Everything Doesn’t Come Back

When most people get a new iPhone, they take it for granted that all their data and settings, etc. can be backed up to the cloud and then reinstalled on their new phones. Sorry, but that’s not always the case, and it will be a matter of greater importance when Microsoft makes you use the Authenticator app instead of SMS in your login process. It’s time to reset your thinking and the app.

Yes, it’s true that when you back up all your iPhone’s data to iCloud, you can have a high degree of assurance that your contacts, emails, photos, apps, etc. can be transferred from your old phone to your new one. But it’s not true for Microsoft 365 and the Authenticator app you need – or will need, come February – to access all your Microsoft accounts and shared workspaces, such as SharePoint.

In fact, SharePoint and the Authenticator app will require some special attention and planning once the Authenticator app is your only way to prove it’s you and your device that need access to the account. So, let’s reset your thinking on new iPhones, SharePoint and MFA. It’s important now if you’re planning on getting a new phone, and it will be critical in February.

Your best option is to call us to set up the Authenticator app on your new phone before you give up your old phone. It’s not always possible – if your phone dies or you lose it – but it makes life much, much easier. The process involves a lot of back-end work that’s all related to security. It’s work that Apple or your carrier won’t do when you activate your phone, and if you skip the step, you won’t be able to login to your Authenticator app without going through a complicated process.

When you have both phones, we can help you safely remove any sign-in methods linked to your old phone and re-register the app on your new phone. Because we do this a lot, we can make sure that no steps are missed as we go through all the on-screen prompts to link the app with your account.

Without having the old phone, you need to go through a number of administrative steps, which we can do if we are serving as your IT administrator. These include alternative verification steps that should have been set up. If they were set up with us, we should have the information available.

Whether you are getting a new phone or not, remember that starting in February, you won’t have SMS available as a backup for authentication. Therefore, it’s critical to make sure you have the most recent version of the Authenticator app on any device you will be using for SharePoint and other collaborative tools. If the app doesn’t work because it’s not properly registered, there is no way a SharePoint host, for example, will be able to allow you access.

We can help you and everyone on your team is able to transition seamlessly to a new Authenticator app with a new device. Call us – 973-433-6676 – or email us to make sure we can be available to help you re-register while you have your old and new devices. We can also answer any questions you may have to make sure your authentication systems work without interruption after SMS verification goes away.

Microsoft Demands Authenticity for Access

Microsoft will retire SMS (text messages) next February as a means of authentication for access to its accounts. I can imagine someone standing up in a meeting and saying: “We’re doing this for your own good.” It’s time to cut the phishing line.

Text messages can work as an authentication method, but the concept has vulnerabilities. It’s based on the assumption that when you get a verification code to authenticate your access, you have your cell phone in your physical possession. That’s true virtually all of the time. However, text messages are subject to SIM swapping, a technique hackers use to temporarily take over your phone number, and they can do it long enough to intercept the text without you ever knowing about it until something goes wrong.

There are also some locations in various cellular networks that are vulnerable to breaches, and it’s possible that a hacker can get access to the cellular network right as the text message is being sent to you.

If a hacker can gain access to a user’s Microsoft account while they’re logging in, they can gain access to contact lists and use them to launch phishing campaigns by email and text.

Authenticator apps bypass the cellular network. They generate a code from your phone, making them impossible to intercept. Many authenticator apps include additional security measures such as passcodes, passwords, or biometric authentication (like fingerprints or facial recognition), making it more difficult for unauthorized users to access your accounts even if they have your password.

This does force an issue, especially for businesses or other organizations that require employees to use their personal cell phones for business. Some employees fear their employers will be able to access their personal phones. That does NOT happen with an authenticator app. Instead, it will provide stronger security for remote logins.

If an employee leaves an organization, the authenticator app for that phone can be blocked by the employer.

To comply, we highly recommend that users have a fairly recent smartphone. Older devices may have problems running the app or require a time-consuming process to get them set up or install a backup process.

We can help any user set up an authenticator app on their phone. In most cases, it’s just a matter of walking someone through the process. Once it’s installed, it can be used independently of the employer for access to any website that offers it as an option to SMS authentication.

Call us – 973-433-6676 – or email us if you have any questions or need help setting up the app.

Block That Flow – Device Code Flow in Microsoft Entra ID

As you read this, I’m at the Xchange Security Conference in Dallas, and I learned something yesterday that I must share to protect your data. I will need to work with you to block device code flow in Microsoft Entra ID. In simple terms, it’s disabling a code system that’s similar to how you match a code on two devices when signing into Netflix.

Device code flow is typically used to sign into accounts on devices such as smart TVs or IoT devices. You enter the short code displayed on the device into a separate device, such as your smartphone or computer, to complete the authentication process.

It’s super convenient, but it also poses security risks, particularly related to phishing attacks. Attackers can exploit this flow to gain unauthorized access to accounts without needing to steal credentials directly. It’s especially critical to prevent phishing attacks.

Microsoft advises organizations to block device code flow unless absolutely necessary. This should help mitigate the risk of phishing attacks. At the same time, we will need to help you implement conditional access policies to control and restrict the use of device code flow. This includes specifying when and where it can be used.

We can tailor conditional access policies based on factors such as user location, device status, and risk assessments. This allows you to enforce specific security measures that align with your needs and compliance requirements. This approach enhances security by ensuring that only authorized users can access sensitive information.

Some of things we’ll discuss with you are:

  1. Determining which users or groups need specific access controls based on their roles or functions.
  2. Setting conditions based on the factors mentioned above. For example, you might require MFA for users accessing data from untrusted locations.
  3. Choosing the appropriate access controls, such as blocking access, requiring MFA, or enforcing device compliance.
  4. Testing all of your policies in a report-only mode to assess their impact without affecting users.
  5. Continuously monitoring the effectiveness of the policies and make adjustments as necessary based on user feedback and security incidents.

Call us – 973-433-6676 – or email us to discuss how to block the flow and develop access control policies for your specific needs.

Make Reading a Habit

We’re so overloaded with emails, texts, WhatsApp and other communications that we’ve fallen into the bad habit of skimming messages and probably doing the same with websites and documents. It’s time to get back into the habit of reading things more closely because not everything is as it seems.

For example, you may be expecting to get a payment from a customer or a client, or you may be asking someone for help. When you get an email that appears to be responding to your expectation, many people tend to click on something without reading all the details closely. That’s when disaster strikes because that click opens the door for a hacker.

Hackers have taken really good advantage of artificial intelligence (AI). They can use it to create exact matches for corporate logos and write messages with perfect spelling and the most appropriate language for their target. This makes phishing attacks easier to carry out, and phishing attacks are the most common means of hacking an email account.

The obvious way to combat AI-generated phishing attacks is to use your own RI – real intelligence. Read the sender’s address very carefully. Is it the real address that you know, or is there a slight misspelling, such as an extra letter, a missing letter, or transposed letters? Does it make sense to you that the sender has included an attachment or link?

If you’ve skimmed over a phishing email and didn’t catch a warning sign, you may have provided a hacker with an opening to your personal information and the ability to access your financial accounts. If you’ve skimmed legitimate invitations to use two-factor authentication (2FA) for websites and – especially – your email login credentials, you may have provided an opening for hackers.

Protecting your email login credentials is critical to your online security. If a hacker steals access to your email and you have no 2FA, they can go to your bank’s website, for example, and use the “forgot password” process to reset your password. Signs your email account has been hacked include the inability to log in with your correct password, notifications about changes to your account settings or messages sent from your account that you didn’t initiate.

The start of the year is a good time to get a security audit and initiate strong security procedures, such as 2FA measures and the use of a password manager with unique passwords for every website you and your employees or family members access. Call us – 973-433-6676 – or email us to set up an appointment.

DIY Email

We can expect cable and telecom companies to accelerate their exit from providing email services. Verizon/FIOS long ago transitioned their email management to AOL, which is really Yahoo Mail. Comcast is about to follow the same route, handing their email off to Yahoo. Getting live support from an actual person will become even more difficult. If you think Gmail is an answer, when did you EVER talk to a person from Google? It’s time to take matters into your own hands by getting your own domain and better managing how you handle your email accounts.

The problem with email from your cable or telecom company or from Yahoo/AOL is that it’s not a profit center – unless they can convince you to buy a support subscription. And buying a support subscription is the only way you’ll get a chance to talk to an actual human being if you have a problem.

Support can be critical when your email gets hacked. In cases with Comcast, for example, it can take human intervention to clear out any contact info a hacker may have planted in your account. Then, you’ll need to reset your password and set up a phone number and secondary email address that can be used for two-factor authentication (2FA) and notifications of problems if you get hacked again. Support people are generally good when you get to one of them after navigating their cumbersome phone trees. When you move to the Yahoo platform, it will be harder to get human support – unless you get a subscription. The cost of Yahoo Plus is $49.99 per year, which includes features such as ad-free email, priority customer support, and premium features for Yahoo Mail and Yahoo Fantasy.

Instead of sliding over to the Yahoo platform when your cable company ends its email, we recommend you go to Outlook or Gmail. Microsoft (Microsoft 365 subscriptions) and Google (lots and lots of ad revenue) have many other ways to monetize their relationship with you, so they put more stock in maintaining email support. Additionally, IT consulting services know the ins and outs of their systems and your needs. We can help you transfer all your folders and messages to your new system. We make it a point to provide the personal support you need when you have problems.

But a much better solution is to get your own email domain for both business and personal use. For security and management, the key benefits are:

  • Enhanced Security and Control: You can create better security processes to prevent unauthorized access, and you can create multiple addresses for specific purposes.
  • Improved Deliverability: Custom email domains allow for proper authentication and are less likely to be flagged as spam.
  • Long-term Consistency: Whether you’re a business, non-profit organization, family or business, you can keep your system going forever and ever if you wish, and people will always know where to contact you. It keeps life simple.
  • Flexibility and Scalability: You can create as many email addresses as needed for various functions. For businesses and organizations, you can manage functions or projects better. For individuals, you can keep various parts of life separate, such as a shopping address where you can get coupons or messages you only want to check occasionally.

 Getting your own email domain is no different from getting any other domain. We can help you with everything involved from securing a domain name to setting up all the email addresses you need. Then, we can work with you to transfer all your messages, folders, etc. from your old email account to your new domain. Call us – 973-433-6676 – or email us to answer all your questions about email accounts and get you set up with a system that can work for you long into the future.

The Key to Better Security

Many of us have replaced keyed door locks with electronic locks that use codes to unlock doors. They emulate the PIN technology we use to unlock our computers. Our computer technology, however, is going the other way. Physical keys – with PIN codes – are proving safer and more convenient in office environments.

In many offices, an administrative assistant or another employee may need to access the email or a website of an employee who is out of the office. Two-factor authentication (2FA) – which should be installed – usually requires access to a second device, such as a cell phone or an email address. If the account owner is not available, 2FA won’t work, unless the system is set up to work with another person’s devices. That gets really complicated, and it can be compromised.

A security key is a much more secure passwordless form of 2FA. The term security key should not be used interchangeably with passkeys, which are another form of passwordless security. Security keys are physical devices that typically work through a USB-C port, but they are not limited to USB-C. They can use USB-A ports and Apple’s Lightning ports.

When you or an authorized user logs in, that person enters your password and then uses the security key, which generates a unique code or signature to confirm your identity. That makes it difficult for unauthorized users to access your account even if they have your password.

Security keys utilize public-key cryptography, making them resistant to phishing and credential theft. They can be used with cell phones, and to be honest, not enough of our clients are setting them up on their phones. They can be more secure in public places.

Security keys work with virtually all password managers, but they need to be supported by website hosts and the cloud providers they use, such as AWS. That support is getting stronger as many services now recognize their importance for enhancing online security. Security keys are compatible with various platforms and applications, providing reliable authentication without the risks associated with cloud storage.

Security keys are relatively inexpensive to purchase, but they do require specific setup and customization. We can help you with a comprehensive purchase and deployment program. Call us – 973-433-6676 – or email us to discuss your needs and develop a program.

Fools and Their Money: A Seasonal Shopping Guide

“A fool and his money are soon parted” is a saying often attributed to Thomas Tusser, an English poet and farmer, who first wrote a version of it in his 1573 book Five Hundreth Pointes of Good Husbandrie. If only he could have envisioned today’s internet. AI will test your ability this year to differentiate the fake from the real more than ever.

As we scour the internet for bargains, hard-to-find items, and the best possible shipping terms, charities are making their annual push for donations, including major online solicitation campaigns. Scammers of all sizes are also using all sorts of AI tools to get between you and the companies you want to buy from or donate to.

Succumbing to a scam doesn’t make you a fool; the scammers and their tools are really, really good. AI helps them create exceptionally good graphic and video deep fakes. It helps them replicate flawless logos and improve their grammar, spelling, and syntax, all of which used to be dead giveaways of a scam.

But it would be foolhardy not to raise your antennae and harden your common sense with renewed vigilance. The cardinal rule remains the same: If something looks too good to be true, something is likely wrong.

Let’s look at some things that should raise a red flag:

  • Links: Whether in an email or especially on a website popup, don’t click on a link from a person or entity you don’t know or can’t verify. It’s the quickest way to allow a bad actor to plant malicious code that can compromise your data and that of anyone in your contact list.
  • Emails from Businesses, Charities or People You Don’t Recognize: The sender’s name may look legitimate, but you can hover your mouse over the sender’s name and see the real email address. If you’re not sure about anything you see, you have two options:
    • Delete the email.
    • Open a new browser window and type in the name of the business or charity as you know it to be. You should be able to find a phone number to call to verify if it’s from a legitimate organization.
  • Unsolicited Text Messages: This is another form of phishing known as smishing. Treat them the same as an email.

Be careful of really good prices when shopping for all products and services. Prices that are too good to be true may be outright fraudulent or carry terms and conditions that are extremely unfavorable to you. Check closely to make sure a product or even an airline ticket or hotel room is not offered by a gray-market or third-party provider. Read the terms and conditions and look for authentic user reviews. Again, if something looks funny, it should raise a red flag.

No matter what you’re looking to do online, it’s more important than ever to use two-factor authentication (2FA) for all the websites you can. While a code sent to your computer or phone is better than nothing, more advanced forms of 2FA, such as authenticator apps or biometrics, rely more on information stored on a specific device, making them more secure.

If you think you may have been hacked, call us – 973-433-6676 – as soon as you possibly can to assess the breach and take steps to close up your security holes.

Secure Your Email

Security measures such as encryption and 2FA help make email communications more secure, but they have their own issues for many users and fall short in some ways. Use them wherever you can, but remember that nothing works better than common sense, especially when you click on links in an email.

The majority of breaches of computer systems through email are user-initiated. A user clicks on a link – usually because of carelessness – that results in giving up login credentials for a website or a technology system. Encryption is no protection against a user causing a breach.

Security holes in encrypted email include human error, such as failing to encrypt messages or falling for phishing attacks, reliance on imperfect encryption in transit where servers may not support it, vulnerabilities on the recipient’s device like malware or unsecured devices, and issues with key management, such as weak passwords or lost private keys.

Let’s focus on those last two points. Securely managing and distributing encryption keys is complex. If private keys are lost or stolen, recipients may be unable to access their encrypted messages, and attackers could use stolen keys to decrypt emails. Easily guessed passwords for email accounts can be compromised, allowing attackers to access encrypted emails on a device.

Attackers can also exploit complex email systems by compromising intermediary servers or utilizing features that weaken security. These can include URL redirects to bypass encryption and deliver malicious content.

Instead of adding complexity, it might be better for most organizations to reemphasize some proven basics. One of them is 2FA. As imperfect as it is, 2FA can utilize a device such as a cell phone, which should be in the hands of the user. Yes, it can be defeated, but that happens if a system has already been breached and the attacker has changed the phone number and/or email address of the user.

The other basic is common sense. Don’t click on a link in an email unless you are 10,000 percent certain it’s correct and legitimate. AI is making it harder to detect malicious links, so users must be more vigilant. Don’t be in a rush, especially if you’re juggling several tasks. The safest way to respond to an email with a link or phone number is to open a browser and go to the website of the company. You should be able to find a phone number and maybe a legitimate email address to contact.

We can help you with email security in two ways. One way is to conduct a security audit of your email system to find and patch holes. The other way to help you set up 2FA systems, including biometrics and authenticator apps. Call us – 973-433-6676 – or email us to discuss your needs and possible solutions.

Authenticator Apps Can Protect You from SIM Swapping

We hate taking extra steps, especially if we think they’re complicated. But with the rise of SIM swapping, you might want to bite the bullet and get used to using an authenticator app.

The benefits of using an authenticator app for 2FA were illustrated by the problems of a new client who was victimized by a SIM swap of their phone number. The SIM swap caused untold problems, including untangling them based on hard-to-find phone records.

Again, just to recap from last month, SIM swaps happen when a bad actor is able to convince a carrier that they’re you and that you need to transfer your phone number to a new device. While the bad actor has your phone number hijacked, you lose your cellular service. You can’t make or receive phone calls or send or receive texts. If it happens for a short time and you’re not using your phone, you’ll never know it happened. If you’ve set up a form of 2FA that involves getting a code through a text message, you’ll never know about that, too.

An authenticator app is different. It uses a Time-Based One-Time Password (TOTP) algorithm to generate unique, time-sensitive codes for 2FA. The apps are set up on a mobile phone, and the process can be difficult for some. We suggest professional help to avoid untimely problems down the road.

When you type in a link from a computer or a phone to link the app to an online service, both the app and the service’s server use a shared secret key and the current time to independently generate the same time-sensitive codes. When a user logs in, they enter the code from the app, which the server verifies by comparing it to its own generated code. The verification code almost always comes in on your cell phone, and the authenticator app automatically regenerates the code every 30 seconds.

The key point here is that the authenticator app is tied to your device, not your phone number. So, if the bad actor tries to enter a website or app link that uses an authenticator app, they will not see the code. It will come to your device. If you don’t recognize the reason for that code being sent, it’s a big, bright flag that someone may have hijacked your phone number or breached your security in some way.

Of course, the website or online app being accessed must offer an authenticator app as a security measure. More of them are offering it as a security measure, and you should take advantage of it wherever you can. If you’re on your computer, you need to have your phone handy, and if you’re using your phone, it will take a little juggling. But it’s well worth the effort.

We can help you set up Microsoft Authenticator or any other authenticator app. Call us – 973-433-6676 – or email us to learn more about the app and get help setting it up.

Secure Your Email

Email security continues to be the most vulnerable security link in your email chain. Ninety-six percent of all phishing attacks use email, and some three billion emails are launched daily. Phishing can cost businesses $26 billion annually. The more email accounts you have, the more vulnerable you are.

One of our clients had six email accounts, all of them created for a variety of legitimate reasons. The problem is that it meant they had to guard six doors against intruders. That’s worrisome enough, but if you use multiple email clients, such as Outlook and Gmail, you need to deploy your security measures in line with each client.

Google’s Gmail has a particular vulnerability. According to a report from Malwarebytes, Russian hackers were able to bypass Google’s multi-factor authentication (MFA) in Gmail to pull off targeted attacks. They did it by posing as US Department of State officials in advanced social engineering attacks, building a rapport with their target, and then persuading them to create app-specific passwords (app passwords). App passwords are special 16-digit codes that Google generates to allow certain apps or devices to access your Google Account securely, especially when you have MFA enabled.

Outlook faces several significant security challenges, including vulnerabilities that allow for remote code execution, phishing attacks, and the potential for credential theft. These vulnerabilities can lead to data breaches, unauthorized access, and the spread of malware.

Here’s how to strengthen your defenses.

  • Only use app passwords when absolutely necessary. Change to apps and devices that support more secure sign-in methods whenever you can.
  • Authenticator apps, such as Microsoft Authenticator, or hardware security keys (FIDO2/WebAuthn), are more resistant to attacks than SMS-based codes.
  • Stay up to date on phishing attempts. Attackers often bypass MFA by tricking users into revealing credentials or app passwords.
  • Keep an eye on unusual login attempts or suspicious behavior, such as logins from unfamiliar locations or devices. Limit those logins where possible.
  • Regularly update your operating system and the apps you use to patch security vulnerabilities.
  • Enable automatic updates whenever possible so you don’t have to remember them yourself.
  • Use security software that can block malicious domains and recognize scams.

When it comes to SMS-based codes, we want to emphasize one particular vulnerability: SIM swapping. It’s one of the internet security industry’s biggest worries.

It’s undetectable and it works like this:

  • A hacker puts your mobile phone number on a SIM card installed in their own phone.
  • Using their phone, they get your authentication code, which gives them access to a website or email account.

Despite this vulnerability, SMS-based codes are better than nothing. At a recent training seminar, we learned that many people don’t use any kind of 2FA or MFA methods at all. That is totally unacceptable.

We can help you – and your employees and family members – set up better security measures on all apps devices. Call us – 973-433-6676 – or email us to discuss your needs and develop an action plan.