Posts

Showing posts from 2018

The Cloud means no more stormy weather

Image
Many small firms are pretty busy handling their own business, and don’t give much thought to what they would do if a natural disaster from a bad snowstorm to much worse hit their physical location and cut power, or physical access to the building. What if the equipment storing all of your data and software needed to run day to day operations became inaccessible? What would happen to your ability to continue to serve your clients or customers?
Though we call it the cloud, with images of gray skies and rain, the cloud can be a ray of sunshine. It is an excellent and cost effective resource for smaller firms to make sure they maintain 24/7 access even in bad weather. Because everything is maintained off site, you can (1) bypass disruption or damage that may have occurred at your physical site, and (2) access what you need to keep your business functioning from any remote location.

Small firms need to realize they are most vulnerable to business disruptions, as they have less capital and fe…

Your front door is talking

Image
If you've been following the news, the Internet of Things is getting increasing attention. You’re probably also thinking this is some Silicon Valley fancy thing that will take years to reach the rest of us. Not really. You probably already have some items of your own tied into the Internet of Things. First of all, what is the I of T? Simply, it is any object that collects data about itself or its surroundings, and then transfers that data across a network to some other object, which can then make use of that data. For example, if you have a baby monitor that sends crib pictures from upstairs to your phone, you're tied into the I of T. But what about business people? Where is it showing up in the workplace? You may have security cameras tied to a network where they can be monitored by a PC or phone. A front door lock that can be remotely opened via phone. A thermostat that can changed by the same phone. Internal lights that go on when you phone approach. All of these are part of t…

NPO’s and volunteer security nightmare

Image
Not-for-profits have an unusual issue regarding security. Firms that have trained, paid full-time employees have a strong level of control over the actions of their workers. NPOs, however, may rely heavily on volunteers whose time in the office may be minimal and sporadic. You may feel grateful for their dedication and be less likely to subject them to rigid security training. Also, a threat of punishment for those who make inadvertent errors that create security risks isn't going to be acceptable in the “volunteer” environment. Though it may seem a waste of precious volunteer time, you need to consider implementing ongoing training and reminders to all volunteers about what they can do to protect your data and digital infrastructure. The 2 most common human errors are falling for phishing scams and bringing storage devices to your office and introducing them to laptops and other devices. Think of the volunteer who creates a brochure for you in their home office, then downloads it …

Security and your sub-contractors

Image
So you feel relatively comfortable that you have created cyber security around your data and your employees are trained to avoid security errors in their day-to-day business ( a MAJOR source of security breaches, by the way.) However, you may be overlooking one area where you are exceptionally vulnerable. What protection do you have from those you do business with? If you are a manufacturer, for example, you may have several vendors who provide components and raw materials. How careful are they about data security? Smaller producers and service providers may perceive themselves as not being a likely hacker target, which is incorrect. Small firms are significant targets for data hacking because they have access to larger firms. They can provide a “digital backdoor” to the firms they sell to. You need to work closely with all of your vendors to ensure that they are as serious about protecting their systems as you are. If you share digital information with your subcontractors, you open a …

Cyber Crime and Security for SMBs

Image
Did you know the illicit trading of personal data was worth $3.88 billion last year? Cybercrime is a growing industry known for its innovation. It goes far beyond the image many of us have of some hacker kid in his basement. Many who engage in this activity are professionals and work in large teams. Some may even be sponsored by governments. If you follow the news, you can find large corporations and even government agencies who have fallen prey to hackers and had massive amounts of data compromised. Unfortunately, this has led smaller firms to feel they fly below the radar. In fact, the opposite is true. Small businesses-especially those in regulated areas such as medical, financial, and legal services-need to be hyper vigilant about security. The cybercriminals' professional efforts will outdo your amateur efforts at security. As a small business, you are vulnerable for two reasons. First, serious hackers see small business as entrances into larger entities. Small firms that have…

Government regulations

Image
Any business that stores customer payment information must comply with a number of state and federal regulations. The legal, healthcare, and financial sectors have a number of laws tailored specifically for them (such as HIPAA or CISPA). If you run almost any kind of professional practice or agency you probably have very specific data security requirements. Running afoul of these regulations puts you at risk for legal action and probably means that you have bad security in place. As a professional, your focus needs to be on your clients and running your firm. Regulatory requirements to ensure data security can be complex and include rigorous testing requirements. Ensuring compliance with the regulations can be a serious distraction for you and take you into territory where your experience is limited. One of the best solutions is to work with a third party who has strong credentials in the area of regulatory compliance and data security. When you are working with a third party to set up …

Higher goals get dragged down by Tech: The NPO story

Image
If you are a smaller Not-for-Profit, it is likely that your organization has been driven from its inception by individuals strongly motivated with a passion for their cause or humanitarian goal. As a result, it is also possible that the leadership has little interest in developing the administrative technology infrastructure that is necessary for any organization to function in the internet age. Failure to understand and focus on technology can damage an organization's growth and success. However, NPO leadership has to be laser focused on the day-to-day struggles of the organization such as seeking funding, keeping the doors open, and pursuing the mission. As a consequence, technology infrastructure may be cobbled together as an afterthought; resource limitations may lead to short term tech decisions that can be wasteful and more expensive in the long term. An NPO, with its tight budget margins, is an excellent example of an organization that could benefit from outsourcing its funda…

Password basics people still ignore

Image
You can have all the locks on your data center and have all the network security available, but nothing will keep your data safe if your employees are careless with passwords. Change Passwords - Most security experts recommend that companies change out all passwords every 30 to 90 days.Require passwords that mix upper and lowercase, number, and a symbol.Teach employees NOT to use standard dictionary words ( in any language), or personal data that can be known, or can be stolen: addresses, telephone numbers, SSNs, etc.Emphasize that employees should not access anything using another employee's login. To save time or for convenience, employees may leave systems and screens open and let others access them. This is usually done so one person doesn't have to take the time to logout and the next take the effort to log back in. Make a policy regarding this and enforce it. If you see this happening, make sure they are aware of it.These are just a few basic password hints, but they can …

The Cloud: Are there security issues

Image
The Cloud: Are there security issues? For many, the idea of offloading their data to another physical/virtual location can seem like a security risk. It seems counter intuitive that moving data away from “ home” is safer. But is that really true? Any server stored at your location is probably more physically vulnerable than one protected in a large server farm. If you had a fire, flood, or other physical damage that included damage to your server, what would be the result? Also, are your backups stored on–site? If a major event damaged your entire physical location, those backups would be also lost. There is a second reason the cloud may be safer: security. All of your data, no matter where it is located, may be vulnerable to cyber attacks and data breaches. However, cloud storage providers probably offer some of the most sophisticated security projection available. It is unlikely that a small or even mid-sized firm has the internal resources and research capacity to maintain an equival…

How the cloud saves smaller firms money

Image
How the cloud saves smaller firms money OK. You pay someone to store all of your data in the cloud, as opposed to keeping it on your own server and backing it up. And you pay on an ongoing basis. How is that possibly going to be cheaper than just making a one-time investment and keeping it your self? 
Let’s count the ways: (1)  You lose the hardware expense –a capital expenditure cost.
(2)  If that hardware fails, you are out in the cold. 
(3)  Someone has to maintain that hardware. In house IT labor is expensive. 
(4)  If you need more capacity, you have to ramp up at a tiered level, which means you may need to buy capacity you don’t presently need 
(5)  All of that hardware runs on software, which costs money 
(6)  All of that software needs to be installed, updated, etc. (see # 3) 
(7)  All of that hardware and software has to run 24/7. Are you large enough to pay for in house monitoring and support 24/7? (See again #3) 
(8)  All of that data has to be protected with security software, which…

Data regulation and our business: You are probably regulated these laws

Image
Data regulation and our business: 
You are probably regulated these laws
Small firms are probably aware that there are laws regulating the handling of data, but they probably assume that these apply only to larger firms and that they are too small to have any data that is worthwhile or protected under state/provincial or federal laws. Think again. Data protection laws generally worry about the content of your data, not the volume of it. That is, you don’t need to have “tons” (not the technical term) of data to be to regulated by data privacy laws. If you maintain personally identifiable information (PII) you may be regulated by these laws which may include penalties and fines for non-conformance. PII means you store a person’s first name/initial, last name and then link it to another piece of personal information, such as, but not including: Social Security NumberDriver’s license, or state IDPassportSome financial account number, e.g. credit/debit card, checking account, etc.Health insur…

A security hack doesn’t have to mean the end of your company

Image
A security hack doesn’t have to mean the
end of your company
Statistics are showing that each year over 50% of small firms are victims of a cyber attack or data breach. Why does this matter? Most smaller firms have not prepared business continuity plans to keep their IT infrastructure going in the event of an attack. Failing to do so often leads to the failure of the business. Delaying the creation of a business continuity plan is a bit like a younger person delaying writing a will, on the grounds that they are not likely to die soon. That may be true, but if the worst occurs the consequences can be severe for their heirs. If the chance of a breach that could compromise your data or cripple your IT infrastructure is over 50%, there is every reason to immediately develop plans for how your business could maintain operation in the event of an attack on your IT systems. This is an effort that shouldn’t be delayed. Contact ABS Information Systems to help you develop a complete and holistic bu…

Don’t steal… It isn’t nice and makes you vulnerable to security hacks

Image
Don’t steal… It isn’t nice and makes you
vulnerable to security hacks
Don’t steal. It isn’t nice. And... it make you extremely vulnerable you security hacks if you “steal” software packages. Smaller firms often will use unlicensed software packages to save money. This is especially true if they only need a program for a specific task. Aside from the legal and ethical issues involved here, there is a very selfish reason not to do this. Software providers are constantly sending users updates to their programs, and those updates aren’t just about features. They include fixes to security holes and protections against specific new viruses that have been discovered. So, the longer you have an old, outdated software program on your PC or laptop, the more vulnerable you become. Is it really worth saving $200.00 when your entire business’s IT infrastructure could be put at risk? We suggest not.

Cybercrime: In-house protection that only YOU can provide

Image
Cybercrime: In-house protection that only YOU can provide From the political world to the corporate, all we hear about is hacking, hacking, hacking. Everyone gets hacked, data is stolen, etc. So, the cry goes up for better security protections for everyone's data. Firewalls, virus software, etc., etc., etc. Want to know one of the best ways to protect your data? Train your employees to stop opening any emails or links unless they absolutely know they are safe. Scam emails that try to trick you into opening a link to a bogus site, or worse, trick you into providing your password or ID for a known site are exceptionally effective ways for hackers to get into your internal system and compromise data. Yes, ransomware is a serious issue, and malware is out there, but employees naively opening phishing emails remain one of the biggest risks to data security. Talk to your employees on an on-going basis and provide training and tips on how to ID phishing scams

VoIP: A money saving solution for your company’s technology backbone

Image
VoIP: A money saving solution for your 
company’s technology backbone
When small business managers think about their IT infrastructure, they think about their employee’s mobile devices, cabling, Wi-Fi, laptops, a printer, and Internet connectivity. These are the basics of their IT infrastructure. However, there is one other aspect of a modern corporate IT infrastructure and that is an internal phone system that can connect “voice” over the internet, rather than traditional copper wires. Once upon a time, every office had an internal phone system that connected to the world via wire/cable/fiber. That wire/cable/fiber then connected a person in your office to a person somewhere else via the local phone company and a long distance carrier. And they did it for a per minute fee. And a very high per minute fee if you called internationally. A VoIP phone system eliminates the phone company’s per minute connection, sidestepping them and running the voice call over the Internet.  Talk to your mana…

SAFETY PUP SAYS Update

Image
SAFETY PUP SAYS…. Update
One thing smaller firms and individuals are often reluctant to do is download updates to their operating systems and individual apps and programs. Why? Well, because it takes time and you have to reboot the device. Other reasons are a fear that the newest update will have a bug and cause problems. The perception is that it is better to wait a few weeks. Finally, there is a fear that anytime you update a program or OS, something always starts acting weird. All of these may have a certain legitimacy. Even procrastination has its defenders. But why should you download updates ASAP? Because they are not only about new features and a new gadget - they include patches to security issues that have been identified. One of the easiest ways to protect yourself from hacking malware and other nefarious online viruses is to always update your software. Do it the day the update comes out, because it may be released specifically due to the discovery of a brand new malware or r…

With Ransomware, The ONLY Cure Is Prevention

Image
With Ransomware, The ONLY Cure Is Prevention It just keeps showing up in the news. Ransomware seems to just not come to an end. If you haven't heard, ransomware is a particularly nasty virus that freezes access to your data and then demands a ransom, usually in bitcoin. The worst thing about it is that once you are hit, there is almost nothing you can do. There are only 2 options: don't pay the ransom and lose your data, or pay it. There is no "downloadable" fix. You are stuck. With ransomware, the ONLY cure is prevention. In the case of ransomware you need to be constantly updating your data and securing it in isolation from your network. Even then, if your backup system overrides your older data each time it backs up, you can actually save the virus if it has infected your system at the time of the backup. To make sure you are as protected as you can be, we strongly recommend you contact a technical security expert to consult on the best way to protect against ransom…

Business Trade Shows Part III: After the Event

Image
So, you made it back home from the show. You're exhausted and work has backed up in your absence. Here is where the entire investment in the show can go down the drain. Follow-up is critical. Every one of those prospects need to have follow-up. Lots of it. One contact isn't going to be enough. First, send out a short email drip that includes a 'thanks for visiting us at the trade show.' The second should be a 'call to action' email. Send an invitation to meet via phone or in person, and add something for them to download. The download can be a whitepaper, or even just your brochure, but it is always good to attach something. Now comes the really hard work. Contacting prospects. No one is going to just mail you revenues. You need to actively market to your trade show visitors. If some seem uninterested, put their names in a tickler file to try back in 6 months. Just be sure not to just let them drop; the situation may change in the future. In summary, look at a tra…

Business Trade Shows Part II: During the Event

Image
We're back. In the last post, we talked about building momentum toward a trade show exhibition. Today, let's look at your efforts during the show itself.

You already should have sent out a reminder the morning of the show in posts on all your social media accounts, an article on your website blog, and a general email that you're exhibiting. Now it is time to work the booth. First, recognize that your goal is to use this show to develop as large a list of prospects as possible. That means you not only want visitors at the booth, you need their contact information. The proven way to get attendees contact information is to offer them something for free, or run a contest for something worthwhile. Most booths will offer some give way, coffee mug, etc. at the booth if visitors sign a contact info sheet. People can't resist free stuff, no matter how much they don't need another mug or could afford to buy them on their own by the caseload. Therefore, have give a ways. You can…

Business Trade Shows Part I: Before the Event

Image
​ Going to a tradeshow for the first time? Don't make the mistake of viewing this as a 1-2 day discreet marketing event. Instead, view your exhibit at a tradeshow as the central feature of a much longer and holistic marketing plan that builds to the event, and then culminates in the successful post­show follow up that signs on new customers. In the next few posts, we are going to break down the tradeshow marketing plan into three bite size pieces. Today, the pre-show build up. The goal of your pre­show marketing is to attract visitors to your booth at the show. You want them to know about all about you before they take that first walk around the exhibit hall. Take advantage of all the marketing opportunities that the show planner offers. This may include access to an attendees list. If so, use this to send out a few introductory emails prior to the show including your booth number. Send one the day of the show reminding the reader where you are.Sponsorships are also an opportunity, i…

Is Your Website Mobile Optimized?

Image
Smaller firms often struggle just to keep up with maintaining a website. Worrying about a scaled­ down version for mobile users seems like just too much trouble. Today's blog is all about why this matters to you and why should you bother with a mobile version. A bit of background: Mobile sites are versions of your website that can be easily read and used on a small mobile screen. What is readable on a laptop of desktop monitor can be too tiny to use on a small screen. Also, the buttons and fields on your forms become impossible to use. Why does this matter? Three reasons Showing up in search rankings. If you want to be found in a search and appear high in the ranking, you need to have a "mobile optimized" site. Google has now included the failure to have a mobile optimized site as a specific reason to lower a website in its search rankings. If you don't have a mobile optimized site, you slip lower in the ranking. Slip lower in the rankings and fewer people ever find you…

Password Basics That Are Still Ignored

Image
You can have all the locks on your data center and have all the network security available, but nothing will keep your data safe if your employees are sloppy with passwords. There are many ways data can be breached, and opening some link they shouldn't is one of the most serious security sins employees can commit, but today we’ll just talk about passwords. Here are some basic practices that you should require your employees to follow. These are basic tips. System administrators should implement other policies, such as those that forbid using passwords previously used and locking accounts after a few failed attempts to login. But just for you as a manager, here are a few tips. Change Passwords - Most security experts recommend that companies change out all passwords every 30 to 90 days.Password Requirements - Should include a of mix upper and lowercase, number, and a symbol.Teach employees NOT to use standard dictionary words (any language), or personal data that can be known, or coul…

You're Fired! Now Give Me Your Password

Image
"You're FIRED!" ( now give me your password)Losing an employee is not usually a good experience. If they leave voluntarily, you lose a valuable asset. If they have to be fired, you have the arduous task of the progressive discipline process and the final termination meeting. But there are other concerns that arise when an employee leaves. Those concerns are security and their access to company data. Here are some considerations regarding passwords and voluntary termination (A.K.A. resigned) or involuntary termination (A.K.A. fired.) It is important you have a process in place so that whenever a termination occurs, nothing slips through the cracks regarding corporate data security. When you dismiss an employee, you should immediately change out all passwords for anything the employee had access to. Because almost all terminations should be planned, you should also define the process for canceling access. It is unwise to cancel prior to the termination meeting. If you do tha…

IT Defense in Depth Part II

Image
Defense in Depth Part IIIn our last blog we started talking about the different layers of security necessary to fully defend your data and business integrity. Today we will look at the human aspect of it, and network defenses. The human layer refers to the activities that your employees perform. 95% of security incidences involve human error. Ashley Schwartau of The Security Awareness Company says the two biggest mistakes a company can make are "assuming their employees know internal security policies: and "assuming their employees care enough to follow policy". Here are some ways Hackers exploit human foibles: Guessing or brute-force solving passwordsTricking employees to open compromised emails or visit compromised websitesTricking employees to divulge sensitive information For the human layer, you need to:Enforce mandatory password changes every 30 to 60 days, or after you lose an employeeTrain your employees on best practices every 6 monthsProvide incentives for securi…