Paradigm Consulting Company - Blog

Trained to betray: How post-training supply chain attacks hijack coding agents

2026-11-13T17:00:10-05:00

Supply chain attacks are a real risk for everyone these days, and that applies to AI agents as well. Agents are easily convinced to download scripts and modules to make performing tasks easier, and in fact will often download NPM or PyPI packages with no prompting by or awareness on the part of the user.

Microsoft Defender Research spent time discovering how poisoned datasets could be used to backdoor AI agents, and how those poisoned datasets could be delivered via trusted supply-chain channels.

In your organization, planning how and what to give AI access to is critical. Agents can and will use whatever tools seem appropriate to do the job unless effective guardrails are carefully and deliberately put in place.

Full article here: https://www.microsoft.com/en-us/security/blog/2026/11/12/trained-to-betray-how-post-training-supply-chain-attacks-hijack-coding-agents/

Urgent Call from Barracuda: Replace Your Email Security Gateway Now

2023-06-08T09:00:46-05:00

In an unprecedented move that has taken the cybersecurity world by storm, Barracuda Networks has urgently called upon its customers to immediately replace their existing email security gateways (ESGs) due to a serious security vulnerability, identified as CVE-2023-2868. This news is especially significant, considering that evidence shows the vulnerability has been actively exploited since October 2022.

The vulnerability, as the company describes it, originated in a module that screens attachments of incoming emails. The Australian Capital Territory government, one of the victims of this vulnerability, publicly acknowledged that they were breached through this flaw.

One particularly striking aspect of this situation, as noted by cybersecurity firm Rapid7, is Barracuda's pivot from a traditional patch to a complete replacement of affected devices. This drastic action suggests the malware, as deployed by threat actors, achieves a deep-rooted persistence, to an extent where even wiping the device clean fails to erase the attacker's access.

Taking a closer look at the vulnerability, it arises from a failure to thoroughly sanitize the processing of .tar files or tape archives. The issue lies in the incomplete input validation of user-supplied .tar files, specifically related to the file names within the archive. In effect, this provides an opening for remote attackers to craft file names in a way that triggers a system command execution through Perl's qx operator. This would occur with the privileges of the Email Security Gateway product, making it a matter of high concern.

In summary, the magnitude of this issue has caught everyone by surprise, and it underscores the importance of constant vigilance and proactive measures in the constantly evolving field of cybersecurity.

Security Gateways Now

The Hidden Risks of Public USB Charging Stations: Juice Jacking and How to Protect Yourself

2023-04-14T09:56:41-05:00

As a long-time user of Apple products, I'm well aware of the importance of keeping our beloved devices charged. Public USB charging stations in airports, hotels, and shopping centers have become a convenient solution for that purpose. However, the FBI Denver and the FCC have recently warned about a cyber-theft tactic called "Juice Jacking," which can put our personal data at risk when using these charging stations.

What is Juice Jacking?

Juice Jacking is a sneaky cyberattack where hackers infect public USB charging stations with malware to access electronic devices while they are being charged. This malware can lock a device or even steal personal data and passwords directly from the device. Cybercriminals can then use this information to break into online accounts or sell it to other bad actors (1). This is not a new idea - I remember first hearing about this sort of exploit over ten years ago. It is unclear as to why this just bubbled up to the headlines again now. Regardless, it is worth considering a few easy steps to protect yourself from the threat.

How to Avoid Becoming a Victim

I'm not one to take such warnings lightly, especially when it comes to my gadgets. So, I've compiled some tips to help you steer clear of Juice Jacking:

Skip the public USB charging station and opt for an AC power outlet instead.
When traveling, pack your own AC and car chargers, along with USB cables.
Carry a portable charger or external battery for emergencies.
Consider investing in a charging-only cable from a trusted supplier to prevent data transfer while charging.
If your device prompts you to choose between "share data" or “charge only” when plugging into a USB port, always pick “charge only.”

Final Thoughts

Though Juice Jacking may not be as common as other cybersecurity threats, it's still essential to be cautious when charging our devices in public spaces. After all, it's better to be safe than sorry. So, let's keep our devices charged and our personal data secure by taking these precautions to heart.

References:

Federal Bureau of Investigations, Denver. (April 6, 2023). https://twitter.com/FBIDenver/status/1643947117650538498m

Federal Communications Commission. (April 11, 2023). 'Juice Jacking': The Dangers of Public USB Charging Stations. https://www.fcc.gov/juice-jacking-dangers-public-usb-charging-stations

Time to Ditch LastPass

2023-01-27T19:43:46-05:00

In today's digital age, it's essential for individuals and organizations to secure their online credentials. One of the most popular tools used for this purpose is LastPass, a password management software. However, in recent years, LastPass has faced significant security concerns that have raised questions about its ability to protect users' sensitive information.

In 2015, a vulnerability was discovered in the LastPass browser extension that allowed attackers to steal login credentials and other sensitive data by exploiting a flaw in the software's design. This vulnerability, known as a "zero-day exploit," was considered critical because it could be easily used by attackers to gain access to a user's sensitive information. LastPass quickly released a patch to address the issue, but the incident served as a reminder of the potential risks associated with using password management tools.

In 2017, another critical vulnerability was discovered in the LastPass browser extension. This vulnerability, known as "clickjacking," allowed attackers to steal login credentials and other sensitive data by tricking users into clicking on a malicious link. Again, LastPass quickly released a patch to address the issue, but the incident raised further concerns about the software's security.

In 2019, LastPass experienced a data breach where email addresses, password reminders, and other data were compromised. This breach was significant because it affected all users of the software, regardless of whether they were using the free or paid version. LastPass took steps to address this issue, but the incident served as a reminder of the importance of using a unique and complex master password and enabling two-factor authentication.

In 2021, another data breach was reported in LastPass, where user's email addresses and password reminders were stolen. This time, however, the attack was performed through a third-party data breach, which highlights the importance of using a unique email address for each service you use, and enabling two-factor authentication.

One of the main concerns with LastPass is the way that the company has handled the security breaches. In 2019, the company delayed the notification of the data breach for a month after the discovery, which led to criticism from security experts. Additionally, in 2021, the company has not provided much information on the scope of the breach and the number of users affected. This lack of transparency has raised concerns about the company's ability to handle security incidents effectively.

While LastPass has taken steps to address these issues and improve its security, the fact remains that these vulnerabilities existed and were exploited. This raises concern about the company's ability to protect users' sensitive information, particularly in the context of a business environment where sensitive information is of the utmost importance.

As a result, IT end users in a business environment should consider using a password management tool that has a strong security track record, has been audited by security experts for vulnerabilities and has a transparent way of handling security incidents. Alternatives such as Bitwarden, Keepass, and 1Password are more secure options and have a good reputation on these regards. Additionally, it is important to use a password manager securely, by using a unique and complex master password, enabling two-factor authentication, and keeping your software updated.

In conclusion, while LastPass is a popular and convenient password management tool, there are significant concerns about the company's security track record and their handling of security incidents. IT end users in a business environment should consider using a more secure password management tool, such as Bitwarden, Keepass, or 1Password, and use it securely to protect sensitive information.

An incident response team is like the Avengers

2017-03-08T11:12:34-05:00

Today, after leaving a meeting, one of my junior analysts said "I guess we need to lower the threshold for declaring an incident." Intrigued, I asked what brought him to that conclusion. He said "well, our incident response plan says that we organize the team if more than ten computers are affected, but you just said that an incident is any event that indicates harm or malice." Realizing that further clarification was required, I resorted to my favorite tools: analogies and metaphors.

I gave the example of Captain America hearing a car alarm going off. This is just an event, and not yet an incident. Why? Surely if a car alarm is going off, something bad is happening, right? No, not necessarily. It could have been set off by the owner by accident, by a teenager zipping by on his skateboard and accidentally slamming into the car, or another car bumping into it while parking. While these are all (noteworthy?) events, none of them represent an incident in the security context because nothing really bad was happening, and there was no evil intent.

This is the equivalent of an analyst detecting an alert on the corporate SIEM. The analyst notes that there are a large number of failed logons occurring on a system. Investigating, he finds that they are all originating from a single workstation, which was unable to log on due to a recent password change. Is this an incident? No.

Taking it to the next phase, let's say that Cap does investigate, and he sees that the alarm was set off not by some passing skateboarder, but by a common street thug. Does Cap yell "AVENGERS, ASSEMBLE!?" No, not yet. Some two-bit thug trying to jack a car is well within Captain America's ability to cope with without needing to call upon other members; you don't call for Thor and Iron Man just because you've got them on speed dial, and Cap knows that.

This could be likened to the analyst detecting malware on the affected system. Perhaps this malware was trying a brute force attack against a random system on the network. The analyst tasks the antivirus software to re-scan the system and do a cleanup, which it does successfully. Problem solved, with no need to bring on additional help.

Even if the guy breaking into the car turns out to be Batroc, Cap doesn't go crying for help, because he can has handled the likes on his own many times in his extensive career. But what if Batroc is not alone, and is accompanied by his brigade of super villains? This is where it gets a bit subjective. Being a seasoned incident responder, Cap is likely to attempt an immediate intervention in their nefarious activities, even though he's outnumbered. However, if he starts to realize he's being overwhelmed, Captain America is not too proud to reach out to a nearby resource like Bucky, the Falcon, or Spider-Man if he's nearby. Since he has an established relationship with many other super-powered resources around the world, help is just a quick call away.

The analyst continues to investigate, and finds that there is malware on the affected system, and also notices alert that other nearby systems are apparently infected with the same malware. Contacting the department IT liaison, he finds that they are aware of the infection, which was passed around by a shared USB drive. Working together, the department contact and the analyst are able to clean up the malware before it spreads beyond the handful of machines.

But, let's say that Cap notices it's not just an ordinary thug, and not even just Batroc's Brigade, but it turns out that, for some reason - don't ask why - it's Ultron who has decided to steal this car. As a villain who has tried to destroy the world, and come awfully close to doing so, this is immediately dubbed a very serious incident.

Further investigation reveals that multiple systems have been infected, and are communicating to an external IP address in a remote location. There is now evidence that classified data is being exfiltrated from the network. It's time to call on extra help. The incident response team, consiting of members of the networking, server administration, and department IT teams, are notified, and a command center is established. The team immediately begins to compare notes to determine what is going on, and how to contain the threat.

This is why Captain America's got not just Bruce Banner's cell phone, Nick Fury's SUV phone, and Tony Stark's office number, but also Pepper Potts' pager (because she'll be able to get a hold of Tony, regardless of what lady has caught his attention this evening). Cap also has a plan, which directs him to notify the regular members of the team.

This is why the incident response plan must be regularly updated to include a current list of contacts, the systems for which they are responsible, and their best contact methods.

If it turns out that things are getting really bad, he may need to call upon a specialist. For example, since Ultron is (these days, anyway) made largely of vibranium, it may make sense to call upon someone with extensive knowledge of the precious metal - good thing Cap kept T'Challa's Whatsapp handle at the top of his favorites! Now the Black Panther is only a hop, skip, and a jump away from joining the team. If other threats are encountered along the way, say, it's found that Doctor Doom may be collaborating with Ultron, more help - in the form of the Fantastic Four - may be called upon, as they have extensive experience dealing with Victor von Doom, and can likely help contain the threat in a timely fashion.

The organization maintains relationships with law enforcement, their ISP, and outside security firms who can supplement the incident response team if required. Calling on a professional services firm to assist with containing an advanced persistent threat may be called for, as well as notifying law enforcement or various government agencies, depending on the nature and scope of the breach that has occurred.

Is every day in the life of a security analyst as exciting as that of an Avenger? Probably not. But it can be fun, at times, especially if you like being a hero. If you think you have relevant skills or information that could be useful in a security incident, let your local security team know, and ask how you could be of help during a crisis. Who knows? You may just get a snazzy, new ID card to carry around.

Review: Symmetry Series Folio for iPad Mini 4

2016-07-14T10:08:41-05:00

Symmetry Series Folio for iPad Mini 4 Company: OtterBox Price: $59.95

I recently had the opportunity to evaluate and review the Symmetry Series Folio for iPad Mini 4 from OtterBox. This is a protective, wrap-around folio style case. In keeping with their reputation, the case is not one of the slimmest you can get, but definitely offers a lot in the way of protection.

Installation is simple, but took me several seconds to get all of the corners tucked in properly. This was comforting, as I knew that, once snugly inside, my iPad was not coming out by accident.

Once in the case, the back and side edges of the Mini are completely protected, save for openings for the microphone, speaker, camera, and headphone jack, all of which are easily accessible from within the case. A nice touch is that the microphone and speaker openings are pointed to the front of the iPad, so I was pleasantly surprised to find the volume to be a little louder in the case than when not.

Symmetry Series Folio for iPad Mini 4 seals to itself magnetically, offering what seems to be a fair amount of protection from drops and impacts. To be clear, this is not a waterproof case, so I'd advise against submersion or excessively large spills. The back of the case is a hard plastic, while the front flap is made of textile or leather, depending on what option you choose. The model I evaluated was leather, and has a nice grip to it. The cover supports the iPad's wake/sleep capability, automatically placing the iPad to sleep when closed and waking when opened.

When open, the front of the case folds away, to the rear, allowing easy access to the iPad's screen. Alternately, the case can serve as a stand for the mini, offering several different angles at which the iPad can be propped up. A significant difference from other cases and covers I've used is that both landscape and portrait modes are supported, as the iPad Mini is allowed to rotate completely around while mounted in the case.

As my personal preference is for slimmer cases, the main drawback I found with the case is its bulk. Again, this is not a surprise, as most Otterbox cases have a reputation for erring on the side of caution, and if you're prone to dropping your iPad (or dropping things on your iPad), you may be well-served by investing in this case.

10 Critical Steps to Survive a Ransomware Attack, Step 10: Prepare for the Worst

2016-06-27T08:59:56-05:00

Here we are at the 10th and final step to survive a ransomware attack. If you've been following along, you've already done (or at least thought about) a lot!

Hopefully you've dropped your administrative rights over your system, as this is a really simple thing to do, costs almost nothing, and quickly enhances your system's security.
You've checked your systems to make sure they're fully patched, including not just the operating system, but third-party programs as well, and you've got someone watching over these to make sure the correct patches are rolled out promptly.
You've gotten (or at least looked into getting) a web content filter to screen out malicous websites before your systems are allowed to access them.
Your IT provider has configured your firewall to allow only legitimate traffic out from inside your network, so that if a computer on your system is compromised, it won't be able to talk to the bad guys in charge.
Your email administrator has restricted attachments, blocking anything that is not absolutely required.
You've identified the points on your system where data is stored, and worked with your IT provider to restrict access to only those who need it on a need to know basis, instead of just opening everything up to everyone.
You've verified that you have rock solid backups, appropriate to your required level of recovery, so that your business could get "back to business" rapidly in the event of a disaster.
You've let your staff know that they are constantly at risk from Internet threats, and have investigated implementing a security awareness program to keep them and your critical assets safe from phishing scammers.
You've worked with your IT staff, or at least started the conversation, to whitelist and allow only authorized applications to run on your network, making it so that malware won't be allowed to run if it somehow slips through the above controls.

So, that's it! We're done, right?

Not quite. Here's the reality. Even if you did all of the above, there's still a chance something could go wrong. A brand new virus might sneak through the filters, an employee might still fall for a convincing scam, your backups may fail, etc. This should be no means be an excuse for inaction! That is a pathetic excuse, like saying "well, if I get into a really bad car accident, even if I wear my seatbelt, I could die. Therefore, I don't wear it." That's just plan ridiculous.

Should all of the above fail, your last line of defense is to have a comprehensive insurance policy that will cover you in the event of a disaster or an extortion case. Do not assume your current insurance policy includes this! As new threats and risks emerge, insurance policies frequently cite these as exclusions, and require separate policies to provide coverage. Talk to your insurance agent about these and find out what is, and what is not covered.

Also, should you get hit by ransomware, you should be prepared to pay a ransom, in Bitcoin. Bitcoin is an online currency that - when properly maintained - is completely untraceable (which is why criminals favor it over things like credit cards, gift cards, etc.). If you've never exchanged US dollars for Bitcoin, do yourself a favor and set up an account with a reputable Bitcoin exchange today, as this process can take over a week to set up. If your system is compromised and you have no recourse other than to pay the ransom, you don't want your entire business to be stuck for a week twiddling its collective thumbs while you wait for initial ACH transfers to process so you can pay the ransom.

10 Critical Steps to Survive a Ransomware Attack, Step 9: Allow Only Whitelisted Applications

2016-06-20T08:59:54-05:00

Note:this step takes some effort, and you do not want to tackle it yourself without the help of a competent IT person. That said, it is a very,very effective way to stop ransomware and other malware dead in its tracks.

By default, computers are "general purpose devices." This means that, even if you purchased a new computer with one thing in mind, like running payroll, it can do several other things - like email, online shopping, surfing the web, playing games, and... downloading malicious programs to eat your data.

Whitelisting is a simple concept: your computers are configured to only run previously-authorized applications. This is an example of the principle of least privilege. Do you have keys to your home? Sure. Does your next door neighbor? Possibly, if you know and trust them, and want them to hold a backup in case you get locked out. Does everyone on the street have keys to your house? Probably not.

Similarly, if a computer has a specific function, it makes sense to lock it down in such a way so that it can only do what it is required to do. Think of these policies as a train tracks - there's no worry that the Red Line train to Ashmont is going to somehow wind up at Wonderland.

So if you only need to run Word, Excel, and Outlook to do your job, your computer will only run Word, Excel, and Outlook. This does take some work and fine-tuning to get it right, and you need to work closely with your IT provider to make sure that nothing is overlooked, but once you've taken these steps, your computer is dramatically more secure because its exposure to harmful programs is significantly reduced. Along with this, make sure your systems are configured to only run programs from authorized locations. This means you will stop yourself (and other users) from running programs unless they are "in the right place," on the right system. Because many malware programs run directly out of your Downloads or temporary (email and browser) folders, preventing any programs found here from running will stop many malware programs in their tracks.

This also makes sense from an operations perspective. Should a machine on the production floor be accessing HR or payroll records? Probably not!

There are several third-party applications to enable whitelisting, and a competent system administrator can probably do the same thing with tools built in to your Windows or Macintosh operating systems. Regardless of what route you choose, start the conversation today by asking your IT provider "is application whitelisting something we should consider?"

Continue reading part ten.

10 Critical Steps to Survive a Ransomware Attack, Step 8: Train Your Users

2016-06-13T08:59:52-05:00

Never have I encountered a new client where the business owner approached me and said "I think my staff doesn't know how to use our information systems." With few exceptions, it's just assumed that everyone knows how to use a computer, and that's all that's required to get the job done. Let alone questions about efficiency and effectiveness, this completely overlooks the question about information security. Most users cannot tell the difference between a real or bogus software update warning. Most users cannot tell if they should or should not click on something to apply the latest update to their operating system, and what would or would not happen if they did or didn't do so.

And yet, in most SMBs, users are left to their own devices to make these decisions. When you compound this with how effective phishing email (and now telephone) scams can be, it's a recipe for disaster for your business. I was once told by the CFO of a multi-million dollar manufacturing firm that told me "when I see a link that says irs.gov, I tend to trust it." And there's the problem - links can lie. Here's an example: click the link below, notice where it takes you, and then come back to this article. Go ahead! I'll wait.

www.irs.gov

Where did it take you? Was it the IRS website? Didn't think so. "But it said IRS.gov!" This is just the simplest, most trivial method of spoofing out there. Trust me - they only get more devious and sneaky.

Simply assuming that your staff know how to spot a scam when they see one is begging for your business to be successfully attacked. People need to be trained how to identify legitimate and fake communications. I'm not talking about a process where "once per year we go through a checklist to make sure our users know what not to do." Seriously - when was the last time you did something only one time, a year ago, and you remember exactly what it was and exactly how to do it? Most people just don't work like that! We need perpetual education, reminders, and updated information so as to be on the lookout for the latest threats. No matter what your role in the organization is, security is your job.

For starters, make sure your staff know that there are numerous other businesses that are falling victim to ransomware which are delivered as email attachments and through infected websites. Explain to them that this is why we have a policy that prohibits accessing these from work computers, without a business need to do so (and that "this is why the firewall is blocking you from Facebook").

Then, work with a competent security professional to educate yourself and your staff in the latest threats so they know what to be on the lookout for, and establish a security awareness program. Training should be regular - at least monthly - to ensure that it stays on your staff's minds (something I affectionately refer to as a "healthy dose of paranoia").

Don't make the mistake of thinking "my people know how to use computers, so we don't need this." That's not what security is - it's not about knowing what to click, it's about knowing what not to click.

Continue reading part nine.

Kanex Mini Bluetooth Keyboard with Stand Cover - Review

2016-06-06T11:07:08-05:00

Mini Bluetooth Keyboard
Price: $39.99
Company: Kanex

I recently had the opportunity to review the Kanex Mini Bluetooth Keyboard with Stand Cover, and I have to say that I was impressed. Inside the box are the keyboard itself, a magnetic cover (which doubles as a stand for your tablet or phone), and a USB charging cable.

Pairing I the keyboard with my iPad Mini 4 was a breeze, as the keyboard appeared immediately in the iPad's Bluetooth settings. I also paired the keyboard with my iPhone 5S to test, which worked a expected. However, I did have to make a few attempts to re-pair the keyboard with my iPad when I was done experimenting with the iPhone, as pairing with the iPad failed several times until I powered for the keyboard, told the iPad to forget it, and added it back as a new device.

The keyboard itself performed very well, despite the fact that the keys are the size of Chicklets. Recall that it is the same width as an iPad Mini, so there isn't a lot of real estate to play with. I did find myself occasionally hitting Enter when I was trying for other keys, and found the need to press the Fn key to get apostrophe and double quotes a bit odd at first, but I figured it out. Am I as fast a touch-typist on this as I am on a full-sized keyboard? Not even close. Am I a whole lot lot faster than using the iPad's on-screen keyboard (either the Apple default or Google Gboard)? You betcha. However, if you have even slightly larger than average fingers, you could find yourself making a lot of typos and at the whim of autocorrect to save you.

Speaking of autocorrect, I found I was able to express myself fairly quickly and accurately with the Kanex. I was also amazed at how much faster it was for me to be able to Command-Tab from one app to another rather than double-clicking the home button to open the iPad's built in task switcher view. One thing that always takes me a little getting used to is the fact that there is no mouse or trackpad. For some reason, there is still a disconnect for me between typing on a physical keyboard, and having to touch the screen to select icons or menus. That said, the Kanex supports common keyboard shortcuts, like Shift-arrows for selecting text, and Command-X and V for cutting and pasting a selection. The Fn key also provides the ability to invoke several extended commands, such as switching back to the home screen, cycling through apps with Command-Tab, and audio/video playback controls. Including Fn key combinations, I was able to find all of the keys normally found on a standard 101-key QWERTY keyboard.

Although it is fairly intuitive, the provided documentation (in English, Spanish, French, German, Chinese, and Japanese) does not show how to fold the case so as to function as a stand, although the there is a picture of it in stand mode on the box (which I did not notice, because I set the box aside as soon as I opened it). The cover itself magnetically sticks to the keyboard - which is brilliant - as well as itself, to stand up in a sort of tent on which to lean your tablet. You can easily separate the two pieces if you like, but they firmly adhere to each other for a stable typing experience, even when I have the unit on my lap.

Also not documented are the Fn key options to invoke iOS, Android, or Win modes. I noticed that selecting iOS allowed me to use the special commands to return to the Home screen, Find, or even lock the iPad. As I didn't have an Android or Windows device handy to test this, I presume selecting these key combinations issues the appropriate command dependent on what operating system you select.

Kanex claims that the rechargeable battery will last for two months on a single charge. While I did not have any issues with the battery, I did not have time to put this two-month claim to the test.

Overall, the Kanex Mini Bluetooth Keyboard - on which this entire review was written - is a solid offering, and worth a look if you are in the market (or if you've just been typing on an iPad Mini and haven't yet realized that you're in the market).

10 Critical Steps to Survive a Ransomware Attack, Step 7: Have Rock Solid Backups

2016-06-06T08:57:52-05:00

If your luck is anything like mine, you'll find out that your backups are inadequate shortly before you really need it. Fortunately, I learned this lesson early on, when I was in college, and all I lost was a database I'd made of all of my comic books. While it didn't cost me any business, it did cost me hours of work and years of data that I'd accumulated over time. As a result, I had to recreate the database and dedicate a few hours here and there to recreate it.

But when your business is down because your primary line of business data is gone, it's not that simple. Let's imagine the same thing has happened to your business. As I am writing this, we are in the middle of responding to an incident where a business has been entirely shut down due to being infected with the Locky ransomware. The entire business has been shut down for 10 days now because a single employee's PC contracted a virus which managed to attach itself to the entire network, encrypting every Microsoft Word, Excel, Access file, along with every picture, PDF, video, and audio file it could grab - which was all of them. We received a panicked call from the client on Monday morning, expecting that we would be able to wave our magic wand and get their data back. Sadly, this was not the case, as the client was lacking all of the critical controls we will outline in this and subsequent articles.

Most businesses we encounter have some sort of backup. That's the good news. The bad news is that they are often inadequate. There are several different types of backups. This article won't go into great detail on them - just skim the surface so you have a basic understanding, and can make sure you have the appropriate solution for your business.

Manual Backups

One type of backup is manual. This means that a human has to create the backup by themselves, starting it, supervising it, confirming it, and testing it. This may be as simple as dragging a copy of your data file to a USB drive or copying a file from your desktop to a server.

The problem with manual backups is the fact that they are manual! Given enough time, you will forget to perform a backup. This has happened - without exception - to every single backup that I have encountered which required a human to manually perform. It's not a matter of if - it's when.

Automated Backups

As implied, an automated backup is one that happens on its own, without a person having to click a button, swap a tape, insert a drive, etc. This doesn't mean you are totally off the hook, and can just "fire and forget" about the backups; someone still has to check up on them periodically to make sure they ran. I have seen plenty of instances where a business had no backup for days, weeks, or even several months because backups were not being monitored by anyone. Someone - whether it's an internal IT staff member or an external provider - needs to be monitoring to make sure your systems are backed up properly.

File Backups

These backups will grab one file at a time, and keep copies of them. In a pinch, it's likely that you'll be able to get your files back, which is good.

The problem? They usually don't preserve your system's metadata. This is special information on a system - things like file permissions (who should and should not be able to read or write to the file), usernames and passwords, and sometimes email or other types of databases. Often, these special data files require their own, special type of backup to catch everything, and restoring only a part of them means you get back only a part of the data.

A classic example is something like Carbonite or Crashplan. These file level backups do a great job of catching your data files, but don't preserve things like your user accounts or filesystem permissions. As a result, if you use one of them to back up your work server, and need to restore completely (known as a "bare metal restore"), you may not be able to, and will have to go through the process of rebuilding the server from scratch before you even have a place to restore your data files to! This effort should not be underestimated, as the process can take days or even weeks when things like software discs, licenses, and other special information needs to be dug up or re-purchased.

Image Backups

Far superior to file backups are image backups. These take a complete "snapshot" of the system, and allow you to restore the computer back to a prior point in time. These provide the greatest reliability and flexibility, as they often allow you to do anything from extracting a single file all the way up to a complete system restore. Some systems even allow you to use virtualization to make a virtual hardware machine from the backup. This is an amazing time saver when something is wrong with the original server's physical hardware and can't be used. Even if the original server literally bursts into flames, the virtual replacement can be spun up in a matter of minutes, and business can continue.

Local Backups

Local backups are kept on site, with the system which they are backing up. The advantage to these is time - you get to recover your data much more quickly than if the data is kept in a remote location. The disadvantage is that if something catastrophic happens to your facility, the same catastrophe likely will affect your backups. Imagine you have a fire in your server room. Where are the backups? Most businesses will respond "in the server room." So what happened to the backups? They are likely in the same puddle of melted metal and plastic that the server is now.

Remote Backups

Remote backups are kept someone other than at the site which they are backing up. This can be at an off-site facility (often referred to as "in the cloud" or in a remote datacenter), at a satellite office, or even at an employee's home. The advantage is that if something happens to the main location, the data is safe.

However, there are concerns with remote backups. First off, is getting the data back. If you have a lot of data, it will take time to restore, whether it's on a hard drive stored at your home, or in a cloud datacenter over the Internet. When combined with an image backup and virtualization, you can often get your business back up in minutes. However, without this, with data stored far away, it may take days or even weeks to get everything back, and installed on a replacement system in the case of a serious failure.

These qualities of backups are not mutually exclusive, and can be combined in various ways to come up with different backup solutions. For example, your backup solution may be local, and manual, or it could be automated, local and remote, and support image backups with virtualization (my favorite).

Conclusion

To protect your business from ransomware and other disasters, get a solid, robust backup solution that backs up everything on your system - not just a few files and folders - several times per day (not just overnight), and keeps multiple versions that go back several months - allowing you to go back to prior to the infection - both locally and at a remote location. And remember the key step that is too often overlooked: test your backups. Do NOT assume that everything is working fine - test your backups, or have your IT staff test them for you, and give a full report on the restore process. Do a full restore to make sure you could get everything back if the server literally blew up in a ball of flames.

A solution that covers all of the bases likely will require you to work with IT to make sure everything is configured properly, but it's easy for you to take the first step and send an email to whomever manages your backups right now and ask "can you show me the results of the latest backup test?" And if they don't have one, no problem! Just say "Okay, could you perform a backup test and report back to me?" Again, this should be a full backup test restore. If they say this is not possible, ask probing questions as to why, and see what it will take to achieve this functionality to properly protect your business.

Continue reading part eight.

10 Critical Steps to Survive a Ransomware Attack, Step 6: Restrict Access to File Shares (aka "Silo Your Data")

2016-05-31T08:40:16-05:00

10 Critical Steps to Survive a Ransomware Attack, Step 6: Restrict Access to File Shares (aka "Silo Your Data")

Most small firms we work with have a single file repository on their network, and every staff member has full access to it, and all of its contents. This means that anyone, from the CEO all the way down to an intern, has the ability to inadvertently encrypt every document on the server. Compartmentalizing data into silos where people have the least privileges required to do their job is the key to keeping a virus outbreak from running rampant through the entire organization. This is another example of the principle of least privilege - whereby you achieve security by limiting the amount of power you have.

Let's look at some examples. Most small enterprises start with a single server on which to house all of their data. This will usually be a shared folder on a server called something like "Company," "Shared," or "Files." These folders are then shared to everyone in the organization (and sometimes, anyone at all who manages to connect to the network). Within this main folder, we'll often see several folders like "Clients," "Projects," "Procedures," "Contracts," "Quotes," etc. Or we'll see folders for specific departments like "Payables," "HR", and "Accounting."Sometimes we find folders for individual users here, such as "Alice," "Bob," and "Charles." Often the only thing preventing inappropriate access from occurring is the honor system, and given the number of times we find documents in the wrong locations (because users were poorly trained and didn't know where to properly file them), this is anything but a reliable means to secure your company's data!

To properly have your data secured, you need to first be able to classify your data files and who should have access to it. This does not have to be complicated! If you have a bunch of accounting documents, then only the accounting staff (a group that you've defined) should have access to them, and if you have a bunch of sensitive R&D information, make sure the only R&D group has access, etc.

Start by taking an inventory of your company data, then look at your team. Divide them all up into logical groups, then assign permissions based on their role, not because "they think they may need this someday" or they want access. For some reason, this makes perfect sense with financial information - unless your firm practices open book accounting, you probably don't give every employee access to all of your sensitive financial information. The same should be true for all data in your enterprise unless you have determined that it is for public consumption, or for use throughout your organization.

You'll probably have to work with your IT provider to make this happen, but at least you can start by identifying the various share points on your network (often appearing as drive letters) and identifying what roles (not individual people) need access to them (and which ones don't). This will also be useful for you to explain why you need this to be done, as some IT shops take the view of "if it ain't broke, don't fix it." That's like not changing the oil in your car because "it's working just fine now!"

Continue reading part seven.

10 Critical Steps to Survive a Ransomware Attack, Step 5: Restrict Attachments

2016-05-23T09:39:46-05:00

First off, if you did not request it, don't open it. In the last two months, we've worked with three Vice President and higher executives who said exactly this: "I received an attachment from someone I didn't know, and I wanted to see what it was." Curiosity killed the cat... and the VP's computer. The red flags should have been flying at "from someone I didn't know." If you weren't expecting it, don't open it!

Consider having your IT staff filter out email attachments - not just EXE files, but Microsoft Office documents and PDFs as well. If a job doesn't require receipt of email attachments, don't allow them! If you are required to receive attachments to do your job, such as the case for HR professionals, make sure that your default application for handling them is a lesser-functioning viewer, such as the Microsoft Word Viewer. This is a greatly stripped-down program that lacks the features that viruses use to take over your system.

Side note: If you think you are immune because you are a Macintosh shop, I'm sorry to say, you're not; Macs are just as susceptible to virus-laden email attachments as Windows machines - we just don't see them as often because there are more Windows machines than Macs.

Remember, start with a written policy, then give it to IT to enforce.

Continue reading part six.

10 Critical Steps to Survive a Ransomware Attack, Step 4: Configure Your Firewall to Filter OUTbound Traffic.

2016-05-16T09:39:13-05:00

A firewall is a type of security device that blocks network traffic to and from unauthorized sites, and allows traffic to authorized sites. Firewalls range from high end devices designed to protect the likes of Amazon and Facebook, down to SOHO (Small Office/Home Office) devices from Linksys. While there is a tremendous range of features and capabilities across these devices, at their core, they boil down to the same set of basic functions: allowing or denying traffic based on their configuration.

The most common ways we see firewalls configured are to allow little or no traffic in to the network, and to allow any traffic out of the network.

Work with your IT staff to ensure that your firewall allows only legitimate traffic both in AND out. A lot of the problems stem from compromised systems inside your network which are allowed to send traffic out to the bad guys. If this communication is blocked, you have a better chance of recovering your system before it's too late. You have to work with a competent firewall technician to make sure this is done properly. Again, start with the principle of least privilege - lock down traffic so that only what is needed - not anything that is wanted - is allowed in or out through the firewall.

Take an example where a PC in the HR department wants to get to a job search website. As this is likely the sort of thing we'd want the HR department to do, we allow it.

We also see that a server on the network is trying to access the same job search website. This sounds like one of our server admins is trying to get on to Monster.com to find his next gig. Not allowed!

Third, we see a PC with a virus on our network, attempting to access EvilBadGuy.com. This sounds really fishy, so we block it.

Finally, EvilBadGuy.com is trying to send some traffic in to our network, to which we say "no way," and block the attempt.

The "lazy configuration" is to just allow all outbound traffic, and deny inbound traffic. We call this this "lazy" because it takes a lot less effort. The problem is that is means things are less secure. Often, if a computer system gets hacked, as in the PC with a virus in the example above, it will attempt to contact the site that wants to control it out on the Internet. A properly configured firewall will recognize this attempt for what it is, and shut it down. Failure to do so can result in the infected PC becoming part of an army of "zombie" computers, also known as a "botnet," or an army of systems infected with viruses which do whatever they're directed to do by the person in charge of the network. We've seen botnets with literally millions of infected systems under their control. When directed at a single target, these botnets have the ability to completely disable even the largest of websites, and are frequently used as part of extortion rackets.

In addition to having these firewall rules in place, it is important that the devices be monitored so that when inappropriate access attempts are made, they are not only stopped, but reported and responded to by the appropriate party. Too often we see firewall alerts going nowhere at all, or going to someone's mailbox at the end of the week (or month). This means that a virus or hacker could be running around inside the network for a month before anyone even notices! This is one reason why, according to reports from security firms Mandiant and Verizon Enterprise, when attackers gain access to a network, they usually go undetected for over 200 days. Imagine that - someone gains access to your computer network and can do whatever they want, on whatever system they want, recording every keystroke, mouse click, password, etc., for over six months.

For these reasons, be sure to be monitoring and blocking unauthorized traffic through your firewall, inbound and out.

If you'd like to listen to this article discussed in audio format, it was featured as an episode of the Blurring the Lines Podcast. Or, you can continue reading part five.

10 Critical Steps to Survive a Ransomware Attack, Step 3: Use a Web Content Filter to Limit Internet Access.

2016-05-09T09:38:29-05:00

If you and your staff don't need unfettered Internet access to do your job, don't allow it. Period. Most of your employees do not need access to Facebook, Amazon, CNN, YouTube, and a majority of the websites they're accessing every day. Every time you go online and access a website, you are increasing your exposure to bad things - even if you think the websites are perfectly innocent.

In early 2016, we saw numerous examples of popular websites that were compromised and used as malware attack platforms. These were not shady websites of ill repute - we are talking about AOL, the BBC, the New York Times, and Wired.com, to name only a few. Nobody thinks that these websites are out to get them, but they make their money by serving up advertisements from third party content providers. These ad networks failed to sufficiently filter out the content they were serving up, allowing tens of thousands of users to be subjected to malware attacks on their systems in under a day.

On top of this, there is the risk that employees will intentionally go to a website that they should not be accessing from work. Classic examples of this are job searches, online shopping, adult content, and social media when these sites have nothing to do with the employee's job function. Ask yourself "do I want my employees goofing off, looking for a new job while I'm paying them?" Even if you think "I trust my employees," that's great - trust and verify by limiting access to inappropriate websites. If you do think that nobody is doing anything inappropriate, I recommend you work with your IT provider to simply monitor access* for one week, and look at the results, which I guarantee will surprise you.

A good web content filter can be configured to allow, block, or warn groups of users when they attempt to access categories of websites. This is important because you want to be sure to configure access based on job roles, not by people. In other words, you should never set up permissions so that "Sally can get to Job Search websites because she is in HR." You should have an "HR" role to which Sally is assigned, and that role should be granted access to job search websites. By doing this, it is much easier to assign the HR role to Sally's replacement or assistant. It also makes you look like like playing favorites when permissions are based on job role rather than per person. That way, when Bob asks "why does Alice get to go on to Facebook but I don't?" You can say "Because Alice is in the Marketing department, and they handle our social media campaign." Even in smaller firms, this goes over a lot better than "because I said so."

This takes a little more effort to technically enforce this, but you can at least begin with a written policy that spells out what sort of Internet access is and is not permitted. At the very least, you need to have an acceptable use policy, stating what is and is not permitted on your network. Then, be sure to follow up by giving this written policy to your IT staff so that they can enforce it with a technical policy.

* Before you do any sort of monitoring of employee activity, be absolutely certain to have all staff sign off on a policy stating that all of their activities may be monitored. Failure to do so may wind you up with a nasty HR legal issue on your hands.

If you'd like to listen to this article discussed in audio format, it was featured as an episode of the Blurring the Lines Podcast. Or, you can continue reading part four.

10 Critical Steps to Survive a Ransomware Attack, Step 2: Patch, Patch, Patch.

2016-05-02T09:37:46-05:00

What are software patches? Patches are fixes for "bugs," or flaws in programs. While some people still like to say "computers don't make mistakes," one must remember that computers are designed, built, and programmed by humans... and humans certainly make mistakes. Software patches are created when a problem is found, and the author of the program fixes it. To take advantage of this fix, you must install the update on your system.

Sometimes patches are minor, and may look like an addition to the version number of the program. An example of this would be Microsoft Internet Explorer 11.0.29. In this case, the major version number is 11, with a minor version of 0.29. Essentially this means that there have been approximately 29 updates to Internet Explorer version 11. I say "approximately" because sometimes software publishers will skip releasing minor versions, so, for example, Microsoft may never have released Internet Explorer 11.0.28, and skipped straight to 11.0.29.

So what do these patches do? They fix problems with the software. Often these problems are relatively benign, like fixing a problem with the way the mouse cursor shows up on your screen. But sometimes they are extremely serious. For instance, Microsoft recently issued a patch to its Windows operating system that allowed for "remote code execution." This is techspeak for "the ability for a third party to run programs on your computer without your permission or knowledge."

If that sounds scary, it should, because it means these flaws result in the ability for hackers to completely take over your system from anywhere in the world over the Internet if it has not been properly secured.

So what do you do? Even if you configure your computer to automatically update itself, third party applications (things like Microsoft Office, Oracle Java, and Adobe Reader) often do not do so without the user's interaction. This means that someone has to click a button in a pop-up message to approve the upgrade process, and often this requires them having administrative rights over their computer.

The problem is that malware often disguises itself to look like a legitimate software update.

Upon casual observation, even the most savvy user may mistake a fake update notice for a real one because they are that similar. The solution is to not present end users with these popups at all, instead having these updates managed by an IT administrator who approves legitimate patches and serves them up to systems as needed, without asking for the end-user's interaction. Then, training users to never click on popups and immediately notify their IT staff if something like this is detected.

To Update, or Not to Update

Sometimes I hear that people do not want to install any updates because they may cause problems. "But Peter! I installed a software update on my system once, and it completely crashed!" This is like saying "I had the oil changed in my car once, and they didn't do it right, causing engine damage. So now I never change the oil."

Yes, it is true that - on rare occasions - software updates themselves may contain bugs and can destabilize your system. As said, these cases are rather rare, and in most instances, you are much better off taking the updates. However, the best practice is to have test systems in place so that patches can be tested prior to being installed on production systems. This is something you should work with your IT provider on. If this is not possible, then the next best thing is to set aside a computer (or small group of representative computers), and apply patches and updates there as soon as they are available, monitor the system for problems for a few days, then apply the patch to the rest of your systems. Obviously this is not a very formal method, but it's greatly preferred to not patching at all (or patching "when I get around to it").

If you'd like to hear this article discussed in podcast form, it is available as an episode of the Blurring the Lines Podcast. Or, you can continue reading part three.

10 Critical Steps to Survive a Ransomware Attack, Step 1: Drop Administrator Rights

2016-04-29T07:29:47-05:00

This is part 1 of a 10-part series of articles on protecting your business assets from ransomware. You can read the articles as a series of blog posts, or request a copy of the entire series in this free whitepaper: 10 Critical Steps to Survive a Ransomware Attack.

Step 1: Drop Administrator Rights

One of the absolutely most effective ways to shield your network from viruses and spyware is to not log on to your computer as an administrator. As soon as I say this, I usually encounter some resistance because users think that giving up admin rights equates to giving up power. In a way, you are, but for decades I've likened full admin rights on a computer to walking around with a loaded gun that might go off at any minute, and pointing it at people (including yourself). I have seen plenty of damage done by users who thought they needed (but really just wanted) administrative rights over machines, and in truth, they did not.

My rationale for not wanting admin rights is as follows:

Administrative rights give you the ability to install programs.
Viruses, spyware, and other malware are programs. Therefore,
administrative rights give you the ability to install viruses, spyware, and other malware.

People sometimes think I mean they would intentionally attempt to install viruses, spyware or other malware, but that's not what I'm saying. The problem is that viruses, spyware and their ilk either pose as legitimate software, like a browser plugin ("You need a new video player to watch this movie. Click here to install!") or an email attachment which you think you want to run ("Click here to view this greeting card!").

As an average user, you do not require administrative rights to run your own machine. If programs need installing, then this is something you (or your administrator) should do separately, under a special, administrative account. You do not need to be an admin all the time. This is the principle of Least Privilege: you have only the minimum power that you require to do your job. Extra rights means extra responsibility and the potential for extra damage.

Let's take some non-IT examples. Consider your workplace.

Does every employee have a master key, allowing them to get into any and all rooms, offices, closets, safes, on the premises?
Does every employee have the ability to write checks from the company checkbook?
Does every employee have the ability to sign contracts and enter into new business agreements or hire new employees?

(Note: If you answered "yes" to any of these and you have more than two employees, you can probably stop reading right now, as you have larger problems that I can't begin to address in this forum.)

Now, I do realize that the three examples could be potentially more of a risk than administrative rights over a desktop PC, but consider the example where a user has admin rights over their PC, and, by one way or another, that PC is compromised by some form of malware. That malware in turn is used as a springboard to launch an attack against the company's servers. Once compromised, all data on the server is available to the attacker, including emails, client/patient/student/employee/payroll records, financial data, etc.

No, You Don't Need That Program Installed

We commonly get asked "but what if I need to install XYZ program?" I answer "then you should call us and we'll do it for you." At first blush, this may sound a bit excessive, but in reality, it is not. Installing software, while easy, is an avenue for security holes. You should not need to be installing software on any given day. Generally, after the first week or two, everything you need installed on your system should be installed, and you should be good to go without administrative rights. After that, it's usually some sort of actually needed software package which, once installed, is all set and doesn't need much care and feeding afterward, so again, I recommend to my clients that we do software installs for them.

Why Is My System Slow?

When people ask me "why is my system slow," the answer is almost always because they have unnecessary software installed (malicious or otherwise).

You have to have administrative rights to install software.
When you install software, it frequently installs an "agent" or "service" which runs all the time, even if you don't know you're running it.
Agents or services which run on your system slow your system down.
Ergo, your admin rights slowed down your system.

If I still haven't impressed upon you that this is bad, (intentionally) installing unneeded software programs can also slow down your system. Before you install anything on your system first ask yourself

Do I need this program installed?
Do I know all of the ramifications installing it?
Isn't my system slow enough already?

Sometimes clients will ask me "just how do I go about dropping these rights? It sounds tough."

It's actually quite simple. Make a standard, non-administrator account, and use it every day. Make a separate, administrator account, and use it only when absolutely necessary to install software. As an example, you would do your normal web surfing, email-checking, and word processing stuff as a normal user. But when it comes time to install the latest Firefox update, or software patch, you would log off, log on as the administrator account, install the patch, and log off, and log back on again as a regular user. At first, you may think this sounds like a lot of work, but if you consider that you almost always have to reboot after installing new software anyway, the additional time is negligible.

To be clear, this step will not stop most ransomware from encrypting your files, but I can add a strong level of containment to keep a virus from taking over your whole computer or entire computer network.

If you don't now how to do this, then you really should talk to your IT provider and ask for their assistance. By restricting yourself from admin rights entirely, and delegate the task of maintaining your system to a competent IT professional, you're in better hands. Unless your job title officially has a primary function related to information technology administration, you should not be doing this. Use this question as a litmus test: "Would I hire myself to manage someone else's computer systems?" If the answer is "no," then why are you trying to manage your own?

If you'd like to hear this article discussed in podcast form, it is available as an episode of the Blurring the Lines Podcast. Or, you can continue reading part two.

10 Critical Steps to Survive a Ransomware Attack

2016-04-22T13:05:25-05:00

We're seeing a rash of ransomware sweeping across IT systems, ranging from large enterprises to microbusinesses with only a few PCs. As I am writing this, we are in the middle of responding to an incident where a business has been entirely shut down due to being infected with the Locky ransomware. The entire business has been shut down for 10 days now because a single employee's PC contracted a virus which managed to attach itself to the entire network, encrypting every Microsoft Word, Excel, Access file, along with every picture, PDF, video, and audio file it could grab - which was all of them. We received a panicked call from the client on Monday morning, expecting that we would be able to wave our magic wand and get their data back. Sadly, this was not the case, as the client was lacking all of the critical controls we will outline in this and subsequent articles.

Invariably, when we deal with these issues, we're asked the same questions:

How/why did this happen?
How can we make sure this never happens again?

How and why did this happen? Usually it's because of a combination of risks that, when pooled together, form a formidable threat to any IT system. In most cases today, we see ransomware has gotten in to systems via email attachments or seemingly innocent websites which have been hijacked - often by serving up malicious ads - to distribute malware.

Unfortunately there is no way to make sure anything "never happens again," and anyone who tells you otherwise is just plain delusional. Promising complete protection is like guaranteeing you'll never have a car accident - it can't be done unless you never get into a car again.

However, just as there are things you can do to protect yourself when you choose to drive in your car, there are many steps that can be taken - right now - to dramatically lower the likelihood that your business will be the next victim of ransomware. Here are the top 10 steps you can take right now to dramatically improve the chances your business will survive a ransomware attack.

Drop Administrator Rights To be clear, this step alone does not protect you from ransomware, which can affect admin and non-admin users alike. However, it can help to contain an outbreak and confine it, resulting in a relatively smaller incident. I've lost count of the number of times I've written about how running with full administrative rights over your own PC is a bad idea. The more power your have, the more power you have to do damage. There's no need to perform everyday tasks - like reading email or surfing the web - as an administrator. You or your IT staff can do this for you on most desktop systems with very little effort, and reap a very big reward as a result.
Patch, Patch, Patch
Make sure you have a regular, diligent schedule for applying patches, both to your operating system (Windows, Mac, Linux, iOS, Chrome, or Android) and third-party applications and add-ons (from Microsoft, Adobe, Oracle, Google, Mozilla, Apple, etc.) have the latest security updates. Malware almost always exploits security flaws in programs, and these flaws are "patched" in software updates from the publisher. Make sure these are applied promptly.
Use a Web Content Filter to Limit Internet Access If you and your staff don't need it to do your job, don't allow it. Period. Most of your employees do not need access to Facebook, Amazon, CNN, YouTube, and a majority of the websites they're accessing every day. Every time you go online and access a website - any website - you are increasing your exposure to bad things, even if you think the site you're visiting is perfectly innocent. We've seen numerous examples in the last few weeks alone of popular websites that were compromised and used as malware attack platforms.
If you read this and said "Oh, but we do use YouTube!" Fine! Allow YouTube, but block everything else that isn't needed (like Facebook, Amazon, CNN, etc.)
Configure Your Firewall to Filter OUTbound Traffic
Along with #3, work with your IT staff to ensure that your firewall allows only legitimate traffic both in AND out. A lot of the problems stem from compromised systems inside your network which are allowed to send traffic out to the bad guys. If this communication is blocked, you have a better chance of recovering your system before it's too late. You have to work with a competent firewall technician to make sure this is done properly.
Restrict Attachments
First off, if you did not request it, don't open it, even if the attachment seems to be from someone you know. Consider having your IT staff filter out email attachments; if a job doesn't require receipt of email attachments, don't allow them! If you are required to receive attachments to do your job, such as the case for HR professionals, make sure that your default application for handling them is a lesser-functioning viewer, such as the Microsoft Word Viewer. This is a greatly stripped-down program that lacks the features that viruses use to take over your system.
Restrict Access to File Shares (aka "Silo Your Data")
Most small firms we work with have a single file repository on their network, and every staff member has full access to it, and all of its contents. This means that anyone, from the CEO all the way down to an intern, has the ability to inadvertently encrypt every document on the server. Compartmentalizing data into silos where people have the least privileges required to do their job is the key to keeping a virus outbreak from running rampant through the entire organization.
Note: this expands upon step 1 by further restricting your own ability to accidentally cause damage to other systems you have access to.
Have Rock Solid Backups Get a solid, robust backup solution that backs up everything on your system - not just a few files and folders - several times per day (not just overnight), and keeps multiple versions that go back several months, allowing you to go back to prior to the infection.Key step that is too often overlooked: test your backups. Do NOT assume that everything is working fine - test your backups, or have your IT staff test them for you, and give a full report on the restore process. Do a full restore to make sure you could get everything back if the server literally blew up in a ball of flames.
Train Your Users
By this, I don't mean "last year we went through a checklist to make sure our users knew what not to do if they get a phishing email." Seriously - when was the last time you did something only one time, a year ago, and you remember what it was and how to do it? It just doesn't work like that! You and your staff need constant education, reminders, and updated information. For starters, make sure your staff know that there are numerous other businesses that are falling victim to ransomware which are delivered as email attachments and through infected websites. Then, work with a competent security professional to educate yourself and your staff in the latest threats so you know what to be on the lookout for.
Allow Only Whitelisted Applications
This one takes some effort, but the idea is simple: configure your computers to only run authorized applications. That means if you only need to run Word, Excel, and Outlook to do your job, your computer will only run Word, Excel, and Outlook. This does take some work and fine-tuning to get it right, and you need to work closely with your IT provider to make sure that nothing is overlooked, but once you've taken these steps, your computer is dramatically more secure because its exposure to harmful programs is significantly reduced.
Prepare for the Worst Should all of the above steps fail, which can happen, be prepared to shut down for a while. Speak with an insurance agent who specializes in cyber liability insurance and make sure you are covered against outages and extortion. Most likely, your policies will pay you nothing in such an event. Also, be prepared to pay a ransom, in Bitcoin - an online currency that is completely untraceable (which is why criminals favor it over things like credit cards, gift cards, etc.). Set up an account with a reputable Bitcoin exchange today so that your entire business won't be stuck for a week twiddling its collective thumbs while you set up accounts that enable payment.

While this list is by no means exhaustive, taking these proactive measures will dramatically improve the likelihood of your business surviving - perhaps even shrugging off - a ransomware attack. We will be following up with subsequent posts with more details on each of the above points.

Time to remove Quicktime for Windows

2016-04-18T09:00:36-05:00

The US-CERT (Computer Emergency Readiness Team) (a division of the Department of Homeland Security) recently published an advisory to immediately ditch Apple's QuickTime product on Windows systems. They cited a blog post from Trend Micro, which noted that Apple has dropped security updates for the product on Windows, and that there are known security holes being exploited.

To be clear, QuickTime for Mac OS X on Apple Macintosh systems is still a supported product.

You may not recall installing QuickTime on your system, but it is often bundled with third-party applications. I personally found the timing of this ironic, as I had just installed QuickTime as part of my GoPro Studio camera software just two days before the announcement. Be sure to look in your system's Control Panel and see if you have QuickTime, and remove it.

Instructions for removing QuickTime can be found here on Apple's website.

A good discussion on ransomware

2016-04-18T08:38:07-05:00

Last week, WBUR's On Point with Tom Ashbrook dedicated an episode to the topic of ransomware. The guests included ransomware victims, as well as a security professional who discussed the problem. Unfortunately, the expert occasionally used jargon that may be foreign without some context, but Tom did a decent job of getting definitions from him.

If you are more audio-inclined, like me, you may enjoy the discussion, which can be found here.