Neglect – The Silent IT Killer

We saw all the signs of classic neglect when we started with a new client who had been dissatisfied with their previous service provider. The fact that updates were never installed was horrifying because the client was in a financial services field. We can’t say if there was willful or accidental neglect, but the lack of updates could have killed a business.

What we saw can happen in any office where a company owner or manager has lost trust with their IT service provider: They stumble onto an issue. In many cases, businesses trust their IT providers to the point that they don’t keep their passwords on-hand (much less up to date) and don’t learn how to check to make sure updates have been installed. For this client, it seems that automatic updates were turned on and then turned off.

We know that some IT providers and some users don’t like automatic updates because they want to be able to monitor how changes take effect or make sure all the bugs are out. We don’t agree with that practice, and this is an example why. When automatic updates are turned off, it’s too easy to miss a notification when one is available, and that can lead to all sorts of security risks. Bugs in updates are inevitable, and patches to fix them are issued pretty quickly.

In this case, the server hadn’t been updated for nearly two years (keep this time period in mind), but we didn’t learn that until the client forced the previous IT provider to send the passwords for the server and the firewall. Everyone should remember that you own your passwords – and remember that you should keep them stored in a safe but accessible place.

Once we got access, we learned that the physical server and firewall had not been updated for two years. The firewall had no security or operating system updates since 2012. We told the client they had to update everything immediately.

We also found that their Wi-Fi network was not properly segmented, and that allowed access to everything through their guest network. That was neglect on somebody’s part, and I’ll blame the previous provider. That’s something that should be taken care of without any excuses.

At that point, I took out my Dashlane password manager and immediately generated new passwords with random numbers, case-sensitive letters and special characters. I printed them out and reviewed them all with the client to make sure they knew all of them correctly.

You can avoid these problems by making sure you get automatic updates and by knowing all of your passwords. You can also make up for past neglect by checking yourself to see when the last updates were installed – as long as you have all of your passwords.

If you have a server, you can look at the date of your last update through your control panel. If you see a huge gap between the day you check and the last installation, that’s a bad sign. In the case of the new client, who had issues with a previous service provider, the last server update was nearly two years before we found the problem.

On a computer running Windows 10, you can simultaneously push Control, Alt and Delete to bring up Task Manager. Click on the Performance tab and highlight the CPU button on the left. You should see Uptime in the bottom center of the screen. The columns, looking left to right, measure days, hours, minutes and seconds. Uptime is calculated from the most recent restart. If your uptime is 30 days or more, it’s a sign that you likely are not getting updates or not rebooting to clear out trash from your system. In one case, we saw an uptime of 286 days.

You can set up automatic updates for Windows and many of your applications. If you see or believe that your updates are woefully out of date, call us – 973-433-6676 – or email us to set up an appointment to walk you through the update process free of charge. You can’t fall behind on security.

Security and On/Off Wi-Fi

We’re seeing more Ring doorbells. They offer you the ability to monitor your door from anywhere through the internet and your Wi-Fi network. But some clients have told us they don’t want their network on at all times because of radio frequency waves.

We don’t share some people’s concerns about damage from radio waves. We carry cell phones in our pockets and hold them up to our ears. We can reduce our exposure to radio waves by using a headset, but nearly everyone uses a Bluetooth device, which operates on…right.

Despite a majority of scientific studies that radio waves from cell phones pose no danger to most people, some like to avoid them wherever possible. And those avoidance steps include shutting off Wi-Fi systems – routers and boosters within a home – for periods of time.

Personally, we believe that defeats the purpose of having a security device, such as Ring, which can record and store images of anyone coming to your door, even if they don’t ring the bell. But your Wi-Fi has to be on, or else you can’t identify a threat to your home.

The issue of no internet or Wi-Fi was brought home to us this past summer with 10 days left on our vacation. We saw that Ring alerts had stopped – because our internet service was down. We were able to contact Verizon while in Europe, and they were able to restore our service as soon as we got home. But during the time it was out, we lost part of our security protection. (For the record, our service was knocked out by a squirrel.) That being said, we can help you set up a program to automatically control the operating times of your Wi-Fi network. Call us – 973-433-6676 – or email us to discuss all the pros, cons and options.

Password Problems Revisited

To take our discussion of vanishing passwords one step farther, some recent service calls for clients who’ve been hacked – some multiple times – have provided still more reasons to move on to newer technologies.

We are getting numerous calls from clients to help them set up Dashlane, including one client who has been hacked seven times. We tried to get them to use Dashlane or Password Keeper. Now, they’re ready to do it the right way. They’re ready to move beyond the annoyance of having to remember or look up passwords for security and type them into a website. For now, Dashlane or another password manager can resolve the issue for most people who are fearful of trading passwords for newer password-less technologies.

As we’ve noted, people set up passwords that are easy to remember or type. There’s generally enough repeatability that a code cracker can solve the puzzle you’ve tried to create. That happened with our client, whose bank account was hacked. As we were setting up Dashlane and downloading emails, we noticed the client had been getting alerts that the password had been changed. They had not made those changes. It took a phone call to resolve that issue, and it took Dashlane to ward off the hackers.

We should note here that there are a couple of important side lessons to learn from this experience. The first is on you: Call the company – and don’t necessarily use the phone number in the email; get one from their website. The second is on the companies: Make it easier to get a human on the phone when somebody has a security issue. We went through five layers of voice prompts before talking to a person.

Once the “alert” issue was resolved, we were able to fully install Dashlane. The process does take time. Installing any password manager requires you to pay attention to details and maybe some repetition. For financially sensitive accounts, you may want to generate another round of new random-pattern passwords as an extra layer of security. A password management program should allow you to print a copy of your database with all of your passwords – just in case there’s a mistake or if you decide to stop using the program. It should also work across all of your devices: computers, phones, tablets, etc. If you are one of the growing number of people who use an infotainment system in your car like a computer, you might want to change sensitive passwords frequently – as often as once a week.

Again, you only need to remember your master password for the password manager, and that can be a tremendous time saver, especially if you need to access a website from a mobile device.

But again, we believe you should use password-less technologies. They’re more secure, and they are easier to use than many perceive. For example, many Windows 10 computers have Windows Hello, and you can use that to add a fingerprint reader. The reader itself is about the size of a wireless mouse device and plugs into a USB port. Similarly, many mobile devices can use your fingerprint to verify you are the owner and user. If your computer or device has this capability, we strongly urge you to use it.

Many computers and devices also have built-in cameras that can be used for biometrics, and some advanced security measures use locations and usage patterns in place of passwords. As a backup, all of these measures have provisions for a PIN or a password if the biometric program can’t be used or if you don’t want to use it.

We can help you set up a password manager or – better still – go password-less. Call us – 973-433-6676 – or email us to get answers to your questions or to set up an appointment to manage your online security.