The Time to Do the Right Thing

Be honest. How many times do you use a password for multiple websites because you need to remember it? You know that a string of 16 to 20 random characters upsets any pattern a hacker might use to steal a password for one site and maybe get into multiple places.

One of our clients recently told us how they saw the light, and it was a really gratifying conversation for me. He said: “I listened to what you said about passwords, and I did everything. Life is so much simpler now.”

It shocked me because that’s not usually what we hear. I wish more of our clients would get on the bandwagon when it comes to passwords and password managers. I can’t emphasize enough how password managers enable you to have unique, complex passwords for every website you need to access and how easy they are to use. You don’t always get to “stronger” and “simpler” as adjectives for a single concept.

What’s the “stronger” part of password managers? They generate those ideal passwords of 16 to 20 random characters that include upper and lower case letters, numbers and special characters. If everyone in your password chain – the people, companies and institutions you deal with – has a strong, generated password, that should make everyone as hack-proof as you can get. The problem is that the weakest link in the chain is the easy-to-crack password.

The” simpler” part is that you only need to remember one master password. (The hard part is making sure you have access to it in case you do forget it.) Before getting all his passwords into a password manager, our client said he would change a password by adding a number or a character because it was easier to remember. But it wasn’t simple. He would still need to remember what number or character he added to the old one, and maybe he had 50 passwords to remember – or carry around in a list.

A good password manager that can work across multiple devices can cost $50 to $100 a year. We believe that’s relatively cheap for the security you gain and the time you save from trying and retrying passwords or resetting them. The password manager becomes stronger and simpler when you combine it with facial recognition on a mobile phone.

Using a password manager and other forms of authentication will take some getting used to. But it’s worth it to take the time to do the right thing to protect your online security and your sanity.

Call us – 973-433-6676 – or email us if you need help in choosing a password manager and setting up the basics. We can also help you with other ways to authenticate your online access. See our article Pass the Key, Please.

 

Pass the Key, Please

If you’re sick and tired of managing passwords (see our article Take the Time to Do the Right Thing), take a new look at using passkeys and forget about the hassle. A passkey is a pair of cryptography keys generated by your device. A public key and a private key combine to create a passkey that unlocks your account. They may take some getting used to, but the security boost will be well worth the effort.

Microsoft is encouraging everyone to use a passkey when they sign up for a new account, and they’re moving away from the default of passwords for all new accounts allowing you to ditch them altogether. Just as a related side note, when you create a Microsoft account, do not create a local passkey. It will only work on the device you used to create the account, and that will defeat the purpose of being able to sign in from anywhere on any device.

A passkey is a pair of cryptography keys generated by your device. A public key and a private key combine to create a passkey that unlocks your account. If you remember going to your safe deposit box at the bank, you had one key in your possession, and you got a key from the bank for your visit. This is an electronic variation of the theme.

Microsoft introduced passkey support across most of its consumer apps a year ago, eliminating the need for two-factor authentication (2FA) or passwords. Now, it’s encouraging all new signs up to use passkeys as it removes passwords as the default. Websites are increasingly allowing you to passkeys for secure access.

Passkeys and password managers are able to work together for the most part. Usually, the device or software generating the passkeys uses a biometric authentication tool, such as FaceID or TouchID, to authenticate your identity. If your password manager is the passkey source, you can log in with your master password. Passkeys are unique to each app or website and stored in a password manager’s vault or your device’s keychain. Passkeys can also sync across devices, making them a convenient choice.

There are some holes in the passkey strategy that you should be aware of. The websites themselves can be the source of weakness in the security chain. Security experts say criminals can easily get around a passkey by stealing users’ validated browser cookies using malware.

While that puts an onus on the websites  to tighten up their operations, you can help protect yourself better. For example, don’t just accept the website’s data privacy settings when a box pops up on a website. Instead, navigate to the “Cookies” or “User Data” sections and choose the shortest available session duration. That way your cookies will expire automatically or whenever you close your browser window. You can also turn off various marketing and targeting cookies.

Again, passkeys take time to set up, and there’s a learning curve to using them effectively. We believe it’s well worth your time to start using them. Call us – 973-433-6676 – or email us to learn more about passkeys – and how they work with password managers. We can help you select and configure passkeys and password managers together and move you up to the next level of online security.

Read Your Email Before You Open It

Phishers, shmishers and other bad actors on the internet are getting really good at disguising themselves. They’re learning English better, designing their graphics better and even spelling better.

All of this means is that you need to start reading your emails more closely before you ever open them. Whether you’re using Microsoft Outlook or Gmail, the attack strategy is the same. We’ve warned for years and years that scammers rely on you being distracted or trying to do too much in too little time.

But now, the hackers are getting better at combining better language and graphics with holes or workarounds they find in website security systems. It’s not a new problem, but it’s becoming more widespread. ZDNet has an extensive article on how it affects Google and Gmail, but the principles are similar for Microsoft and Outlook. You need to take a close look at every email address for incoming email and every address or website link before you click on anything.

In the article, there was an example of how an email looked like a normal Gmail message, and it had links to what realistically looked like a legitimate Google support site. But a closer look revealed that it went to a Google Sites website. Google Sites is a free, web-based platform from Google for creating websites. It’s particularly useful for internal team sites, project hubs, or public-facing websites, and hackers have uses for it, too. A link to a Google Sites website came from no-reply@google.com, which is a legitimate but spoofable email address. The hackers or creators of that site were able get through some authentication workarounds to bypass safety measures used to stop this sort of attack.

You can see where this is going. One tech industry solution would be to require stronger forms of authentication or more authenticators. But as we’ve said over and over again, you need to take matters into your own hands.

In your email client, you can hover over the address that the email comes from and see who it’s really from. Even if you have opened a particular email, you can slowly and carefully read any email address or website link to see if it raises any suspicions. One thing that should raise a yellow or red flag is an urgent call to action, such as uploading a file or clicking a link to investigate a problem. A Google Sites website will have Google in its URL, and that could be a trap. Not to pick on Google, but any fake site can use a legitimate domain variation to snag you.

Here’s one checklist to help you spot a fraudulent email or website:

  1. Beware of any email that urges immediate action and tells you might face negative consequences.
  2. Check the “from” and ” to” email addresses. If the ” from” domain isn’t the actual company or the “to” recipient is not you, it’s likely a scam.
  3. Avoid clicking on links in the email and look at the context. Would Google send you a legal complaint and direct you to the Google Sites domain? We don’t think so!
  4. Run an online search for the content of the email to see if others have reported it as a scam or received a similar email.

If you think you may have clicked on a malicious website or may have downloaded some malicious software, call us immediately at 973-433-6676. We have tools to see what is on your computer and to remove the malware from your system.

Rule Over Your Domain

We’re seeing more instances of clients and their customers/clients losing access to their websites and emails connected to their domains. The reason why? Somebody missed a notice to verify their identity with their domain registrar.

Prevention is totally within your control. It just requires paying attention to a couple of things that are easy to overlook – as these two stories illustrate.

On a recent Sunday morning, a client called to report their website and email were down. The bad news is that most problems like these seem to happen on a weekend. The good news is that they can be fixed before they interrupt business. When internet systems go down, we look for technical issues, such as the connections between our clients and their host companies or problems with the host company.

In this case, it was an identification issue. Domain registrars, the companies that issue domains, periodically send out a request for the domain holder to verify who they are who they say they are. It should be a simple matter going into your account with your registrar and verifying the names and contact info for the domain owner and the technical contact are correct.

When you don’t respond, two problems typically arise. First, most domain owners miss the message to verify their information because it comes across as a phishing email and gets deleted or ignored. Second, it winds up in a spam folder that never gets checked.

For this client, it took us 2-1/2 hours to solve the problem. First, we checked with their website company, who reported not seeing any notice for verification. Then, we went into their email system and into a list of emails they had deleted and trashed. It’s like going through an electronic dumpster, but we found and retrieved the message – which was never opened. They were fortunate to discover the problem and fix it before the business week began.

In a second case, it took a client more than two weeks to resolve a verification issue for its domain. Outages of this length are usually the result of somebody not having the credentials to get into their registrar’s website to verify their information. You have to jump through hoops to reestablish your credentials.

You can avoid all of this by knowing your username and password for your registrar’s website. It’s your responsibility as the domain owner. If you don’t know the info now, make it a priority to find it or start the process to reestablish your credentials. Second, make it a point to check your spam files or junk mail at least once a day to make sure nothing important is buried there. Third, make it a point to log in to your account with your registrar every six months to verify your info.

If you can’t find your domain registration information or need to manage your email, call us – 973-433-6676 – or email us. We can help you work with your registrar to verify or reestablish your credentials (and store a backup copy), and we can help you set up rules to better handle spam or junk mail.

Getting Oversubscribed and Fed up

Our love-hate relationship with Microsoft – and Apple and Google – is coming to a head. Our beef right now focuses on Microsoft and its hard push to get users to adopt the New Outlook. It’s the default for Microsoft 365 subscriptions, and it’s not as feature-rich as the Old Outlook, which Microsoft calls Classic Outlook. Subscription prices are another issue.

Let’s get one issue out of the way. We like subscriptions for application software, such Microsoft 365. They provide regular updates and bug fixes automatically, either periodically or as needed, to make sure you have the latest performance and security features. As we use the cloud more, these updates become a bigger benefit.

Our beef with Microsoft is with the New Outlook. In our opinion, Microsoft is pushing us into a new system that has fewer features than the one it replaced. We recently covered the differences between Old and New Outlook, and we invite you to revisit that article. Microsoft essentially forced us to go with New Outlook before it was ready for prime time. It may be faster, but Microsoft took away many features in the new version. It seems like they made the move for their own convenience, not for the betterment of its customers. They say they will restore some features, but we have to ask why they didn’t get in all the features before they rolled out the new version?

You can go back to the Old Outlook by clicking on the Help tab along the top of your screen and then clicking on Go to Classic. But it’s not a simple toggle-back-and-forth process. It takes some time, which you may not have when trying to get a lot of things done.

You really don’t have a lot of choices. Most organizations are locked into Microsoft 365 for email (Outlook), its suite of Office products (Word, Excel, PowerPoint, etc.), and the collaboration enabled by OneDrive and Teams. Everyone knows how to use the apps, and businesses, non-profits and governments know how to support them, either through internal tech departments, IT consultants or both.

Microsoft knows they have a firm grip. If they maintain the best possible security measures for their customers, they can get away with fewer features to support while raising prices. They’ll add features (and support them) when enough customers kick and scream or when another software provider threatens a piece of their market.

We can help you on the economic side by analyzing all your Microsoft and other application subscriptions to see where we can eliminate duplications of licenses or scale back some to meet your needs more efficiently. There’s no need to be oversubscribed. Call us – 973-433-6676 – or email us to set up an appointment.

Hardware Plays Hard to Get

As we were writing this issue of Technology Update, tariffs hit the fan. We have discussed their possible impact on prices before, but that was hypothetical. Now, they’re real, but we’re still not sure where they will land and how they will affect supplies and prices. At the same time, technological advances make hardware obsolete faster.

Before tariffs were officially announced, we saw a 10 percent minimum increase in hardware prices. Now, nobody is betting on how long the tariffs will stay in effect and for how long. Anyone who’s been living on the bleeding edge of their hardware’s service life – and there are many – has to feel uncomfortable because there is uncertainty supplies, prices and delivery dates.

That discomfort is heightened by a crunch from software providers, who need to meet demands for better online security and performance from operating systems and applications. It used to be that in some cases, you could expect seven years of service from a piece of equipment. That’s because the hardware manufacturers could provide updates for their products’ firmware (hardware operating system software) to keep pace with software developments.

Today, hardware can become obsolete in as little as three years. Security systems, working in the cloud, and higher-performing application software all demand more powerful equipment. The technology industry has made a business decision to put its resources into supporting the larger base of forward-moving customers than those who are trying to hang on to older systems.

For some organizations, it’s a double-edged sword. They find it’s especially critical to be lean and mean to survive in tougher economic conditions. But they can’t cut away too much meat after they’ve trimmed all the fat. At some point, they’ll need to buy new hardware regardless of the price.

The best way to work around a double-edged sword is to see what hardware is connected to the internet. That’s a security move. Hackers look for the weakest link in any system, and if you have any hardware that’s connected to the internet, it must be able to handle the latest security software.

When one of our retail clients ordered 10 new computers, we saw one old computer just running ads on a TV in their store. It was not connected to the internet, and that was a perfectly good use for it. You may have equipment in your office that’s not connected to the internet – or can be used without an internet connection.

We can help you make more efficient use of your hardware by taking a close look at what equipment you have to determine what needs to be replaced and what can be used in other ways. Call us – 973-433-6676 – or email us to set up an appointment.

Making Technology Work Abroad

When you travel to some of the more remote parts of the world or parts of the world that lag in communications technology, you need to be flexible. You could need to work around slower internet service or service blackouts. But you may not be able to easily work around security and tech support issues that can crop up at the most inopportune time.

As experienced travelers and technology experts, we’re used to dealing with less-than-ideal conditions. But we still came across glitches we didn’t foresee. We need to plan for less-than-optimal service (sometimes no service) and problems with internet access, and we need to have some flexibility.

When we were in a game reserve in South Africa, we knew there would be limited Wi-Fi or cellular service, but we were too busy being awed by all the animals we saw. We were surprised on our cruise ship when we were in Madagascar. The ship had internet blackouts; there was no Wi-Fi service. Satellite connections were not available. We also had to work around 3G technology (which has basically been eliminated in the United States). In some cases, VPNs would not allow access to certain websites – and we had counted on that access for certain business needs.

This presents an interesting dichotomy. We take vacations to get away from our normal routines, but sometimes we need to stay in touch. We like being able to resolve issues remotely for our clients or get a detailed understanding of issues so that we instruct those who provide services on our behalf. We believe it’s a critical part of our pledge to serve you.

We also like to take a lot of photographs and shoot videos to share with family and friends during our vacations. With images and videos creating ever larger files, we rely on fast internet service, which may not be available.

Then, there’s the matter of security, especially with authenticator apps and VPNs (virtual private networks).

Authenticator apps are part of the two-factor authentication (2FA) process for accessing websites. The first thing you should do is log in to your authenticator app and make sure it works. You should especially make sure it works with any privacy measures you might take, such as a VPN. Microsoft Authenticator (our preferred app) and Google Authenticator are two of the most commonly used apps, and they work with mobile devices – even if you are logging in from a computer.

If you get a new phone or tablet, you’ll need to reinstall your authentication app; it doesn’t transfer. When we get a client call about an authenticator problem, the first question we ask is whether you have a new phone. We can always walk you through the setup process.

While we’re on the subject of VPNs, be prepared for yours not to work when logging in to a website you normally use. In some countries, an international company’s website might be hosted in a country outside the US. If you are running a VPN that identifies your device as being in the US, just hope it works well so that you can access the site. If you need to contact that company’s tech support, make sure you know what time it is in their location.

If you’re planning a trip to remote locations anywhere in the world – even here in the US – we can help you with contingency plans based on your needs. Call us – 973-433-6676 – or email us to see what you can do.

Turn on 2FA with Microsoft 365

If you’re using Microsoft 365 without two-factor authentication (2FA), you could have a basic security problem. Cybercriminals are taking advantage of a loophole in Microsoft’s Basic Authentication, an outmoded system doesn’t require extra security checks, like a second password or a verification code sent to your phone. Here’s how to harden your system.

Hackers are using a method called “password spray and pray,” where they try common passwords across many accounts, hoping for a match. Security researchers have discovered that a botnet of at least 130,000 infected devices is being used in this attack. The hackers use non-interactive sign-ins, a method commonly used for automated logins between services. Because these logins don’t require human interaction, they often bypass 2FA protections, and many security protocols don’t pay much attention to them.

While Microsoft is phasing out Basic Authentication, it will still be partially active until September 2025. The threat is immediate and serious.

If you have a website, experts urge you to disable Basic Authentication and monitor non-interactive sign-in logs. You should also adopt access policies based on location and device security to restrict logins from unknown locations or requiring extra security steps for an unfamiliar device. Enabling multi-factor authentication (MFA) or certificate-based authentication would require users to verify their identity with a second factor, like a phone code or fingerprint scan. Even if hackers steal a password, they still won’t be able to access the account without this extra verification.

On the user side, eliminate multiple-use passwords. A password manager makes it easy to generate long, unique, complex passwords that are extremely hard to hack. And if a hacker does happen to hit one, it’s highly unlikely they’ll get another one.

If the websites you use require 2FA, we suggest using your password manager to set up a six-digit token through your phone’s authenticator app. With a cell phone, you can use facial recognition or fingerprint for authentication. And there’s still the six-digit code sent to your phone as a text message or an email.

We can help businesses and individual users upgrade or improve their online security. Call us – 973-433-6676 – or email us to talk about your needs.

When Old Technology Meets the Present Day

This is a cautionary tale about how many businesses maintain years and years of data storage. They’ve maintained servers and stored them on disks using RAID 5 technology. It’s a reliable system, but when you need to retrieve data, it can present a lot of costly complexities, as one of our clients recently discovered.

Our client was having trouble retrieving data and asked us to take a look. They gave us a half-dozen or so drives, and our immediate problem was that we couldn’t just pop them into a machine and take a look.

The problem was that our client had a server configured for RAID 5. In technical terms, RAID 5 is a configuration – redundant array of independent disks – that utilizes disk striping with parity. It enables you to distribute data across multiple drives with a parity check. This ensures data integrity even if one drive fails, and the configuration makes fast data retrieval possible.

However, it requires a minimum of three drives to function properly, and you need detailed record keeping to retrieve your data. That’s where the problem comes in. You need to take a Sharpie and identify each RAID 5 drive you have from the oldest to the newest. If you can’t view them in their proper sequence, you can’t retrieve your data.

If you have data on RAID 5 disks, you should consult an IT pro to see if you can dump your data to an external drive. However, it won’t be cheap. The cost can be $250 to $500 per disk to copy data to an external drive. The more disks you have, the harder it can be – unless you absolutely have them in the right sequence. And the process can be more difficult – if not impossible – if a disk is inadvertently fouled.

A better choice is RAID 1, commonly referred to as disk mirroring. Hard disks are kept in sync with one another so that if a disk were to fail, an exact copy remains, ensuring no loss.

In the event of a drive failure, recovery is easy since the duplicate drive can take over immediately. Read performance can be enhanced as data can be read from multiple disks simultaneously. The major drawback is that storage capacity is diminished, which means you’ll need more disks. In our opinion, that could outweigh the drawbacks of RAID 5, which requires more time and resources to rebuild data after a drive failure and can have slower write operations because of the need to update parity information.

We can help you determine which storage need is better for you or help you organize RAID 5 disks for more efficient data retrieval. Call us – 973-433-6676 – or email us to discuss what’s better for you.

Is ‘Zero Trust’ in Your Future?

The words “zero trust” in Zero Trust Network Access (ZTNA) are probably appropriate in a time when it seems like we don’t trust anybody about anything. ZTNA is being touted as a replacement for VPNs (Virtual Private Networks), especially for remote business needs. It could be more effective, but small businesses will need to jump through hoops.

ZTNA is a technology designed to limit who can access a network and where in the network they can go. The limits are important. For example, anyone who can access a Microsoft 365 network as a global administrator can effectively play God; they can do ANYTHING.

The goal of a ZTNA is to keep out false gods. Its proponents tout the following benefits:

  • Invisible infrastructure: ZTNA allows users to access applications without connecting them to the corporate network, thereby eliminating risk to the network.
  • More control and visibility: Managing ZTNA solutions is easy with a centralized admin portal with granular controls. Managers can see everything and create access policies for user groups or individual users.
  • Simpler app segmentation: Because ZTNA isn’t tied to the network, organizations can segment access down to individual applications instead of complex network segmentation.

Proponents further contend ZTNA is faster and more convenient than VPNs, offer better security, and are easier to manage. Gartner, a technology and research consultancy for large corporations and government, predicts its client base will largely phase out VPNs for ZTNA.

If you’re a small business or nonprofit organization that deals with large companies and government agencies, you may need to learn how to live in the world of ZTNA at the very least. If you want to adopt for your own use, you’ll need to answer some risk/reward questions:

  • Do you need a Ft. Knox type of defense system?
  • Are you willing to build new access systems to maintain your current business process?
  • Are you willing to take on the learning-curve risks of implementing a new security system?

There are no cookie-cutter solutions to changing your security measures. Call us – 973-433-6676 – or email us to discuss the specifics of ZTNA, especially if you need to use it to comply with another organization’s directive. We can help you design and implement a plan that minimizes your risk as best as possible.