Posts

The Kaseya Attack Effect

Data Protection & SecurityThe Kaseya attack demonstrates how cyber crime is a big, organized business.  How big? You can subscribe to “Ransomware as a Service” and outsource attacks on your intended targets.  How organized? Hacker groups and service providers, such as the REvil Ransomware Group and DarkSide, actively manage their brands and reputations.  The REvil attack on Kaseya shows us that cyber criminals are technically advanced and operationally sophisticated. The nature of the attack, and its scope, should scare you.

By using known vulnerabilities in Kaseya’s VSA Remote Monitoring and Management system, REvil was able to create an automated ransomware distribution network. They used the very systems that Managed Service Providers (MSPs) use to monitor and manage customer servers, computers, and networks.

The Impact

MSPs update their Kaseya VSA servers automatically installed the Ransomware on their customers’ systems, as well as their own. Best estimates are that up to  1,500 small and medium-sized companies are victims. While this number seems small, those 1,500 business face an existential threat. Remember: more than half of businesses victimized by ransomware fail within six months.

Most MSPs shut down their Kaseya VSA services before spreading the ransomware. These firms had no ability to monitor, manage, or remotely support their customers. Customers facing IT issues were met with longer diagnostic and resolution times, resulting in business disruption, lost productivity , and the possibility of data loss.

As a managed cloud service provider, Cumulus Global does not use the Kaseya VSA system.  Our clients were not at risk, via our services, from this attack.

The Lessons

We were on the sidelines for the Kaseya attack. We understand, however, that the way in which may cloud services are managed create connections between vendors, resellers, partners, and customers. While these connections do not generally provide any access to customer data, they do provide access to management functions and information about users.  This information, in turn, could be used to improve the effectiveness of phishing attacks, spoof identities, and gain access to systems.

As a trusted IT advisor and a managed cloud service provider, we are part of a connected supply chain. We take our responsibility to secure our part of that chain seriously. While we follow commercially accepted best practices for security and privacy, the Kaseya attack warns us to step back and re-evaluate our strategy, policies, and procedures.

Our Next Steps

Cumulus Global is conducting an internal review of all of our internal and operational systems, including vendor portals and services we use to order, provision, manage, and support cloud services. As part of this review we are examining our policies and procedures related to:

  • Identity management and protection
  • Access to the systems
  • System level permissions related to function and data
  • Roles and responsibilities with respect to security and privacy
  • Business continuity plans and capabilities

Through this process, we are challenging our assumptions, re-assessing how we operate security and effectively, and raising our expectations for how well we protect ourselves and our customers.

We will also be making recommendations to our clients, and the broader community, on steps they can take to improve their security profile and protections.

Your Next Steps

As a user of cloud services, and technology in general, have responsibilities as well.

We Can Help

To assess your cyber security status, discuss your risks and needs, and identify solutions that fit your business and your budget, contact us to schedule a complimentary session with one of our Cloud Advisors.

The State of SMB Cyber Security

Data Protection & SecurityGone are the days when cybercrime was exclusively a big business problem. In the modern workplace, all businesses are at risk, regardless of their size or industry. Today, we recognize that implementing a cyber security program, much like hiring people and growing sales, is an essential part of running our companies.

With 43% of cyberattacks targeted at SMBs, it’s not surprising that many have identified cybersecurity as a priority. And while most of us have deployed protections, it is challenging to know if you have the right balance of protection relative to your risk.

Here are 4 key findings from research conducted by Microsoft:

01 Businesses understand that cybercrime is a problem, but understate the severity of the threat and overestimate their preparedness

The vast majority of businesses (85%) cite cybercrime as a concern, and more than half (56%) believe it is a top priority. Businesses are backing up this belief with action. Most have begun to invest both time and dollars into protecting their company from hackers and other malicious actors.

However, when you look a little deeper, it becomes clear that many have underestimated their risk. 74% of businesses don’t believe they are likely to be attacked at all and that corporations are two times as likely to be attacked.

90% of businesses say they have the right protections in place to prevent an attack, and those with more than 50 employees are even more confident. It is encouraging that businesses are investing in security, but the reality is that they are at greater risk than they think. Nearly half (41%) have been attacked

02 Small and medium-sized businesses are just as likely to be attacked as large corporations

For solutions that do cost money, businesses allocate about 15% of IT budgets go to cybersecurity,  and  21% plan to increase how much they spend protecting the company. Businesses recognize that this investment is worth it because three out of four know that it costs more to recover from an attack than it does to prevent one.

03 Employees can be a business’s biggest protection and also their biggest threat

As a small business owner, you face many of the same threats as larger businesses, but also unique challenges.

Given the number of security events tied to employees, businesses run the risk of underestimating the threat of employees leaking data or  sharing sensitive information, whether maliciously or accidentally.

Insider threats take several forms. Employees or partners may find it more convenient to transfer sensitive data using personal email or an unsecure cloud drive, not realizing the risk to your company. In fact, 30% of security events are attributed to careless or uninformed employees. More alarming is the roughly 36% of attacks where a malicious employee steals sensitive data.

04 Businesses have begun taking steps to protect themselves and there is a set of solutions and practices available to them

Most small and midsize businesses don’t have the same scale of resources to combat security threats and implement cyber security solutions as larger entities.

Fortunately, there are right-sized solutions and strategies designed to overcome the unique vulnerabilities of smaller companies. An effective security strategy doesn’t have to be expensive—or time-consuming. With a few simple, no-cost/low-cost steps, you can make a significant  impact on your company’s overall security profile. The key is to match security to your business needs and your budget.

To assess your cyber security status, discuss your risks and needs, and identify solutions that fit your business and your budget, contact us to schedule a complimentary session with one of our Cloud Advisors.

Security Threats: 3 You Know and 1 You Should

Data Protection & SecuritySecurity threats take many forms. Most owners of small and medium-sized businesses (SMBs) are aware of the need to defend against the top three — viruses, ransomware, and phishing attacks — but their organizations are generally not as prepared to deal with the risks related to employees leaking data or sharing sensitive information, whether maliciously or accidentally.

1 Viruses

According to research conducted by Microsoft, infection by a computer virus is the most commonly cited among security threats facing businesses. Preventing viruses requires an integrated approach to endpoint and identity management, including:

  • Deploy next-gen antivirus software, with advanced threat protection, installed and updated, on all devices
  • Use web filtering and monitoring services to prevent infection, even from trusted sites
  • Roll out mobile device management to secure work devices (including laptops and desktops), as well as personal devices used for work
  • Enforce the use of multi-factor authentication as part of an integrated identity and access management solution

2 Ransomware

Ransomware is a type of malware that restricts access, encrypts files, or even stops you from using your systems. Like viruses, ransomware can enter the company through insecure endpoints or unsuspecting users.

While virus protections also protect against ransomware, no protection is perfect. You need to be ready to respond and recover in the event of a successful cyber attack. Here are some solutions and services you should have in place:

  • Backup your data and system images, in the cloud, to ensure your ability to restore and recover
  • Encrypt all data, at rest and in motion
  • Deploy business continuity services to spin-up copies of servers in parallel with remediation
  • Pre-arrange access to forensic, legal, and communications resources to ensure a proper business response
  • Acquire cyber insurance to cover remediation, recovery, and regulatory costs, along with lost revenue

3 Phishing Attacks

The majority, 67 percent, of cybersecurity professionals surveyed consider phishing to be the greatest security threat facing your business and employees. To protect your people, your data, and your business:

  • Configure advanced threat protection services to identify and block attacks via email using links and/or attachments
  • Monitor inbound and outbound email traffic
  • Provide your team with awareness training to recognize problem emails, and how to respond/act
  • Instruct your team to report suspicious messages, links, and attachments
  • Deploy domain level services to prevent identity-spoofing

!! Internal Leaks & Threats

Insider security threats are often overlooked. Surveys indicate that 53% of organizations have experienced insider attacks against their organization.

These risks take several forms. About 37% of internal leaks can be attributed to careless or uninformed employees. In many cases, these employees are using personal, less secure or unsecured services to conduct business.  Whether consumer versions of email or cloud drives for sync and share, these “shadow IT” services pose a significant risk.

While the majority of internal leaks and threats are unintentional, 36% of internal leaks are identified as attacks by a malicious employee.

To prevent data leaks and breaches, you should:

  • Actively manage access and permissions to networks, systems, applications, and data; periodically review permissions for compliance
  • Leverage features within your systems that help you manage and protect confidential and proprietary information
  • Deploy information protection solutions, such as Data Loss Prevention (DLP) and document/message level encryption, to block sensitive data from leaving your control

>> Take Action

All of the suggestions, above, fall within our CPR best-practice model for cyber security: Communicate & Educate; Prevent & Protect; Respond & Recover.

To assess your cyber security status, discuss your risks and needs, and identify solutions that fit your business and your budget, contact us to schedule a complimentary session with one of our Cloud Advisors.

Work From Home – Office Ergonomic Checklist

Even with the pandemic and the shift to work from home (“WFH”), business owners remain responsible for making sure employees’ home work spaces are safe, comfortable, and effective.  For employees working at a computer most of the day, bad ergonomics can lead to musculoskeletal disorders (MSDs) such as tendonitis, carpal tunnel syndrome, and sciatica.  MSDs can be uncomfortable or painful for employees.  Beyond the impact on productivity and job satisfaction, MSDs often require medical treatment and can result in longer term disabilities.

When employees work from home, the are unlikely to have the same chair and workstation options as they do at the office.  Businesses should do what they can to help employees maintain good posture and relieve strain.

This short checklist can help you evaluate work from home environments. Have employees answer these questions to determine if any changes are needed and appropriate. Often, small adjustments to the work space can improve ergonomics and reduce the risk of injury.

General

  • Are items that you frequently use located close by?
  • Are items positioned equally on both sides, i.e., not all on the dominant side of your body?

Chair

  • Are feet resting flat on the floor, with hips slightly higher than knees?
  • Does the chair fit the contour of your back? If you can, adjust the back rest up or down to fit the
    natural curve of your lower back with the curve of the chair.
  • Is there a two-finger gap between the back of your lower legs and the seat of your chair? If
    possible, adjust the seat pan forward or backward to correctly fit it to the length of your legs.
  • Are both chair arms are at the same height to prevent you from leaning one way throughout the
    day?
  • Can you use your keyboard and mouse without twisting or reaching? Note: If you can’t get the
    keyboard or monitor low enough for your body type then raise your chair and use a footrest to
    obtain the ideal height for the chair, keyboard, and monitor.

Keyboard

  • Is the keyboard close to elbow level to help keep the wrists straight? Note: Don’t use high force to
    type on your keyboard as force can put strain on your muscles and ligaments.
  • Is the mouse located right next to the keyboard so it can be operated without reaching?
  • Can you move your mouse cursor from one end of your screen(s) to the other without picking it
    up? (Adjust mouse/pointer settings as needed in your software)

Computer monitor(s)

  • Can you see the display of both monitors without looking downward or to either side?
  • Does the distance from your monitor(s) to your eyes allow you to read the screen without leaning
    your head, neck, or trunk forward or backward?
  • Is the monitor positioned so the top line of the screen is no higher than eye level? Note: If you
    wear bifocals and you feel like you’re always looking down, you should adjust your monitors lower
    than the normal height to use the bifocal part of your glasses.

Varying positions

  • When possible, do you make small adjustments to your chair or backrest to keep from staying in
    the same posture for long periods of time?
  • Do you stretch your fingers, hands, arms, and torso throughout the day?
  • At least hourly, do you stand up and walk around for a few minutes periodically?
  • If possible, do you perform some of your tasks in a standing position? Note: When adjusting height of your
    desk or monitor, ensure it is on a sturdy surface with proper adjustment of your mouse also.

If you cannot answer “Yes” to most, if not all, of these questions, we can help.  Cumulus Global can provide ergonomic aids — from keyboards and wrist supports to monitor arms and sit/stand desks. Email us or complete our contact form for information and solutions.

 

library

State of Security for Small and Midsize Businesses

State of Security for SMBseBook | Source: Microsoft

If you work at a small or medium-sized business (SMB), you probably juggle multiple roles, including cyber security.

Gone are the days when cybercrime was exclusively a big business problem. In the modern workplace, all businesses are at risk regardless of their size or industry. Businesses recognize that a cyber security  program is an essential part of running a company.

This eBook identifies key findings from studies and surveys for small and midsize businesses and makes recommendations to ensure your business is protected, and can recover, from cyber attacks.

Please confirm the information, below, to view and download the ebook



Protect Your Business – Top 3 Security Threats

Protect Your BusinesseBook | Source: Microsoft

Security threats take many forms. Most owners of small and medium-sized businesses (SMBs) are aware of the need to defend against the top three — viruses, ransomware, and phishing attacks — but their organizations are generally not as prepared to deal with the risks related to employees leaking data or sharing sensitive information, whether maliciously or accidentally.

You face many of the same threats as larger organizations, but also the unique challenges around budgeting and setting priorities as the leader of a small or medium-sized business.

This eBook explores how you can safeguard your business against the top three security threats, plus the one threat your business is probably overlooking.

Please confirm the information, below, to view and download the ebook



Crash Course in Office 365

Office 365 Crash CourseeBook | Source: Microsoft

How Microsoft 365 and Office 365 can help you grow your business.

You already know the productivity power of Office applications like Word, PowerPoint, and Excel. Full adoption empowers you to access your content from any device, coauthor with anyone in real time (regardless of whether or not they’ve purchased a copy of Office), and use the power of artificial intelligence (AI) to create more impactful content with less effort.

This eBook is a six step crash course in empowering your team by leveraging the capabilities and features of Office 365 and Microsoft 365.

Please confirm the information, below, to view and download the ebook



Global Year in Breach – 2021

eBook | Source: ID Agent

Fundamental changes in the way we lived and worked made 2020 a wild year for cybersecurity professionals. The resilience of every company was tested in the midst of a pandemic-induced, volatile economy as threats snowballed in the wake of a rapid shift to remote workforce support.

Adding to, and perhaps fueled by, those challenges, a cybercrime boom that included record-breaking phishing and ransomware threats ratcheted up the stress. Sectors unaccustomed to being targeted by cybercriminals suddenly found themselves under siege while unprepared companies quickly learned the cost of failing to take cybersecurity seriously.

The Global Year in Breach 2021 report, gathers and analyzes data from industry-leading cybersecurity
solutions, combined with illuminating industry statistics to give you a clear picture of how the data breach landscape evolved in 2020.

Through this lens, this report provides insights into how global events can rapidly transform the cybersecurity landscape. The report forecasts continuing and emerging cybersecurity trends for 2021 and provides helpful advice about smart risk mitigations that fit every business and every budget.

Please confirm the information, below, to view and download the ebook



Google Workspace Security

Google Workspace SecurityeBook | Source: Google

We fully understand the security implications of powering your business in the cloud.

Because Google and our enterprise services run on the same infrastructure, your organization will benefit from the protections we have built and use every day.

      • Secure by design
      • Product security innovation
      • Compliance, eDiscovery, and analytics
      • Transparency

Our robust global infrastructure, along with over 700 security professionals and our drive to innovate, enables Google to  stay ahead of the curve and offer a highly secure, reliable, and compliant environment.

Please confirm the information, below, to view and download the ebook



Make it Work: The Future of Collaboration and Productivity

Make it WorkeBook | Source: Google

Many of the technologies , trends , and cultural norms that will shape tomorrow’s workplaces are already transforming forward thinking organizations around the world. In other words , the future of work is here it’s just not evenly distributed.

This report identifies three important and impactful changes businesses  can make to catch up with competitors that are already working in the  future:

  • Give people the tools to save time and work faster
  • Empower people to access knowledge and share ideas
  • Let people work how they want: flexibly and collaboratively

Armed with these three strategies , businesses can improve productivity and encourage innovation while better  meeting the needs of their customers and their employees now and in the decade (or more) ahead.

Please confirm the information, below, to view and download the ebook



Unblocking Workplace Collaboration

Unblocking Workplace CollaborationeBook | Source: Microsoft

A lack of workplace collaboration – a work environment that doesn’t encourage teamwork – is one of the top 5 reasons people quit their jobs.

Today’s workforce is more collaborative than ever. Unfortunately, though, many modern workplaces lack the tools to make collaboration efficient, effective, and enjoyable.

The solution lies in building workplace collaboration. Strategically break down collaboration blockers so that teams can work together with ease. To accomplish that, business are turning to  collaboration suites that allow employees to communicate and share through a single platform.

This eBook explores 5 collaboration blocks that likely impact your business and outlines solutions, featuring the capabilities and features of Office 365 and Microsoft 365.

Please confirm the information, below, to view and download the ebook



Six Types of Remote Workers and How to Support Them

Six Types of Remote WorkerseBook | Source: Microsoft

Great teams build great companies. And remote workers will be part of your team.

How do you best use technology to keep your employees and business as efficient as possible? Understand the six types of remote workers who impact your team and

  • Evaluate their technical needs
  • Assess their remote work styles
  • Help them simplify and enhance their work, across devices

Solutions like Microsoft 365 Business and Office 365 Business Premium bring new levels of productivity to your business.

Please confirm the information, below, to view and download the ebook



Webcasts

Next Normal: WFH and Remote

3T@3 Webcast Series: Tuesday, April 20th at 3:00 PM

COVID-19 and the events of the past year have, and continue, to change the way we run our businesses.  While some of these changes are temporary, many will become part of our next normal.

Now part of the norm, Work From Home and remote work changes your IT service needs.

This month’s 3T@3 Webcast, is the third in our “Next Normal” series looking at how we adapt, prepare, and respond to economic, social, and business changes. To some extent — small or large — employees working remotely and from home will continue to be part of how we run our businesses.

With “WFH and Remote”, we explore how Work From Home and remote workers alters your IT service needs.  Taking a holistic view, we look beyond using apps and accessing files. In this session we look at factors that protect your business and support productivity.  We use our PARS model (performance, availability, reliability, and security) as a framework to explore how to effectively create, manage, and support your team — wherever they may be working.

Watch the recording on-demand



Data Protection & Security