SolarWinds is a well-respected organization, and many organizations utilize their products. Not enough details are known to discredit their organization. Clearly, attackers see them as valuable enough to use as an infection vector.

This is called a supply chain attack because bad actors use a trusted product in an organization’s supply chain to attack the organization. A similar well-publicized attack happened with a popular tool, with many benefits, called CCleaner. The attackers successfully compromised 2.3 Million PCs.

The CCleaner supply chain attack is an illustration of dwell time. Attackers waited five months from the time they gained access to CCleaner before they launched the attack on CCleaner users. Many computers were safe, but not 2.3 Million of them.

Remember: Just because your organization fixes a vector through which the infection came does not eliminate damage already done. As an analogy, if you were the king or queen of a castle, and you found that attackers entered your castle walls to attack your city, raising the bridge over your moat does not eliminate the attackers who already made it inside.

Supply chain attacks are one of many reasons to eliminate as much software as possible at your organization. If a program is not essential, remove it asap. SolarWinds is vital for many organizations.

Please forward this to your friends so they can alert their IT departments to address this situation, and know to remove all non-essential software from all computers.

The post Emergency Update if Your IT Team Uses SolarWinds Products, and How to Protect Against Supply Chain Attacks appeared first on Foster Institute.

The attacker does not need to know any passwords; they do not even need a username. They plug in a cable, and 3 seconds later, they’ve completely compromised your network. An attacker posing as a visitor, a copier repair person, or a member of a cleaning crew can all compromise your organization. They can steal sensitive information, install ransomware, and can shut down operations entirely. They bypass the majority of, if not all, of your other protections because now they’re a Domain Administrator.

This exploit is so severe that the Department of Homeland Security directed all federal agencies to apply the patch in accordance with the Federal Emergency Directive 20-04.

Take these three steps ASAP:

First, ask your IT team if they’ve backed up your Domain Controller servers and applied Microsoft’s patches that address the Zerologon exploit CVE-2020-1472. They must do this immediately. Be compassionate if they’ve not. IMPORTANT: Realize that if an attacker already took over a network, the patch doesn’t help.

Second, if you have Domain Controllers using operating systems older than Windows Server 2008 R2, your IT professionals must shut them down for good. Be sure to migrate any mission-critical services to other servers.

Third, does your organization rely on third parties to support you? What if one of your major suppliers, a distributor, or your biggest customer falls prey to an attack? Prepare your organization now for an interruption of their operations. Be sure their executives know about this flaw and these three steps. You do not want a catastrophe at their organization to domino and cause a disaster for you, even though you’ve protected your systems.

Additional steps:

Inform your work-from-home team members that, in some cases, the attacker can take over your network using a VPN connection. Do you have an armed guard at every work-from-home user’s home to watch visitors? Of course not. But your entire organization might rely on their security. What if a teenager’s friend feels like playing around, experimenting, with this new cool exploit on a mom or dad’s computer?

The patches only protect you from attacks from Windows devices. If an attacker accesses a network port or cable with a non-Windows machine, the attacker can still take control of your network. Microsoft will release a second patch on February 9, 2021. Ask your IT team to configure alerts now to monitor security log events 5827 thru 5831 to see when connections are allowed or denied.

The average time for IT Professionals to apply critical security patches is five months, but you need to help yours be above average. Ask them what you can do to help them have time to test and install all critical security patches within 14 days or sooner. They might want to have a patch management tool. They might need more time to devote to applying updates.

Confirm that your IT Team disconnects or disables all unused Ethernet ports, including those in conference rooms. Lock doors to any offices and conference rooms that contain active Ethernet ports. Train everyone to be proactive and remove opportunities for anyone, including guests and repair people, to plug a device into a network port.

Keep in mind that 911 systems, airlines, governments, and every organization that you depend on are at risk for Zerologon exploit CVE-2020-1472 until they take action too.

Please forward this to fellow executives you care about so they can support their IT Professionals successfully backing up servers and applying the emergency patch.

The post Attackers Can Take Control of Your Network in Three Seconds, and How to Stop Them appeared first on Foster Institute.

More often than ever before, bad actors infiltrate organizations in a slow, methodical way. They can remain undetected for weeks, months, even years. The FBI uses the term dwell time to designate the period from when attackers infiltrate systems until you discover them. The FBI warns businesses that attackers can cause significant damage during dwell time. Bad actors quickly establish backdoors to ensure access, even if you block their first point of entry. They deploy keyloggers on systems to record keystrokes. If your cyber assets are compromised, the bad actors can potentially monitor your messages to find out when you discover their presence in your network, computers, applications, cloud resources, websites, or anywhere else.

Once attackers know you’ve discovered their infiltration, that triggers them to move forward with their next phase, often contacting you to demand a ransom. Sometimes they threaten severe consequences if you attempt to recover your system in any other way than paying them. Since they are in your systems, you must take the threats seriously.

Establish a protocol for workers to communicate suspicions in some method other than email.

Even your IT department must avoid emailing each other questions such as, “I received an alert that someone is resetting an administrator password. That’s odd. Is that you?” Instead, they must communicate by mobile phone or radio.

If you suspect a breach and contact us, consider phoning. If you must email, use a personal account outside of your company account, and use a phone or some device other than a company computer’s keyboard to send the message.

I’m not talking about when users receive a phishing message. I’m talking about if they receive a phishing message that includes customer account information, if an important file is missing or won’t open, or if they receive an unexpected login request on a website or to open a file. IT needs to investigate these early-warning signs.

Please forward this to other executives who you care about to establish a mobile hotline number for users to reach the IT team to report suspicious activity. Help avoid triggering attackers’ responses before your IT team has time to react and, hopefully, mitigate a potential cybersecurity disaster.

The post If You Get Hacked, Do Not Email Anyone About It appeared first on Foster Institute.

Believing that small to mid-size businesses are not targets helps business owners and executives sleep better at night. The thought is comforting.

However, the reality is that instead of choosing targets based on organization size, the majority of attackers choose soft, easy to breach, targets. In particular, that category includes work-from-home computers.

In our consulting business, we’re seeing many firms suffer major breaches that originate at an unsuspecting work-from-home user’s computer.

Please forward this to your friends so they know that it may feel comforting to believe attackers only go after the big companies, that belief is putting their organization at tremendous risk.

The post Be Smart and Avoid This Comforting Belief appeared first on Foster Institute.

Use at least two monitors. You can often separate the presentation so that you see slides on one screen and all the participants’ faces on another. When you buy new, seek 4K resolution. Investigate 15-inch portable monitors if you need to move around, or 27-inch screens if portability isn’t necessary.

Second, straining to hear someone’s voice over a poor connection is very distracting. Rather than using your computer’s built-in mic, consider using a suitable USB Microphone. Position the mic close to your mouth. Some people prefer headset mics – especially if they are in a noisy environment. I wear a wireless lapel mic when presenting online keynote speeches and webinars. All of those provide better sound than a laptop’s built-in mic.

Please forward this to everyone you know because, when their video conferences run smoothly, they can pay more attention to security and being mindful of what they say. Stay safe!

The post Two Tips to Make Your Online Meetings Better appeared first on Foster Institute.

Here is another essential tactic to help protect your remote workers.

There’s a company in Saint Louis that ran into a problem your organization might face too.

Their remote workers must attend many video conference calls, online meetings, webinars, and online training sessions. Their IT Pro doesn’t want to install different programs on his users’ computers if he can avoid it.

As you know, a significant way to improve cybersecurity is to uninstall nonessential software, not to add more programs.

The company’s savvy IT Pro discovered an excellent solution. He found that all of the video conferencing and training tools his team needs can run inside their already-installed browsers. They don’t need to download and install extra software. They have Zoom already, but workers use their browsers for other kinds of meetings. They may not get all the advanced functionality, but they can still participate in the sessions just fine.

Please forward this to your friends so that they know, to improve cybersecurity, avoid installing software or apps whenever possible. Their IT Pro may find that workers can participate in many meetings using their browser only, without needing to increase the attack surface by installing more software.

The post Video Conferencing – Avoid Installing Meeting Programs When Possible appeared first on Foster Institute.

You may have heard that Netflix agreed to reduce the picture quality of movies in the UK to reduce the load on the Internet. What’s that have to do with your company? Prepare a contingency plan now. Something easy to change is to instruct your workers to ask their family members to please download their movies at night rather than streaming the videos during work hours. That way, their family can watch their downloaded movies during the daytime without using up your workers’ remote network speed.

If your remote workers use VPN connections, and they experience slow speeds, your IT team can enable something called split tunneling. Then, if they aren’t already, your workers’ computers take a shortcut directly to the Internet without going a long way around through your primary office location’s firewall first. That trades speed for security, so executives have to make the decision, but the change might be worth it if your workers cannot work otherwise. There are other strategies too. Know that recorded video and audio conference calls will make it through even when a real-time conference is so slow it fails.

Other customers explain that the cellular towers in their area are so overloaded that phone calls get dropped, and voices are sometimes garbled beyond understandability. That’s when text messages, though less convenient, will be your plan B. At least text messages will usually go through even with weak or slow connections.

Please forward this message to your friends so they can have a plan in place at their company in case an Internet or cell phone traffic jam interferes with their business.

The post Plan Now for Slow Internet and Dropped Phone Calls appeared first on Foster Institute.

The post Warn Your Workers about Attacker Decoy Tactics appeared first on Foster Institute.

More often, the executives have administrative level permissions to access everything on the network and, additionally, the executive has a weak password. If an executive demands administrative access to a network, create two user accounts for the executive. One of the accounts is for day-to-day work and the administrative account is only for resetting passwords, deleting users, and whatever else the executive wants to do on occasion.

Any users who have administrative access should not have access to a web browser or to email. Avoid exposing administrative users to those common and dangerous attack vectors.

Please post your comments on this blog.

The post Are you rolling out the welcome mat to attackers? appeared first on Foster Institute.

Good anti-spam solutions block unwanted email, allow email you are interested in receiving, and even attempts to block viruses arriving via email. One of the biggest signs of a good service, in addition to working properly, is that the service saves your workers and your IT team time by not needing to babysit the anti-spam solution.

Eliminate specific E-mail attachments since they may contain malicious code. This infection vector is a significant source of infections that lead to attackers gaining control over major assets in your network.

It is important for security and productivity to implement a solution to block Internet access to inappropriate sites. While most everyone in an organization can quickly agree on blocking certain sites because the inappropriate content could endanger the organization. For other categories of web sites, there may be more than one point of view.

Consider, at least initially, only blocking the sites that everyone can agree need to be blocked. Simply activating the blocking tool will usually help reduce drive-by-downloads at some sites.

Many firewalls support web filtering although many firewalls do not provide reporting features with enough detail. If your solution is inadequate, then upgrade the firewall or add a tool that will provide this functionality.

Please post your comments on this blog.

The post Stop Drive-By-Downloads appeared first on Foster Institute.