alt tag

Posts Tagged ‘desktop management’


7 Ways to Keep Work Secure on Employee Personal Devices

Monday, May 14th, 2018

Technology improvements have made it easy for employees to get work done on their personal devices from anywhere. However, that freedom comes with additional security risks and requires extra diligence to keep data secure. Safeguarding information is a combined process of utilizing technology and educating staff. The following considerations will help your business keep work secure on employee personal devices.

1. Always Update/Patch Software

Hackers invest time trying to find new ways to bypass security or take advantage of personal apathy and laziness.

According to PC World, failing to install the latest patches and updates for software is the top security risk for both business and private use.

Hackers can look for known exploits that the software creator closed and use them against people who haven’t updated the software to close that security hole. Unlike with business-owned devices, your business really can’t force employees to install software that will prompt updates, so it becomes a matter of training.

2. Use Cloud Apps

Cloud applications for both computers and mobile devices offer some excellent security benefits for your business, especially when your employees access them on personal devices. Cloud apps shift much of the data security burden to the server side, which alleviates many of the security problems that could come from traditional apps run on employee devices. Cloud email is an excellent example of this because the server can handle scans for phishing, malware and other malicious attacks before the content ever makes it to the employee device. Cloud apps generally run the most current software versions, so your business won’t have to worry about employees running updates.

3. Encourage Strong Antivirus and Anti-Malware Practices on All Devices

While employees don’t need to use the same security software your business runs on their personal devices, they do still need quality security software. There are many free and low-cost security programs for personal users that provide excellent protection. Your IT staff can help make recommendations for employees on personal devices.

4. Train to Avoid Phishing Scams

While security software and cloud apps do a great job of catching phishing scams, some still might slip through. That’s why it’s important to train your employees in how to identify and avoid phishing scams.

5. Use Strong Passwords, Password Managers and 2-Step Verification

Employees should also keep their accounts secure by using sophisticated access credentials. This means using 2-step verification for all accounts and programs when possible and using password managers to protect their credentials. Employees should be trained in creating strong passwords in the event that more advanced security techniques don’t work.

6. Practice Public Wi-Fi Safety

In general, employees should avoid using public Wi-Fi when working with confidential information. If employees are going to do work on Wi-Fi outside of the home or workplace, they need to be trained in identifying fake access points and how to tell if a library, restaurant or other business’s network is secure.

7. Consider Using Remote Wipe or Lock Software

As a final effort, your business should encourage employees to install software that allows them to remote wipe or lock mobile devices and laptops they are going to use for work purposes. That way if someone steals that device, the damage will be limited to the financial loss of the hardware and not related to a data security breach.

The IT consulting experts at MPA Networks can help your business implement both software and training practices to help keep your data safe when employees use their personal devices for work. You can read our previous blog on tips for managing remote employees for even more information on keeping data safe. Contact us today to learn more.

What Changes in Net Neutrality Could Mean for Your SMB

Thursday, April 19th, 2018

The FCC net neutrality 3–2 repeal vote of December 2017 could lead to major concerns for IT staff at small and medium businesses. As of February 2018, the FCC is continuing to move toward the net neutrality repeal, but actual business changes will take a while to go into practice. That delay means IT staff is left with more questions about what’s going to happen rather than solid information on what will happen.

Understanding the Public Protests and FCC Defense

Opponents argue that the repeal allows services providers to create premium paid “fast lanes” that will give the paying customers a leg up on the competition when it comes to how quickly their content travels over the internet.

While big businesses can afford to pony up for fast lane service, SMBs will be less likely to afford the advantage.

Service providers say they just don’t want to be treated like a utility akin to gas, electric and phone service providers. Additionally, service providers argue the “fast lane” concept would be a step-up deal and wouldn’t mean slowing down speeds for non-paying businesses.

A lack of competition means that customers who are dissatisfied with fast lane practices can’t simply take their business elsewhere. According to the FCC’s 2016 Broadband Progress Report, “Only 38 percent of Americans have more than one choice of providers for fixed advanced telecommunications capability.”

How Net Neutrality Changes Impact IT

As far as IT staff is concerned, net neutrality changes are related to internet performance. The rules could amplify existing concerns over how different services function and change some points of emphasis:

  • Customer-facing website and online application performance will be more important than ever. Businesses that aren’t paying for “fast lane” access will want to make sure their CDN is performing well and their platforms have efficient data footprints. Not paying for “fast lane” service could be considered a barrier to entry for new competitors.
  • Company website SEO could take a hit because longer load times on their sites mean more people will abandon the page load. Load time doesn’t play a role in search result rankings, but page abandonment does — and longer load times mean higher abandonment rates.
  • Growing SMBs that move a lot of data across the internet could be crushed by larger businesses entering the same space and paying for an ISP speed advantage.
  • IT staff will have to address unfair business complaints against service providers with the FTC rather than the FCC, which the Harvard Business Review argues is less equipped to protect consumers in those disputes.
  • “Fast lane” cloud services may be more appealing for business use, which means IT staff may be tasked with migration to other platforms.
  • Businesses may opt to change high-bandwidth services such as teleconferencing to competitors who are paying for “fast lane” performance, especially those who rely on those services to communicate with clients.
  • Cloud-based backups could run at less optimal speeds compared with the full potential of the internet package speed, which could mean more time between backups.
  • Location-to-location network traffic could run at less-than-optimal speed, which could turn into a problem down the line as the business moves increasing amounts of data.

The IT consulting experts at MPA Networks can help your business adjust to changes in net neutrality rules as they take effect. Contact us today to learn more.

Training Employees in Data Security Practices: Tips and Topics

Tuesday, April 3rd, 2018

While there’s plenty of technology available to keep your business’s data protected, the human element is still the most important piece to consider in safeguarding your company’s data. Properly training employees to understand and implement data security best practices works best when your business makes a cultural shift toward prioritizing IT security. Successfully training your staff is half about knowing how to train them and half about knowing which topics to train them on. Businesses that embrace a proactive approach to training employees on data security will have a much better track record than those that take a reactive approach.

Training Tips

Don’t just make a plan: Implement a program that focuses on training all employees. Have your business take an active role in implementing a data security program. This ensures training is far more effective than simply creating security practices, offering one-time training and hoping it works.

By implementing regular security training meetings on changing topics, your business can train your staff on a wide range of concerns.

In addition, your company can benefit from focused training while constantly reinforcing security as a priority. Hold multiple sessions that get into each topic in depth to help your employees better understand data security.

Training doesn’t end when the session ends — it’s an ongoing process. As an extension of training, your security staff should frequently send out reminders about security concerns to help employees remember what they’ve learned. Make your data security training materials easily accessible in the event staff members see a reminder and realize they should read up on a topic if they’re unclear of what the reminder is about. Additionally, C-level staff, IT and supervisors should lead by example.

Training Topics

The bad news is hackers will always create new threats for your staff to worry about — but the silver lining is that you’ll never run out of fresh topics to cover. Because of the fluidity of data security, your program will need to change which topics are covered in training and continually adjust strategy to address new threats. The following list covers just some of the many topics training sessions can cover:

  • Strong passwords and more secure authentication practices: This includes covering two-step authentication when applicable.
  • Secure Wi-Fi best practices: Explore red flags to look for when using public Wi-Fi and discuss whether public Wi-Fi should be used at all.
  • Physical device security: Cover topics such as encryption and disabling devices remotely to minimize data leaks for stolen/lost devices.
  • Use policy: Reaffirm that non-employees shouldn’t be using employee hardware.
  • Device security: Discuss the importance of keeping software patched and running security software on devices.
  • Popular methods of attack: Cover security best practices for avoiding popular phishing, man-in-the-middle and ransomware attacks.
  • Social engineering threats: Discuss the importance of the user as an essential line of defense when software can’t protect from threats.
  • Three-copy backup strategy: Explain that data is also at risk of being lost rather than stolen, and explore key backups to minimize these losses.

Hackers and thieves are known to exploit human complacency in security practices — and frequent training sessions will help employees stay aware. Is your business looking to improve its security practices? The IT consulting experts at MPA can help; contact us today to learn more.

10 Cyberattacks Your Business Should Defend Against

Thursday, March 29th, 2018

Cyberattacks are a major security concern for any business that uses the Internet. Even if your company doesn’t have a website, hackers can go after your email address and business service accounts.

Though they represent one of the more severe risks of a cyberattack, a data breach costs an enterprise $1.3 million and an SMB $117,000 on average.

Cyberattacks take many forms; your business should plan to protect itself from the following common types of cyberattacks:

1. Phishing: In phishing attacks, hackers impersonate a business in an email to persuade recipients to hand over personal information via a reply or to install malware. The email may also contain a fraudulent link to a fake version of a trusted website’s login page. Whaling and spearphishing are specific types of phishing that refer to attacks that single out a specific person or group.

2. SQL Injection: SQL injection is a technique cybercriminals use to exploit database-entry forms on a website. Rather than inputting a name, password, address or other information, a hacker will instead enter a code command designed to damage your database. This is typically successful when the website doesn’t properly sanitize and clean user-input data.

3. Cross-Site Scripting: XSS attacks occur when a hacker slips malicious code into your website or application. It’s common for hackers to exploit advertisement networks and user-feedback fields to sneak code onto a business’s public platform.

4. Man in the Middle: An MITM is similar to a phishing scam in that a hacker impersonates an endpoint in communication. For instance, the hacker might pose as a representative for your bank when communicating with you and pose as you when communicating with the bank — and obtain valuable information with this strategy. More sophisticated variations of this attack involve jumping into a legitimate conversation and impersonating a trusted individual.

5. Malware Attacks: Malware refers to malicious programs designed to infiltrate and disrupt user devices. Of all the different types of malware, ransomware is among the most high-profile and dangerous: It disables access to a device until the user pays a ransom. Trojans, worms, and spyware are other notable types of malware.

6. Denial-of-Service Attacks: DoS attacks disrupt networks and online platforms by overwhelming them with incredible amounts of traffic. Hackers can use these attacks to knock your website offline or slow your network to a crawl. Distributed-denial-of-service (DDoS) attacks are a DoS variation that utilize multiple devices to pull off the attack; one such example is the Mirai IoT Botnet, which caused a major internet disruption for the eastern United States.

7. Social Engineering: Social engineering refers to a hacker using psychological manipulation to get an employee to hand over confidential information or install malware.

8. Drive-By: These attacks trick a user into installing malware, usually a Trojan, by clicking a link in a web browser. Drive-bys typically exploit security holes in web browser plug-ins.

9. Unpatched Software: Unpatched software attacks are entirely avoidable: They work by hackers using known exploits in programs that have already been fixed. Hackers rely on the fact that some users neglect to install important updates.

10. Brute Force Password Hacks: Hackers may also seize your company and employee accounts through brute force password hacking. In this scenario, they use a program to continually guess an account’s password at login until the program finds one that works. Secure passwords will take far longer to crack, so hackers tend to target less secure accounts.

IT security is an incomplete process unless your business has the right hardware, software and employees working together to prevent attacks. The IT consulting experts at MPA Networks can help. Contact us today.

Cybersecurity and C-Level Execs: Protecting Data While On the Go

Monday, March 26th, 2018

While all employees need to be mindful of security, the nature of C-level executives makes them more attractive targets for hackers. That means it’s necessary for them to take greater precautions.

According to TechRepublic, C-level executives are more vulnerable than other employees because of the mobile tendencies of their work, and they are higher-value targets because of their access to confidential information. Hackers often use lower-level employees as a way to work up to C-level executives to get the information they’re looking for.

Because of their vulnerabilities and target value, C-level executives need to adhere to the strictest security practices.

Internet Access Security Risks

Hackers can do a lot of damage with little effort if executives connect their devices to unsecured networks. C-level executives tend to travel frequently, which can expose their devices to vulnerable Wi-Fi networks. Coffee shops, airports, hotels and exhibition centers are among the largest and most vulnerable network threat locations — and all are places executives tend to frequent. Executives may be working on unsecured Wi-Fi or even worse: hacker-implemented Wi-Fi masquerading as a legitimate access point.

Your company’s best defense against vulnerable public and private networks is to avoid the “penny wise and dollar foolish” mindset: Pay for an unlimited mobile data plan with tethering support for your executives. Using mobile 4G internet on the go eliminates the risks of using out-of-office networks, and tethering support will allow C-level executives to connect their devices that don’t have built-in 4G mobile network access. Your company can also invest in network tunneling, VPNs and other security measures.

Executive Data Access Is an Attractive Target

Consider this hypothetical example: Bob from H.R. has access to everyone’s Social Security numbers, while Janet from accounting has access to the company’s financial records. But Sam the CEO has access to all that information and more. Because of this, hackers view executives as the biggest fish in the sea, and they will target executives over all other potential targets. This is an even bigger problem on outside networks than within the office network because executives don’t have all the security technology that the office provides protecting them.

In addition to preventing the attack, it’s also wise to limit the amount of data access an executive has on devices they use when traveling — especially for international travel.

Executives should use “burner” laptops/phones that only have the information they need for the trip in order to limit data exposure in the event of a hack. For example, don’t store a payroll spreadsheet containing every employee’s Social Security number on a travel laptop.

A stolen device is also an important risk to consider, so your business should always use encryption and secure passwords on executive devices used when traveling.

Email Is a Primary Attack Avenue

Email security needs to be a priority: It’s everywhere, so it’s irrational to think executives will only read and reply to emails in an office setting. C-level executives are primary targets in “whaling” attacks — high-value targeted email phishing scams. The main concern is man-in-the-middle attacks, where a hacker poses as a trusted individual in a conversation. Technology can only do so much to safeguard against whaling scams. Hackers may learn a great deal about a specific target and tailor their methods based on that information — unlike a standard phishing scam that involves throwing out a generic net to see who falls for it.

IT security is important at all levels, but lapses at the executive-level can have disastrous results. The IT consulting experts at MPA Networks can help your business implement strong security practices so your company can avoid catastrophic security breaches. Contact us today to learn more.

Giving a Presentation: A Technology Preparedness Checklist

Monday, March 19th, 2018

Giving a presentation can be stressful, so dealing with technology issues at the last minute is the last thing you want when attempting a professional delivery. The following technology preparedness checklist can help you make a good impression rather than forcing the audience to sit through on-the-fly troubleshooting.

A presenter should test the presentation where they are going to deliver it in advance.

Here’s what to do:

Hardware/Software Preparation Checklist

  • Run a “dress rehearsal” by testing any new hardware against the presentation delivery workflow. If this is the first time you’ve presented in a particular environment, run through loading your presentation and making sure the whole thing works correctly.
  • Ensure you have working login credentials for the presentation device and network, and test them in advance. Some computers will run a time-consuming new account setup script the first time a user logs into a device with network credentials.
  • Be sure the presentation device is running the most recent software updates. This will avoid surprise “update needed” popups and forced updates that can derail presentations.
  • Disable screen savers, phone calling and background messaging programs to avoid unwanted interruptions. Turn off any other disruptive applications you can identify.
  • Ensure the presentation device is compatible with the screen mirroring monitor or projector, and make sure you have all the necessary adapters and cables. Check in advance to see if you’re using an AppleTV, Miracast, Roku, WiDi or direct cable connection for monitor/TV/projector access. Make sure your device is compatible with the connection platform. Don’t rely on the IT staff to have all of the necessary cables ready.
  • Know your device’s screen mirroring shortcuts. For example, Windows devices use “Windows Key + P.”
  • Make sure audio playback works on the presentation device if you’re using sound in your presentation. Working video does not guarantee working audio.

Software Compatibility Checklist

  • Ensure your presentation files are compatible with the presentation device’s software. For example, if you’ve prepared a speech in Keynote, you may need to convert it to PowerPoint.
  • Check for embedded media file compatibility. For example, an embedded .MOV file may work on the PC on which you created the presentation, but it might not work on the presentation device. If you’re sure you’ll have internet access, you can link to or insert the videos from website sources to remove compatibility issues.
  • Run through the presentation and check for formatting issues on the presentation device. The presentation device may be using a different version of the software and thus may display differently. Avoid using custom fonts, and stick to the five-by-five text rule to work around formatting changes.

Presentation Access Checklist

  • Make sure you can load your necessary files onto the desired presentation device. PowerPoint files may not embed all linked content, so be sure to move all the necessary media files with the presentation file. Test it on another device if you can.
  • Have two data copies of your presentation ready in case one fails. Store copies on a flash drive and external hard drive, an optical disc and a portable drive, or a flash drive and cloud storage. If you’re bringing your own device, have a copy on external storage just in case you need to present on a different device.
  • Avoid internet dependencies if at all possible.

The more familiar you become with a given presentation environment, the better able you will be to pinpoint the most important factors to check on before a presentation. The experts at MPA can also help your business streamline its presentation hardware and software configuration through productivity consulting and desktop management. Contact us today to find out more.

5 Specific IT Considerations for Remote Employees

Monday, February 5th, 2018

Businesses have a lot to gain by hiring remote employees, including the ability to recruit from a larger talent pool and the potential for less expensive workplace accommodations. However, remote employees introduce new challenges in IT security because of the lack of IT centralized IT management. While the majority of security best practices and techniques still apply, your business and its remote employees will need to take a more hands-on approach to properly protect devices and information. Remote workers introduce the following unique IT security challenges:

1. Increased Importance of Human-Based Security Policies

Remote workers need to be more self-directed when it comes to IT security, as there’s no physically centralized IT staff or infrastructure to reinforce safe practices. A business with remote employees should establish a well-developed set of strict security guidelines to protect both devices and online information.

2. Reduced Reliance on Centralized IT to Secure Devices

Any device used for company work needs to be secured with strong passwords, updated operating system software, current antivirus software and regular malware scans. All applications need to be patched to the most recent versions, too.

Hackers take advantage of weak security practices and known vulnerabilities that were patched by attacking unpatched software installations.

Employees will need to make sure all devices they use for work are properly updated and secured.

3. Potential Threats From Personal Devices

Just as with in-office staff, remote employees often use many different devices to do their jobs. They don’t use only the company-provided laptop; they may also use personal smartphones, tablets and computers. While remote IT services can access and update company-owned devices, ensuring personal devices are secured entirely falls on the remote employees.

4. A Lack of Office Network Security

Remote employees do not have the benefit of office network security. Instead, they are likely spending most of their time working on a personal network from their homes. This means employees need to configure their own secure Wi-Fi connection with a strong password and keep both their router and modem updated with the latest firmware. Additionally, remote employees need to change the default password on all networked devices, including the router and IoT devices.

5. Protecting Online Information

While office-based employees transfer a great deal of data over the internet, remote employees do almost all of their work online. If possible, your company can protect this data by configuring a VPN for remote employee use. Businesses should use cloud applications, such as Google’s office suite, whenever possible. These programs are automatically updated and won’t introduce legacy security issues with information exchanged online. Additionally, remote employees are likely to store and share most of their work over cloud-hosted platforms, so your company will also need to consider the security of those platforms.

If your business is considering the addition of remote employees or you want to make existing remote work more secure, the experts at MPA Networks can help. Through IT managed services and desktop management, we can provide your remote employees with security closer to what they’d expect from an office setting. Contact us today to learn more.