying they’d had a glitch that resulted in no statements being sent, and asked about the hundreds of thousands of dollars the victim company owed the vendor. And, of course, the victim company had been paying all along, but the money was going to a happy fraudster who enjoyed a significant income for their efforts. The loss was devastating. A top executive, one of the smartest and kindest people I’ve ever known, left the company soon after.

Threat actors successfully bypass spam protection by tricking anti-phishing systems into believing their message, sent from an external server, came from inside your network. The duped spam filter doesn’t check the message and allows it through because, by default, all internal email messages are allowed. This trickery removes the need for the threat actors to breach the victim company’s email system.

You’ve seen the online videos of deepfakes and how difficult it is to tell some of them apart from a real human. Although it isn’t common yet, threat actors could theoretically use AI to use deepfake voices that sound very convincing during an approval process. OpenAI is specifically warning banks about this risk right now. Threat actors are using deepfake video in job interviews now, so it is reasonable to expect that they will use audio impersonation to fake a vendor representative’s voice to successfully and fraudulently complete the approval process.

Have a Wire Transfer Process Policy that your team adheres to. Be sure there is extensive training and regular samples. If your team knows there could be a test message at any time, they’re more likely to stay vigilant.

I know you can use AI to write one, but here is a sample wire transfer policy we’ve spent a lot of time compiling that you can adjust to fit your organization:

1. Receive and log the request into whatever logging system you’re using now. Even a spreadsheet would work. Record:
   1. Entity requesting the transfer
   2. How they contacted you: email, phone, etc.
2. Look for Obvious Problems:
   1. Carefully check the email address to confirm the text after the @ sign matches the company’s domain. If they don’t, check your email history to see what domain name they typically use. And of course, you already know the source and reply-to email addresses can be spoofed anyway. If anything is off in the addresses, consider the message fraudulent.
   2. Does the request indicate some urgency? If so, be very suspicious that it is fraudulent.
   3. Does it ask you to keep something secret, such as a surprise or gift? If so, be very suspicious of this, too.
   4. Do you already have different payment details on file for that company? If so, be extra careful.
   5. If something feels “off” about the request, trust your gut feeling and escalate it for secondary review. Sometimes our brains can detect subtle clues that aren’t obvious, and fraud is so expensive that you must honor all indications, even when it is just an odd feeling about the message. It is better to err on the side of safety than lose a fortune to fraud.
   6. If someone phones you, keep in mind that AI is excellent at helping threat actors create deep-fake audio impersonations. If you’re unsure, start a casual conversation and ask specific questions about their city. If they can’t answer even simple ones, or they make an excuse like having just moved there, that is a big red flag. If a threat actor is using a voice chatbot responding to you directly, it will know the answers to your questions right away, but at least it gives you more time to see if the voice sounds AI-ish.
   7. Just because you confirm that an email is from a company, that doesn’t mean it is valid. Threat actors earn lots of money if they succeed, so they are motivated to invest a lot of time and use sophisticated techniques to hack into the email of one of the companies you already transfer money to. Then they can send and receive email via the company’s actual mail servers. The company whose email they hacked has no idea.
   8. Tell other members of your team about messages that concern you so they can spot them quickly.
3. Mandatory Callback Verification if the message passed the initial review
   1. Verifications must be conducted out-of-band, meaning in a different way than the request arrived. For example, if the request arrived by email, verify it in a different way
   2. If your organization utilizes secure communication methods, such as encrypted email or a secure portal, contact the person that way to confirm the transfer or account number update.
   3. If you need to use email, forward, not reply, the request to the supposed person at the company domain (not another domain; watch for minor typos in the domain name) and ask if they sent that message.
   4. Call the person requesting the transfer or account number update. Avoid calling the phone number provided in the email message. Find the phone number you typically use or look up the phone number at the company’s website or another independent way.
   5. Ask the person to call you back so you can verify that the phone number matches the one on the company’s website. If the number doesn’t match exactly, the area code, prefix, and first one or two numbers should.
   6. If this is a new setup, or a change in account number, contact a second person at the organization to independently confirm the worker’s identity whom you contacted.
   7. Document all of this in your log.
4. Dual Approval for transferring money
   1. See if your bank will allow you to set up dual approval so that two people must confirm each wire transfer. If your business processes dozens of wire transfers every day, consider setting a threshold where you only need two people if the transfer is over a specific amount.
   2. Even if your bank doesn’t have the two-person verification option, you can still use that process internally on your own by having the person who is about to make the transfer get the sign-off of another worker who can verify it.
5. After you make the transfer or update the routing and account numbers, send a confirmation to the user at the company using the email address you independently verified. Do not assume the email address or the “reply to” address is accurate. Update the log entry that corresponds with the transaction you started when the request arrived, so you’ll be able to review the details if you need to.
6. Immediately activate the response plan described below if you suspect fraud has happened. Speed is of the essence because the sooner your bank and the authorities know about the fraud, the more likely it is that they can recover some or all of the money. There are no guarantees, but act quickly anyway.

Here is a list of other essential steps we created for you. Some are more technical, but you can always lean on your IT team to help:

1. By default, most spam filters allow all internal messages between your workers to pass through without inspection. As mentioned above, attackers can successfully trick your email systems into believing the sender is inside the company. They can trick your anti-fraud tools to pass their wire transfer requests without scrutiny. Ask your IT Department to change the settings to remove this bypass and require all messages, internal and external, to be tested thoroughly.
2. Thoroughly educate your team about preventing BEC and wire fraud.
3. Check your regulatory and legal requirements for your industry and your situation. There is a chance that there are specific wire transfer regulations that will apply to your organization.
4. Ask your bank and your application providers what forms of fraud protection services they offer. AI is empowering banks and other financial institutions to watch for suspicious behaviors. The tools can watch trends with all of the transactions they process and also watch for irregularities from your organization’s typical usage. AI is getting better and better at catching fraud quickly. Make sure yours is set at the highest level.
5. You can utilize the security principle of “separation of duties” by ensuring that the person approving the transfer is different from the one making the transfer. This is the “separation of duties” principle that can help catch fraud since more than one person has a chance to recognize an issue.
6. An attacker might use deepfakes to dupe you into thinking everything is legitimate. After all, if they stand to make a mint, they will go to great lengths, the stuff Hollywood is made of. Someday, it might get to the point that some transactions must happen in person. If going in person is not practical, an alternative that would be very difficult, as of today, for an attacker to simulate would be a video call with multiple people whom you recognize from the other organization in the same online meeting at the same time, especially if the vendor’s representatives are in a setting you recognize. The threat actor would have to accurately depict the background, animate all the people at the company and give them the right voices and the right things to say in a very human way. The technology just isn’t that good yet.
7. Ensure your IT Department has configured alerts that will trigger the moment a new email rule is created. It is very common for threat actors to breach a company, configure email forwarding rules, and then get out before they’re noticed, all to prepare for lucrative fraudulent email requests. In post-incident forensics processes, we frequently discover that the threat actor was only in the network for a few minutes and was gone before even the best EDR, XDR, and other automated detection tools could notice. To the system, it appeared to be a typical user logging in and logging out, nothing out of the ordinary.
8. Be sure you set up MFA at your bank. Ask if they support you logging in with a physical token, an authenticator app on your phone or using a passkey, all of which are more secure than a text message. Even then, know that hackers can bypass MFA, so it cannot positively prevent a threat actor from accessing your account. But use MFA anyway.
9. Here’s the technical stuff to send to IT, but executives, please read the next section after this section.
   1. Ask them to enable Spoof Intelligence in Microsoft 365 Defender
   2. Ensure Anti-Spam Policy > Spoof settings blocks failed SPF and DMARC internal spoof attempts
   3. Enable domain and user impersonation protection in an Anti-Phish Policy for your Accepted Domains
   4. Disable or at least restrict any inbound connectors that accept mail from untrusted IPs
   5. Add an Exchange Mail Flow transport rule so that if a message is authenticated as Anonymous but claims to be from inside your domain, check the message: If AuthAs=Anonymous AND InternalOrgSender=True, treat it as external and run spam and phishing filters again.
   6. Be sure your IT Department has configured technology they will recognize called SPF, DKIM, and DMARC to help protect you from fraudulent email messages. But they need to implement it in phases to ensure you don’t lose essential messages and that your company’s outbound email messages don’t get blocked due to the settings. They can start SPF with ~all (soft fail) while monitoring, then move to -all (hard fail) for SPF after they’ve identified all the approved sources of email, and separately configure DMARC to progress from p=none > p=quarantine > p=reject over time. Important: Don’t move DMARC to p=reject until both SPF and DKIM are properly configured and aligned, as this could block legitimate emails.
10. You already have incident response plans for what happens if there is a security breach, and be sure to have one for fraudulent wire transfers, too.
    1. Include immediate notification of your bank, cyber-insurance carrier, the FBI, your data breach lawyer, and the executives of your organization. Include all contact information right in the plan so there are no delays. Sometimes, when money gets transferred to a fraudulent account, the threat actors cannot access the full amount right away; they must remove the money in smaller increments. Sometimes you can recover some of the money if you act quickly. Other times, the funds are moved immediately to overseas mule accounts.
    2. Include an instruction to ask your IT department to immediately run an Exchange message trace on the specific messages related to the fraud; they’ll understand the request.
    3. Ask IT to also check the admin audit logs for recent rule/connector modifications.
11. To combat the voice-print dangers, you need to consider both someone impersonating your company to the bank, and someone pretending to be the bank calling you. For the former, ask your bank to require multiple forms of authentication, not just voice-print. They will probably suggest pre-arranged code words or security questions that only you and your bank know. Here’s something many people learn the hard way: Do not answer with a fact. In other words, you might say your high school was Sea of Tranquility High on the Moon. Good luck to any attacker trying to find that on your LinkedIn profile, even if they are using AI to assist them! And if someone calls you claiming to be from your bank, hang up and call the bank back on a number you can verify as being legitimate.
12. And last, it is an excellent idea to ensure everyone who pays you by wire transfer does everything in this document and more. After all, if they pay all the money they owe you to a fraudster, they might not have enough money left to pay you, too. We’ve seen that happen to some of our best clients; their customers suffered a BEC and transferred money to threat actors, and then couldn’t afford to pay our customers. This is an example of how another company’s breach can hurt your organization, too.

This simple process could save you many hundreds of thousands of dollars, as fraudulent emails requesting wire transfers are becoming too frequent. Review your policy today and have a table-top exercise this quarter.

About the Author

Mike Foster, CISSP®, CISA®
Cybersecurity Consultant and Keynote Speaker
📞 805-637-7039
📧 mike@fosterinstitute.com
🌐 www.fosterinstitute.com

Mike Foster is a leading cybersecurity consultant with decades of experience helping organizations across North America secure their digital assets. He holds CISSP® and CISA® certifications and is the author of The Secure CEO. As the founder of The Foster Institute, Michael has delivered over 1,500 keynote presentations and consulting engagements, equipping executives and IT leaders to strengthen their cybersecurity posture and defend against evolving threats.

The post Wire Transfer Fraud Just Got Smarter – Your Defenses Need to Catch Up appeared first on Foster Institute.

We’re receiving calls from our cybersecurity customers when the IT Team discovers that ordinary users have given third-party applications access to all their organization’s files, email messages, calendar events, Teams chats and channels, and other data.

How can ordinary users have that much power?

By default.

Situation: This configuration affects most companies. While the default settings for your Microsoft 365 system allow your users to approve third-party access, Microsoft recommends the following more restrictive settings to increase security.

The Risk: Without this setting, workers may override protections without oversight and allow any application to access your company data, create and delete files in SharePoint and OneDrive, read and send email messages, edit calendar events, access and modify Teams chats and channels, update user profile information, and perform other tasks. While some applications might need this level of access, it must be granted only after the appropriate authorities, including your IT Team, thoroughly consider it.

Reality Check: This setting catches many IT Teams by surprise. Microsoft is updating its security controls quickly, and it is nearly impossible for IT Teams to keep up with the changes. And when defaults promote ease-of-use over security, like this one, your systems can become at risk quickly without the team realizing it. Know that your IT Team’s level of expertise can be excellent, and situations like this sneak up on them anyway.

Urgent Quick Verification: Your IT Team can quickly access the Microsoft Entra admin center > Enterprise applications > Consent and permissions > User consent settings. There are three options:

• “Do not allow user consent.”
• “Allow user consent for apps from verified publishers, for selected permissions.”
• “Allow user consent for all apps” (the current risky default value)

Update If Necessary: Microsoft recommends you select “Allow user consent for apps from verified publishers, for selected permissions.” Different organizations have different data access needs. Your IT and compliance teams must determine the appropriate level for your situation. Smaller organizations might choose the first option if they don’t want users to expose data to third-party applications without checking with the IT team. Larger organizations with more complex needs often prefer the middle option with careful permission management to take some of the workload off busy IT professionals while providing protection.

Next Step: Your Administrators will also need to specify which permissions are low-impact, as detailed in Microsoft’s article “Overview of user and admin consent.”

Facilitate the Approval Process: Your team can optionally set up an admin consent workflow that users must follow when they want to provide permissions.

Forward this to your friends who are executives at other organizations so they can give their teams this heads-up, too.

The post Executives – Any User Can Accidentally Expose All Your Data Unless IT Changes This Default Setting appeared first on Foster Institute.

AI’s Growing Role in Controlling Devices:

As AI starts entering more workplaces, it is crucial to recognize that AI will become more interconnected with hardware devices in your organization. You might want AI to control room lighting and air conditioning to make it voice-controlled or adapt to the changing activities in the room. AI can also control massive machinery, including robots and high-powered lasers for cutting steel. We’ll all be surprised at how many real-world tangible controls AI can assist. For AI to control devices, computers must drive the machines. Threat actors could exploit weaknesses to disrupt companies, damage equipment, cause expensive delays, and worse.

Machines Driven by Computers, Including Those Running AI and Traditional Computer Control Systems, Introduce a Security Threat:

As AI becomes integral to your operations, remember: Everything from climate control and identity detection to robots and laser cutters hinges on computer systems. AI’s potential is vast, and its growing adoption means more devices linked to our networks.

However, this surge in AI adoption produces an often-overlooked danger that all organizations with industrial controls must consider. The computer systems hosting your AI and traditional solutions can become obsolete faster than the devices they control. Neglecting to update operating systems and using other security controls exposes your organization to cybersecurity threats. While devices might seem to run smoothly, the escalating sophistication of cyber attackers can’t be underestimated.

Executives: Unchain Your IT Pros from the Security Limitations:

Is your IT Team prohibited from applying critical cybersecurity updates to operating systems or upgrading to supported operating systems on workstations that control instruments, lasers, robots, and other machinery? If they are, those workstations pose a security threat to your organization.

Executives must understand that using workstations with old operating systems or without the most recent critical security updates is a significant security risk. In some cases, executives must ask the IT Team if they have encountered this situation. Sometimes, executives are inclined to delegate decision-making to the IT Pros. Instead, the IT team must alert the executives of the pros, cons, and expenses. The executives need to decide if it makes sense to pay to upgrade the applications that control robotics, manufacturing, or other equipment on a network.

Three Definitions:

In case nobody’s explained these terms, it is essential to differentiate between upgrades and updates:

1. Operating System Upgrades: An example is upgrading from Windows 10 to Windows 11. Newer operating systems often have more security features. Microsoft and Apple will naturally be tempted to assign their best and brightest people to develop and update the newest operating systems, so they eventually drop support for old operating systems. Unsupported operating systems are designated EOL (End of Life.) Using an operating system after it is no longer supported is a significant security risk.
2. Operating System Updates, a.k.a. Patches: Security updates are rated by the severity of the security risk and how likely an attacker will exploit the weakness. Critical security updates are the most important to apply. Staying up to date with patches can be a significant struggle in many situations.
3. Application Upgrades: Upgrades to new versions of the software that controls devices such as CNC machines, robotics, lasers, laboratory equipment, instruments, or any other hardware that connects to a computer.

The Shocking Reality:

Some applications that control devices may prohibit operating system upgrades and security patches. The applications might break if the IT team deploys the patches or upgrades the operating systems. Sadly, as reckless as it seems, some companies that create applications to control machinery will no longer provide technical support to your IT team if the operating system on the workstations is upgraded or has security patches. Their software developers may be too busy to create flexible, secure applications and are forced to focus strictly on functionality.

Depending on the application vendor, paying for an upgraded version of a controller application can be very expensive. Fortunately, sometimes, the upgrade charge is reasonable or free. Sometimes, no upgrade is available to permit operating system upgrades or critical security updates.

Another consideration is the risk that upgrading might interrupt manufacturing flow if the upgrading process requires extensive troubleshooting or potentially interrupt production. When equipment operates 24/7, the IT Team is under more pressure since there is no downtime for maintenance.

If the new application’s user interface significantly differs, shop floor personnel might require additional training. Inadequate training can lead to costly mistakes and safety issues. Scheduling training will affect the timing of deploying the new applications.

So, as you can see, when robotics, scientific instruments, lasers, manufacturing, or other equipment works just fine, upgrading the application offers no valuable benefits, and the IT team is busy, we find during audits and security assessments that many manufacturing organizations have outdated operating systems or need critical cybersecurity updates.

The organization’s executives might accept the risk, especially if compensating controls are in place.

Alternative Tactics Increase Security:

Using compensating controls in networks is essential because systems sometimes have significant vulnerabilities before updates are released or installed. Compensating controls are even more essential to help protect workstations if patches are missing.

Compensating controls include, and are not limited to, isolating the machines that control robotics, manufacturing equipment and scientific instruments on a separate network away from your network. That separate network must have limited connectivity to only allow traffic to and from the specific devices necessary and limit the kind of data and how it traverses the network to reduce the attack surface and make it more difficult for a malicious program or third party to access that instance or device. I sometimes refer to this tactic in keynote presentations as creating filtered subnets.

Another compensating control is to harden the unpatched or EOL machines by removing all applications except those essential for the equipment’s operation. Examples of applications that must be removed include browsers and email clients since they are common vectors for successful attacks. If the employees operating those devices require internet and email access, consider adding a separate workstation that is patchable for email and web access.

EDR/XDR (Endpoint Detection and Response / Extended Detection and Response) technology is another helpful control. It involves installing a small program called an agent on each computer. The EDR/XDR agent monitors the system’s software, services, and behavior for any signs that threat actors might have already compromised the computer. If the EDR/XDR tool detects an IoC (Indicator of Compromise), it can respond by interrupting the process. When tuned to avoid false alarms, the best response is to allow the agent to effectively quarantine the workstation from the rest of the network until the IT team can investigate. This helps prevent attackers from spreading to more hosts.

However, it is common for IT teams to succumb to the danger of relying too heavily on EDR/XDR to protect their organization and, therefore, neglect implementing other industry best practices to protect systems. Threat actors often set up EDR/XDR tools on their test networks to find ways to circumvent the protections. So, even if your EDR/XDR tool says everything is safe, it doesn’t necessarily mean threat actors aren’t active in your network.

To combat this, companies commonly conduct yearly red-team exercises, performed by exceptionally skilled IT teams that regularly perform these exercises and know the tricks and practices real-world threat actors use. These exercises are designed to test the effectiveness of the detection and response process. These exercises look for weaknesses in EDR/XDR and help keep the IT team in practice, ensuring they’re better prepared in the case of an attack.

Depending on your budget, if $20/user/month for EDR/XDR is not feasible, know that the other cybersecurity controls in this article, such as careful hardening and segmentation with very restrictive filtering, are much less expensive than EDR/XDR and have little if any ongoing expense. I don’t want to diminish the usefulness of EDR/XDR tools. If you are on a tight budget, unless your cybersecurity policy requires EDR/XDR, you might choose to focus on other compensating controls.

The IT Team must alert the executives about the expense of upgrading applications, isolating the shop floor instances on a separate network, deploying an additional network for web and email access, training users and operators, implementing EDR/XDR tools, and other expenses. Include time estimates along with financial estimates. Then, the executives can make an informed decision, and IT can follow their instructions and ask for support as necessary.

Step-by-Step Guidance for IT Teams:

Acknowledge that it can be a significant challenge and sometimes practically impossible to ensure that all workstations run with a current OS and that all critical security updates are applied. But keep applying updates if possible.

Inform your executives whether your team has time to make these changes. IT teams must alert executives of the time and expense involved. The executives will have options such as adding more IT professionals to augment the team, postponing other projects, or accepting the risk of continuing with unpatched systems or EOL OSs with the compensating controls listed below.

Explore all technical, training, and expense changes before upgrading applications.

Ask your supervisor to delegate the price checking to someone outside the IT department if feasible. Your IT team is very busy, so checking the prices might cause the upgrade to be delayed. It can be time-consuming to check with the robotic, manufacturing, and scientific equipment vendors to find the pricing for upgrades to their applications that control machinery.

Investigate more than the pricing. Ask about changes in the upgraded applications affecting the user interface and user experience. Ideally, the upgraded application software operates similarly and has the same interface. Unfortunately, some manufacturers significantly change the user experience when they upgrade their applications.

If users will need training, identify a trainer.

Determine how scheduling the training will affect the deployment timing.

Involve executives in decision-making and send them regular reports about the project’s progress.

Implement compensating controls on the workstations because of the high cybersecurity risk of missing critical patches or using EOL OSs. Compensating controls aren’t a replacement for missing patches, but the controls can help tremendously.

Remember that attackers can exploit security risks long before they are discovered. Only when the vulnerability is discovered will the operating system and application developers know to create or release patches to seal that security hole. Refrain from relying on patches as your sole security control for application software and operating systems.

Strongly consider isolating shop floor machines on a separate subnet, especially those you are prohibited from patching and those using EOL OSs. Isolate that subnet completely with an air gap or utilize aggressive filtering at the switch or router to limit traffic to only the required source, destination, ports, and protocols.

Additionally, hardening the workstations against attacks is strongly recommended.

Remove or restrict web and email access. This is one of the most effective ways to harden workstations, as web and email are two of the most common vectors for malware.

If the workers at those devices need access to the web and email, consider deploying a separate workstation to their station they can use for web and email. If feasible, that workstation should not be on the shop floor network. If you put those workstations on the equipment network, you would need to allow email and web traffic, and modifying access control lists to allow more sources, destinations, ports, and protocols can significantly reduce the security you would otherwise introduce to the equipment control network. Strive to exclude TCP ports 80 and 443 on the AI device network while allowing full functionality of the AI and other computer-controlled devices.

Be sure you limit the sources of inbound and destinations of outbound network traffic to the absolute minimum. If you need to run new cables to facilitate the additional workstations for web and email at the workers’ stations, then running new cables might be a significant investment. Deploying a WiFi network for email and web access might be more economical. Keep the key secret. If you share the WiFi password, workers might connect other devices to the equipment network and compromise security. Completely blocking email and web access and access to external IP addresses will hamper the workers on the manufacturing network from exposing the hosts to many threats.

Strongly consider using EDR/XDR tools, along with the Red Team Exercises, to help ensure the configurations’ effectiveness and allow your IT team to prepare for actual emergencies.

Summary:

Protect workstations that control hardware such as robotics, pharmaceuticals, lasers, and scientific instruments, regardless of whether they utilize AI. This helps ensure the safety and operability of your systems, protecting your organization and workers.

Subscribe to maximize your executive potential with Foster Institute’s E-Savvy Newsletter, packed with practical IT security solutions and actionable strategies for success: https://fosterinstitute.com/e-savvy-newsletter/

(Image source: Bing. Learn more at [Bing.com].)

The post An Executive’s Handbook to Securing Modern Manufacturing Networks and Robots, AI or Not appeared first on Foster Institute.

1. Assemble Your AI Implementation Team

• Choose a person or team to lead AI implementation
• Include representatives from leadership, legal, and IT

2. Educate Your Team on AI Applications

• Watch the 7-minute educational video showcasing 23 Business Uses for Chatbots in 7 minutes
• Alternatively, schedule a “lunch and learn” webinar or workshop to explore practical AI uses

3. Collaborate and Brainstorm

• Discuss insights from the video/workshop
• Identify potential AI applications relevant to your business

4. Explore Multiple AI Tools

• Test various chatbots (e.g., Perplexity, Anthropic Claude, ChatGPT, Microsoft Copilot, Google Gemini)
• Consider paid plans, privacy of sensitive information, and the ability to create custom chatbots
• The setting to make the model better for everyone means your data will be less private

5. Review Industry-Specific AI Tools

• Investigate AI solutions tailored to your industry
• Consult a curated list of AI tools for practical options

6. Consult with Your IT Team

• Discuss potential added support requirements
• Address concerns about job complexity
• Develop strategies to integrate AI without overburdening your IT team

7. Engage Your Legal Counsel

• Address privacy concerns
• Review automatic ingestion vs. uploading of data for different AI tools
• Analyze privacy and security policies of prospective AI solutions
• Consider internal data access and permissions per user or department
• Evaluate potential implications for mergers and acquisitions
• Consider that data from recordings of meetings will be discoverable during the due diligence phase

8. Assess User Access Control

• Discuss with IT about controlling access to AI tools
• Implement measures to manage access to AI on company networks and devices

9. Establish an AI Ethics Framework

• Develop guidelines for ethical AI use within your organization
• Address issues like bias, fairness, and transparency

10. Create a Data Governance Strategy

• Establish protocols for data handling, storage, and access in AI systems
• Ensure compliance with relevant data protection regulations (e.g., GDPR, CCPA)

11. Implement Security Measures

• Work with IT to set up necessary security protocols for AI systems
• Consider encryption, access controls, and monitoring systems
• Utilize sensitivity labels and permissions to limit employee access by role, etc.
• Establish data retention time policies

12. Plan for Ongoing Monitoring and Evaluation

• Establish KPIs to measure the effectiveness and impact of AI implementation
• Set up regular review processes to assess and adjust AI usage

13. Develop a Crisis Management Plan

• Prepare for potential AI-related incidents or breaches
• Outline response procedures and communication strategies

14. Draft an AI Policy

• Based on input from IT and legal, create a comprehensive AI usage policy
• Define the scope and purpose of the AI policy
• List approved AI tools and outline acceptable use cases
• Establish guidelines for data handling and privacy compliance
• Specify required security measures for AI use
• Address ethical considerations like bias and fairness
• Clarify ownership of AI-generated content and intellectual property
• Outline required AI literacy training for employees
• Define monitoring procedures and consequences for policy violations
• Set criteria for selecting and evaluating AI vendors
• Provide a framework for responding to AI-related incidents
• Establish a schedule for reviewing and updating the policy

15. Conduct User Training

• Train employees on approved AI resources
• Educate staff about the new AI policy, including ethics and protecting sensitive information
• Encourage users to look at their daily tasks and see which tasks AI might streamline or improve in other ways

By following all these steps, you’ll be more prepared to deploy AI in your organization while addressing some essential security, legal, and operational concerns. Successful AI implementation is an ongoing process requiring continuous attention and adaptation. AI is here to stay; you want to be thoughtful sooner to avoid costly problems later.

The post AI Implementation Roadmap: The Executive’s Guide to Avoiding Million-Dollar Mistakes appeared first on Foster Institute.

While VPNs have long been a staple for securing connections in coffee shops and other public networks, by integrating advanced security measures, you can fortify your organization’s defenses and stay ahead of emerging threats.

The goal of this article is to empower you with insights and strategies to bolster your IT team’s efforts. By equipping them with cutting-edge tools and knowledge, you can elevate your organization’s cybersecurity posture. Remember, cybersecurity is a dynamic, ever-changing domain that demands continuous adaptation and vigilance.

Introduction:

A VPN, a virtual private network, is designed to provide privacy of traffic across untrusted networks and through the Internet by encrypting data between the user’s device and the company network. It functions as a network connection from one point to the other. In the case of a remote access VPN, those two points are the user’s laptop and your company’s VPN terminus in your data center or elsewhere.

Some companies commonly allow or encourage remote users to connect via VPNs while out of the office, under the impression that the VPN alone protects remote users from security risks on a public network.

While a VPN can protect data in transit, it does not protect against all threats on the local network, such as those present on a Wi-Fi network at a public location. The evolving nature of cybersecurity threats means additional measures are necessary.

The often-overlooked risk is that when connected to a public network and using a VPN, the user’s laptop remains exposed to network sweeps, vulnerability scans, and other network attacks. VPNs still play an essential role by encrypting traffic.

Ideally, users should avoid connecting to public networks. If connecting to a public network is necessary, it is crucial to implement additional cybersecurity controls, such as using a properly configured physical hardware firewall, to protect against network attacks.

Real-World Ways Attackers Breach VPN Users on Public Networks:

Here are three notable examples of how threat actors attack workers who connect to a public network using a VPN:

Attacking a VPN Client via Airport Wi-Fi:

Advanced Persistent Threat (APT) groups are targeting enterprise VPN vulnerabilities. A recent example is the 2024 VPN attacks against Ivanti. For example, an employee connects to their corporate network using vulnerable VPN software at an international airport. Attackers exploit the VPN vulnerability, bypass encryption, and install malware on the employee’s laptop. This allows them to infiltrate the company’s network, stealing proprietary manufacturing processes and trade secrets, causing significant financial losses and requiring a major incident response.

Attacking and Breaching VPN Users on Public Library Wi-Fi:

A severe security flaw known as PrintNightmare can be exploited by threat actors against computers, even those of users connected to a VPN over a WiFi network. A typical instance is an employee of a prestigious law firm working remotely from a public library, using the corporate VPN to access internal resources. Attackers on the same network exploit the PrintNightmare vulnerability, executing malicious code on the employee’s laptop. This breach allows the attackers to move within the firm’s network, accessing confidential client information and case details. This leads to legal repercussions and reputational damage, prompting a thorough overhaul of its security practices.

Tech Company Infiltrated via Coffee Shop Wi-Fi:

Threat actors can utilize Mirai malware that spreads to devices on networks, including public WiFi networks, affecting users even when they are utilizing VPNs. A case in point is an employee of a tech company connecting to their office VPN from a coffee shop’s public Wi-Fi network. The network contains compromised devices infected with Mirai malware. The employee’s laptop, running outdated Windows, becomes infected. The malware uses the VPN connection to infiltrate the company’s network, leading to data theft and unauthorized access to sensitive projects. The company must enforce strict security protocols and undergo a comprehensive network data discovery and clean-up.

The Core Issue with VPNs on Public Networks:

VPNs play a vital role in encrypting data and maintaining privacy by encrypting data in transit. They do not fully protect you from local threats found on public networks like those in coffee shops, hotels, or airports. Complementing VPNs with additional tools, such as travel routers or cellular hotspots, as explained below, can significantly mitigate these risks.

Simplifying the VPN Concept:

Some think of a VPN as a tunnel through the Internet that provides a network connection. This tunnel can allow you to work as if you were connected in person at your office, but remember, the VPN provides privacy for your data but not comprehensive security for your laptop.

Understanding the VPN Paradox to Prevent Breaches

The common belief that a VPN alone guarantees security in a coffee shop scenario is not only incomplete – it’s potentially dangerous. Addressing this belief is crucial for your company’s cybersecurity.

The Danger of a False Sense of Security

When workers believe that a VPN makes them secure, they may unknowingly increase their risk by connecting to insecure networks, thinking they are safe. This false sense of security can lead to substantial cybersecurity incidents within an organization.

Solutions for Executives to Consider:

Two relatively simple solutions to help remote users be secure are to prevent them from connecting to the coffee shop, hotel, or other network and connect with a mobile phone or cellular hotspot. Alternatively, the user can be provided with and trained to use a properly configured small hardware firewall to help protect their laptop from the risks of the public network.

Addressing these challenges with your IT Team can strengthen your defenses against sophisticated cyber threats. Implementing portable hardware firewalls or alternative connectivity options can bolster users’ security as they work remotely.

Introduction to Ways to Help Keep Remote Users and VPNs Secure:

What follows is detailed information, described in plain English, for executives and IT Pros who want more information about the risks and how to protect remote users connecting through a remote access VPN connection. Allowing users to use a VPN on a public network could result in a breach at your organization, hence the reason for this document.

Actionable Steps:

This article’s purpose is to highlight the potential security enhancement provided by eliminating the incidence of users connecting to the public network or, if they do connect, using a hardware firewall to isolate them from the public network.

A threat actor doesn’t need to be in the coffee shop; the attacks can originate from an innocent user’s laptop that they do not realize has been compromised by a threat actor or a malicious program or service running on another computer connected to the guest network.

To avoid connecting to the public network, users can use their properly configured phone or a cellular hotspot to connect from the coffee shop, hotel, or other public area. Cellular networks can have security concerns, too. Fake cellular towers or insiders working at the cellular company are examples of threats, but cellular connections are arguably more secure than public WiFi networks. The benefit of this method is how quick and convenient the connection is. Drawbacks include the need for a reliable cellular signal and potentially increased recurring data charges by the cellular carrier. Additionally, if the user exceeds the carrier’s data limit for the month, the carrier might throttle (slow down) the user’s data rate for the rest of the month.

If the user doesn’t have access to a cellular connection, wants to avoid wireless carrier fees, or wants to connect to the public network for any other reason, they could use a portable firewall, commonly known as a travel router, to help isolate them from the risks of the public network. Useful travel routers are available for a one-time purchase for less than $100. Keep in mind that the user’s data rate will be restricted to the data rate of the public network or slower if the user uses a VPN across the public network. Public network speeds can vary greatly, as can cellular data speeds, even during different times of day.

It is essential to note that while travel routers and firewalls can help mitigate many risks, they must be appropriately configured to be effective. Their configuration screens can be complex, potentially leading to insecure configurations. A user with an improperly configured travel router connection is dangerous since the user might have a false sense of security. It is essential to involve your IT Team in the planning, configuring, and deploying travel routers, as well as the necessary training for users to use the devices securely.

Using a travel router requires additional user training for them to complete three steps. After powering on the firewall device, the laptop user must first connect their laptop to the travel router as if it were a cellular hotspot or another Wi-Fi connection. This is a relatively simple process and will likely be the same routine for the life of the travel router. Many travel routers accept wireless and wired connections. The second step is for the user to use a window in their browser to connect the travel router to the public network’s name. This step is potentially precarious due to the complexity of the configuration screen on some travel routers. Your IT Team must be involved in creating precise documentation, user training, and configuring the devices. Third, the user goes through the process of logging into the public network if the public network requires some kind of login process, such as a room number and last name at a hotel. If the user doesn’t see the hotel login screen, they can open a new tab in their browser to neverssl dot com or nossl dot com, and the hotel login screen will usually pop up.

Typically, the public network recognizes the firewall as if the user is connected directly from their laptop. Now, the user does their work as usual. The travel router acts as a firewall between the laptop and the potentially risky public network.  The connection process is usually speedy if the user frequents the same public hotspots. Even at a new network, if the user is trained, going through the three-step process usually takes five minutes.

VPNs are essential for encrypting data and protecting privacy, including the sites users visit while connected to a network. Users wishing to use a VPN to control privacy can use the VPN client on their laptop as usual. This applies whether the user uses their cellular connection or a travel router. Many travel routers include a VPN feature, too. Secure Access Service Edge (SASE), pronounced sassy, is a technology that provides a more comprehensive approach to secure access that can sometimes replace traditional remote connection strategies. Everything in this article about protecting a user’s laptop from security threats against the public network connection still applies in SASE.

Technologies that sound like alphabet soup and are explained below, such as IDS (Intrusion Detection System), IPS (Intrusion Prevention System), EDR (Endpoint Detection and Response), and XDR (Extended Detection and Response), can help protect the laptop against threats potentially lurking on public networks. However, attackers also obtain these protection tools. They are constantly probing for weaknesses they can exploit, so you must continue to use additional tools and techniques to protect your organization in a layered approach.  And the necessity of maintaining and monitoring those technologies can create a significant burden on your IT Team. More on that below.

Multi-factor Authentication is Not a Shield:

Multi-factor authentication (MFA), such as a text message or authenticator app, is an essential part of your cybersecurity strategy that you must adopt immediately if it isn’t already in use. While MFA helps secure the authentication process, it does not address network attacks or other ways that could allow an attacker to compromise the laptop. If attackers compromise the laptop, they can bypass MFA by utilizing the user’s active session. The attacker can wait for the authorized user to log in using MFA on their behalf, and then the attacker can have the same level of access as the authenticated user. The point is that MFA is an essential, if not mandatory, cybersecurity control, but it does not protect the user against network attacks on a public network.

For those of you familiar with my articles, you know my focus is to present cybersecurity topics in non-technical terms. The following section is more technical than usual. Consider passing this along to your IT team if they want more technical details.

The Technical Details to Protect Yourself and Your Organization

In the next portion of this document, we’ll explore configuring the data center’s networking environment and the remote hosts to make using a remote access VPN safer.

Quick Definitions Used in this Document

• Remote Access VPN: This type of VPN allows individuals to connect to their company’s network, unlike site-to-site VPNs, which connect two office locations or data centers.

• Unmanaged Computer: A computer not maintained by your IT professional who uses specialized knowledge and tools. These endpoints are more vulnerable.

• Public Network: Think coffee shops, cruise ships, resorts, hotels, airports, etc.

• MFA (Multi-factor Authentication): This adds a layer of security for the authentication process beyond just passwords. Examples of MFA include a text message or an authenticator app on your phone. However, MFA doesn’t shield you from threats of malicious signals on a network scanning your laptop for vulnerabilities and security misconfigurations.

The Core Issue with Remote Access VPNs

A significant concern with remote access VPNs is that attackers gain the same access as the remote user if a remote host is compromised.

Protective Strategies

Please keep reading to learn how to safeguard your network and host computers, ensuring they don’t become conduits for attackers to infiltrate your network.

Part 1: Fortifying User Devices Against Infection: Such as Protecting the User at the Coffee Shop

While a VPN doesn’t inherently secure a device on a public network, the following measures can bolster your device’s security:

• Fundamental Cybersecurity Controls on Endpoints: Use core cybersecurity controls for laptops. For example, regular critical security updates should be applied soon after release. To help stop attacker programs, restrict what applications can run using application control. Prevent users from installing applications by controlling their permissions or using third-party tools. Restrict enabled services to essential functions only that the user would use. Close all open ports. Follow other cybersecurity best practices.

• Endpoint Protection: Some organizations deploy Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS) on remote users’ devices. Using Endpoint Detection and Response (EDR), Extended Detection and Response (XDR), or Managed Detection and Response (MDR) agents on the laptops can increase security by monitoring for malicious behavior known as an indicator of compromise (IoC). EDR/XDR tools provide many benefits, including continuously monitoring network devices and watching for suspicious activities or evidence that an attacker is compromising a system. EDR/XDR is designed to identify, isolate, and mitigate threats. Response options include stopping the threat actor by shutting down processes and services or, as a more comprehensive response, quarantining the remote device until the IT Team can investigate. The thorough response would be for the IT team to erase and reload the workstation if there is any indication that the device was compromised. Some organizations use automated means of initializing workstations to facilitate this reloading process. IDS, IPS, EDR, and XDR must be effectively monitored, managed, and updated. One way many organizations ease the burden on their internal IT Teams is to utilize a third-party MSSP to perform these tasks. Managed Detection and Response (MDR) means you pay a third-party provider to manage your EDR/XDR. One key point to remember is that attackers can obtain these protection tools, too, and are always looking for ways to bypass the tools. We perform Red Team Exercises at companies to test the capabilities of the EDR and XDR protections. Do not make the common mistake of letting your guard down in other security areas after implementing EDR or XDR.

• Shielding from Public Networks: Equip remote users with a filtering device, such as a portable firewall or travel router, to act as an intermediary between their laptop and the public network. In some cases, these devices can establish VPN connections directly to the data center, offering an added layer of security since the laptop is shielded from the network. Proper configuration of travel routers is crucial. They should be set up to help ensure secure connections, such as using the most secure Wi-Fi security protocols, regularly updated with the latest firmware to protect against vulnerabilities, secure configuration policies, and other steps to enhance security.

• Alternative Connectivity: When a secure filtering device isn’t available, it is recommended that remote users connect via a cellular network to avoid the risks of public Wi-Fi. When you are disconnected from public Wi-Fi, you are also disconnected from potentially harmful devices on that network.

By implementing these practices, you can significantly enhance your security posture against the potential risks associated with remote VPN access.

Part 2: Securing Your Organization’s Network Against Compromised Users’ Laptops on a Remote Access VPN: Protecting the Organization from the User at the Coffee Shop

To help prevent unauthorized network access through a compromised VPN user’s device, consider these strategies:

• Restricted Access: Restrict VPN use to company-issued computers only. Your IT team must manage robust security measures like patch management, EDR/XDR solutions, stringent configurations, and more.

• Ban Personal Devices on VPN: Consider prohibiting the use of family or personal devices for VPN access. These unmanaged devices are more susceptible to malware, which can spread to your corporate network.

• Network and Firewall Strategies at the Data Center:

• Server Segmentation: Isolate RDS and file servers in separate network segments or VLANs. This approach allows for tailored security policies and mitigates the spread of potential breaches.

• VPN Traffic Isolation: Create a dedicated network segment for VPN traffic to act as a buffer zone, keeping incoming connections separate from the core network.

• Firewall Implementation: Place firewalls strategically to monitor and control traffic between the VPN and other network segments. Implement Firewall Access control Lists (ACLs, a.k.a. Firewall Rules) to define and enforce permissible traffic types, sources, and destinations between these segments.

• Traffic Protocol Rules: Specifically, allow only necessary protocols like RDP and file-sharing through the VPN to the designated servers, using protocol filtering and port restrictions to enforce this.

• Session Management: Configure firewalls to limit session numbers and durations, reducing the risk of prolonged unauthorized access.

• Deep Packet Inspection: Employ firewalls capable of DPI to scrutinize traffic content, ensuring it aligns with expected patterns.

• Vigilant Monitoring: Set up logging for all traffic passing through the firewalls and regularly review these logs for anomalies.

• Firewall and Infrastructure Firmware Patches and Updates: Keep firewall firmware and configurations up to date to counter emerging threats.

• Regular Audits: Conduct periodic audits to validate the effectiveness of your security measures.

Part 3: Don’t Provide an Easy Path for Attackers to Access Your Files

• Omitting Drive Mapping to Remote Hosts: Consider alternative solutions for file sharing rather than mapping server drives for remote VPN users. If you share a drive through the VPN and an attacker compromises a host, the attacker can access the drive. The mapping makes it easier for the attacker to encrypt or delete files on your servers.

• If you won’t map drives, and the remote users need direct access to the exact instances of the files local users have, strategies include:

• Cloud Storage: To avoid drive mapping, the files could be stored in a cloud location, from Microsoft or a third-party solution, for all users to access.

• File Synchronization Considerations: If cloud storage is not an option, and the files must be stored on traditional servers for local users, some form of file synchronization could be utilized to copy the files to a hosted location accessible to remote users. This would be effective if remote users only read, not edit, the files. If multiple users edit files simultaneously, data inconsistencies are likely. The synchronization would need to consider the possibility of a local user editing a file while a remote user editing a file in the shared storage environment. In this case, the synchronization process would need to know which saved version to preserve and what to do with the conflicting version. It should also alert the users that they could have lost their edits.

VPNs and MFA: A Misunderstood Safety Net

In my experience, some well-meaning IT professionals proclaim, “If you are in a coffee shop, you can protect yourself from the security risks if you use a VPN backed up with MFA.” This well-intentioned advice, however, needs a deeper dive to uncover the whole truth.

MFA and VPN Security:

Multi-factor authentication (MFA) significantly enhances security by helping ensure that only authorized users can access VPNs. However, it’s crucial to understand that while MFA helps in securing the authentication of users, MFA does not safeguard against attacks exploiting vulnerabilities on devices connected to the public network. For example, MFA cannot protect against an attacker scanning for open ports on a laptop connected to a compromised Wi-Fi network. These attacks can occur independently of the authentication process that MFA protects, highlighting the need for comprehensive endpoint security measures and robust authentication protocols.

To guard against a wide range of threats, organizations must implement a layered security approach that includes strong authentication measures like MFA and endpoint protection strategies. This should involve regularly patching and updating software and operating systems, closing unnecessary ports, employing host-based firewalls, and continuously monitoring suspicious activities. By addressing device-level security with authentication controls, organizations can provide a more robust defense against attackers’ diverse tactics.

Consider Alternative Solutions for Remote Access:

A Remote Desktop Services (RDS) gateway can allow remote users to access internal network resources without requiring a traditional VPN connection. This approach can reduce the network’s attack surface by not providing a tunnel for attackers to exploit. However, RDS gateways come with other security challenges and require robust configuration and protection. User devices using RDS still need robust security measures to help protect against potential compromises, including an attacker compromising a remote user’s laptop.

Similarly, allowing remote users to operate cloud-based virtual desktops, such as those provided by Windows 365, can eliminate the need for drive mappings to the remote user’s computer.

However, it is essential to recognize that if the remote host system—whether a cloud-based virtual desktop or a machine accessed via an RDS gateway—is compromised, an attacker may still be able to hijack a user’s session. This potential risk underscores the necessity for robust security measures, including continuous monitoring and response strategies, to quickly detect and address any such compromise.

In Conclusion:

VPNs provide significant security benefits by encrypting data, which is crucial for privacy and protection against eavesdropping. However, they should be part of a broader security strategy that includes secure endpoints and awareness of public network risks. An attacker, physically present in the coffee shop or remotely controlling another patron’s device, could exploit open ports, unpatched vulnerabilities, or other security loopholes. This is where malware, often lurking unnoticed, can exploit weaknesses on your laptop.

Threat actors rely on the misconception that using a VPN is the only cybersecurity control necessary to protect users on public networks. Some of the most significant cybersecurity predictions relate to threat actors attacking VPNs. Additionally, using a VPN with drive mapping is a common practice for remote work but includes significant inherent risks.

Bolster your organization’s security by empowering your users to avoid connecting to a public network and consider some form of securely configured cellular connection. If they connect to the public network, consider facilitating their security with a properly configured hardware firewall to help isolate their laptop from the public network.

Combining multiple tools and best practices is essential for a layered security approach. As always, regular user training is an essential component of keeping your organization secure.

Note: This document provides guidelines for enhancing remote access security through VPNs and alternative methods. It does not address the security specifics of the VPN client application or browser plugins. Readers are encouraged to follow cybersecurity best practices for those components as well.

Disclaimer: The information provided in this blog is for general informational purposes only. Technology changes constantly, and some of this information might become obsolete or incorrect. We do not endorse or receive compensation for mentioning products, services, or brand names. Any outbound links provided are for your convenience and to get you started, but we cannot guarantee the security or safety of those external websites. Conducting your research and making an informed decision about any products or services mentioned here is essential. We shall not be held responsible for any actions taken based on the information provided.

The post What Executives Must Know: VPNs and Public Network Security appeared first on Foster Institute.

File Uploads Made Easy

ChatGPT Plus allows you to upload various types of files for a more integrated interaction. Whether it’s a PDF document for analysis or an image of an object for detailed inquiries, the process is straightforward. This feature eliminates the need for extensive copying and pasting, enabling ChatGPT to analyze your data in its intended format for more accurate responses.

Bypassing Prompt Length Limitations

Encountered the “The message you submitted was too long” error? Uploading a file is an effective workaround. Be mindful, though, if your file is exceptionally large, it might exceed the token limit, affecting ChatGPT’s ability to process the entire content. As technology advances, expect to see expansions in these limits.

Versatile File Types and Actions

• Documents (.pdf, .docx, .txt): Ideal for generating summaries, updates, translations, and more. ChatGPT’s proficiency in extracting information from PDFs is particularly impressive. For instance, try asking, “Address challenges with solutions” after uploading a document.
• Images (.jpg, .png, .gif): Upload images for descriptions, analysis, or creative storytelling. Imagine uploading a photo of your pet and asking, “Generate an image of my pet sitting in First Class on a plane.” Mobile app users can directly take and upload pictures.
• Spreadsheets (.xls, .xlsx): While capabilities continue to grow, basic functions like finding, counting, and analyzing data work smoothly. If you encounter difficulties, consider converting your spreadsheet to a PDF for more efficient processing.
• Presentations (.ppt, .pptx): Share your slides for summaries and improvement recommendations. Converting to PDF might enhance ChatGPT’s understanding.

How to Use the File Upload Feature

Utilize the ‘Upload’ button in the ChatGPT interface to interact with your chosen file. This feature is accessible both in the browser and mobile app versions. For more advanced capabilities, ChatGPT Plus members can enable Advanced Data Analysis in the Settings under Beta features.

Privacy Considerations

Prioritize your privacy when using this feature. ChatGPT offers options to disable chat history and assures not to use your data for training purposes. Stay informed by checking OpenAI’s Data Controls FAQ and additional insights on chatbot privacy.

Experience the Enhanced ChatGPT

The file upload feature significantly broadens ChatGPT’s utility, catering to educational, professional, or exploratory needs. Dedicate a few minutes to import non-sensitive files and experiment with various prompts. You’ll discover its strengths and limitations, pushing the boundaries of AI interaction.

Comparing With Other Platforms

At a subscription fee of twenty dollars per month, ChatGPT Plus stands out for its file upload capability. Yet, other chatbots, including free versions like Perplexity.ai and Google Bard, offer similar features, indicating a trend towards standardizing file uploads across AI platforms.

Subscribe to maximize your executive potential with Foster Institute’s E-Savvy Newsletter, packed with practical IT security solutions and actionable strategies for success: https://fosterinstitute.com/e-savvy-newsletter/

(Image source: DALL-E via ChatGPT Plus)

The post Have You Explored ChatGPT Plus’s File Upload Feature Yet? appeared first on Foster Institute.

Keep Personal Matters Out of Company Email:

Attackers sometimes gain access to websites used for personal activities like watching movies, paying utility bills, personal checking accounts, and more. Bad actors leverage this information to craft convincing email messages, enticing users to click on malicious links or open harmful attachments.

If your workers avoid using their business email for personal activities like online shopping or personal social media, then a phishing email related to these topics would immediately stand out as suspicious. They are much more likely to recognize the message as fake.

On the other hand, if they have used their business email for personal tasks like online shopping or social media, they’re at a higher risk for spear phishing when an attacker knows details about their activities. If they receive an ‘urgent message’ related to these personal tasks in their business email account, they might be more easily deceived into thinking it’s legitimate.

Worsened Notification Burden:

Another drawback of using work emails for personal matters is the heightened risk of exposing sensitive personal data. If employees use their work email to conduct personal business, such as insurance applications or other private matters, the likelihood of sensitive personal data residing on your servers increases. In the unfortunate event of a data breach, their sensitive information could necessitate you sending notification letters to affected parties, increasing your company’s expenses and vulnerability to potential lawsuits.

Personal Webmail on Company Devices is a Significant Security Risk:

The above situations refer to workers using their work address for personal use. But you must also address the issue of allowing employees to access personal webmail on company devices. IT departments have no control over the security of these personal email accounts. While your business email systems can have robust filters to block malicious links and attachments, allowing workers to access personal webmail sites can significantly reduce the overall security of your network, making your organization’s security as weak as the weakest personal email account.

To Enhance Security:

1. Ask your IT Team to limit email access on company devices to approved business email servers only.
2. Continuously remind employees to use their company email address exclusively for work-related matters.
3. Ask your IT team to block access to all webmail sites except those essential for business. If employees need to access personal email, they should do so on their personal devices. If connectivity is an issue and you must allow employees to connect personal devices to your Wi-Fi, use a separate “guest” network instead of the primary company network.

Conclusion:

By drawing clear boundaries between personal and professional email usage, you can reduce the risk of cyber threats and help protect your company and your employees. Please tell your associates and friends; spread the word.

Subscribe to maximize your executive potential with Foster Institute’s E-Savvy Newsletter, packed with practical IT security solutions and actionable strategies for success: https://fosterinstitute.com/e-savvy-newsletter/

(Image source: Bing. Learn more at [Bing.com].)

The post Executives, Guard Your Company’s Future: Why Ensuring Email Boundaries is Crucial for Security. appeared first on Foster Institute.

The good news is Dell’s not detected any attacks in the wild. However, now bad actors have a new challenge, a puzzle to solve, a game with payoffs for them, and potential tragedy for their targets. Dell urges companies to install the update immediately.

Executives decide whether to accept the risk or provide teams with time to implement the two-step solution from Dell.

To exploit the security weakness, bad actors might effectively social engineer at least one user to click on a malicious link, open an infected attachment, or grant access to someone pretending to be a technical support professional.

Alternatively, the attacker can steal or guess the user’s password. For example, we are auditing a business right now and discovered the following passwords: Password, Password!, Password1, and Password123. Users choosing those passwords is NOT the IT professional’s fault.

Please forward this to your associates so they know that Dell is urging all affected customers to address this problem immediately.

Time is your team’s most precious asset, and this fix takes time. Discuss ways they can postpone other projects to address the problem before attackers start exploiting the vulnerability to potentially:

• Shut down systems
• Spread ransomware
• Threaten to expose stolen data
• Delete your data stored in the cloud or on your servers
• Or otherwise devastate organizations

Dell recommends acting immediately: dell.com/support/kbdoc/en-us/000186019/dsa-2021-088-dell-client-platform-security-update-for-dell-driver-insufficient-access-control-vulnerability

During the recent Pwn2own competition, a team demonstrated exploiting Exchange servers. With the new knowledge, attackers infiltrated servers before IT Professionals could apply patches. The Dell vulnerability could have the same outcome. Keep in mind that there are vastly more Dell computers in businesses than there are on-prem Exchange servers.

Interestingly, the vulnerability only exists if the IT Team is applying Dell’s patches and updates. However, if your team is not using Dell’s other security updates, that is a problem too. They might not have enough time and need your understanding when they need to reprioritize their tasks, have additional help, or automate some processes they must do manually.

The post Urgent Security Patch for Hundreds of Millions of Dell Computers appeared first on Foster Institute.

–> ONE: Ask your IT team, “Do we still have Microsoft Exchange Server email software installed anywhere?”

If they answer affirmatively, even if they’re already moving to the cloud, you must continue:

–> TWO: Ask them, “What can I take off your plate or postpone so that you can immediately test and deploy the patches to the Exchange Server right now?”

Essential: Applying security updates to your Exchange server does not resolve the issue if your organization is already compromised. There might be a small program on your system quietly waiting for an attacker’s commands.

To help determine if you are already compromised: https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/#scan-log

If your team cannot update immediately, send them here: https://github.com/microsoft/CSS-Exchange/tree/main/Security

–> THREE: Say, “The emergency is too great to postpone. Later, let’s discuss the pros and cons of moving email to the cloud.”

Pros include eliminating one server and associated headaches. Often, online email is better for remote workers too. But you could lose some integration features you have now, for example, an on-site phone system tied into Exchange. Because saving money and streamlining is essential, online Exchange is often less expensive.

The blog posting https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/#scan-log has a plethora of other information and guidance for your team related to the updates. Some organizations are experiencing errors after applying the security updates. For example, some learned they must install the updates from an elevated command prompt window. Microsoft provides more guidance:

https://msrc-blog.microsoft.com/2021/03/05/microsoft-exchange-server-vulnerabilities-mitigations-march-2021/

https://support.microsoft.com/en-us/topic/description-of-the-security-update-for-microsoft-exchange-server-2019-2016-and-2013-march-2-2021-kb5000871-9800a6bb-0a21-4ee7-b9da-fa85b3e1d23b

https://support.microsoft.com/en-us/topic/description-of-the-security-update-for-microsoft-exchange-server-2010-service-pack-3-march-2-2021-kb5000978-894f27bf-281e-44f8-b9ba-dad705534459

The post Three Essential Questions to Ask Your IT Team Today Because of the Massive Exchange Attack appeared first on Foster Institute.