Avoid BitLocker Recovery Issues

Every business-grade Windows-based computer has a hidden 48-digit BitLocker recovery key. It’s a hidden, unique numerical password that automatically unlocks an encrypted drive when standard authentication methods fail, and it’s essential for regaining access to your data in situations such as hardware changes, forgotten passwords, or system updates. It typically restores access after BIOS updates, but sometimes it fails. Here’s how to avoid BitLocker problems.

First and most important, there is NO WAY to recover your 48-digit BitLocker recovery key. So, Step Number 1 is to write it on a piece of paper or copy it into a note on your smartphone or tablet. If you don’t have it when the “blue screen of death” appears, your data is dead.

The blue screen that appears when there is a failure does have a place for you to enter your 48-digit BitLocker recovery key. Just enter it accurately and you’re good to go. If you bought your business-grade computer from us, we have backed up your 48-digit key, and we can provide it for you.

Regardless, you should have your key readily available, and you can find it before anything happens. Go to account.microsoft.com on any device, sign in to your Microsoft account, click Devices, select your PC, and look for BitLocker data protection. Write down the code and store it safely in several places. This will work from any device that’s connected to the internet, and it’s one way to get your key when the blue screen is present.

While your computer is still functioning, you can go into your profile and click on the BitLocker key for your device. It is buried in your profile, but it can be found. We can walk you through the process or send you detailed instructions. We also keep records of the BitLocker key for each device, but sometimes names of people or devices don’t match our records.

BitLocker keys are good for security, but they are bad if you don’t remember your key or have access to it. There is an option to turn off the BitLocker system altogether, but we don’t recommend it. It’s like leaving a door open to all your data.

Call us – 973-433-6676 – or email us if you have any questions or need assistance in securing your BitLocker recovery key.

AI: the Good, the Bad, and the Ugly

AI gives you the tools to do a lot of things in a fraction of the time they used to require. But using AI has its privacy costs, and trying to avoid them can lead to some really bad consequences. AI also doesn’t always get things right.

The most important thing you need to know about AI is that it’s not private. As soon as you put something into AI, it’s out in the world. AI makes its living by collecting data from the internet – lots of data at lightning-fast speed and often without permission. That means they frequently gather sensitive information without your knowledge or consent, and that data can be used for purposes you didn’t agree to, raising ethical concerns. AI can also enable unchecked surveillance, and when you combine that with the vast amounts of data stored by AI systems, you could be set up for the heightened risk of unauthorized access and data breaches. That’s bad and ugly.

Protecting your privacy takes some work. Best practices include never sharing sensitive information, actively controlling data settings, and using approved AI tools. Additionally, regularly deleting past chat histories and reading privacy policies can help ensure better data security. To be anonymous, consider using tools that run locally on your device instead of cloud-based services, and utilize a secure browser with privacy features. You can also use a VPN and sign up with a disposable email address to further protect your identity. DO NOT try to use the dark web. I have some good “street smarts” in the internet world, but these streets are populated by some really bad people. You can easily stumble into a really bad place and be ruined. It’s not like a game.

You also need to remember that AI is not always correct or all that smart. AI can provide wrong answers, so it’s up to you to make sure you verify any information you get from it. A wrong answer could create a life-and-death situation, a costly business decision, or a major inconvenience – just to name a few.

But what I find really frustrating is when Copilot puts you into a loop that is not related in any way to what you’re trying to do. I understand how computers work – they’re anal – but you are supposed to be able to use plain English get your work done or get information. I got into some serious verbal tiffs with my AI; it was really ugly.

However, if you check and double-check AI and really stay on top of it, the technology can work wonders. As an example, I was able to create in just a few hours a travel itinerary that combined independent travel and a cruise. It got us down to the minute we would arrive in various locations, and in the next-to-the-last stage, it gave us choices of hotels that met specific criteria. On the downside, it included a hotel that doesn’t exist, but the beauty was that as I continued to feed it information, it kept narrowing down our options to those that were more acceptable. The lesson from this exercise is that you have to verify all the information, but the bottom line is that it saved me days of work.

We can help you peel away the bad and the ugly to get to the good stuff in AI. Call us – 973-433-6676 – or email us to see how you can keep your corporate data safe and prevent employees from leaking sensitive information. We can set up rules for how your system uses AI. Our new security software tools provide safeguards if you choose to use them.

Make Reading a Habit

We’re so overloaded with emails, texts, WhatsApp and other communications that we’ve fallen into the bad habit of skimming messages and probably doing the same with websites and documents. It’s time to get back into the habit of reading things more closely because not everything is as it seems.

For example, you may be expecting to get a payment from a customer or a client, or you may be asking someone for help. When you get an email that appears to be responding to your expectation, many people tend to click on something without reading all the details closely. That’s when disaster strikes because that click opens the door for a hacker.

Hackers have taken really good advantage of artificial intelligence (AI). They can use it to create exact matches for corporate logos and write messages with perfect spelling and the most appropriate language for their target. This makes phishing attacks easier to carry out, and phishing attacks are the most common means of hacking an email account.

The obvious way to combat AI-generated phishing attacks is to use your own RI – real intelligence. Read the sender’s address very carefully. Is it the real address that you know, or is there a slight misspelling, such as an extra letter, a missing letter, or transposed letters? Does it make sense to you that the sender has included an attachment or link?

If you’ve skimmed over a phishing email and didn’t catch a warning sign, you may have provided a hacker with an opening to your personal information and the ability to access your financial accounts. If you’ve skimmed legitimate invitations to use two-factor authentication (2FA) for websites and – especially – your email login credentials, you may have provided an opening for hackers.

Protecting your email login credentials is critical to your online security. If a hacker steals access to your email and you have no 2FA, they can go to your bank’s website, for example, and use the “forgot password” process to reset your password. Signs your email account has been hacked include the inability to log in with your correct password, notifications about changes to your account settings or messages sent from your account that you didn’t initiate.

The start of the year is a good time to get a security audit and initiate strong security procedures, such as 2FA measures and the use of a password manager with unique passwords for every website you and your employees or family members access. Call us – 973-433-6676 – or email us to set up an appointment.

Fools and Their Money: A Seasonal Shopping Guide

“A fool and his money are soon parted” is a saying often attributed to Thomas Tusser, an English poet and farmer, who first wrote a version of it in his 1573 book Five Hundreth Pointes of Good Husbandrie. If only he could have envisioned today’s internet. AI will test your ability this year to differentiate the fake from the real more than ever.

As we scour the internet for bargains, hard-to-find items, and the best possible shipping terms, charities are making their annual push for donations, including major online solicitation campaigns. Scammers of all sizes are also using all sorts of AI tools to get between you and the companies you want to buy from or donate to.

Succumbing to a scam doesn’t make you a fool; the scammers and their tools are really, really good. AI helps them create exceptionally good graphic and video deep fakes. It helps them replicate flawless logos and improve their grammar, spelling, and syntax, all of which used to be dead giveaways of a scam.

But it would be foolhardy not to raise your antennae and harden your common sense with renewed vigilance. The cardinal rule remains the same: If something looks too good to be true, something is likely wrong.

Let’s look at some things that should raise a red flag:

  • Links: Whether in an email or especially on a website popup, don’t click on a link from a person or entity you don’t know or can’t verify. It’s the quickest way to allow a bad actor to plant malicious code that can compromise your data and that of anyone in your contact list.
  • Emails from Businesses, Charities or People You Don’t Recognize: The sender’s name may look legitimate, but you can hover your mouse over the sender’s name and see the real email address. If you’re not sure about anything you see, you have two options:
    • Delete the email.
    • Open a new browser window and type in the name of the business or charity as you know it to be. You should be able to find a phone number to call to verify if it’s from a legitimate organization.
  • Unsolicited Text Messages: This is another form of phishing known as smishing. Treat them the same as an email.

Be careful of really good prices when shopping for all products and services. Prices that are too good to be true may be outright fraudulent or carry terms and conditions that are extremely unfavorable to you. Check closely to make sure a product or even an airline ticket or hotel room is not offered by a gray-market or third-party provider. Read the terms and conditions and look for authentic user reviews. Again, if something looks funny, it should raise a red flag.

No matter what you’re looking to do online, it’s more important than ever to use two-factor authentication (2FA) for all the websites you can. While a code sent to your computer or phone is better than nothing, more advanced forms of 2FA, such as authenticator apps or biometrics, rely more on information stored on a specific device, making them more secure.

If you think you may have been hacked, call us – 973-433-6676 – as soon as you possibly can to assess the breach and take steps to close up your security holes.

Secure Your Email

Security measures such as encryption and 2FA help make email communications more secure, but they have their own issues for many users and fall short in some ways. Use them wherever you can, but remember that nothing works better than common sense, especially when you click on links in an email.

The majority of breaches of computer systems through email are user-initiated. A user clicks on a link – usually because of carelessness – that results in giving up login credentials for a website or a technology system. Encryption is no protection against a user causing a breach.

Security holes in encrypted email include human error, such as failing to encrypt messages or falling for phishing attacks, reliance on imperfect encryption in transit where servers may not support it, vulnerabilities on the recipient’s device like malware or unsecured devices, and issues with key management, such as weak passwords or lost private keys.

Let’s focus on those last two points. Securely managing and distributing encryption keys is complex. If private keys are lost or stolen, recipients may be unable to access their encrypted messages, and attackers could use stolen keys to decrypt emails. Easily guessed passwords for email accounts can be compromised, allowing attackers to access encrypted emails on a device.

Attackers can also exploit complex email systems by compromising intermediary servers or utilizing features that weaken security. These can include URL redirects to bypass encryption and deliver malicious content.

Instead of adding complexity, it might be better for most organizations to reemphasize some proven basics. One of them is 2FA. As imperfect as it is, 2FA can utilize a device such as a cell phone, which should be in the hands of the user. Yes, it can be defeated, but that happens if a system has already been breached and the attacker has changed the phone number and/or email address of the user.

The other basic is common sense. Don’t click on a link in an email unless you are 10,000 percent certain it’s correct and legitimate. AI is making it harder to detect malicious links, so users must be more vigilant. Don’t be in a rush, especially if you’re juggling several tasks. The safest way to respond to an email with a link or phone number is to open a browser and go to the website of the company. You should be able to find a phone number and maybe a legitimate email address to contact.

We can help you with email security in two ways. One way is to conduct a security audit of your email system to find and patch holes. The other way to help you set up 2FA systems, including biometrics and authenticator apps. Call us – 973-433-6676 – or email us to discuss your needs and possible solutions.

Authenticator Apps Can Protect You from SIM Swapping

We hate taking extra steps, especially if we think they’re complicated. But with the rise of SIM swapping, you might want to bite the bullet and get used to using an authenticator app.

The benefits of using an authenticator app for 2FA were illustrated by the problems of a new client who was victimized by a SIM swap of their phone number. The SIM swap caused untold problems, including untangling them based on hard-to-find phone records.

Again, just to recap from last month, SIM swaps happen when a bad actor is able to convince a carrier that they’re you and that you need to transfer your phone number to a new device. While the bad actor has your phone number hijacked, you lose your cellular service. You can’t make or receive phone calls or send or receive texts. If it happens for a short time and you’re not using your phone, you’ll never know it happened. If you’ve set up a form of 2FA that involves getting a code through a text message, you’ll never know about that, too.

An authenticator app is different. It uses a Time-Based One-Time Password (TOTP) algorithm to generate unique, time-sensitive codes for 2FA. The apps are set up on a mobile phone, and the process can be difficult for some. We suggest professional help to avoid untimely problems down the road.

When you type in a link from a computer or a phone to link the app to an online service, both the app and the service’s server use a shared secret key and the current time to independently generate the same time-sensitive codes. When a user logs in, they enter the code from the app, which the server verifies by comparing it to its own generated code. The verification code almost always comes in on your cell phone, and the authenticator app automatically regenerates the code every 30 seconds.

The key point here is that the authenticator app is tied to your device, not your phone number. So, if the bad actor tries to enter a website or app link that uses an authenticator app, they will not see the code. It will come to your device. If you don’t recognize the reason for that code being sent, it’s a big, bright flag that someone may have hijacked your phone number or breached your security in some way.

Of course, the website or online app being accessed must offer an authenticator app as a security measure. More of them are offering it as a security measure, and you should take advantage of it wherever you can. If you’re on your computer, you need to have your phone handy, and if you’re using your phone, it will take a little juggling. But it’s well worth the effort.

We can help you set up Microsoft Authenticator or any other authenticator app. Call us – 973-433-6676 – or email us to learn more about the app and get help setting it up.

Not All Cloud Storage is a Backup

We tend to use the terms data storage and data backup interchangeably. It can be a costly mistake.

Cloud storage is all about easy access to files. It’s not only your access, but also collaborative access that allows teams of people to work on projects together without the need to email various versions. Cloud storage servers such as Microsoft OneDrive, Google Drive, and Dropbox allow team members to be online at the same time and see changes to files in real time. They also allow a single user to access files from anywhere in the world where you can get an internet connection.

Stored files typically are not encrypted or protected with any special technology, and that makes them vulnerable to theft and ransomware attacks. If just one team member has lax security, such as an easily cracked password or uses an unsecured public network, all those stored files are exposed. Further, it could open someone up to SIM swapping.

How should you store your data? We like Microsoft’s Conditional Access, an access management solution that enforces security policies by bringing together real-time signals from users, devices, locations, and applications to block, allow, or require additional verification steps to access resources.

It works on a granular level. For example, you can set limits on which countries someone can log into your system. You can limit IP addresses. Steps like these can provide extremely useful insurance against worldwide hacker organizations that take advantage of local weaknesses in our global networks.

Installing and configuring the right access limits for your needs is not something you should attempt by yourself. There are myriad variables to the conditions that limit access, and if you make a mistake, you could lock out access to people who need it. If that happens, you’ll need an IT professional to undo the problems and reconfigure your system.

How should you back up your data? The short answer is to use specific backup technology. It makes a copy of files in storage and then encrypts them for protection. In the event of a cyberattack, a system outage or some other disaster, the encrypted files are used to restore the files to your system.

We can help you set up and configure both Microsoft Conditional Access and a backup program to keep you safely up and running. We can also provide the training needed to maintain both systems. Call us – 973-433-6676 – or email us to set up an appointment to design a coordinated plan that best meets your needs.

Secure Your Email

Email security continues to be the most vulnerable security link in your email chain. Ninety-six percent of all phishing attacks use email, and some three billion emails are launched daily. Phishing can cost businesses $26 billion annually. The more email accounts you have, the more vulnerable you are.

One of our clients had six email accounts, all of them created for a variety of legitimate reasons. The problem is that it meant they had to guard six doors against intruders. That’s worrisome enough, but if you use multiple email clients, such as Outlook and Gmail, you need to deploy your security measures in line with each client.

Google’s Gmail has a particular vulnerability. According to a report from Malwarebytes, Russian hackers were able to bypass Google’s multi-factor authentication (MFA) in Gmail to pull off targeted attacks. They did it by posing as US Department of State officials in advanced social engineering attacks, building a rapport with their target, and then persuading them to create app-specific passwords (app passwords). App passwords are special 16-digit codes that Google generates to allow certain apps or devices to access your Google Account securely, especially when you have MFA enabled.

Outlook faces several significant security challenges, including vulnerabilities that allow for remote code execution, phishing attacks, and the potential for credential theft. These vulnerabilities can lead to data breaches, unauthorized access, and the spread of malware.

Here’s how to strengthen your defenses.

  • Only use app passwords when absolutely necessary. Change to apps and devices that support more secure sign-in methods whenever you can.
  • Authenticator apps, such as Microsoft Authenticator, or hardware security keys (FIDO2/WebAuthn), are more resistant to attacks than SMS-based codes.
  • Stay up to date on phishing attempts. Attackers often bypass MFA by tricking users into revealing credentials or app passwords.
  • Keep an eye on unusual login attempts or suspicious behavior, such as logins from unfamiliar locations or devices. Limit those logins where possible.
  • Regularly update your operating system and the apps you use to patch security vulnerabilities.
  • Enable automatic updates whenever possible so you don’t have to remember them yourself.
  • Use security software that can block malicious domains and recognize scams.

When it comes to SMS-based codes, we want to emphasize one particular vulnerability: SIM swapping. It’s one of the internet security industry’s biggest worries.

It’s undetectable and it works like this:

  • A hacker puts your mobile phone number on a SIM card installed in their own phone.
  • Using their phone, they get your authentication code, which gives them access to a website or email account.

Despite this vulnerability, SMS-based codes are better than nothing. At a recent training seminar, we learned that many people don’t use any kind of 2FA or MFA methods at all. That is totally unacceptable.

We can help you – and your employees and family members – set up better security measures on all apps devices. Call us – 973-433-6676 – or email us to discuss your needs and develop an action plan.

The Time to Do the Right Thing

Be honest. How many times do you use a password for multiple websites because you need to remember it? You know that a string of 16 to 20 random characters upsets any pattern a hacker might use to steal a password for one site and maybe get into multiple places.

One of our clients recently told us how they saw the light, and it was a really gratifying conversation for me. He said: “I listened to what you said about passwords, and I did everything. Life is so much simpler now.”

It shocked me because that’s not usually what we hear. I wish more of our clients would get on the bandwagon when it comes to passwords and password managers. I can’t emphasize enough how password managers enable you to have unique, complex passwords for every website you need to access and how easy they are to use. You don’t always get to “stronger” and “simpler” as adjectives for a single concept.

What’s the “stronger” part of password managers? They generate those ideal passwords of 16 to 20 random characters that include upper and lower case letters, numbers and special characters. If everyone in your password chain – the people, companies and institutions you deal with – has a strong, generated password, that should make everyone as hack-proof as you can get. The problem is that the weakest link in the chain is the easy-to-crack password.

The” simpler” part is that you only need to remember one master password. (The hard part is making sure you have access to it in case you do forget it.) Before getting all his passwords into a password manager, our client said he would change a password by adding a number or a character because it was easier to remember. But it wasn’t simple. He would still need to remember what number or character he added to the old one, and maybe he had 50 passwords to remember – or carry around in a list.

A good password manager that can work across multiple devices can cost $50 to $100 a year. We believe that’s relatively cheap for the security you gain and the time you save from trying and retrying passwords or resetting them. The password manager becomes stronger and simpler when you combine it with facial recognition on a mobile phone.

Using a password manager and other forms of authentication will take some getting used to. But it’s worth it to take the time to do the right thing to protect your online security and your sanity.

Call us – 973-433-6676 – or email us if you need help in choosing a password manager and setting up the basics. We can also help you with other ways to authenticate your online access. See our article Pass the Key, Please.

 

Pass the Key, Please

If you’re sick and tired of managing passwords (see our article Take the Time to Do the Right Thing), take a new look at using passkeys and forget about the hassle. A passkey is a pair of cryptography keys generated by your device. A public key and a private key combine to create a passkey that unlocks your account. They may take some getting used to, but the security boost will be well worth the effort.

Microsoft is encouraging everyone to use a passkey when they sign up for a new account, and they’re moving away from the default of passwords for all new accounts allowing you to ditch them altogether. Just as a related side note, when you create a Microsoft account, do not create a local passkey. It will only work on the device you used to create the account, and that will defeat the purpose of being able to sign in from anywhere on any device.

A passkey is a pair of cryptography keys generated by your device. A public key and a private key combine to create a passkey that unlocks your account. If you remember going to your safe deposit box at the bank, you had one key in your possession, and you got a key from the bank for your visit. This is an electronic variation of the theme.

Microsoft introduced passkey support across most of its consumer apps a year ago, eliminating the need for two-factor authentication (2FA) or passwords. Now, it’s encouraging all new signs up to use passkeys as it removes passwords as the default. Websites are increasingly allowing you to passkeys for secure access.

Passkeys and password managers are able to work together for the most part. Usually, the device or software generating the passkeys uses a biometric authentication tool, such as FaceID or TouchID, to authenticate your identity. If your password manager is the passkey source, you can log in with your master password. Passkeys are unique to each app or website and stored in a password manager’s vault or your device’s keychain. Passkeys can also sync across devices, making them a convenient choice.

There are some holes in the passkey strategy that you should be aware of. The websites themselves can be the source of weakness in the security chain. Security experts say criminals can easily get around a passkey by stealing users’ validated browser cookies using malware.

While that puts an onus on the websites  to tighten up their operations, you can help protect yourself better. For example, don’t just accept the website’s data privacy settings when a box pops up on a website. Instead, navigate to the “Cookies” or “User Data” sections and choose the shortest available session duration. That way your cookies will expire automatically or whenever you close your browser window. You can also turn off various marketing and targeting cookies.

Again, passkeys take time to set up, and there’s a learning curve to using them effectively. We believe it’s well worth your time to start using them. Call us – 973-433-6676 – or email us to learn more about passkeys – and how they work with password managers. We can help you select and configure passkeys and password managers together and move you up to the next level of online security.