How CPA Firms Can Benefit from Managed IT Services

/in , , , /by

Let security and confidentiality be your watchwords!

When it comes to safeguarding your CPA firm’s confidential data, there is zero tolerance for risk. CPAs rely upon various forms of technology to gather data – whether it is a tax return or an independent audit.

CPA firms have made great strides by implementing such technology as electronic data management systems, client portals, and cloud-computing systems. However, records maintained by CPA firms must remain confidential because of professional standards, statutes, and regulations governing record retention. Data breaches can happen in numerous ways, including the following: fraud, hacking, improper disposal of data, or even a lost or stolen device.

A CPA firm will need their IT department (or an outsourced Managed IT Services vendor) to implement and maintain a comprehensive list of data and network security controls. It is helpful to understand the basics:

Perimeter security. This first line of defense includes firewall and intrusion detection systems, in addition to intrusion prevention systems. These should be configured with appropriate restrictions to block and filter both incoming and outgoing Internet traffic.

Endpoint security. Endpoint security requires each computing device on a corporate network to comply with established standards before network access is granted. These measures protect the servers and workstations and include safeguards such as administrative access limitations and anti-virus protection.

Network monitoring. Part of the control environment should include a frequent and ongoing monitoring program for all IT systems.

What We Do

circles

Comprehensive Support Program™ (CSP) — Bryley provides ongoing, proactive maintenance and remediation support to ensure a stable, highly-available computer network. Our most-popular Comprehensive Support Program (CSP) consolidates all end-user devices (mobile and desktop), servers, and computer-network equipment issues into one, Bryley-managed, fixed-fee program. Among the many services delivered under the Managed IT umbrella, Bryley installs and manages all software updates and patches.

Secure Network™ (SN) – An ongoing, managed-IT service that prevents intrusion, malware, and spam from entering the computer network through its Internet gateway and can restrict web-site surfing to inappropriate sites.

Multi-Point Security Hardening Service™ (MPSHS) – A periodic review to harden your computer-network security by reviewing/updating policies and configurations and testing. With this program, Bryley Systems can help your organization comply with the technical aspects of Massachusetts 201 CMR 17.00.

If you are looking for a business partner to help you navigate the ever-changing technology and cybersecurity landscape, we’re here for you. For more information about Bryley’s full array of Managed IT Services, Managed Cloud Services, and Cybersecurity Services please contact us at 978.562.6077 or by email at ITExperts@Bryley.com.

Bryley Basics: When to filter email by domain, rather than by a single address

/in /by

Have you ever had trouble receiving email from someone, even after you have added their address to your email filter’s allow list or whitelist?  In some instances you may be able to solve this problem simply by adding the domain from the contact’s email address to your allow list, rather than adding their entire address.  If you aren’t entirely sure how to identify the domain in an email address, don’t worry, we will cover first.  Then we will take a look at when and why this might work.

Every email address is composed of two major components, the User Identifier and the domain.  If we take the address Support@Bryley.com for example, we have the User Identifier “Support,” and the domain “Bryley.com.”  Essentially, everything that comes before the @ symbol is part of the User Identifier, and everything that follows the @ symbol is part of the domain.

What’s wrong with including the User Identifier?

The problem is that some email systems generate a unique User Identifier every time a user sends an email.  As a result, instead of the address Support@Bryley.com, you might see Support+id245789@Bryley.com, where “245789” is a computer generated set of numbers added to the User Identifier every time a user sends a new email.  The domain, on the other hand,  will remain the same, making it a more reliable means of identifying email coming from a particular source.

Why do User Identifiers change?

There are two major reasons why email systems might create unique User Identifiers.  The first is to allow a large number of users to send email through a single system without each user having to have their own dedicated email address.  For instance, this is extremely common within help desks at large companies as it remove the need for each staff member to have a separate email address dedicated for that purpose.  Instead, unique addresses are created on the fly as needed, and expire once they are no longer necessary.

The second is that it allows an end user to communicate with someone they don’t know without having to expose their actual email address. This effectively creates a buffer between the users email address and various sources of unwanted email.

For instance, when signing up for an online mailing a user can create what is effectively a one-off email address, unique for that purpose.  That way, if they no longer wish to receive that mailing at some point, the user can simply delete that unique address, rather than relying on the unsubscribe system of that service.

In addition, if an organization were to abuse a unique address given to them by a user, it would become obvious who the offending party was, as no one else would have that unique address.  As a result, the ability to create unique email address is catching on within email security solutions.  For instances, this is an option available within Sophos Reflexion, the email security solution deployed by Bryley Systems.

In general, however, these systems will not modify the domain a user is sending from.  As a result, if you trust the contact’s organization, adding only their domain to your email filter’s allow list should allow you to receive email from them, even if their User Identifier changes regularly.

Time for a Server Refresh?

/in , /by

There is no crystal ball for an IT manager to look at to accurately predict when a server will need to be replaced, but there are some general guidelines you should observe to ensure that this critical piece of equipment is running properly.

A server refresh cycle is the length of time that typically passes between installations of new servers.  Generally, the refresh cycle averages 3 to 5 years. Replacing your server will allow your organization to deploy updated equipment intended to improve reliability, enable new capabilities and save money in the long term.

Here are a few things to keep in mind:

Is your equipment more than 3+ years old?  If your server is three years old (or more), you should seriously consider replacing it.  Your reaction may be “I just bought it”.  You may be tempted to try to squeeze a little more life out of it.  You definitely could do that – perhaps you already have, but the reason you want to replace a server after three years isn’t just to avoid a potential server outage.

According to IDC, “the moment your server hits its fourth birthday, support costs raise by approximately 40%. Your users often won’t report the troubles they’re having with your slow server – employees are notorious for working around these issues.” 1

If a process takes much longer than it is supposed to, lost productivity costs your organization money and that lost time adds up.

Warranty.  Your server should never outlast the warranty it came with.  The reason you will want to replace your server after the warranty runs out is that if it crashes, you will be able to get it fixed or replaced. At the point in which the manufacturer is not going to do this, you should take this as a sign that your server may have reached its use-by date. If your server has a very high workload, it may limit its lifespan.

When you’re choosing your new server warranty, they often come with different support levels to fit your needs. Typically, it covers replacement parts and an on-site tech to replace those parts.

Hardware Support.  When you’re considering replacing your server, you should check to see if it is still being manufactured.  If your server is still in production, that’s the first piece of good news.  If something breaks, it won’t be that hard to find replacement parts.

If it’s no longer being built, hardware issues may be difficult to fix. The parts you may get are going to be more expensive, possibly second-hand, and may take a while to get to you.  That’s why if your server is out of production, it’s good to make sure you shelve it as well. That way you won’t be hit as hard by hardware failure.  Much like with a warranty, if your manufacturer has decided to shelve the server, it’s likely you should too.

Your Server Has Issues.  Oftentimes people try ignoring a temperamental server instead of just replacing it.  The longer you ignore it, the worse it will get, and you put your organization at risk if it completely shuts down.  There are some things that can’t be fixed no matter how many parts you replace.

You Need More from Your Server.  Growing organizations place higher demands on their servers. When use of your server reaches 70% of maximum, or drive space is running low, you’re going to see a drop in server performance.  This is where virtualization can come in handy. If you have two or more servers – or you suddenly have the need for them, you can purchase one really good server and run virtual machines off it.  Since you can scale virtual machines to your needs, this means you can change your infrastructure to fit your growing business needs.  If your organization is expanding with new locations, it’s time to consider upgrading your server.

Your organization’s server hardware is there to support your operating system and applications that you’re running off it.  If you are barely running Windows Server 2008 properly, then it won’t handle moving to 2012 or 2016.  When you’re upgrading your operating system, it is the perfect time to upgrade your server as well.  This effort will take some planning and additional work, but doing it in a phased-approach is much easier.

Before deciding whether or not to upgrade your datacenter servers or virtualize your environment, talk to Bryley Systems.  Our team of experts will help you navigate through this process and the important decisions including determining how to size your physical or virtual server hardware for the workloads that you are planning to put on it. Contact us at 978-562-6077, or by email at ITExperts@Bryley.com to learn more. We are here to help.

References:

1 –  IDC

Tech Target

Business Technology News

 

 

 

Why Invest in a UPS?

/in , /by

UPS stands for uninterruptible power supply. This electrical device is meant to provide a power supply in the event of a power outage or when the power input fails.

Power outages can result from electrical poles being damaged by storms, traffic accidents, fire, flood and other disasters.  Faults in the grid or power plant can also cause blackouts.  We cope with these inconveniences but our computers, unfortunately, just are not hardwired to cope with them in the same way.  Sudden power loss during data transfers can be damaging making the hard drive inaccessible.

Computers can be fragile pieces of machinery.  Severe damage can occur with a sudden power outage or fluctuation.  Components in a computer such as a hard drive can be affected and data can even get lost when power goes off and you have not properly shut down your computer.  It is especially damaging to the computer’s hard drive when there is power interruption.  When power is suddenly cut off, your hard drive spins down without being shut down properly.  When power comes back and you restart, you may find that much of your work has been lost. When power is restored, it is often accompanied by fluctuations which may turn your computer off again.  Hard drives can only take so much, and in some cases, computers can be destroyed. To protect your computer’s hard drive from these unfortunate scenarios, you need to plug your computer into an electrical device called a UPS system.

Right at the moment of a power blackout, these handy devices will act as a battery backup power supply which will automatically provide power to your computer for enough time to allow you to save your data and properly shut down your computer.

Because the circuit in this power device continuously monitors the voltage, it can sense surges, spikes and outages. When the UPS senses an electrical problem, it switches to AC power which is generated by a battery which provides you with protection.

Ultimately, a UPS backup battery gives you peace of mind while working. You won’t have to cringe when a thunderstorm rolls through, wondering if it would be better to simply power down your machine and wait it out. In addition, you won’t have those fears in the back of your mind that a power blackout may instantly cut off your work, wasting your time and efforts, and even worse, destroy your computer.

Remember, having a plan and being prepared is your first line of defense.  If you would like more information about emergency power outage strategies please contact us at 978.562.6077or by email at ITExperts@Bryley.com.  We are here to help.

Anna D. is a Bryley Systems HERO!

/in /by

Anna D., Bryley’s  Manager of Client Relationships, recently passed D&H’s HPE HERO (Heighten and Elevate Revenue Opportunity) Program with flying colors, scoring an impressive 100%.

The HPE HERO Program involves training in ALL HPE product areas, including Servers, Storage and Networking devices, as well as access to dedicated Solution Specialists. In addition it provides Bryley Systems the opportunity to leverage exclusive tools and cost savings, enabling our clients to stretch their IT investment even further.

Congratulations Anna!

Pop Quiz: How Prepared is Your Company to Recover If Disaster Strikes?

/in , , /by

You depend on your IT systems every day, but how dependable are they really?  If your company was subjected to a sudden loss of power could you keep working, or would business stop?  What if the power didn’t come back on for several days, or even a week?  Most importantly, have you already asked yourself these questions, and if so, do you have a written action plan to address them?

If you are at all unsure of how a disaster would impact your business, and how you might recover, here is a great little quiz to help you get the wheels turning.

1. How frequently are your company’s critical systems backed up?  Is it more than once a day?

2. If your company lost power, would your systems keep running without any interruption?

3. In the event of a system failure, could your company’s data be restored to working order quickly?

4. If your company experienced a security breach, do you have a clean set of data backups available and could they be restored in a timely fashion?

5. Does your company have a fail-over site it could revert to if your primary systems become inaccessible?

6. Does your company have a written disaster recovery plan to refer to in case of emergency?  If yes, do your employees know where to find it, and are they trained in implementing it?

If you were able to answer “yes” to these questions, congratulations!  Your company is in relatively good shape in terms of its ability to cope with a disaster.  If you answered “no” to any of the questions on this list, however, it would be a good idea to spend some time putting a plan together to address any gaps in your ability to recover from a disaster.

As a Managed IT provider, Bryley Systems specializes is helping companies plan for disaster and mitigate the risk of a loss of data.  If you think you could use a hand putting together an effective disaster recovery plan, why not give us a call at 978.562.6077.  We are here to help.

3 Recommended Practices to Keep Your Servers Running All Winter

/in , /by

Based in Central Massachusetts, wild New England weather is nothing new to us.  While simply making it in to work during a storm can be a significant challenge in itself, in a modern business environment, keeping essential technology systems operational 24/7 can prove even more critical.  That is why we have put together this list of three best practices we recommend you follow to keep your technology working, even when you are stuck at home shoveling out your driveway.

1. Deploy Uninterruptible Power Source (UPS) Devices – And Check Them Regularly

Deploying UPS devices for critical network equipment, as well as high priority PCs and workstations, is an excellent way to protect your most essential devices in the event of a power failure.  This is even more critical if you have on-premise servers.  It is important to ensure that any servers are able to communicate with their UPS(s) so the server can detect that it is running on stand-by power, giving it a chance to shut itself down properly.

2. Add an In-Line Generator

If you have devices that must continue running in the event of a power failure, adding an in-line generator is your best bet.  When the power goes out the generator takes over, powering equipment and feeding UPS devices.  At Bryley Systems we utilize an in-line generator to ensure that our local data center is always operational, no matter what.

3. Establish a Fail-Over Site

It is a good idea to develop a disaster-recovery plan that includes the ability to migrate to a fail-over site in the event that your primary data center becomes unavailable.  This will ensure that your data is always accessible, even under the worst of conditions.

You can learn more about how Bryley Systems is able to ensure business continuity through the use of our own fail-over site on our Back Up/Data Recovery page.

Stay safe this winter!

 

Smartphone Security

/in , , /by

We all love receiving new technology during the holiday season, but we must remember to protect it.  Whether we like it or not, cell phones and laptops are no longer simply devices – they are an extension of ourselves.  They house important information and records that we wouldn’t dare give a stranger (social security numbers, passwords, confidential information). In fact, we use them for socializing, shopping, banking, browsing, and much more.  Simply for the ease of use, it becomes a habit to stay logged into your accounts on your devices, but the downside is that if your phone is lost or stolen, it can lead to identify theft.  Someone could also hack your phone and access information via web-pages you have visited.  The importance of smartphone security is something we should all be aware of and implement right away.

Nearly 40% of data breaches are caused by mobile devices.

  1. Employee negligence is typically due to employees who are busy, traveling constantly, or hurrying through a task, and simply not knowing or paying attention to the risks involved.
  2. Theft is a big problem since there are ways to breach a smartphone.
  3. Malicious attacks. Hackers are responsible for the majority of breaches and thrive on those who leave the doors wide open to an attack.  Don’t leave yourself vulnerable.

Here are some tips to enjoy that new device as well as protect your privacy and information:

  • Activate Screen Lock. Perhaps the easiest and first line of defense on any device is the lock screen. After any time of inactivity (usually 30 seconds for cell phones and slightly longer for laptops and desktops), the device should be enabled to auto-lock so no one else can access your information.  On a cell phone, the code is usually four characters, but can be longer.  No matter how protective you may be of your devices, there’s no guarantee that you may not accidentally leave it somewhere.
    • Encryption can do a lot to protect your phone’s data and the good news is that all iPhones and newer Android versions come with their phone automatically encrypt once you set a password.
  • Mind your Apps. We all like the simplicity and efficiency that apps provide, but it’s important to keep an eye on them. There has been an increase in malware attacks, especially on smartphones, since most users gain access to confidential information.  Always read the small print and consider the personal information the app requires. If an app requires significant personal information, reconsider installing it.
    • Always use official app stores. App stores generally approve and vet apps prior to granting them space on the platform. (Always make sure the Web site URL starts with a secure https:// and contains a locked padlock icon.)
    • Check permission for the app. Some apps will ask permission to access certain aspects of the device. While it will make sense for a GPS to ask for your location, the same cannot be said for a flashlight app asking permission to access your text messages.
  • Browse Carefully. When you access a web browser on your smartphone, you should be very careful because it is easy to accept messages that pop up. For instance, you might decide to save your password and other information as it leads to easier access later on.  Unfortunately, that can provide others a way to copy your data. Always use reliable and safe websites and never enter your information on new or unknown websites, especially when they are asking for sensitive information like your credit card or bank details.
  • Remote Wipe. Have security knowing that if your phone is lost or stolen, you can safely wipe the device to protect the data from falling into the wrong hands.  A similar feature can be enabled after a certain number of failed passwords to access the phone (usually it is around 10 attempts before the device is wiped).  This service provided to our clients enrolled under the CSP agreement.
  • Use caution with any links you receive via email or text message. Exercise caution when clicking on links. Phishing scams are not limited to email – a text message can incite you to click on a malicious link or ask for personal information.
  • Do not alter security settings for convenience. Tampering with your phone’s factory settings, jailbreaking, or rooting your phone undermines the built-in security features offered by your wireless service and smartphone, while making it more susceptible to an attack.
  • All Wi-Fi was not created equal. Be mindful when using open Wi-Fi. When you are not using your wireless connection, you should keep it switched off. This can ensure that no one else can connect to your device without your permission or knowledge. You should also check your device’s network settings as they might be configured to connect to a network automatically when in range and may not ask for permission. In addition, your home wireless router should also be protected through a password or security code.
  • Run the Updates. Don’t put off downloading updates. Many updates tweak and fix several flaws on your phone that could open a backdoor for hackers.
  • Wipe data on your old phone before you donate, resell, or recycle it. Your smartphone contains personal data you want to keep private when you dispose your old phone. To protect your privacy, completely erase data off of your phone and reset the phone to its initial factory settings.

 

https://heimdalsecurity.com/blog/smartphone-security-guide-keep-your-phone-data-safe/#
http://www.nsiserv.com/blog/mobile-security-threats
http://www.smallbiztechnology.com/
https://www.networkworld.com/category/malware-cybercrime/
https://www.fcc.gov/smartphone-security
http://pcworld.com

 

2018 Tech Trends

/in , , /by

Technology is drastically changing the way we live and work and more adjustments will be apparent in the years ahead.  Instead of thinking “bottom-up” or “top-down,” business and technology needs to be thought of in a hybrid solution.  “From the bottom up, they are modernizing infrastructure and the architecture stack.  From the top down, they are organizing, operating, and delivering technology capabilities in new ways.  In tandem, these approaches can deliver more than efficiency – they offer the tools, velocity, and empowerment that will define the technology organization of the future.”1

IoT is one such tool that continues to gain traction and will have an even larger impact in 2018.  It is estimated that there are currently between 8-15 billion IoT devices.  That’s more than there are humans on Earth!  These devices include everything from home security systems, pacemakers, voting machines, voice-activated cars, personal assistants (i.e. Alexa) and personal health trackers (i.e. FitBit), as well as toys, toothbrushes, and even pillows.2  Having these devices makes life simpler, but will truly help when the devices can “talk” to each other.  Josh Siegal, a research scientist at MIT highlights the importance of interconnected devices and their usefulness: “It’s not about the car or the home, it’s about how your car can talk to your home to tell it that you’ll be arriving home early because your car talked to the roadway to avoid traffic, and now you need to put the heat on a little bit sooner than you would – while still saving energy due to having a smart thermostat. People aren’t used to thinking in such terms today.”2

These new IoT devices must also be able to function with the older technology.  “Having the intelligence in the lightbulb makes it pretty easy to adopt. It’s as easy as screwing in a lightbulb. But the usefulness is diminished when my 8-year-old daughter turns off the light switch – and now my fancy internet-enabled lightbulb is offline.”2

Security is Paramount

Now, more than ever, security is a top concern for organizations.  Individuals were rightfully upset about the Equifax breach, but IoT devices have the potential to leak information that’s just as valuable and sensitive.  It doesn’t help matters that security of these devices seems more like an afterthought.  The most vital, and yet underrated IoT applications are those that “allow administrators to automatically update them when issues are found and enforce strong defaults for things like passwords and encryption.”2 This highlights the importance of conducting due diligence and not rushing the vetting process for a shiny, new technology.  Ultimately, organizations must balance the need for better production and employee satisfaction with protecting company data.  They must know what and where the devices are attaching to the networks and manage accordingly.

IoT Data Analytics

As IoT expands, so too does the amount of information available to organizations.  This information can and will drive business decisions.  A prime example of IoT data analytics helping an organization work more efficiently and profitably is Navistar, who reduced the cost of managing its fleet of 180,000 trucks from 15 cents per mile to just 3 cents.3 Opportunities for cost savings exist in nearly every business, but it must be done judiciously; cost savings needs to be weighed against the cost of storing and sifting through the data.

2018 is poised to see technology have an even greater impact upon organizations.  It helps to have a Managed Services Provider (MSP), such as Bryley Systems to help navigate the ever-changing landscape.  Contact us at 844.449.8770 or by email at ITExperts@Bryley.com to learn more. We’re here for you.

 

1 https://www2.deloitte.com/content/dam/insights/us/articles/Tech-Trends-2018/4109_TechTrends-2018_FINAL.pdf
2 Schuchart, Wendy. IoT for Business: Five Key Trends for 2018. Channel Partners
3 https://www.forbes.com/sites/danielnewman/2017/09/26/top-10-trends-for-digital-transformation-in-2018/#734e6621293a