Cybersecurity Keeps Them Awake at Night

“What keeps you awake at night?” That’s a question that seems to come up at many a business networking group when someone begins to offer a solution to a problem they can solve. If you’re a CEO at a major corporation, the answer to that question is: cybersecurity.

Internet systems are more complex, and complexity leads to more risks. It’s become a boardroom issue, and the most concerning part of the problem should be the increased time it takes to find a system intrusion. It now takes 292 days – more than nine months – to discover a breach.

Part of the problem is the size and complexity of large corporate networks. They have thousands of endpoints, and it’s become harder to spot anomalies and deploy patches. While our clients typically don’t have large, sprawling networks, we all interact on the corporate or personal level with large global networks for just about everything we do.

Other parts of the problem are that companies may take too long to investigate the breach, and then they need time to develop a plan to patch it. That time is directly related to the network’s size and complexity. If a company doesn’t have a continuous monitoring plan (yes, it’s hard to believe a large company wouldn’t have one), it also extends the time to discover a breach.

Two other reasons are:

  1. Hackers have better stealth tools to invade a network. Once they’re in undetected, they can take their time to look at all of their victim’s data to see what’s best to monetize.
  2. Hackers can steal login credentials and hang around a system for a long time until they’re detected.

Companies that can detect intrusions in less than 100 days can save $1 million in containment costs. But they may not be as motivated as you are to protect your network and the people they serve.

Here are some things you can do right away:

  1. Make sure you have strong passwords for every account you and your employees and family members have.
  2. Insist on using passkeys or some other form of two-factor authentication (2FA) wherever possible. A good authenticator should be device-specific and tied to a device that’s always with the user.
  3. Make sure all your software (operating systems and apps) and firmware (hardware systems) is up to date.
  4. Have an easily accessible list of your key usernames and passwords for emergency use.

Microsoft is making strides in a couple of areas. The company introduced passkey support across most of its consumer apps a year ago, allowing you to sign into your account without the need for 2FA methods or remembering long passwords. Today, it’s encouraging all new signups to use passkeys as it removes passwords as the default.

Windows Hello allows users to securely sign in to their accounts with their face, fingerprint, or PIN. Today, more than 99 percent of users sign into their Windows devices using Hello. The company reports that 98 percent of passkey attempts to login are successful; passwords are only 32 percent successful.

To help keep all your software up to date, Microsoft is developing an update orchestration platform designed to unify the updating system for all apps, drivers, and system components on Windows systems. Right now, it’s aimed at developers and IT product teams. The goal is to run an update scan tool that will queue downloads and updates at optimal times. We’ll see if they can actually make it work.

That’s in the future. For the here and now, we recommend you contact us for a security audit. It’s something you should do annually to make sure you’ve taken the four steps we enumerated above. At the very least you can strengthen your own systems before the big guys know they were breached. Call us – 973-433-6676 – or email us for an appointment.

We Need Humanity

My father-in-law recently sent me an article by Frank Bruni from the New York Times. Neither is a tech expert, but they hit the nail squarely on the head when it comes to making technology usable. Our modern conveniences are exhaustingly inconvenient, as the headline read, and the “the paradoxes of progress” smack us in the face. A little humanity can be helpful – and sometimes necessary.

We have to say, first off, that technology has given us some highly useful gadgets. The Ring doorbell, just to cite one example, enabled us to monitor and interact with our front door visitors from anywhere. It’s a convenience and a security tool, and early on, it helped us manage deliveries for business. Today, as Frank Bruni writes, it’s so much more. He has relished how it lets him know if a package has arrived, a service provider has shown up or his dog is staying put and behaving in the front yard. But when he got a new phone, the app didn’t accept his password, even though his computer did. It took him two weeks to resolve his problem.

Bruni didn’t say if he tried to contact a human at Ring. You have to scroll all the way to the bottom of its website and go through a few clicks to get a phone number. If you can’t easily speak to a human, you may not get a solution, or you may be exhausted from going through a menu tree. If you have a security issue with your product, the difficulty in reaching a human is intolerable.

But let’s put this into a business situation. More businesses are using the internet to move large sums of money, and some of that is being done by an AI-powered chatbot. Why do they do this? AI is programmed by humans, based on reactions humans have to situations. If you raise an unanticipated question, the chatbot will stumble.

This came up with a client who thought they had been hacked. They were given wiring instructions in an email from someone they had not dealt with before. They were right to question the email. As we pointed out in our previous article, the more complex a network might be, the more risk there is of something going wrong. And cybersecurity is today’s big corporate concern.

Our client really needed a human solution more than a technical solution to verify the wire transfer instructions. When you get an electronic message from someone you don’t recognize, you must take steps to verify its authenticity. Independently from the message, call a person you know at the financial institution or the organization that invoiced you. A person can reassure you. An AI chatbot can’t.

On your side, we can help you set up email handling rules based on senders’ names and subject lines that pertain to invoices you need to pay and payment methods to use. At the very least, it will help you flag and re-examine emails on financial matters and see who you may need to talk to. Call us – 973-433-6676 – or email us to talk about it.

Keep Control of Your Technology

We recently made a sales call to a prospective client that was serviced by a larger IT provider and were shocked by what we saw and heard. They were still using Windows 10 but had switched to a new accounting system on the advice of their accountants. You need to demand better communications and coordination from all your providers to control your technology and your business.

Right up front, I saw Windows 10 as the current operating system as I glanced around their office. I was alarmed that at this late date, it seems that nobody told them that Microsoft is ending its support for Windows 10 in October. Yes, they will most likely be able to buy a one-year subscription to get security patches, but they won’t get any performance updates, and that will really hamper their accounting program.

That’s because their accounting firm suggested they upgrade their 20-year-old accounting software, which they can’t successfully install without upgrading to Windows 11. It seemed like nobody had put the issues together for them.

They are facing basic problems that we see all the time. Without an up-to-date operating system and application software, they won’t be able to move all their files from the old system to the new. They will need to deal with multiple versions of multiple files, and it will be a messy, time-consuming (and money-consuming) task to straighten them out. Finally, and increasingly more important in today’s technological environment, they won’t have the best security available to protect their data. They could risk becoming the weak link in their business chain.

The saddest parts of all this are that their IT provider didn’t seem to have upgraded them as Microsoft moves on from Windows 10 and that their accounting firm didn’t talk to them about having the right technology to handle a system that would make their business more efficient. It’s also sad that neither seemed to be aware of the relationship between technology and app performance. We pride ourselves on being keenly aware of that relationship.

The prospective client felt like they’d been taken advantage of. If you know of a company that seems to be struggling to match its technology to its apps, we’d like to talk to them. And if you think your systems aren’t doing all they can for you, we should talk. We can help you investigate possible solutions, select the one that should best meet your needs and configure it for your operations. Call us – 973-433-6676 – or email us to discuss it – or provide a referral.

The Time to Do the Right Thing

Be honest. How many times do you use a password for multiple websites because you need to remember it? You know that a string of 16 to 20 random characters upsets any pattern a hacker might use to steal a password for one site and maybe get into multiple places.

One of our clients recently told us how they saw the light, and it was a really gratifying conversation for me. He said: “I listened to what you said about passwords, and I did everything. Life is so much simpler now.”

It shocked me because that’s not usually what we hear. I wish more of our clients would get on the bandwagon when it comes to passwords and password managers. I can’t emphasize enough how password managers enable you to have unique, complex passwords for every website you need to access and how easy they are to use. You don’t always get to “stronger” and “simpler” as adjectives for a single concept.

What’s the “stronger” part of password managers? They generate those ideal passwords of 16 to 20 random characters that include upper and lower case letters, numbers and special characters. If everyone in your password chain – the people, companies and institutions you deal with – has a strong, generated password, that should make everyone as hack-proof as you can get. The problem is that the weakest link in the chain is the easy-to-crack password.

The” simpler” part is that you only need to remember one master password. (The hard part is making sure you have access to it in case you do forget it.) Before getting all his passwords into a password manager, our client said he would change a password by adding a number or a character because it was easier to remember. But it wasn’t simple. He would still need to remember what number or character he added to the old one, and maybe he had 50 passwords to remember – or carry around in a list.

A good password manager that can work across multiple devices can cost $50 to $100 a year. We believe that’s relatively cheap for the security you gain and the time you save from trying and retrying passwords or resetting them. The password manager becomes stronger and simpler when you combine it with facial recognition on a mobile phone.

Using a password manager and other forms of authentication will take some getting used to. But it’s worth it to take the time to do the right thing to protect your online security and your sanity.

Call us – 973-433-6676 – or email us if you need help in choosing a password manager and setting up the basics. We can also help you with other ways to authenticate your online access. See our article Pass the Key, Please.

 

Pass the Key, Please

If you’re sick and tired of managing passwords (see our article Take the Time to Do the Right Thing), take a new look at using passkeys and forget about the hassle. A passkey is a pair of cryptography keys generated by your device. A public key and a private key combine to create a passkey that unlocks your account. They may take some getting used to, but the security boost will be well worth the effort.

Microsoft is encouraging everyone to use a passkey when they sign up for a new account, and they’re moving away from the default of passwords for all new accounts allowing you to ditch them altogether. Just as a related side note, when you create a Microsoft account, do not create a local passkey. It will only work on the device you used to create the account, and that will defeat the purpose of being able to sign in from anywhere on any device.

A passkey is a pair of cryptography keys generated by your device. A public key and a private key combine to create a passkey that unlocks your account. If you remember going to your safe deposit box at the bank, you had one key in your possession, and you got a key from the bank for your visit. This is an electronic variation of the theme.

Microsoft introduced passkey support across most of its consumer apps a year ago, eliminating the need for two-factor authentication (2FA) or passwords. Now, it’s encouraging all new signs up to use passkeys as it removes passwords as the default. Websites are increasingly allowing you to passkeys for secure access.

Passkeys and password managers are able to work together for the most part. Usually, the device or software generating the passkeys uses a biometric authentication tool, such as FaceID or TouchID, to authenticate your identity. If your password manager is the passkey source, you can log in with your master password. Passkeys are unique to each app or website and stored in a password manager’s vault or your device’s keychain. Passkeys can also sync across devices, making them a convenient choice.

There are some holes in the passkey strategy that you should be aware of. The websites themselves can be the source of weakness in the security chain. Security experts say criminals can easily get around a passkey by stealing users’ validated browser cookies using malware.

While that puts an onus on the websites  to tighten up their operations, you can help protect yourself better. For example, don’t just accept the website’s data privacy settings when a box pops up on a website. Instead, navigate to the “Cookies” or “User Data” sections and choose the shortest available session duration. That way your cookies will expire automatically or whenever you close your browser window. You can also turn off various marketing and targeting cookies.

Again, passkeys take time to set up, and there’s a learning curve to using them effectively. We believe it’s well worth your time to start using them. Call us – 973-433-6676 – or email us to learn more about passkeys – and how they work with password managers. We can help you select and configure passkeys and password managers together and move you up to the next level of online security.

Read Your Email Before You Open It

Phishers, shmishers and other bad actors on the internet are getting really good at disguising themselves. They’re learning English better, designing their graphics better and even spelling better.

All of this means is that you need to start reading your emails more closely before you ever open them. Whether you’re using Microsoft Outlook or Gmail, the attack strategy is the same. We’ve warned for years and years that scammers rely on you being distracted or trying to do too much in too little time.

But now, the hackers are getting better at combining better language and graphics with holes or workarounds they find in website security systems. It’s not a new problem, but it’s becoming more widespread. ZDNet has an extensive article on how it affects Google and Gmail, but the principles are similar for Microsoft and Outlook. You need to take a close look at every email address for incoming email and every address or website link before you click on anything.

In the article, there was an example of how an email looked like a normal Gmail message, and it had links to what realistically looked like a legitimate Google support site. But a closer look revealed that it went to a Google Sites website. Google Sites is a free, web-based platform from Google for creating websites. It’s particularly useful for internal team sites, project hubs, or public-facing websites, and hackers have uses for it, too. A link to a Google Sites website came from no-reply@google.com, which is a legitimate but spoofable email address. The hackers or creators of that site were able get through some authentication workarounds to bypass safety measures used to stop this sort of attack.

You can see where this is going. One tech industry solution would be to require stronger forms of authentication or more authenticators. But as we’ve said over and over again, you need to take matters into your own hands.

In your email client, you can hover over the address that the email comes from and see who it’s really from. Even if you have opened a particular email, you can slowly and carefully read any email address or website link to see if it raises any suspicions. One thing that should raise a yellow or red flag is an urgent call to action, such as uploading a file or clicking a link to investigate a problem. A Google Sites website will have Google in its URL, and that could be a trap. Not to pick on Google, but any fake site can use a legitimate domain variation to snag you.

Here’s one checklist to help you spot a fraudulent email or website:

  1. Beware of any email that urges immediate action and tells you might face negative consequences.
  2. Check the “from” and ” to” email addresses. If the ” from” domain isn’t the actual company or the “to” recipient is not you, it’s likely a scam.
  3. Avoid clicking on links in the email and look at the context. Would Google send you a legal complaint and direct you to the Google Sites domain? We don’t think so!
  4. Run an online search for the content of the email to see if others have reported it as a scam or received a similar email.

If you think you may have clicked on a malicious website or may have downloaded some malicious software, call us immediately at 973-433-6676. We have tools to see what is on your computer and to remove the malware from your system.

Rule Over Your Domain

We’re seeing more instances of clients and their customers/clients losing access to their websites and emails connected to their domains. The reason why? Somebody missed a notice to verify their identity with their domain registrar.

Prevention is totally within your control. It just requires paying attention to a couple of things that are easy to overlook – as these two stories illustrate.

On a recent Sunday morning, a client called to report their website and email were down. The bad news is that most problems like these seem to happen on a weekend. The good news is that they can be fixed before they interrupt business. When internet systems go down, we look for technical issues, such as the connections between our clients and their host companies or problems with the host company.

In this case, it was an identification issue. Domain registrars, the companies that issue domains, periodically send out a request for the domain holder to verify who they are who they say they are. It should be a simple matter going into your account with your registrar and verifying the names and contact info for the domain owner and the technical contact are correct.

When you don’t respond, two problems typically arise. First, most domain owners miss the message to verify their information because it comes across as a phishing email and gets deleted or ignored. Second, it winds up in a spam folder that never gets checked.

For this client, it took us 2-1/2 hours to solve the problem. First, we checked with their website company, who reported not seeing any notice for verification. Then, we went into their email system and into a list of emails they had deleted and trashed. It’s like going through an electronic dumpster, but we found and retrieved the message – which was never opened. They were fortunate to discover the problem and fix it before the business week began.

In a second case, it took a client more than two weeks to resolve a verification issue for its domain. Outages of this length are usually the result of somebody not having the credentials to get into their registrar’s website to verify their information. You have to jump through hoops to reestablish your credentials.

You can avoid all of this by knowing your username and password for your registrar’s website. It’s your responsibility as the domain owner. If you don’t know the info now, make it a priority to find it or start the process to reestablish your credentials. Second, make it a point to check your spam files or junk mail at least once a day to make sure nothing important is buried there. Third, make it a point to log in to your account with your registrar every six months to verify your info.

If you can’t find your domain registration information or need to manage your email, call us – 973-433-6676 – or email us. We can help you work with your registrar to verify or reestablish your credentials (and store a backup copy), and we can help you set up rules to better handle spam or junk mail.

Getting Oversubscribed and Fed up

Our love-hate relationship with Microsoft – and Apple and Google – is coming to a head. Our beef right now focuses on Microsoft and its hard push to get users to adopt the New Outlook. It’s the default for Microsoft 365 subscriptions, and it’s not as feature-rich as the Old Outlook, which Microsoft calls Classic Outlook. Subscription prices are another issue.

Let’s get one issue out of the way. We like subscriptions for application software, such Microsoft 365. They provide regular updates and bug fixes automatically, either periodically or as needed, to make sure you have the latest performance and security features. As we use the cloud more, these updates become a bigger benefit.

Our beef with Microsoft is with the New Outlook. In our opinion, Microsoft is pushing us into a new system that has fewer features than the one it replaced. We recently covered the differences between Old and New Outlook, and we invite you to revisit that article. Microsoft essentially forced us to go with New Outlook before it was ready for prime time. It may be faster, but Microsoft took away many features in the new version. It seems like they made the move for their own convenience, not for the betterment of its customers. They say they will restore some features, but we have to ask why they didn’t get in all the features before they rolled out the new version?

You can go back to the Old Outlook by clicking on the Help tab along the top of your screen and then clicking on Go to Classic. But it’s not a simple toggle-back-and-forth process. It takes some time, which you may not have when trying to get a lot of things done.

You really don’t have a lot of choices. Most organizations are locked into Microsoft 365 for email (Outlook), its suite of Office products (Word, Excel, PowerPoint, etc.), and the collaboration enabled by OneDrive and Teams. Everyone knows how to use the apps, and businesses, non-profits and governments know how to support them, either through internal tech departments, IT consultants or both.

Microsoft knows they have a firm grip. If they maintain the best possible security measures for their customers, they can get away with fewer features to support while raising prices. They’ll add features (and support them) when enough customers kick and scream or when another software provider threatens a piece of their market.

We can help you on the economic side by analyzing all your Microsoft and other application subscriptions to see where we can eliminate duplications of licenses or scale back some to meet your needs more efficiently. There’s no need to be oversubscribed. Call us – 973-433-6676 – or email us to set up an appointment.

Hardware Plays Hard to Get

As we were writing this issue of Technology Update, tariffs hit the fan. We have discussed their possible impact on prices before, but that was hypothetical. Now, they’re real, but we’re still not sure where they will land and how they will affect supplies and prices. At the same time, technological advances make hardware obsolete faster.

Before tariffs were officially announced, we saw a 10 percent minimum increase in hardware prices. Now, nobody is betting on how long the tariffs will stay in effect and for how long. Anyone who’s been living on the bleeding edge of their hardware’s service life – and there are many – has to feel uncomfortable because there is uncertainty supplies, prices and delivery dates.

That discomfort is heightened by a crunch from software providers, who need to meet demands for better online security and performance from operating systems and applications. It used to be that in some cases, you could expect seven years of service from a piece of equipment. That’s because the hardware manufacturers could provide updates for their products’ firmware (hardware operating system software) to keep pace with software developments.

Today, hardware can become obsolete in as little as three years. Security systems, working in the cloud, and higher-performing application software all demand more powerful equipment. The technology industry has made a business decision to put its resources into supporting the larger base of forward-moving customers than those who are trying to hang on to older systems.

For some organizations, it’s a double-edged sword. They find it’s especially critical to be lean and mean to survive in tougher economic conditions. But they can’t cut away too much meat after they’ve trimmed all the fat. At some point, they’ll need to buy new hardware regardless of the price.

The best way to work around a double-edged sword is to see what hardware is connected to the internet. That’s a security move. Hackers look for the weakest link in any system, and if you have any hardware that’s connected to the internet, it must be able to handle the latest security software.

When one of our retail clients ordered 10 new computers, we saw one old computer just running ads on a TV in their store. It was not connected to the internet, and that was a perfectly good use for it. You may have equipment in your office that’s not connected to the internet – or can be used without an internet connection.

We can help you make more efficient use of your hardware by taking a close look at what equipment you have to determine what needs to be replaced and what can be used in other ways. Call us – 973-433-6676 – or email us to set up an appointment.

Making Technology Work Abroad

When you travel to some of the more remote parts of the world or parts of the world that lag in communications technology, you need to be flexible. You could need to work around slower internet service or service blackouts. But you may not be able to easily work around security and tech support issues that can crop up at the most inopportune time.

As experienced travelers and technology experts, we’re used to dealing with less-than-ideal conditions. But we still came across glitches we didn’t foresee. We need to plan for less-than-optimal service (sometimes no service) and problems with internet access, and we need to have some flexibility.

When we were in a game reserve in South Africa, we knew there would be limited Wi-Fi or cellular service, but we were too busy being awed by all the animals we saw. We were surprised on our cruise ship when we were in Madagascar. The ship had internet blackouts; there was no Wi-Fi service. Satellite connections were not available. We also had to work around 3G technology (which has basically been eliminated in the United States). In some cases, VPNs would not allow access to certain websites – and we had counted on that access for certain business needs.

This presents an interesting dichotomy. We take vacations to get away from our normal routines, but sometimes we need to stay in touch. We like being able to resolve issues remotely for our clients or get a detailed understanding of issues so that we instruct those who provide services on our behalf. We believe it’s a critical part of our pledge to serve you.

We also like to take a lot of photographs and shoot videos to share with family and friends during our vacations. With images and videos creating ever larger files, we rely on fast internet service, which may not be available.

Then, there’s the matter of security, especially with authenticator apps and VPNs (virtual private networks).

Authenticator apps are part of the two-factor authentication (2FA) process for accessing websites. The first thing you should do is log in to your authenticator app and make sure it works. You should especially make sure it works with any privacy measures you might take, such as a VPN. Microsoft Authenticator (our preferred app) and Google Authenticator are two of the most commonly used apps, and they work with mobile devices – even if you are logging in from a computer.

If you get a new phone or tablet, you’ll need to reinstall your authentication app; it doesn’t transfer. When we get a client call about an authenticator problem, the first question we ask is whether you have a new phone. We can always walk you through the setup process.

While we’re on the subject of VPNs, be prepared for yours not to work when logging in to a website you normally use. In some countries, an international company’s website might be hosted in a country outside the US. If you are running a VPN that identifies your device as being in the US, just hope it works well so that you can access the site. If you need to contact that company’s tech support, make sure you know what time it is in their location.

If you’re planning a trip to remote locations anywhere in the world – even here in the US – we can help you with contingency plans based on your needs. Call us – 973-433-6676 – or email us to see what you can do.