by Blog | Jun 30, 2023 | Cybersecurity
Cloud account takeover has become a major problem for organizations. Think about how much work your company does that requires a username and password. Employees end up having to log into many different systems or cloud apps.
Hackers use various methods to get those login credentials. The goal is to gain access to business data as a user. As well as launch sophisticated attacks, and send insider phishing emails.
How bad has the problem of account breaches become? Between 2019 and 2021, account takeover (ATO) rose by 307%.
Doesn’t Multi-Factor Authentication Stop Credential Breaches?
Many organizations and individuals use multi-factor authentication (MFA). It’s a way to stop attackers that have gained access to their usernames and passwords. MFA is very effective at protecting cloud accounts and has been for many years.
But it’s that effectiveness that has spurred workarounds by hackers. One of these nefarious ways to get around MFA is push-bombing.
How Does Push-Bombing Work?
When a user enables MFA on an account, they typically receive a code or authorization prompt of some type. The user enters their login credentials. Then the system sends an authorization request to the user to complete their login.
The MFA code or approval request will usually come through some type of “push” message. Users can receive it in a few ways:
- SMS/text
- A device popup
- An app notification
Receiving that notification is a normal part of the multi-factor authentication login. It’s something the user would be familiar with.
With push-bombing, hackers start with the user’s credentials. They may get them through phishing or from a large data breach password dump.
They take advantage of that push notification process. Hackers attempt to log in many times. This sends the legitimate user several push notifications, one after the other.
Many people question the receipt of an unexpected code that they didn’t request. But when someone is bombarded with these, it can be easy to mistakenly click to approve access.
Push-bombing is a form of social engineering attack designed to:
- Confuse the user
- Wear the user down
- Trick the user into approving the MFA request to give the hacker access
Ways to Combat Push-Bombing at Your Organization
Educate Employees
Knowledge is power. When a user experiences a push-bombing attack it can be disruptive and confusing. If employees have education beforehand, they’ll be better prepared to defend themselves.
Let employees know what push-bombing is and how it works. Provide them with training on what to do if they receive MFA notifications they didn’t request.
You should also give your staff a way to report these attacks. This enables your IT security team to alert other users. They can then also take steps to secure everyone’s login credentials.
Reduce Business App “Sprawl”
On average, employees use 36 different cloud-based services per day. That’s a lot of logins to keep up with. The more logins someone has to use, the greater the risk of a stolen password.
Take a look at how many applications your company uses. Look for ways to reduce app “sprawl” by consolidating. Platforms like Microsoft 365 and Google Workspace offer many tools behind one login. Streamlining your cloud environment improves security and productivity.
Adopt Phishing-Resistant MFA Solutions
You can thwart push-bombing attacks altogether by moving to a different form of MFA. Phishing-resistant MFA uses a device passkey or physical security key for authentication.
There is no push notification to approve with this type of authentication. This solution is more complex to set up, but it’s also more secure than text or app-based MFA.
Enforce Strong Password Policies
For hackers to send several push-notifications, they need to have the user’s login. Enforcing strong password policies reduces the chance that a password will get breached.
Standard practices for strong password policies include:
- Using at least one upper and one lower-case letter
- Using a combination of letters, numbers, and symbols
- Not using personal information to create a password
- Storing passwords securely
- Not reusing passwords across several accounts
Put in Place an Advanced Identity Management Solution
Advanced identity management solutions can also help you prevent push-bombing attacks. They will typically combine all logins through a single sign-on solution. Users, then have just one login and MFA prompt to manage, rather than several.
Additionally, businesses can use identity management solutions to install contextual login policies. These enable a higher level of security by adding access enforcement flexibility. The system could automatically block login attempts outside a desired geographic area. It could also block logins during certain times or when other contextual factors aren’t met.
Do You Need Help Improving Your Identity & Access Security?
Multi-factor authentication alone isn’t enough. Companies need several layers of protection to reduce their risk of a cloud breach.
Are you looking for some help to reinforce your access security? Give us a call today to schedule a chat.
—
Featured Image Credit
This Article has been Republished with Permission from The Technology Press.
by Blog | Jun 25, 2023 | Cybersecurity
Passwords are the most used method of authentication, but they are also one of the weakest. Passwords are often easy to guess or steal. Also, many people use the same password across several accounts. This makes them vulnerable to cyber-attacks.
The sheer volume of passwords that people need to remember is large. This leads to habits that make it easier for criminals to breach passwords. Such as creating weak passwords and storing passwords in a non-secure way.
61% of all data breaches involve stolen or hacked login credentials.
In recent years a better solution has emerged – passkeys. Passkeys are more secure than passwords. They also provide a more convenient way of logging into your accounts.
What is Passkey Authentication?
Passkeys work by generating a unique code for each login attempt. This code is then validated by the server. This code is created using a combination of information about the user and the device they are using to log in.
You can think of passkeys as a digital credential. A passkey allows someone to authenticate in a web service or a cloud-based account. There is no need to enter a username and password.
This authentication technology leverages Web Authentication (WebAuthn). This is a core component of FIDO2, an authentication protocol. Instead of using a unique password, it uses public-key cryptography for user verification.
The user’s device stores the authentication key. This can be a computer, mobile device, or security key device. It is then used by sites that have passkeys enabled to log the user in.
Advantages of Using Passkeys Instead of Passwords
More Secure
One advantage of passkeys is that they are more secure than passwords. Passkeys are more difficult to hack. This is true especially if the key generates from a combination of biometric and device data.
Biometric data can include things like facial recognition or fingerprint scans. Device information can include things like the device’s MAC address or location. This makes it much harder for hackers to gain access to your accounts.
More Convenient
Another advantage of passkeys over passwords is that they are more convenient. With password authentication, users often must remember many complex passwords. This can be difficult and time-consuming.
Forgetting passwords is common and doing a reset can slow an employee down. Each time a person has to reset their password, it takes an average of three minutes and 46 seconds.
Passkeys erase this problem by providing a single code. You can use that same code across all your accounts. This makes it much easier to log in to your accounts. It also reduces the likelihood of forgetting or misplacing your password.
Phishing-Resistant
Credential phishing scams are prevalent. Scammers send emails that tell a user something is wrong with their account. They click on a link that takes them to a disguised login page created to steal their username and password.
When a user is authenticating with a passkey instead, this won’t work on them. Even if a hacker had a user’s password, it wouldn’t matter. They would need the device passkey authentication to breach the account.
Are There Any Disadvantages to Using Passkeys?
Passkeys are definitely looking like the future of authentication technology. But there are some issues that you may run into when adopting them right now.
Passkeys Aren’t Yet Widely Adopted
One of the main disadvantages is that passkeys are not yet widely adopted. Many websites and cloud services still rely on passwords. They don’t have passkey capability yet.
This means that users may have to continue using passwords for some accounts. At least until passkeys become more widely adopted. It could be slightly awkward to use passkeys for some accounts and passwords for others.
Passkeys Need Extra Hardware & Software
One thing about passwords is that they’re free and easy to use. You simply make them up as you sign up for a site.
Passkeys need extra hardware and software to generate and validate the codes. This can be costly for businesses to put in place at first. But there is potential savings from improved security and user experience. These benefits can outweigh the cost of passkeys.
Prepare Now for the Future of Authentication
Passkeys are a more secure and convenient alternative to passwords. They are more difficult to hack, and they provide a more convenient way of logging into your accounts. But passkeys are not yet widely adopted. Additionally, businesses may need to budget for implementation.
Despite these challenges, passkeys represent a promising solution. Specifically, to the problem of weak passwords. They have the potential to improve cybersecurity. As well as boost productivity for businesses and individuals alike.
Need Help Improving Your Identity & Account Security?
Take advantage of the new passkey authentication by exploring it now. It’s the perfect time to ease in and begin putting it in place for your organization.
Give us a call today to schedule a consultation.
—
Featured Image Credit
This Article has been Republished with Permission from The Technology Press.
by Blog | Jun 10, 2023 | Cybersecurity
Many people worry about someone hacking their computer. But they’re not really thinking about their wireless printer getting breached. It’s a tool that most individuals use sporadically. For example, when you want to print out tax forms or mailing labels.
Printers tend to be out of sight, out of mind. That is until you need to print something and run out of ink. Well, they’re not out of the mind of hackers. In fact, unsecured printers are a classic way for criminals to gain access to a home network.
To illustrate this point, Cybernews purposely hacked printers. It hijacked nearly 28,000 unsecured printers globally. The success rate was 56%. What did it do once it gained access? Ironically, it made the printers print out a guide on printer security.
Are you wondering how exposed your network is from your printer? We’ve got some security tips below to help. These tips can enable you to better secure your network, which keeps data on all devices more secure.
1. Change the Default Login Credentials
When you buy a new printer, it will likely have included default information. Manufacturers give you a way to connect and set up your device. This usually involves default login information.
Immediately change that information during set up. Hackers use a master list of all these defaults. They plug it into an automated script and just keep trying them all until they get a hit. Change these, and make sure you create a strong password.
2. Keep Printer Firmware Updated
Keeping firmware updated is vital to keeping your printer secure. Hardware needs updating just like computers, software, and apps do. Those updates often contain important security patches.
Firmware updates aren’t usually as visible as software updates. Software and OS updates usually give you a popup notification. But updates to the drivers and firmware that run printers, aren’t so visible.
Some of the places you can check for firmware updates are:
- The PC manufacturer’s utility app on a connected device
- The printer’s information panel
- The printer manufacturer’s app installed on a PC
3. Use a Network Firewall
A network firewall is important to ensure the monitoring of traffic. Firewalls can block suspicious activity to keep hackers out of your network. You should configure the firewall to watch incoming and outgoing printer traffic.
4. Put Your Printer on a Guest Network
Most of today’s home routers allow you to set up a guest network. This is a separate Wi-Fi that runs from the same router you use for your main network. It’s harder for hackers to get from one network to another.
Keeping a less secure device separated from computers and phones improves security. You can still print to your printer from devices on another network. You just need to have things configured correctly. If you need help with that, just let us know.
5. Disable Unused Ports or Services
IoT devices, like printers, often have many ways to connect. You may not need all the ports or services that come with your printer. These ports are risk areas where hackers could find a way in.
It’s best to disable any ports and sharing features that you don’t need. This reduces the risk of a breach.
6. Unplug It When Not in Use
Most home printers aren’t used as much as work printers. People may only use them once a month or a few times a year. If you’re not using your printer constantly, unplug it when not in use.
One surefire way to cut off a hacker’s access is to unplug the device. When it’s shut down, no access is available at all.
7. Teach Your Family Cybersecurity Best Practices
Your printer is one device on your network. Most families connect several devices to their home Wi-Fi. In 2022, the average number of connected devices per U.S. household was 22.
Families need to know and adopt good cyber habits. This keeps everyone’s data more secure. It also helps you avoid costly identity theft breaches. Or the takeover of things like baby monitors.
Some standard best practices to follow for good cyber hygiene are:
- Always use strong passwords. (at least 10-12 characters & include a mix of letters, numbers, and symbols)
- Keep software & firmware on devices updated
- Use multi-factor authentication wherever possible
- Enable device firewalls & other protections
- All devices that should have a good antivirus installed
- Never login to an account from a link you receive via email or text
- Learn how to identify phishing & get a second opinion before clicking
- Get a security checkup from a pro at least every year or two
Get Some Help Keeping Your Family’s Data Secure
IT pros don’t only work with businesses. We also help families ensure their data is safe & devices are running smoothly. Give us a call today to schedule a home security checkup.
—
Featured Image Credit
This Article has been Republished with Permission from The Technology Press.
by Blog | Jun 5, 2023 | Cybersecurity
Netflix is one of the most popular and well-known streaming services. It has nearly 231 million subscribers around the world. It has been growing steadily for almost a decade.
The platform has become an essential part of many people’s daily entertainment routines. They fire up their devices, log in, and pick right back up on their favorite shows.
Unfortunately, like any online service, Netflix accounts can be vulnerable to hacking. It’s a baked-in risk when you have a service that is only protected by a username and password.
If you experience an account hack, it can be shocking, confusing, and infuriating. You may not know exactly what to do and may react without thinking first. This is a dangerous space to be in because it can cause you to do things that only make things worse.
In this article, we’ll give you the steps to take when you suspect someone has hacked your Netflix account. Let’s first cover how hackers typically operate when deploying an account takeover.
How Does a Netflix Hack Typically Work?
Phishing overload is a problem that hackers take advantage of in these types of breaches. People receive fake emails all the time that spoof brands like Netflix. One common phishing ploy is an email stating, “There has been suspicious activity on your account.” It will include a link to log in to a spoofed site that looks like the brand’s normal login page. This is a classic trick to steal your login credentials.
Hacked Netflix accounts typically go for $12 each on the dark web.
People get numb to these emails because they get so many of them. They tend to tune them out, knowing that clicking on them could be dangerous. Hackers take advantage of this, hoping you’ll ignore the real ones from Netflix that warn you of a suspicious login (theirs!).
They lay low and don’t take any action yet that will lock you out. They wait for you to receive a few more of these emails, so you’ll completely ignore them. Then they attempt a takeover.
Accounts hacks can go in various ways. Here is one typical scenario of a Netflix hack:
- The account owner gets an email about a suspicious login. Often it will be from a different country.
- They may log into their Netflix account to see if there are any unknown devices logged in. Usually, none will show yet. The hacker logs back out. The goal is to get you to check and see that nothing is wrong, and assume the real notice is phishing.
- This same scenario may happen 2-4 more times in the span of a month.
- Once the hacker feels the user is ignoring the Netflix warnings, they’ll make their move.
- They add their credit card to your account. This is so they can call Netflix and give them a method of verification.
- They may increase your subscription plan to a higher level.
- They also usually replace any user profile names on your account with numbers (1, 2, 3, etc.)
- At this point, the account owner will typically receive an email. It will note a change in account information. This could be the account email, password, phone number, etc.
- The hacker is now trying to lock the account owner out of their account.
What Do You Do If Someone Has Hacked Your Netflix Account?
1. Go to the Netflix site & try to log in.
If you suspect a hacked account, visit the Netflix site directly from your browser. Do not go through a link you received via email, DM, or SMS.
See if you can log in using your password. You may be able to if you caught the hacker before they’ve locked you out. If not, then skip to Step 4 below, calling Netflix support.
2. If you can log in, change your password immediately.
If you can log into your account, change the password right away. Ensure it’s a strong password that is at least 10-12 characters in length. It should also include a combination of letters, numbers, and symbols.
Do not use a variation of the breached password. You should not use any part of your old password to create the new one.
3. If you can log in, remove any strange payment methods
If you can still access your account and settings, go to the payment methods area. Often hackers will add another payment card to your account. They use it to verify the account to Netflix support.
Remove any strange payment method that is not yours. But if you remove your own payment card, you will need another way to verify your account with Netflix. So, at this point, you may want to call before you do that.
4. Call Netflix support. (Don’t skip this step)
Everyone’s experience may be different. Some users that have gone through a hack have praised the fast and helpful support from Netflix.
Contact Netflix support whether you have or have not succeeded in logging in. There may be things the hacker has done that you aren’t aware of. They may have changed subscription information.
Let the support representative know you think you’re the victim of an account hack. They’ll walk you through the process of undoing what the hacker has done.
5. Watch your bank statements.
Continue to watch your bank statements for any unusual charges. You should do this after any account hack.
6. Change the password for other accounts that used the same one as your Netflix account.
People often use the same or the nearly same password for several accounts. Make sure to change the password for any accounts that used the one that was just hacked.
Get Help Securing Your Passwords & Accounts
Don’t wait until a hack happens to you. Give us a call today to schedule a chat about our password security solutions.
—
Featured Image Credit
This Article has been Republished with Permission from The Technology Press.
by Blog | May 31, 2023 | Cybersecurity
The number of apps and web tools that employees use on a regular basis continues to increase. Most departments have about 40-60 different digital tools that they use. 71% of employees feel they use so many apps that it makes work more complex.
Many of the apps that we use every day have various alerts. We get a “ping” when someone mentions our name on a Teams channel. We get a notification popup that an update is available. We get an alert of errors or security issues.
App fatigue is a very real thing and it’s becoming a cybersecurity problem. The more people get overwhelmed by notifications, the more likely they are to ignore them.
Just think about the various digital alerts that you get. They come in:
- Software apps on your computer
- Web-based SaaS tools
- Websites where you’ve allowed alerts
- Mobile apps and tools
- Email banners
- Text messages
- Team communication tools
Some employees are getting the same notification on two different devices. This just adds to the problem. This leads to many issues that impact productivity and cybersecurity.
Besides alert bombardment, every time the boss introduces a new app, that means a new password. Employees are already juggling about 191 passwords. They use at least 154 of them sometime during the month.
How Does App Fatigue Put Companies at Risk?
Employees Begin Ignoring Updates
When digital alerts interrupt your work, you can feel like you’re always behind. This leads to ignoring small tasks seen as not time-sensitive. Tasks like clicking to install an app update.
Employees overwhelmed with too many app alerts, tend to ignore them. When updates come up, they may quickly click them away. They feel they can’t spare the time right now and aren’t sure how long it will take.
Ignoring app updates on a device is dangerous. Many of those updates include important security patches for found vulnerabilities. When they’re not installed, the device and its network are at a higher risk. It becomes easier to suffer a successful cyberattack.
Employees Reuse Passwords (and They’re Often Weak)
Another security casualty of app fatigue is password security. The more SaaS accounts someone must create, the more likely they are to reuse passwords. It’s estimated that passwords are typically reused 64% of the time.
Credential breach is a key driver of cloud data breaches. Hackers can easily crack weak passwords. The same password used several times leaves many accounts at risk.
Employees May Turn Off Alerts
Some alerts are okay to turn off. For example, do you really need to know every time someone responds to a group thread? Or just when they @name you? But, turning off important security alerts is not good.
There comes a breaking point when one more push notification can push someone over the edge. They may turn off all the alerts they can across all apps. The problem with this is that in the mix of alerts are important ones. Such as an anti-malware app warning about a newly found virus.
What’s the Answer to App Fatigue?
It’s not realistic to just go backward in time before all these apps were around. But you can put a strategy in place that puts people in charge of their tech, and not the other way around.
Streamline Your Business Applications
From both a productivity and security standpoint, fewer apps are better. The fewer apps you have, the less risk. Also, the fewer passwords to remember and notifications to address.
Look at the tools that you use to see where redundancies may be. Many companies are using two or more apps that can do the same function.
Consider using an umbrella platform like Microsoft 365 or Google Workspace. These platforms include several work tools, but users only need a single login to access them.
Have Your IT Team Set up Notifications
It’s difficult for users to know what types of notifications are the most important. Set up their app notifications for them. This ensures they aren’t bombarded yet are still getting the important ones.
Automate Application Updates
A cybersecurity best practice is to automate device and software updates. This takes the process out of employees’ hands. It enhances productivity by removing unnecessary updates from their view.
Automating device updates through a managed services solution improves security. It also mitigates the chance there will be a vulnerable app putting your network at risk.
Open a Two-Way Communication About Alerts
Employees may never turn off an alert because they’re afraid they might get in trouble. Managers may not even realize constant app alert interruptions are hurting productivity.
Communicate with employees and let them know they can communicate with you. Discuss how to use alerts effectively. As well as the best ways to manage alerts for a better and more productive workday.
Need Help Taming Your Cloud App Environment?
Today, it’s easy for cloud tools to get out of hand. Get some help consolidating and optimizing your cloud app environment. Give us a call today.
—
Featured Image Credit
This Article has been Republished with Permission from The Technology Press.
by Blog | May 25, 2023 | Cybersecurity
You wouldn’t think a child’s toy could lead to a breach of your personal data. But this happens all the time. What about your trash can sitting outside? Is it a treasure trove for an identity thief trolling the neighborhood at night?
Many everyday objects can lead to identity theft. They often get overlooked because people focus on their computers and cloud accounts. It’s important to have strong passwords and use antivirus on your PC. But you also need to be wary of other ways that hackers and thieves can get to your personal data.
Here are six common things that criminals can use to steal your information.
Old Smart Phones
People replace their smartphones about every two and a half years. That’s a lot of old phones laying around containing personal data.
Just think of all the information our mobile phones hold. We have synced connections with cloud services. Phones also hold banking apps, business apps, and personal health apps. These are all nicely stored on one small device.
As chip technology has advanced, smartphones have been able to hold more “stuff.” This means documents and spreadsheets can now be easily stored on them. Along with reams of photos and videos.
A cybercriminal could easily strike data theft gold by finding an old smartphone. They often end up at charity shops or in the trash. Make sure that you properly clean any old phones by erasing all data. You should also dispose of them properly. You shouldn’t just throw electronics away like normal garbage.
Wireless Printers
Most printers are wireless these days. This means they are part of your home or work network. Printing from another room is convenient. But the fact that your printer connects to the internet can leave your data at risk.
Printers can store sensitive documents, such as tax paperwork or contracts. Most people don’t think about printers when putting data security protections in place. This leaves them open to a hack. When this happens, a hacker can get data from the printer. They could also leverage it to breach other devices on the same network.
Protect printers by ensuring you keep their firmware updated. Always install updates as soon as possible. You should also turn it off when you don’t need it. When it’s off it’s not accessible by a hacker.
USB Sticks
Did you ever run across a USB stick laying around? Perhaps you thought you scored a free removable storage device. Or you are a good Samaritan and want to try to return it to the rightful owner. But first, you need to see what’s on it to find them.
You should never plug a USB device of unknown origin into your computer. This is an old trick in the hacker’s book. They plant malware on these sticks and then leave them around as bait. As soon as you plug it into your device, it can infect it.
Old Hard Drives
When you are disposing of an old computer or old removable drive, make sure it’s clean. Just deleting your files isn’t enough. Computer hard drives can have other personal data stored in system and program files.
Plus, if you’re still logged into a browser, a lot of your personal data could be at risk. Browsers store passwords, credit cards, visit history, and more.
It’s best to get help from an IT professional to properly erase your computer drive. This will make it safe for disposal, donation, or reuse.
Trash Can
Identity theft criminals aren’t only online. They can also be trolling the neighborhood on trash day. Be careful what you throw out in your trash.
It’s not unusual for garbage to enable identity theft. It can include pre-approved credit card offers that you considered “junk mail.” Your trash can also hold voided checks, old bank statements, and insurance paperwork. Any of these items could have the information thieves need to commit fraud or pose as you.
A shredder can be your best friend in this case. You should shred any documents that contain personal information. Do this before you throw them out. This extra step could save you from a costly incident.
Children’s IoT Devices
Electronic bears, smart kid watches, Wi-Fi-connected Barbies… all toys that hackers love. Mattel’s Hello Barbie was found to enable the theft of personal information. A hacker could also use its microphone to spy on families.
These futuristic toys are often what kids want. Parents might think they’re cool, but don’t consider their data security. After all, these are children’s toys. But that often means they can be easier to hack. Cybercriminals also zero in on these IoT toys, knowing they aren’t going to be as hard to breach.
You should be wary of any new internet-connected devices you bring into your home. That includes toys! Install all firmware updates. Additionally, do your homework to see if a data breach has involved the toy.
Schedule a Home IT Security Audit & Sleep Better at Night
Don’t let the thought of identity theft keep you up at night. Give us a call today and schedule a home IT security audit. You’ll be glad you did.
—
Featured Image Credit
This Article has been Republished with Permission from The Technology Press.
