What you need to know about the OneLogin Breach

/in , , , , , /by

OneLogin, a single sign-on service that allows users to access multiple sites and applications using just one password confirmed on June 1st that its systems had been breached and login information had been exposed. According to the firm, this breach affects “all customers served by our US data centre” and the hackers had “the ability to decrypt encrypted data”1. This is the second time within the past year that the firm had its security breached.1

So, how can you protect your data from a breach? One way is to have two-factor authentication, which is a method used to confirm a user’s claimed identity by utilizing a combination of two different components, generally something you know with something you have. For example, when you withdraw money from an ATM, only the correct combination of a PIN (something you know) with the bank card (something you have), will grant the transaction to take place.

One of the safest ways to ensure your data is protected is to encrypt it before placing it in the Cloud or with a single sign-on provider, such as OneLogin. Provided your encryption key has not been generated from a simple password, your data will be protected from any breach to your provider, as the provider does not have the password to gain access to your information.

It is vital that one stays vigilant when it comes to protecting your passwords and data. Even the most difficult password can be deciphered if given enough time. Therefore, it is important to regularly change your passwords and ensure they are strong. We have more information on the Do’s and Don’ts of Password management on our blog.

For more information on password and security, connect with Bryley’s cybersecurity experts by calling us at 844.449.8770 or emailing us at ITExperts@Bryley.com.

 

1 Fiveash, Kelly. Ars Technica. “OneLogin suffers breach – customer data said to be exposed, decrypted.” June 2017.

BBC News. “Password manager OneLogin hit by data breach.” June 2017

 

What you need to know about the “WannaCry” Attack

/in , , , /by

On Friday, we learned that hackers had exploited malicious software stolen from the National Security Agency (NSA) and held many organizations’ data ransom. As of this morning, it is estimated that this cyberattack was felt by approximately 200,000 organizations in 150 countries including Britain’s hospital network, Germany’s national railway, “computers that run factories, banks, government agencies and transport systems in scores of countries, including Russia, Ukraine, Brazil, Spain, India and Japan, among others… Russia’s Interior Ministry and companies including Spain’s Telefonica and FedEx Corp. in the U.S.”1

While the exact scope of the damage is not fully known, it does appear to be the largest cyberattack on record. These cybercriminals demanded $300 in the beginning and later increased it to $600 before destroying the files hours after that.1 While the ransom amount won’t necessarily bankrupt a company, it is also no guarantee that a company will have its data returned or unlocked, which can have more dire consequences.

There are several steps you can take to avoid becoming the next victim:

  • Immediately update both desktop and Windows systems with the Microsoft patch MS17-010.
  • Do not open links sent from unknown sources. If you need to open a link, scan it for malware first.
  • Backup your files. It is always a wise decision to regularly backup your files to ensure your business can continue to function.
  • Keep your systems up-to-date. It is vital to check for updates on your machines to catch any vulnerabilities and perform patch updates.
  • Educate your users. They are the first line of defense against an attack so it is imperative that they are able to identify potential phishing scams and fraudulent emails.

These are but a few of the “Best Practices” that can be employed to safeguard your data and business. If you’re ready to protect your organization, it pays to work with a Managed IT Services/Managed Cloud Services company, like Bryley Systems, to ensure that you’re taking the right steps. Bryley will recommend solutions to eliminate weak links in your security chain, and help you develop an organization-wide policy to help prevent data loss.

Please contact us at 978.562.6077 or by email at ITExperts@Bryley.com. We’re here to help.

 

  1. Associated Press. “Monday morning blues as ‘WannaCry’ hits at workweek’s start.” May 2017.
  2. New York Times “Hackers Hit Dozens of Countries Exploiting Stolen N.S.A. Tool.” May 2017.

What Can we Learn from the Netflix Leak?

/in , , , , /by

Netflix was in the news recently for a mishap with its production company. A cybercriminal that goes by the name “thedarkoverlord” was able to breach postproduction company Larson Studios, and has claimed to have “stolen unreleased content from ABC, Fox, National Geographic and IFC.”1 After Netflix refused to pay the ransom, the cybercriminals released the first 10 episodes of Season 5 of “Orange Is The New Black” on Friday, April 28th via Twitter. When they did not receive the desired response (payment), the released the remaining nine episodes of the season the following day.1

This is the latest high-profile breach in the past year (LinkedIn, Twitter, IRS just to name a few). According to a report published by Verizon, ransomware attacks have “increased in the past five years and were up 50 percent in 2016 compared with 2015…”1

This breach is a reminder to stay vigilant and maintain your safeguards. Here are some tips on how to avoid finding yourself in this type of predicament:

  1. Create a Firewall. While most operating systems come with their own firewalls, they are typically only designed to protect one machine. To protect yourself from attacks and malware, it is best to invest in a network firewall.
  2. Encrypt Your Data. A firewall is considered the first line of defense, encrypting your data provides that extra layer of security. You do not want them to be able to through the firewall and have easy access to your proprietary information.
  3. Have Policies in Place. You can have all the devices and systems in place, but if your employees are not well-versed in their roles of protecting the data, all your effort will be for not. Instead, make sure employees know how to treat the data and the steps they need to take to avoid any potential issues. One of the core policies that should be implemented is a password policy. Employees should be prompted to change their password a minimum of every 90 days (less depending upon your industry). Passwords should be complex and include numbers, letters, and symbols.
  4. Have a regular review of your infrastructure. You go to the doctor for regular checkups, you should do the same for your company’s infrastructure. It can often be difficult to do on your own as you may not have all the knowledge and expertise or the bandwidth to conduct a proper evaluation. Do not be afraid to ask an MSP, such as Bryley, to conduct a network assessment and evaluate your infrastructure. They have expertise and breadth of knowledge that will prove valuable and can highlight what you are doing well and areas where you can improve.

If you would like to improve your cybersecurity plan, or to inquire about Bryley’s full array of our Managed Cloud Services and Managed IT Services, please contact us at 844.449.8770 or by email at ITExperts@Bryley.com. We’re here for you.

 

1 Perlroth, Nicole and Matthew Haag. Hacker Leaks Episodes From Netflix Show and Threatens Other Networks. 29 April 2017.
http://www.cbsnews.com/news/irs-identity-theft-online-hackers-social-security-number-get-transcript/
http://www.cnbc.com/2017/03/15/turkey-twitter-accounts-hacked-germany-netherlands-nazis-forbes.html
http://www.verizonenterprise.com/verizon-insights-lab/dbir/2017/

Beware!! Google Docs Phishing Scam

/in , , , , /by

If you recently received an email asking you to open a Google Docs, and you don’t know the sender, don’t open it! Chances are, this is a phishing email designed to have you click on a link and gain access to your information.

The email looks similar to a true Google invitation, but there are key differences.

The bogus email does not provide the name of the shared document and lacks the Google Docs icon.

The real email includes the name of the document, with the Google Docs icon .

Google is aware of this issue and issued a statement Wednesday saying, “We’ve removed the fake pages, pushed updates through Safe Browsing, and our abuse team is working to prevent this kind of spoofing from happening again. We encourage users to report phishing emails in Gmail.”

We all face the grueling task of trying to manage our email. While email is a very convenient mode of communication and most of it is genuine, knowing the signs of phishing emails will prevent you from unleashing a disaster.

When in doubt, don’t click! Contact your IT administrator. And remember, legitimate organizations will never ask you to disclose personal data via email.

For more information, please see “Recommended Practices – Part 4: Email Use” in the November 2014 edition of Bryley Information and Tips (BITs).

Read this case study about a particularly vicious attack that Bryley remediated.

Bryley Systems specializes in protecting you from malware. Contact us at 978.562.6077 or by email at ITExperts@Bryley.com. We’re here for you.

Interested in more security news? 

Sign up for our monthly newsletter to receive the latest cybersecurity updates right in your inbox!

Newsletter Signup

Bryley Receives Prestigious Channel Partners 360° Award!

/in , , , , , /by

April 11, 2017 — Bryley Systems is pleased to announce that it has been honored by Channel Partners, with the 2017 Channel Partners 360° Business Value Award.  We are one of only 25 technology-oriented companies worldwide to receive this award, which is one of the most sought-after in the industry.

This award honors service providers that are taking a holistic approach to technology solutions and creating business value for their clients and have a well-rounded portfolio.  Channel Partners started “as a simple idea to reward partners of all sizes for creating business value for their customers through telecom, IT, and cloud solutions…” and “rewards channel partners – agents, VARs, dealers, system integrators, MSPs and consultants – of all sizes for innovation, solutions-orientation and customer focus.”

Bryley’s President, Gavin Livingstone and co-owner, Cathy Livingstone, were on hand to accept the award stating “Bryley Systems works toward continuous improvement; we strive to manage, optimize, and secure our client’s information technology, which brings substantial business benefit and value to their organizations. Our team-focused, best-practices-oriented approach, coupled with high-value/low-risk service options, enables us to provide our clients with Dependable IT at a Predictable Cost™.

We thank Channel Partners for this prestigious Channel Partners 360° award!”

Award recipients were honored at a ceremony on April 11 at the Channel Partners Conference & Expo in Las Vegas.

Bryley Basics: Purchase Windows 10 with new PCs and laptops

/in , , /by

We keep having the same conversation with clients over and over again, especially those who are buying new computers: What Windows version should I deploy?

If you are purchasing new computers for your organization, please consider installing Windows 10. We have clients who still want us to install Windows 7, however, that operating system will be end of life January 14th, 2020.  What that means is that Microsoft, after 1/14/2020, will no longer provide security updates for Windows 7, such that your computer will be more susceptible to getting malware and your organization will not be compliant. In less than 3 years, you will have to upgrade the operating system of that computer, which involves additional labor costs, software licensing, and employee downtime.

Note: We didn’t forget about Windows 8.1, but we find that a lot of distributors no longer stock computers that have Windows 8 (8.1) pre-installed. It also seems to be another operating system (remember Vista?) that Microsoft “abandoned” since it was only around for 3 years, making it one of the most short-lived operating systems.

Prior to installing Windows 10 on new computers, we will need to find out if current applications are compatible with the new operating system. With the name of the application and the version, we should be able to verify compatibility by searching the Internet and then verifying with the manufacturer directly.

For more information, please visit Migrating to Windows 10 – Now, later, or never, from the August 2015 issue of BITs (Bryley Information and Tips).

Making this type of transition isn’t always easy, but we are here to help; please reach out to us at 978.562.6077 or email ITExperts@Bryley.com.

 

Meet Your “Typical” Hacker – Know Thine Enemy

/in , , , /by

Imagine sitting in your chair watching TV after a long day in the office, you look up and there’s a stranger rummaging through your refrigerator… a little disconcerting at best! You would likely stand up and ask: “Who are you and how did you get into my house?” You would likely call the Police. This is very serious. When someone invades your home you are angry, scared, and possibly indignant.

The scenario described above can happen with your computer and network without you even knowing someone is there. Who are these people and what are they doing on your computer and network?

There are different tiers of hackers who might invade your home or business computers and network without your knowledge or consent. Who are they are they? Let’s have a look.

There is not a single “typical” type of hacker, but rather 4 types or variants of hackers who might invade your computer and your network at home or work:

  • Kiddie Hacker
  • Corporate Hacker
  • Military Hacker
  • Criminal Hacker

Their motives and methods vary but often result in similar consequences:

  • Stolen personal or confidential information
  • Disruption of the operation of your computer or network
  • Kidnapping your files and folders for ransom

Kiddie Hackers

The name sounds innocent, but the problems caused by these hackers can be debilitating or at the very least, time consuming and disruptive. This type of hacker can be the kids next door who are bored of playing video games and are just curious as to how far they can go if they attempt to walk into your computing environment. It can be your nosey neighbors who have familiarity with computers to the extent that they look for the easily available tools to penetrate your defenses (if you have them). These hackers look for the local Wireless Networks that neglected to impose security and show up as unprotected. Some go even further in their determination to invade and the results are the same. See Bryley’s IT Security Checklist for more information on how to protect your home and organization.

Corporate Hackers

These hackers are motivated and capable. They want to get information about your company or disrupt your business operations. They are usually professional IT people who have clear motives and directives. These hackers are concerned about being caught and in most cases take extreme measures to hide their activities.

Military Hackers

These are the patriots of their respective nations who are on the job 24×7 targeting other countries to find and potentially expose government intelligence and the vulnerabilities of their targets. Although they target national agencies, they will, in the process, uncover many unsuspecting individual users who might lead them to their objectives, so they are very opportunistic and aggressive. They have the tools, the time, and the determination to break into anything or anywhere they can to find their openings. This activity is common to around the world and includes players such as: US Military/Government, UK, France, Germany, Russia, China, Japan and many others. These hackers are also concerned about being caught and in most cases take extreme measures to hide their activities as well.

Criminal Hackers

DANGER. These are the truly bad guys. There are many organized criminal groups around the world who engage in hacking for profit. They are remorseless, determined, and capable. They enlist operatives who want to make a quick dollar, provide them with the tools of the trade, and take a percentage for making them capable of performing their work. This group is growing rapidly as is evidenced in the sharp rise of Ransomware and DDoS (Distributed Denial of Service) Attacks. These people are performing many of the tactics that the Military Hackers employ. They just recently stole tools used by one of our national security agencies to infiltrate computers and networks and have made them available for sale on the Internet. These are the guys who send you that email with the attachment that when opened, will encrypt every file it can find on your computer or network, and then demand payment for allowing you to regain access to your files. These are the guys who initiated the DDoS attack recently that disabled the credit card verification ability of much of the country. There is one organization suspected of being capable of targeting a victim with up to 100Gb of Internet traffic, which can completely disable the Internet access for the victim. These are the guys who seed the Internet with their specifically designed software that makes innocent users’ computers part of a BOTNET for the distribution of SPAM or a component in a DDoS attack. These are the guys who likely invaded the DNC computers this past election.

The conclusion you can reach here is that the bad guys are out there working 24×7 to invade your computer or network for a variety of reasons. You must be aware that the danger exists from a variety of sources and if you don’t exercise due diligence, they will gladly give you the motivation to do so after you’ve been violated. Unfortunately, it’s not a matter of whether you will experience an attack; it’s a matter of when. No one is completely immune, but you can protect yourself to minimize your surface of vulnerability. In most cases, these hackers want the low lying fruit. If there is a barking dog at the door when they knock, they will likely be motivated to check the house next door.

Ask Bryley how you can reduce your surface of vulnerability in your business. It can mean the difference between an inconvenient disruption and an unmitigated disaster. Call us at 844.449.8770 or email us at ITExperts@bryley.com. We look forward to hearing from you.

Tour of the new maintenance facility of the WRTA

/in , , /by

Bryley’s President, Gavin Livingstone, who currently chairs the Worcester Regional Chamber of Commerce (WRCC) Ambassadors, arranged for a group of 20 WRCC Ambassadors and staff to tour the new Worcester Regional Transit Authority (WRTA) maintenance facility at 42 Quinsigamond Avenue, Worcester. The tour was conducted by Jim Parker, General Manager of Central Mass Transit Management Inc. (CMTM), which operates and maintains all of the WRTA buses and facilities.

Touring Maintenance Facility

Created in 1974, the WRTA is the second-largest regional transit authority in Massachusetts, servicing Worcester and its surrounding 37 communities. WRTA buses typically run continuously from early morning through midnight (with some holiday exceptions); seven days a week, 365 days a year.

The WRTA’s new, 156,000-square-foot facility is roughly double the size of the original, outdated garage, which was built in 1928 as a trolley barn. The new facility is large enough for 75 transit buses and 30 vans (the current fleet includes 52 buses), and has nine maintenance bays. Buses enter the facility and head to a refueling bay where they can get a wash, repairs, fluid checks and adjustments – even get repainted – before rolling back into service.

Window View from the Upstairs Office

 

The new facility is also home to significant, up-to-date technology, including a WRTA BusTracker app, Track by Text, Track by QR Code, and WRTA-schedule/ tracking Kiosks located throughout the city.

Control Center

All operations run through the sophisticated Control Center, which is continuously manned when buses are on the road.

In 2014, Bryley Systems – the Managed IT provider for CMTM and the WRTA – designed and deployed an IT-infrastructure platform to support the technologies listed above, but with managed redundancies to allow continuous operation. (For details, visit Transportation Company Relies on Bryley Systems to Stabilize Technology Platform and Create Blueprint for the Future for details.)

Do’s and Don’ts of Password Security

/in , , /by

We can’t say enough about the importance of passwords for your security

Strong passwords are the frontline against cyberattacks.

Passwords are the primary gatekeeper to secure your data, so it’s imperative to ensure it they’re as strong as possible. We have compiled a list of DOs and DO NOTs to help you create secure passwords.

DO create a complicated password. While passwords such as “123456” and “password” are easy to remember, they are also easy to hack. It is best to create a password that has at least 8 characters and uses a combination of upper and lowercase letters, numbers, and special characters. This makes it harder for hackers to gain access to your accounts. One way to accomplish this is to take a sentence and convert it into an acronym, using numbers to replace words such as “to” or letters (3 or $ for “s”, 1 for “I”, @ for “a”, etc.). For example, take the sentence “my favorite activity to do is swim” and convert it to “mF8a2di$!”

DO NOT keep written passwords within reach. There’s no point in creating a secure password if you are going to have the password in plain view. That’s akin to locking the deadbolt on the house, but having all the windows open! If you would like a written reminder of your passwords, keep it in a secure place (a locked cabinet or car glovebox are good examples). You may also consider a Password Manager Service.

DO change your password regularly. Even the most complicated password can be compromised given enough time. It is recommended that passwords be changed every 90 days (or sooner depending upon the importance of data that they safeguard). When you change your password, do not reuse an old password. Instead, create a new one for better protection.

DO NOT use the same password for multiple accounts. While this may be easier for you to remember, it also makes it easier for cybercriminals to gain access to all of your information!

DO use two-factor authentication. Two-factor authentication (also known as 2FA) is a method of confirming a user’s claimed identity by utilizing a combination of two different components, generally something you know with something you have. A good example in everyday life is the withdrawal of money from a cash machine. Only the correct combination of a PIN (something you know) with a bank card (something you have) allows the transaction to be carried out.

This provides another layer of protection and significantly reduces the risk of a hack. That being said, it’s imperative that you update your personal information when something, such as your phone number or email address, changes.

For more information on password protection and security, connect with Bryley’s cybersecurity experts by calling us at 844.449.8770 or emailing us at ITExperts@Bryley.com.

Bryley Systems again named Top 501 MSP

/in , , /by

Bryley Systems Inc. Ranks in Top 501 Managed IT Service Providers (MSPs) Worldwide for the Third Consecutive Year

9th Annual MSP 501 Ranking and Study Identifies Bryley Systems as one of the
World’s Most Progressive MSPs in Information Technology

June 7, 2016:  Bryley Systems of Hudson MA, ranks at #350 of the world’s most progressive, Managed IT Service Providers, according to Penton Technology’s 9th-annual MSPmentor 501 List.

“On behalf of Penton and MSPmentor, I would like to congratulate Bryley Systems for its recognition as an MSP 501 honoree,” said Aldrin Brown, Editor in Chief, MSPmentor. “The managed IT service provider market is evolving at a rapid pace and the companies showcased on the 2016 MSP 501 list represent the most agile, flexible and innovative organizations in the industry.”

Bryley has ranked in the MSP 501 over three consecutive years, starting at #440 in 2014, moving to #462 in 2015, and advancing to #350 in 2016.

In conjunction with the MSPmentor award, Bryley Systems is #308 on the Clarity Total IT Services Provider (TSP) List, which ranks MSPs in their ability to provide complete solutions to their clients.

“Demand for Bryley’s services is being driven by IT complexity, the need for end-user support, security concerns, and compliance requirements.” said Gavin Livingstone, President of Bryley Systems.  “We are pleased to once again rank in the MSP 501; it is a great honor and demonstrates our dedication to remain one of the top providers of managed IT services worldwide.”