Here’s Lookin’ at Your Password

Passwords are just as painful for companies that require them as they are for you. And, they’re expensive as well as subject to theft. What are we looking at in the near future? The eyes have it.

Microsoft and Apple are moving ahead with facial recognition to replace passwords. The technology is getting better and better, and, let’s face it, once their systems can recognize you and match you up with other records, you won’t have to remember some arcane, complex password – which you could mistype…

Going “password-less” would create a huge economic benefit for the business world. At our recent Microsoft IT conference in Orlando, the company said lost passwords are their biggest IT cost. In the month of July, they spent $686,000 in IT-related costs for restoring forgotten passwords. Annually, the cost is roughly $12 million.

The way systems work, it’s always to your benefit to say you’ve forgotten your password if you risk being locked out of website or application, such as your Office 365 account or a bank account. While their security needs dictate making a password reset more difficult, the complexities raise costs.

Also, in today’s world, all of these systems and interactions can be hacked, and dark-web operatives can change your letters, numbers and special characters once they’ve cracked your code. Your face is another matter. And while someone at some point in the future will figure out a way to defeat facial recognition, I believe this gets us ahead of the curve – for now.

Microsoft has facial recognition tools available for computers that have Windows 10 with Hello installed, and Apple has it for iPhones and iPads. While you can use them now for their own websites and online apps, it will take some time for the rest of the online world to get there. Your bank or credit card company, for example, will need to develop tools that work with all platforms and operating systems, and they will need to make sure online performance doesn’t suffer.

One online security app that some banks encourage their customers to use is Trusteer. While it can be effective as form of two-factor verification, it can slow down a user’s computer. We’ve had numerous incidents of clients calling us about slow computers, and Trusteer has been the problem. Once it’s uninstalled, performance levels return to what they should be.

There are other two-factor authentication methods you can use, but you’ll be up against that issue of whether you want more convenience or more security.

If you have any questions about facial recognition tools or two-factor authentication, call us – 973-433-6676 – or email us. New technologies can be scary, mostly because you can worry about making a mistake somewhere that can lock you out of the info and apps you need for work and life. We can help you navigate the brave new world with confidence.

Equifax and Protecting Your Identity

If anyone learns just one lesson from the recently disclosed hack of Equifax, the credit-rating service that has the keys to many people’s vital data, here it is: You have to take your data protection into your own hands.

We had a really queasy feeling when we saw the news reports, and a lot of the information didn’t pass our initial smell test. First, why did it take so long for Equifax to notify its customers and authorities? More than a month went by before there was any announcement. Second, when Equifax did respond, it seemed ineffective. You can go to https://www.equifaxsecurity2017.com/, enter some information about your name and Social Security number and see if you have something to worry about. From there, you need to scroll to the bottom of the page to find the Potential Impact button, which will take you to https://www.equifaxsecurity2017.com/potential-impact/. Most people will learn that their data has possibly been compromised.

If you don’t want to fuss around with the internet, you can call a dedicated call center, 866-447-7559, from 7 a.m. to 1 a.m. ET every day to discuss your account.

You can go back online and enroll in a credit monitoring with program with Equifax – or with Experian or TransUnion, the other two credit reporting agencies in the US. Equifax will give you the program free for a year without requiring you waive the arbitration clause and class action waiver included in the Equifax and TrustedID Premier terms-of-use for this cybersecurity incident.

We strongly recommend you take these additional steps:

  • Place an initial fraud alert on your credit records. Again, it doesn’t matter which reporting agency you use. They all “talk” to each other. When lenders see the fraud alert when checking your credit, they must take additional steps to verify that it is actually you who wants to open the account. Initial fraud alerts are good for 90 days, and you can renew them or cancel them as it suits your needs. Equifax is offering an “automatic fraud alert” feature, which automatically renews itself every 90 days.
  • Freeze your credit. This makes it virtually impossible to open an account in your name because it blocks access to your credit report. Nobody can complete a credit check, so someone else won’t be able to open an account. A credit freeze won’t expire until you choose to remove it, and you can cancel and reinstate them as needed. However, you must place a credit freeze with each bureau individually, and that can come with a fee, usually $10 or less, depending on what state you live in or if you’re already a victim of identity theft.
  • Sign up with a credit monitoring service. We have a service that does this, but there are others.
  • Check your bank and charge accounts and your credit score regularly. If you see something that raises a red flag, contact your financial institutions or credit reporting agencies immediately.

 We spoke to a number of people involved in the storage of highly sensitive personal information, and they all reminded us that you need to protect more than your financial information. Any organization that stores your medical and insurance records is vulnerable to a hack, and that can lead to additional problems. For example, someone who has your medical records can file a fraudulent medical insurance claim using your records.

That, of course, gets us back to advice you’ve often heard from us:

  • Install all updates for operating systems and application software as soon as they are available for computers and devices. The updates almost always include security patches and bug fixes.
  • Manage your passwords. Keep them long and complex and change them frequently.
  • Keep your networks secure by installing updates, managing passwords effectively, making sure your firewall and anti-virus protection is active, and limiting access to administrative functions.
  • Use common sense. Don’t click on links within an email from someone you don’t know or on something that looks out of the ordinary from an address you recognize. Email addresses are easily hijacked – and not necessarily because the owner of the address did something wrong. Don’t click on pop-up ads or ads with offers that are too good to be true.

Are we safe on the internet anymore? No, but you can be safer if you take ownership of your security. We can check security settings and run deep scans to help keep you as safe on the internet as possible. Call us – 973-433-6676 – or email us to set up a security audit or answer any questions you have about managing your security.

Cyberbullying Hits Home

When you know a family that’s been victimized by cyberbullying, you take a closer, more personal look at this problem as both a parent and an IT professional.

As I was waiting for a flight home the week before last, I saw something on Facebook and had a sinking feeling. I knew the family through my affiliation with the Morris County Chamber of Commerce, and I had heard about a service earlier in the week for a young woman in our community, Mallory Grossman.

It was a suicide that came to a head because of cyberbullying. It brought home problem that is plaguing mostly youngsters but also people of all ages. The internet allows anyone to post the meanest messages imaginable and largely stay anonymous.

The solution is not a tech issue because this problem is rooted in how we function as a society. Some people have cruel senses of humor, and in the absence of personal filters, there are few filters to prevent them from spewing venomous posts. When the target of cyberbullying is experiencing other issues, which the bully likely doesn’t know about (and could selfishly care less), it’s like pouring gasoline on a fire.

I honestly don’t know what the answer is. As parents of two children approaching their teenage years, my wife and I are extremely concerned. Perhaps we need an even more concerted effort to provide better education for parents and students, and maybe that can be done through the school curricula in coordination with programs run by PTAs and/or business associations. The business associations can encourage their members to provide some kind of education program for their employees.

Technology measures by themselves will be ineffective for many reasons. Chief among them, very few parents have the capability to totally monitor and control their children’s online activity. Even for those of us who know a lot about technology, what will it accomplish? It won’t teach our kids about social responsibility. Instead, it will motivate them to find ways to break our technological measures, and kids in groups are pretty good at figuring out how to override our controls.

Further, what’s to stop any kid who has no access to some websites from going to a friend’s house and getting online there?

Any blocking we can do is ultimately temporary, but if it can be a sufficient delay to prevent just one tragedy, it helps. If you have any questions about what you can do and need any help in setting up parental controls, call us – 973-433-6676 – or email us. And that goes double for working together on what we really need to do as a community to fight cyberbullying.

Home Router Vulnerability

Your home router is easily your most essential device for connecting businesses and family members to the world. It’s also the most vulnerable opening for hackers. How vulnerable is your router? One good place to look is Port 7547. If it’s closed on your router, it’s safe – for now. If it’s open, you’re vulnerable.

You can test your router by visiting a blog post from Wordfence, which makes a firewall and malware scanner that protects over 2 million WordPress websites. They also monitor attacks on those sites to determine which IPs are attacking them and blocks them in real-time through a blacklist. They recently published a post showing that 6.7 percent of the hacks they see on WordPress sites comes from hacked home routers. Hacking gives them access to workstations, mobile devices, Wi-Fi cameras, Wi-Fi climate control and any other devices that use the home Wi-Fi network. From there, they can implant malware or viruses in your system, which can lead to all sorts of problems.

Hacking through an open Port 7547 is known as the “misfortune cookie,” or MC. ISPs (internet service providers) use the port to manage home routers, and they should configure their network to prevent access by outsiders. But many do not block the port, leaving you vulnerable. By clicking the Scan Me button on the post, you can find out if it’s open or closed.

If it’s closed, your OK for now. You should check back periodically, however, because your ISP could open it for some reason and then forget to re-block it. If it’s open, Wordfence suggests you immediately reboot your router, which may flush out malware. You can also run a virus scan on all computers and devices in your home and update your operating systems. Almost anyone can take these steps.

You may be able to take the more advanced step of upgrading your router firmware, but in most cases, you can’t. In all cases, you can contact your ISP and let them know there’s a security vulnerability in your home router and ask them to help you fix it. You can specifically mention Port 7547.

If you are unable to take all the steps mentioned above, call us immediately at 973-433-6676. We can help you reboot your router and may be able to help you close the port or upgrade the firmware. Just have your router name and model number handy to help us serve you better. If necessary, we can coach you in dealing with your ISP to resolve this important security issue.

If you want to take preventive action on Port 7547 vulnerabilities, call us – 973-433-6676 – or email us to schedule an appointment. Remember, you are your router’s first line of defense.

Don’t Wait When Hacked

A client got hacked at 5 p.m. and discovered it at 8 p.m. They waited until the next morning to call us. Our advice to them was to shut down their system. Our advice to you is don’t wait – but please use some common sense. We don’t appreciate calls at 5:30 in the morning because you can’t connect to the internet or get your email, but a hack is a whole other story.

If you think you’ve been hacked, shut down – as in “power off” – your computer or your system immediately. If nothing’s running or connected, nothing more can be taken from you, nor can anyone get deeper into your system. Once you call us, we can examine every part of your system and help you take steps to secure it before you and everyone in your business or home goes back online.

If we’ve learned anything from news reports, no system is immune from attack. But there are a number of steps you can take to make an intrusion more difficult – and for small businesses and homes, they may be enough to deter anyone from making a huge effort to invade your system.

In the case of the client who was hacked, he did not have administrative rights to his computer – and that was a big help in minimizing the damage. Administrative rights give those who have them the authority to make all sorts of changes to a computer or a group of networked computers. In addition to adding and removing programs and managing data files, administrative rights can be used to grant permission to other users to perform all of those actions.

In a small business, it makes sense to give several people administrative rights to keep business flowing smoothly. Even if you have automated systems to take care of certain functions, you may need to give people permission to do certain things. However, you need to pay attention to security to benefit from the convenience of this flexibility. We recommend:

  • Keep the number of people who need administrative rights to a bare minimum.
  • Make sure those people change passwords frequently and that they use strong passwords.
  • Limit permissions to certain functions to prevent a hacker from getting carte blanche to your entire system.
  • Set up separate users and log-in credentials for performing administrative functions and delete them after those functions are performed.

The same recommendations can apply to a home computer or home network, with the requirement that children and seniors should not have the ability to install or remove programs.

We also can repeat steps we’ve suggested before:

  • Do not use any simple usernames and passwords for any piece of equipment that is connected to the internet. Every device has a default name and password, and hackers know them all.
  • Use strong passwords and change them often. Strong passwords are usually complex passwords. Hackers have software to figure out certain patterns of numbers and letters, and they can pick up information about anyone from public records. Try not to relate your passwords to that information, but for any password, use a combination of upper and lower case letters, numbers and special characters.
  • Download and install updates from the publishers of your application software. In most cases, the updates contain bug fixes and patches to improve the security of your applications.
  • Keep your anti-virus and malware software up to date and active.

Again, if you get hacked, don’t wait to call us. Time is of the essence. Shut down everything and call 973-433-6676 for immediate help.

Of course, preventive measures offer the best protection. Call us or email us to arrange a security audit of your system. And don’t wait until you’re hacked to do it.

Smarten Up! The Spoof is On

I was at a client’s office when the email – to her as president of a service organization – arrived, asking for a wire transfer of money. Other members of the organization got the same message, and some actually sent money. A scammer had spoofed a name or email address that was recognizable. This is becoming a growing problem. Is technology making us stupid?

The answer is “no,” but it is making us careless because it gives us the ability to do too many things too easily with too little forethought. That, in turn, leads to doing stupid things – and that’s what spoofers and other Internet-based thieves are counting on now and will continue to do so.

Email seems to open the doors to your computer and your data more conveniently than anything else. The biggest breach opportunities come when you click on something or follow through on instructions because you didn’t take the time to look carefully at an email and when you send sensitive information in an unencrypted email.

Spoofing is the most effective way to get you to open an email and link yourself to trouble. It’s remarkably easy to recreate a company’s logo and attach a fake email address to it. When many people see what they think is a legitimate logo, they just click to open. If nothing jumps out as a red flag, they’ll continue to a bogus website, and BINGO, it’s too late.

People are particularly susceptible to spoofs at this time of the year. Online merchandise sales continue to grow at holiday time, and merchants or shipping companies often send tracking info so you’ll know when your packages should arrive. If you take a little time to look at the message, you’ll probably see that the domain attached to the shipper or merchant bears no resemblance at all to the company. You might also note that the message itself is generic – and it likely has misspelled words or syntax that just doesn’t fit how we converse in the United States.

If you want to verify the tracking on a package, you can go onto the merchant’s or shipper’s website and enter a tracking number you received when your order was confirmed. If you don’t have that number, there is often a way to get the information.

Similarly, as we move from the holiday season to the tax season, be especially careful of financial-related information. There’s a reason why your financial advisor doesn’t let you leave trade information on voicemail or email. They don’t want your financial data left out in the open, and you should feel the same way. When financial advisors and institutions – and even healthcare providers – have messages for you, they generally tell you to access them on their secure websites – and require you to sign in.

DO NOT click a link on an email you think was sent to you by anyone who wants financial, health or other sensitive personal data. If you know the website, open a new browser window and go to the website by typing in the website address. Even if the domain name in an email looks correct, something like “[email protected]” can really link to “you’vebeenscammed.com.”

And, of course, never, never send user names, passwords, credit card info, bank accounts, Social Security numbers (even the last four digits) or other personal information in an email. Unless you and the other party have activated a mutually agreed-upon encryption process, the data is wide open. Email messages can go through multiple communications systems, and it’s impossible to know when a data thief is waiting to pick off any number of random messages at any point. They can pick off thousands in the blink of an eye and then take their own sweet time pulling out key info and wreaking havoc.

It all goes back to convenience vs. security, with a dose of distraction thrown in for good measure. We’ve had clients accidentally open a door to their computers, and the invaders took their info and denied the owners access to their systems. Fixing it on the computer end generally requires a visit from us, and then there’s the nerve-wracking hassle of working with other companies to close your breaches. When you have to go through all of that, it’s more than just an inconvenience.

We’re not telling you anything you don’t know. We are telling you to take a deep breath and a closer look at your email and the links inside them. We’re also telling you not to send sensitive information in emails. If you think you may have had a breach in your security, we can help you patch up your computer system. We can also help you set up an email encryption system. Call us – 973-433-6676 – or email us with your questions or to have us help resolve an issue.

Behind Last Month’s Internet Breakdown

We’ve harped for years about the inherent conflict of convenience vs. online security. That conflict reared its ugly head during the distributed denial-of-service attacks, using – maybe – millions of computers to hit some of the world’s largest and most popular e-commerce and news websites.

Investigators have been able to pin part of the cause on hackers using IP addresses commandeered from millions of home devices, commonly called IoT (Internet of Things) – such as interior and exterior security cameras, doorbell and baby monitors, thermostats, etc. – that are increasingly popular with consumers. Too many people install them on their Wi-Fi networks and never bother to change default user names or passwords. That just leaves the door wide open to have their devices hijacked and used for malicious purposes.

From our point of view, it’s what happens when we get lazy and sloppy because we are so tuned into convenience. And, a DDoS attack can be the least consequential problem for you, personally. The hacker can gain control of your device and peak into your house at will – and even change your thermostat settings.

Users are not the only sloppy parties in this turn of events. The device manufacturers share the blame because they don’t require you to reset your user name or password as part of the installation process. After all, they don’t want the blame for your inconvenience, and we think that’s wrong. They can require you to reset user names and passwords as part of the installation process.

You can help prevent these DDoS attacks by making sure you change user names and passwords for the devices during the installation process. You can further protect your privacy by making sure your Wi-Fi network has a good, strong password. Too many people leave the default user name and password on their routers, too.

We should note that businesses, including professional services providers, can be just as lax as home users. We’ve had client systems hacked because their system administrators did not set up stronger log-in credentials.

We strongly urge everyone to have somebody look at their networks and IT systems and procedures once or twice a year. This may not be a comfortable analogy for some people, but even though you brush your teeth and floss every day, you still maintain better health when you visit the dentist once or twice a year for a cleaning and exam.

If you avoid the visit because of expense, it’s costlier – and more painful – to fix the problem instead of preventing it. What would be your cost for system downtime and repairing security breaches? Contact us by phone – 973-433-6676 – or email to find out what our security audit would cover for you and to set it up. In today’s world, you can’t afford to overlook any possible weakness.

Upgrade for Better Browsing

Browser performance is becoming a bigger issue as browser updates and website advances require new versions – and even new computers. Not upgrading can also present security issues.

The problem we are seeing is a combination of clients with older computers using older versions of their favorite browsers trying to view websites that have advanced features the browsers and computers can’t support. The problem manifests itself when visitors can’t access a site or they can’t move around the site and use all of its features. They also start to see pop-up messages to upgrade their browsers.

We all tend to keep using our older systems and make a lot of allowances until something has to give. In this case, it’s your browser and/or computer. If your computer is not woefully out of date, you likely can upgrade your browser, but there are a few things to keep in mind.

Most important, don’t click on an upgrade pop-up message without being absolutely sure it’s a legitimate message. We have not heard of scammers and hackers using this type of pop-up to get your money or your data or both, but if they’re doing it already…

You can always go to the browser publisher’s website (Microsoft, Firefox/Mozilla, Chrome/Google, Apple, etc.) and download a browser upgrade from there. We believe it’s a safer way to do it. If you happen to download more than one upgraded browser, make sure you designate only one as your preferred or default browser. That will ensure that links you click – such as the link from our email message to get to this article – open in the browser you prefer to use.

If your computer cannot support a browser and a website you use, you should consider upgrading your computer. It’s not really an arbitrary suggestion; it’s all about security.

From the website owner’s point of view, they constantly need to incorporate new software to cover multiple platforms, such as Windows or Apple computers and a host of mobile devices. At some point, they just cannot incorporate the software needed to function properly on older browsers and older computers. Some of the reasons may include the ability to perform e-commerce transactions efficiently and securely, the storage of financial and medical records, the protection of encrypted messages and vulnerability to a variety of attacks.

Those needs take into account legal and insurance issues that affect their decisions about the software and systems they use and support. (We will discuss those in a future issue of Technology Update).

For you, the computer user, you need to consider costs – and that goes beyond just the cost of a new computer.

  • What is your cost if you cannot purchase business items online from your preferred vendors?
  • What is your cost if you cannot purchase any items online – personally or for business – because your browser (and computer) may have security risks?
  • What is your cost if you cannot bill customers and clients because of doubts about your security (see Protection in the Third-Party World)?
  • What is your cost if your data is breached?
  • What is your cost if you are found liable for others’ data breaches?

Browser requirements are likely to get tighter as we go deeper into our Internet-based world and as security becomes an even more important concern for website owners. We can help you get the most up-to-date browsers onto your computers, and we can help you plan an orderly upgrade of your personal and commercial systems to take advantage of any possible cost efficiencies. Call us – 973-433-6676 – or email us to help keep your website browsing as safe and enjoyable as possible.

Protection in the Third-Party World

The reliance on third-party providers for so many data servers continues to grow. That increases your dependence on other people’s diligence, and it increases your responsibility to be more vigilant.

“NJ Biz” recently devoted a series of articles to many aspects of online safety and protection, and one of them focused on issues we’ve been discussing: verifying the integrity of third-party providers and two-factor authentication. Third-party providers are being used more and more by businesses of all types because they can scale up faster and more economically to handle any number of users from any number of locations.

However, you need to rely on those providers to protect your data, and according to Jonathan Dambrot, CEO and co-founder of Prevalent, a Warren-based IT security, compliance and third-party risk management service provider, the security environment is far from ideal. In one of the “NJ Biz” articles, he says: “Depending on who you talk to, between 40 to 80 percent of all data breaches are happening at third-party vendors, because that is where most of the data is. People are focusing on third-party data security risks because criminals are going after the data where it resides.”

If a provider has weak security, it can be more vulnerable to an attack by hackers. But government and industry leaders are getting together to help you. Last December, Congress passed The Cybersecurity Act of 2015 to encourage companies to share with the government and each other technical details of hacking threats. This regulation reflects a growing acceptance of collaboration as a way to access data security threat intelligence and enforce vendor compliance.

It’s the latest of several early steps in a fluid regulatory process.

“Regulators have put controls in place over the last two-and-a-half to three years, and there is a combination of reasons why third-party or downstream risk has become really important to people as they look at their cybersecurity,” Dambrot said. “Third-party vendor and business associate risk has really changed as vendor services have changed. Years ago, people weren’t talking about cloud usage as much as they are today, and so, regulators will continue to change the wording to match the way data is handled.”

This collaborative effort, however, doesn’t get you off the hook. On the contrary, you need to do more. Two other articles we recently came across expand on two security matters we discussed last month: two-factor authentication and asking the right questions of any data-services provider.

Rather than re-explain some of the more effective ways to use two-factor authorization (2FA), we can refer you to a recent post by Ed Bott on ZDNet. There are many options available, including apps you can download to your mobile devices.

As he asks, “How much are your private communications worth? How about your reputation? Your bank account? Your identity?”

We know they are priceless to us but have great value on the black market. With 2FA enabled for a cloud service, any attempt to sign in on an unrecognized device might require you to enter a secret code that’s either received as a text message or generated by an authenticator app on your previously registered smartphone.

“Depending on the service, entering a code might automatically establish the current device as trusted, or you might be given the option to trust the current device,” he writes. “If this is your new computer or tablet (or a new browser), and you have this option you should say yes. When you’re signing in on a device you don’t control, you shouldn’t allow it on your trusted list. One way to make sure that the device isn’t marked as trusted is to use a browser in private mode (aka incognito in Chrome). If a bad guy manages to steal your credentials for an account that’s protected by 2FA, he’s unable to do any damage. Because he is signing in on an unrecognized device, he’s required to provide a second form of authentication. Without access to your trusted device, he can’t authenticate himself and can’t go any further.”

There are many variations on that theme, and we can help you find one or two 2FA programs that can best meet your needs and comfort level with your devices. But you need to be sure the data center that houses your information has all the right policies and procedures in place, too.

Services provider vXchange, which estimates some 78 percent of work-related data will be on the cloud by 2018, has a list of 10 questions you should ask your next data center manager, and we suggest you read them to get an idea of what’s at stake. They’re questions we ask of ourselves and our provider to minimize your risk and ours.

While you don’t get total control of your data, you will have a much better grasp of the possible risks and the steps you can take to maximize your protection.

As your trusted IT service provider and advocate, we have 2FA techniques we prefer and providers with which we have established relationships. We can answer your questions and address your specific concerns in selecting and installing 2FA programs, and we can help you select and vet data centers. Call us – 973-433-6676 – or email us to set up an appointment to discuss your specifics.

Preventing Viral Infections

Early shopping season reports showed online purchasing way up over in-store shopping this year. If you know what you want and what you want to pay for presents, online shopping is convenient and efficient. We’ve written a lot over the years about being safe online, but you’d be surprised who could be infectious.

One culprit, for example, could be an electrical contractor or video-surveillance-system contractor who does work at several locations for a national or regional retailer. That contractor may use some sort of billing app to invoice the retailer – let’s say it’s Target or Walmart, but it could be anybody; we’re talking about the size of the company. That invoice goes somewhere in the retailer’s massive data management program.

Now, let’s say that contractor hasn’t had the time to keep all of their security software update – or they’re using some free antivirus program that has more holes than a slice of Swiss cheese – or they’re using easily cracked passwords.

Do you see where this is going? A hacker gets into the contractor’s computer system, simply because it’s open. Once inside the system, the hacker sees that the contractor has done business with the large retailer and is able to find all the information the contractor uses to get into the system. Once hackers are in, they have the opportunity to explore other parts of the system, and that’s where it’s possible for them to get all sorts of personal data about the retailer’s customers.

It could only be email addresses, but that may be enough to help them launch a scam – which we’ll get into later in this article. They could also get into credit card information, which leads to financial consequences.

As a business or consumer, what can you do to keep from being infectious? First of all, make sure all of your antivirus and malware software and firewalls are up to date and activated. We always advise going beyond free versions of all of this software. The paid versions are stronger and better supported.

Second, make sure you have strong passwords and change them. Yes, it’s an inconvenience, but that’s the tradeoff you need to make to protect your security. We also recommend using additional security measures such as two-factor authentication or requiring a text notification being sent to your cell phone when you change a password. The text notification will tip you off if someone is impersonating you online.

Third, be VERY, VERY CAREFUL at this time of year. Holiday season is scam season. When you buy online, it’s common to receive an email from a retailer or shipper with a link to track your packages. With thefts of packages commonplace, it’s useful to know when a package will arrive to make sure you or a neighbor can take it in. With everyone rushing to complete shopping and get work done, it’s all too easy to click on a link, and that’s the opening for scammers to get into your system.

Another scam is in the travel industry, such as a special offer purportedly from a hotel or airline. Again, you invited to click a link to take advantage of a “great opportunity.”

You should do your best to verify the authenticity of any link before clicking it. One effective way to check is to hover your mouse over the link. You should see the link’s origin. If it looks funny, avoid it. Even better, open your browser and go to the company’s website to see if you can find the information contained in the email. If it’s legit and available, you should be able to access it. Your other option is to pick a phone and call the company – using a number provided on its website, not from the email.

The sad truth is that no person, business or government is safe from hacking. The question is not if you will be hacked, it’s when you will be hacked. And the consequences can be even more widespread than they used to be. Some of the viruses now get into your computer’s firmware. That means that even if you wipe your hard drive clean and reinstall your operating system and all your other software, the virus is still there.

If you think you’ve been hacked or have a virus in your computer, call us or your IT specialist immediately. We know where to look and have the tools to discover your breach and mitigate the virus if it’s all possible. Call us – 973-433-6676 – immediately if you have a security concern or contact us by email if you have any questions about your online security.