Phishing: Don't Take the Bait.

Do you really want to click that?

A big issue for SMBs is recognizing phishing emails. Oftentimes, hackers trick employees into clicking malware infected files and malicious links in emails that redirect to dummy pages. This type of cybercrime involving sending fraudulent emails that appear to come from a legitimate company with the aim to steal confidential information is known as phishing — and it’s a real threat.

What is Phishing?

• Phishing is an online scam where someone appears to be soliciting you from a legitimate company asking you to provide them with sensitive information.
• This is typically done through a link that takes you to a landing page asking you to fill in information that is then passed on to them. This information is typically in the form of credit card numbers, social security numbers, username / passwords, etc, etc.

How Do You Identify a Phishing Email?

• Phishing emails use fake email addresses that imitate known brands, such as FedEx, UPS, Office 365, Google, etc. ALWAYS LOOK AT THE ACTUAL EMAIL ADDRESS BETWEEN THE "< >" SYMBOLS, such as "John Doe <johnd@cds-tech.com>". In a phishing scenario, the email alias may read "Office 365 Admin" but the actual email address is "<gotchanow@mso365hacker.com>".
• Phishing emails most of the time do not address you by your name.
• Phishing emails use scare tactics like threats to close accounts, password verification, password reset, or other tactics that create a sense of urgency and cause you to make impulsive decisions that can end up being detrimental to you and your company.
• Read the emails carefully and look for spelling errors. A lot of phishing emails come from overseas and are typically filled with spelling and grammatical errors. This is a common red flag. 
• Spear Phishing is highly customized phishing that can include the target's information such as name, position, company, phone number, etc to trick the recipient into believing that they have a connection with the sender. This information is typically mined from the targets online social media profile on sites such as LinkedIn and Facebook.  Employee awareness is paramount and users should be discouraged from publishing sensitive personal and/or corporate information to these sites.
• Common Phishing Email examples are as follows:
  • You are asked to verify your email account information or reset your password. DON'T DO IT! Unless YOU'VE initiated anything that would require verification, your email provider, financial institution, etc will not / should not ask you for account verification or password reset out of the blue.
  • You get an email stating that your mailbox storage is full. This one is a little tricky because your email admin may have turned on mailbox storage quotas and warnings so ALWAYS double-check that email address in between the "< >" from the sender. It should match a legitimate email account within your domain.
  • You get an email about UPS/FedEx/DHL tracking information. Unless you specifically asked from email notifications on a shipment DO NOT follow the embedded link within these emails and more than likely, you're not even expecting a package.
  • Dropbox, Google Docs, Office 365 Phishing.  Some phishers no longer bait their victims, now they've created specialized attack emails according to an individual company or service.  Millions of people use these services every day so it's no surprise that attackers have starting targeting them. The attack is usually initiated by an email containing a link that leads to a fake Dropbox, Google or Office 365 login page for which the attacker captures your login information. To prevent against such attacks two-step / multi-factor verification should be enabled on these accounts.
  • Below is a prime example a client of ours got the other day! Fortunately, they knew better not to follow through on the request.

LEARN MORE: Whaling... a more sophisticated form of phishing. Follow the link below to learn more: 

https://www.cds-tech.com/blog/2017/9/18/whaling-assault-the-new-email-threat-targeting-your-business

5 Signs You Need a Managed IT Service Provider

What is a Managed Service Provider?

In the IT industry, a Managed Service Provider is a company that offers small to medium businesses the ability to outsource the management of their day-to-day technology and IT needs.

In other words, an MSP is essentially your IT department. If something technology-related breaks, they help fix it. If you need an app devised or want to upgrade hardware and software, or take a look into virtualization, they can often help in these complex areas too. Many of these organizations act as your business partner to help increase the effectiveness of your business operations, and achieve your overall goals.

1. You don’t have a dedicated IT department or staff

A commonality many small businesses have is that employees often wear more than one hat. The problem with this is that those who are not necessarily IT experts, but are perhaps more tech savvy than others, are tapped to look after the company’s IT needs. Businesses can suffer from gaps in knowledge of the latest IT developments. It is also a challenge to balance IT needs while also running a business and remaining productive.

While for some small businesses having a knowledgeable tech person look after the IT on top of their main job works, the chances are high that they aren’t planning for a future in IT and may not be able to carry out complicated upgrades or even ensure that your systems are secure beyond the current environment. This can undoubtedly lead to increased problems in the future, which are likely not going to be fixed.

Instead of hiring a full-time IT staff member, you could look into using an MSP who can offer the same services, but at a fraction of the cost. This allows your employees to focus on their main roles, while also allowing you to rest easy knowing that your IT demands are being adequately taken care of.

2. You have continuous tech problems

At first glance, many of the systems we use on a daily basis are relatively simple. That is, they are simple when they are working. But, when systems breakdown business owners quickly come to realize that the technology utilized in their businesses and the systems that support it are not only complex, but are becomingly increasingly so.

Complexity aside, all technology will eventually break. When it does, you need to factor into your budget resources to make replacements and repairs. If the technology incorporated into your business is constantly experiencing problems there is a good chance this is having a negative impact on profits and productivity.

By partnering with a quality MSP that looks after your technology, you can be assured that a team of experts are running your technology and systems efficiently and that you are able to meet IT demands and scale to meet future needs. Decreased maintenance and replacement costs can help improve your overall productivity and even profits.

3. The people looking after IT are overwhelmed

Any growing business needs technology to be able to scale to meet and support growth. This often overwhelms even the most seasoned IT professionals. Even if your business has a dedicated IT role or team there is a chance that they can become overwhelmed.

When the pressure is on important issues may not be addressed and corners may be cut in order to meet current demands. This can lead to increased costs and problem issues down the road, resulting in an even more overwhelmed Technology department.

The great thing about quality IT partners is that you often don’t have to outsource all of your IT needs to them. If, for example, you have an employee who is a whizz with building computers but does not have the time to oversee the whole of your technology needs, then outsourcing some functions can free up their skills or allow them to work more effectively in their main roles.

4. Your IT budget is unpredictable

The cost of technology is ever changing. Some months you may have to replace a computer while others may see a new server needed or a security issue that needs to be dealt with immediately. Because of this, actually budgeting for technology is incredibly hard, especially for small businesses.

Most IT partners offer their services on a flat-fee, monthly basis. This makes it easy for companies to budget for technology. The upside to this is that while your budget is predictable, overall costs and overheads are often reduced because your systems are kept in better working order and will last longer.

5. You have trouble prioritizing your IT needs

It can sometimes seem like a new system is needed on a near monthly basis. From servers to email systems; computers to mobile devices; your business will almost always require ongoing technology. The problem many businesses face is that they simply are not equipped with the skills and the knowhow to recognize what their IT priorities should be.

Do you update a server, or look for a new email solution first? And in what order do you need to implement updates? It is not always obvious what the answers to these questions are, especially when everything seems urgent. If you outsource the management of your technology, the companies you partner with can take the time to get to know your company’s needs and demands and prioritize. This will make your organization more efficient and better able to reach business goals.

If you are struggling with technology in your business, contact us today to see how as your IT partner, we can work with you to ensure that your technology is working for you.

Whaling Assault - The New Email Threat Targeting Your Business

Let's Define Email Whaling

"Whaling" is both highly deceptive and damaging. A hacker, disguised as the CEO, CFO or other senior executive, typically sends an email message to a recipient and convinces this person to initiate a wire or data transfer. These attacks are also referred to as impersonation attacks or business email compromise attacks. "Whaling schemes led to more than $2.3 billion in losses over the last three years according to the Federal Bureau of Investigation."

The 5 Phases of a Whaling Assault

1. Cyber thieves frequently rely on social media sites, such as LinkedIn™, to gather details about a high-level executive to impersonate along with a lower-level target. The target is typically a controller or human resources executive with the authority to request a financial transaction or send data without additional approvals. A key part of the scam is to make the target react to the perceived power of the spoofed executive. "55% of organizations witnessed an increase in the volume of whaling attacks at the end of 2015."
2. Crooks register a domain that appears similar to the actual domain for a company. For instance, testcompany becomes “testconpany” or “testcornpany.” This creates potential confusion. The busy target may not notice the fake domain "70% of whaling attacks involve domain spoofing."
3. The recipient receives an email message with his or her name on it, as well as other details that make it look authentic. This includes relevant details about the impersonated executive and likely mentions a specific business initiative. "72% of whaling attackers pretended to be the CEO, while 36% were attributed to the CFO."
4. To the target, the email looks authentic — and prompts for the specific action or transaction leading to a loss. The request usually has a sense of urgency and it may request that the individual bypass normal procedures. "43% of organizations witnessed an increase in attempted sensitive data transfers involving whaling or CEO impersonation fraud over the last three months."
5. In most cases, cyber thieves impersonating a high-level executive request a wire transfer or for the recipient to send tax data containing personal employee information, such as W-2 forms in the U.S. or P60 forms in the U.K.. "41 companies fell for W-2 fraud in the first quarter of 2016."

Why Whaling Works

Messages appear highly credible. They are well researched using social engineering techniques that exploit the natural human tendency to trust and be helpful. Messages use the right names, correct titles and have very similar-looking domain names. They are custom-written to avoid spam filters. They appear to originate from the CEO, CFO or another senior executive and often request immediate action. They’re almost always under the amount or threshold required for a second signature. In some cases, impersonation messages are sent by thieves when a key executive is on vacation — making an external or unknown domain name seem legitimate.

The targeted company lacks essential authentication and controls, such as a second signature or sign-off on key transfers or transactions. Or, the recipient ignores key procedures for fear of raising the ire of the CEO or CFO. In many instances, employees are duped into thinking that checking on a transaction might slow things down and derail a key deal. 

Organizations may lack essential security safeguards, including endpoint security, data encryption and email gateway technology to identify suspicious email.

6 Ways to Harpoon The Thieves

1. Educate and inform employees. Coach key employees to recognize an impersonation email and what steps to take to avoid falling victim to thieves. Train them to pick up the phone and verify a large transaction.
2. Use simulations. An effective method for detecting weaknesses and raising awareness is the use of tests and simulations. This takes the form of a staged whaling message that is intentionally sent to key individuals in the organization.
3. Make faking messages difficult. Customized stationery and unique identifiers contained in messages — as well as changes in design periodically — make it more difficult for cyber thieves to create convincing-looking emails.
4. Tap technology. A highly-effective method for thwarting thieves is advanced email gateway technology that identifies and, if desired, quarantines suspicious messages through the use of names, domains and keywords.
5. Stay alert. Monitoring and alert services that notify organizations when a new or different threat exists are also valuable. In today’s fastmoving cybersecurity environment, hours and even minutes matter.
6. Rethink procedures. It may be necessary to change authentication and approval methods by adding a second signature or lowering the monetary amount required to trigger secondary approval. Multilevel authentication and approvals can greatly reduce risk.

* All information here within provided by Mimecast

Is Your Business Disaster Prepared?

We've all seen the news as of late regarding natural disasters. The flooding, loss of power, loss of business, the human impact. How we prepare ourselves for these natural disasters has a direct effect on how well we can manage the outcome.
In a business looking to minimize the risk of IT failure, there are extremely important areas that need to be addressed.

Let's take a look:

1. Risk Assessment / Business Impact Analysis: A risk assessment is the process of identifying potential hazards and what could happen if they occur. A business impact analysis is the process for determining the impacts from the interruption of business processes.
2. Disaster Recovery Plan / Business Continuity Plan: An IT Disaster Recovery Plan should be developed alongside a Business Continuity Plan. Strategies should be set in place to restore hardware, software and data to minimize business downtime and keep the business running. Offsite data/backup storage is essential and should be at the top of any DRP/BCP.

---

At Computer Development Systems, Inc. we recognize that your business up-time is paramount. Put our 36 years of experience to work for you! Reach out to us today and let's work together to develop a disaster recovery plan that works for you!

Happy Birthday To Us!

Celebrating 35 Years In Business!

Today marks 35 years in business for us here at Computer Development Systems, Inc.  We could not be more proud of all the hard work we put in over the years to serve you, our customers, with the best and most trusted IT support in The State of Connecticut.   Your support has made this possible all of these years and for that a BIG THANK YOU from all of us! Cheers to many more years!

What is "The Cloud"?

Recently I've been asked, what is "The Cloud"? Here is a link that perfectly sums up what exactly The Cloud is and why it could be beneficial to your business.