Your iPhone and iPad will prompt you to upgrade to the new iOS 11 soon. Having the most recent version of iOS is one strategy for being secure. Like Google does with the Android OS, Apple focuses on keeping the newest iOS free from security vulnerabilities.

But, with Apple’s new iOS 11, you need to be aware of a feature that might cause you to believe you are safe from Wi-Fi attacks when you are not.

Mobile devices are vulnerable to Wi-Fi attacks, and people who are serious about the security of their phone or tablet choose to turn off Wi-Fi except when they are at their office, home, or somewhere else they know they want to use W-Fi.

In the new iOS, turning off Wi-Fi in the Control Center does not really turn off Wi-Fi. Apple says this is a feature that keeps you from losing connectivity with Wi-Fi devices like an Apple TV or a Pen. But the practice of Apple leaving Wi-Fi on without your knowledge has created some discontent in some of us who want to help you be as secure as you want to be.

If you turn off Wi-Fi in the Control Center, your device will indeed disconnect online connections to Wi-Fi networks, at least temporarily, so it appears to work.

But Apple says that, as soon as the user walks or drives to a new location, the auto-join feature will turn itself back on without notifying or asking the user’s permission. I tried that, turning off Wi-Fi in my Control Center, and then drove a few miles just to see. To my happy surprise, the Wi-Fi did not re-enable. However, a little time later in my office, I noticed that the Wi-Fi had turned itself on again on its own.

Apple also says that auto-join will come on again automatically at 5 am. Sure enough, I turned off Wi-Fi in the Control Center at night, and when I checked the icon in the Control Center at 5:15am, the Wi-Fi was re-enabled.

You can read about this unexpected feature, on Apple’s own website: https://support.apple.com/en-us/HT208086

You will be OK, as long as you know that if you want to turn off Wi-Fi, you have to go to the settings menu and turn Wi-Fi off there.

Please forward this to anyone you know who knows that turning off the Wi-Fi on their phone can increase their safety from attackers. Help them know that the only way to turn off Wi-Fi is to go to settings, not to the easy to reach control center.

The post New iPhone and iPad iOS 11 Can Quietly Override Your Attempt to Be Secure appeared first on Foster Institute.

Instructions for Windows and Apple home users are listed below the numbers. For organizations, here are 10 Steps To Avoid Incidents Including the Massive Ransomware Attack:

1. The reality is that most organizations are missing critical security patches and there is a very strong likelihood that yours is too.

2. Provide your team with extra time, and perhaps additional personnel, to test and then deploy patches ASAP. Some organizations are adding a new IT professional to their team whose sole responsibility is to manage patches. If the patch fails testing, then time must be invested to resolve the issue or implement compensating controls.

3. Prioritize critical security patches for the operating system, all the browsers, Flash, Java, your PDF Reader, and Microsoft Office. They are usually the easiest to attack and form your first line of defense.

4. Many IT teams are very reluctant to apply patches for fear of breaking your systems that are already running. Help remove their fears by reassuring them that you take on responsibility if the patch causes a problem. Encourage them to follow a procedure that mitigates risks:

5. Test Patches in a test environment that uses the same applications as the rest of your network. For very small companies, your test environment might be a single computer. For larger organizations, and organizations that stand to lose a great deal in the event of an attack, create a separate testing environment that is isolated from the production environment.

6. Have a pre-tested rollback plan so that, if the patch does cause a problem, your IT team will already know what they need to do right away to roll back a patch that causes an unexpected problem. They will then go back to the testing phase.

7. Deploy the patches in stages rather than patching all machines simultaneously. That way, even if the patch does cause a problem, not all your machines will be affected.

8. You may decide to empower your IT team with a patch management tool such as Ninite, LANGuard, Shavlik, or others. Allow them to test and choose a tool, and provide them with the means and time to do so, ASAP.

9. Ask IT, perhaps weekly and at least monthly, to provide you with a list of missing patches, not a pie chart.

10. You must upgrade from older operating systems, any of the ones that Microsoft no longer supports. If some machines cannot be upgraded, then they must be isolated or some other compensating control put into place. Microsoft clearly states when they stop producing patches for old operating systems.  So, there was no patch available for Windows XP and others.

Call me if they are not able to apply patches. Let’s team up to help prevent this.

At home, or if your organization is so small that you do not have an IT team or have an outsourced IT company that takes care of your patches, be sure that the option that provides automatic updates to Microsoft is enabled. The instructions are easy to find – just google the phrase: configure automatic updates site:Microsoft.com

Apple computer users, google: Automatic security updates os x site:apple.com

iPhone and iPad users, google: Automatic security downloads ios site:apple.com

Additionally, manually check for updates in Microsoft Office to be sure those are applied. Be sure that automatic updates are enabled in your browsers. Regularly download and apply patches to, or new versions of, Flash, Java, and your PDF reader.

Please forward this to everyone you care about and want to help stay secure.

The post Patching – 10 Steps to Seal the Holes in Your Armor appeared first on Foster Institute.