Personally Identifiable Information

Personal Identity Management: What You Need to Know About Protecting Yourself Online

November 20, 2018 by securewebsite

We’ve all heard the nightmare stories. Someone had their bank account breached, their social media was spoofed, or, worse, their identity was stolen. Cleanup of such issues can wreak havoc on our credit, personal, and professional lives at a cost of billions of dollars each year in the United States alone. That’s why identity management is so imperative. Here are some facts, stats, and pointers to keep you and your family members better protected online.

Identity Management & Theft
Identity management is the digital security of your identity online. It encompasses your personally identifiable information (PII) such as your birthdate, address, and banking information. Your online identity also encompasses other information found about you online from your social media accounts including Facebook, Twitter, and Instagram to your credit card accounts. Identity management, or IdM as it is known in IT circles, authenticates the identity of a user, information about them online, and who is allowed to access or modify that information.

There are several ways that cybercriminals can steal your identity online with just a bit of your PII. Here’s just a sample of what identity theft can look like:

• Applying for credit cards or loans in your name
• Withdrawing funds from your savings or checking account
• Using health insurance to obtain medical care
• Employing your social security number to steal your tax refund
• Selling your PII on the dark web to other criminals

The Cost of Theft
Time and money are two huge costs affiliated with identity theft. Anyone who has had their identity stolen, their credit card credentials lifted, or their social media breached can tell you how much time it requires to play cleanup. According to a blog by LifeLock, the average time it takes to fix an identity theft issue is seven hours. The same online article reports that in extreme cases, people may spend up to 1,200 hours over the course of a year working to resolve such issues.

The sad truth is you may personally end up investing hundreds or even thousands of dollars to repair your good name and credit. Some of the common costs for repairing identity theft can include:

• Printing fees
• Sending documents by certified mail
• Lost time at work
• Hiring an attorney
• Gas
• Police report fees

The Emotional & Physical Toll
In addition to the time and financial costs of identity theft, there are other costs as well. The Aftermath study by the Identity Theft Resource Center found, “The emotional ramifications of identity crimes continue to leave victims negatively impacted well beyond the initial incident, impacting how they manage their daily lives in perpetuity.”

Identity theft victims interviewed for the study reported long-term feelings of anger and frustration (85.7 percent), and 83.7 percent reported that they felt violated. Another 69.4 percent said they couldn’t trust others and felt unsafe as a result of being victimized online.

The negative emotional impacts left people physically ill as well. According to The Aftermath report, 84 percent of the individuals who participated in the research said they had sleep issues as a result of the identity theft they experienced. More than 77 percent reported an increase in stress levels, 63 percent had problems concentrating, and nearly 57 percent said they experienced persistent aches, pains, headaches, and stomach issues. Another 54.5 percent reported increased fatigue and decreased energy while 50 percent of people lost interest in hobbies and activities.

The Socio-Economic Impact
The Aftermath study also looked at the socio-economic impact of identity theft as well. Nearly 30 percent of victims who participated in the research reported they had to go “to family or friends to ask for financial assistance while remediating their case. For those that could not find a way to get their other needs met, 37 percent went without whatever that need was.”

Respondents in the study reported employment and educational opportunities were also impacted. More than 30 percent of victims in the study said the incident caused problems for them at their place of employment while eight percent reported issues with school as a result of identity theft. Some victims said they lost employment opportunities, benefits, or their jobs because of what happened to them.

To make matters worse, almost 39 percent of respondents said they tapped their savings to address financial needs during remediation of their case. Some even had to dip into their retirement accounts or got into debt they otherwise would not have had.

“An alarming 42.8 percent of respondents noted that as a result of their identity theft incident, they are in debt and 40.5 percent said they could not pay their bills,” reported The Aftermath study.

New Account Fraud
When it comes to identity theft, new account fraud is the most expensive, according to an online piece by LifeLock. This occurs when someone other than you opens a new account, typically a credit card, in your name with stolen PII. The article reported that in 2011, the average cost of resolving this type of theft was $354 and 12 hours of time. Today, the number of fraudulent cases has only increased and the costs have also climbed.

Child Identity Theft
Though your children may not even be old enough to spell their own name, that doesn’t stop criminals from trying to steal their information, too. According to the 2018 Child Identity Fraud Study by Javelin Strategy and Research, more than one million children were the victims of identity fraud in 2017. The fraud of children’s identity led to $2.6 billion in total losses and more than $540 million in out-of-pocket costs to families, according to the same report.

One of the most disturbing trends found in the study by Javelin is that minors who are bullied online are at an even greater risk of identity theft. The research found that victims of online bullying are nine times more likely to be the victims of fraud than those not bullied online.

Here are some great tips to help concerned parents better protect their children’s identity online:

• Train your children to protect their identity in the digital age. For example, teach them not to share login and password information.
• Pay attention to children who may be being bullied online. Children seeking friendship online are more vulnerable to becoming victims of fraud by sharing their personal information.
• Check and freeze their credit. New account fraud is the most pervasive type of fraud against children. This is the most effective method for preventing new accounts from being opened in their name.
• Monitor their accounts. Parents and guardians must actively monitor financial accounts from child savings to credit cards. Review statements online and sign up for account alerts.
• Protect physical documents. Keep sensitive documents such as birth certificates, social security cards, and passports under lock and key.
• Take notifications seriously. If you receive a notification that someone has stolen your child’s identity or that unauthorized activity has taken place on one of their accounts, move quickly to rectify the situation.
• Ask for help. If you find your child’s accounts have been breached or their identity stolen, contact banks and credit bureaus directly. This is the quickest way to close unauthorized accounts and clear their credit history.
• Sign them up for coverage. Just as you can sign yourself and your spouse up for credit monitoring, you can sign your children up for the same protection as well.

More to Chew On
A 2017 study by Javelin Strategy gives us even more information to digest. Here are some more facts and figures from their research:

• There was a 16 percent increase in identity fraud over the previous year; a record high since Javelin began tracking the issue in 2003.
• Identity fraud increased by two million victims in the 2017 study over the 2016 study.
• That increase in identity fraud meant cybercriminals stole roughly $16 billion in 2017.
• Account takeover incidents and losses rose in the 2017 report to $2.3 billion, a 61 percent increase over the previous year.
• People on social media face a 46 percent greater risk in account takeover fraud than those who shun social media.
• Being an American puts you at higher risk. According to a 2018 Internet Security Threat Report by Symantec, more than 791 million identities were stolen in the U.S. in 2016 while France came in at a distant second place with 85 million identities stolen.

What You Can Do
To protect yourself from becoming the victim of identity theft or fraud, the first step is to protect yourself with an identity monitoring program such as ID Agent, which is what we recommend here at Oram. The program monitors the dark web for your information and notifies you if your PII is found there for sale so you can be proactive about blocking thieves. The great thing about ID agent that we love is that it also monitors social media and alerts you if someone is actively targeting you. It also monitors your credit through all three major credit bureaus to let you know of any new accounts or major changes.

Should the worst happen and you do experience an identity theft or fraud, ID Agent has certified restoration specialists that will work on your behalf to completely restore your identity, even if the issue started before you enrolled. When you enroll, you get $1 million in identity insurance to cover related restoration costs.

Here are some other things you can do on your own as well if you are victimized by cybercriminals:

• Review credit card and bank statements for unusual charges. Report any that you didn’t make.
• Notify your bank(s) and creditors. Send them a copy of your ID theft report.
• Place a fraud alert on your credit files and monitor your credit reports regularly. This requires that you contact all three of the major credit reporting firms: Equifax, Experian, and TransUnion.
• Put a credit freeze on your reports.
• Close accounts you know were not opened by you or those that have been tampered with.
• File a complaint with the Federal Trade Commission.
• Contact your local police department or the police in the area where the theft took place and file a report. Make sure you get a copy.
• Change all of your account passwords and PIN numbers. Do not reuse old ones or those from other accounts.
• Contact the social security fraud hotline and request a copy of your personal earnings and benefits statement.
• Check with your local department of motor vehicles to see about getting a new driver’s license number and license.
• Contact your utility companies so thieves can’t open a new account using a utility bill.
• Ensure you are using multifactor authentication on all of your accounts.
• Sign up for credit monitoring if you haven’t already done so.

If you need help securing your personal identity online or remediating an identity theft or fraud, Oram is here to help. Call us now at (617) 933-5060 or visit us online.

‘Tis the season for being victimized

November 13, 2018 by securewebsite

Tips for staying safe online this holiday season

Whether you’re sharing plans for your upcoming vacation on Facebook, you’re knocking out holiday shopping online, or you’re a retailer ready to strike while the iron is hot through a virtual store, the holidays can be risky business. Hackers connive year-round to steal important data that can leave you broke or your organization in shambles, but the holidays are an especially profitable time for them.

With modern technology, information is always at our fingertips. What you don’t want is your information being shared as it can put you at risk online and off both as an individual and as a business leader. Here are some things to think about before sharing, shopping, and selling online this season.

Beware & Don’t Overshare
It is hard not to get wrapped up in all the excitement of the holidays and want to share it with others. After all, who wouldn’t want to read about all of the visitors, gifts, and fun from your seasonal gatherings? While you may wish to share photos of your family, talk about your travel plans, and show off your new gifts, you must be wary of sharing too much.

Just as your friends and family enjoy your posts cybercriminals, cyber criminals could be as well. The information you share on social media accounts, especially when your privacy settings are public, can be seen by everyone. Criminals can use this information to misrepresent themselves as someone you know, use the information to crack your account passwords, or even learn when you’re out of town to rob your home or business.

Put a Lock On It
Analysts project that there will be more than three billion active social media users by 2021, according to Statista, a compilation of statistics and studies from more than 22,500 sources. That equates to about 40 percent of the world’s population. Be sure to set your accounts to maximum privacy and carefully choose who you give access to your social media. Here are a few tips to keep you socially savvy during the holiday season:

• Set the privacy settings to be as secure as possible.
• Don’t accept friend or connection requests from people you don’t know.
• Be careful not to overshare on your social media.
• Never announce when you have plans to be out of town on social media.

Online Shopping Set to Boom
When it comes to online shopping during the months of November and December, this year promises to see the largest online holiday sales yet. According to a piece by Shopify, worldwide online holiday sales reached $94.4 billion in 2016 but that jumped to $108.15 billion in 2017. Online purchases peak between Black Friday and Cyber Monday but the entire week of Thanksgiving is one big shop ‘til you drop event for consumers. According to the Shopify article, online spending is set to jump again this year with an estimated $3.35 billion in expected sales on Thanksgiving and $5.8 billion in sales for Black Friday which means people are learning to love shopping from the comfort of home.

Safer Shopping
The thought of dragging yourself to the store, fighting holiday crowds, standing in long lines, and dealing with traffic can make the holiday elf in all of us quickly turn into the Grinch. Avoiding all of that while easily finding the best deals on the gifts we want to give (and get) has become irresistible. Criminals can put a huge dent in your holiday budget though, if you aren’t careful.

To best protect yourself while shopping online, stick to retail websites you already know and trust. Avoid shopping through links on social media and email as they can take you to legitimate-looking sites that are actually fraudulent. If you do find a must-have gift on an unfamiliar site, do some investigative work before handing over your credit card number. Check the company out online, see if they have a social media following, and read customer reviews. You can even contact the business directly and call the Better Business Bureau for more information.

You will also want to ensure that when you sign up for new accounts that you use strong passwords that are unique to each site. You can use a password manager to help you keep track of new accounts. Be sure to use a complex set of lowercase and uppercase letters, numerals, and special characters when creating your passwords.

Be On Alert
Regardless of when you do your holiday shopping online, there are some precautions you should be taking. There is an easy acronym (ALERT) to help you shop smart and stay safer online:

• A– Activate two-factor authentication on all banking transactions. This means that you need to input a one-time password (OTP) which is sent by your bank (via SMS or email) to confirm the transaction. This provides an added level of security as anyone trying to use your cards would also have to have access to your mobile phone or email.
• L– Look for signs that the site you are shopping on is secure. Before you type your card details into a website, look for a small padlock symbol in the address bar and a web address beginning with https:// (the s stands for ‘secure’).
• E– Enter a web address yourself and don’t access it through links. Links in email messages, text, instant messages and pop-up ads can take you to websites that look legitimate but are not.
• R– Review all transactions, check your statements, and SMS notifications to ensure that all debits from your account are familiar. Use credit cards, not debit cards, for online shopping. Credit cards offer better fraud prevention and consumer protection.
• T– Treat your details with care. Don’t save your card details on your computer or in your browser. Be selective as to where you input your details, avoid shared devices, and always make sure your security software is up to date.

If You’re the Store
If your business allows people to shop, pay, or schedule appointments online, then it has a responsibility to protect client data at all times. This is especially true during the holidays when hackers are even more likely to attempt to swipe credit card data or personally identifiable information (PII). To ensure the privacy and protection of your clients, you will want to employ the CIA Triad:

• Confidentiality– Ensure the privacy of data so it can’t be accessed by unauthorized parties.
• Integrity– Ensure the accuracy of data in a manner that guarantees the data is reliable.
• Availability– Ensure data is available and cannot be destroyed either maliciously or accidentally.

This triad provides a structured approach to helping businesses appropriately store, transfer, and protect client data as well as their own. In order to do a thorough job of protecting vital, proprietary data, we need to consider data privacy from all angles and the CIA Triad allows us to do just that by encouraging us to think before we click, verify sources of information and requests, ensuring accuracy, and following data security policies.

Keep It Updated
Whether you are an individual or a business, ensure your devices from mobile phones and tablets to laptops and desktops are kept up-to-date. You don’t want to miss any security patches that address vulnerabilities that might make you an easier target for the bad guys. You also want to keep updated on the latest cyber threats, so you know what to watch for and protect yourself against.

Wi-Fi Wisdom
According to Cisco, experts estimate by 2020 there will be 432.5 million public Wi-Fi hotspots. While this relieves your data use when you’re out and about, cybercriminals love them because they can use such public networks to capture PII, credit card credentials, and other profitable data.

Avoid Email Scams
We have all seen them. Those incredible sales and deals that pique your shopping interest, especially during the holidays when we are looking for the perfect gift. Email security is particularly important during the holidays when email scams seem to multiply.

While it’s tempting to click away and open those emails, be careful. Those special offers can lead to computer viruses, malware, and much worse. Play it safe by deleting emails from unknown sources. If you don’t know the company or person sending you an email, simply trash it and definitely don’t open any attachments from unfamiliar businesses or individuals.

Extra Safety Tips for Holiday Shopping, Sharing, and Selling
Here are a few other professional tips to keep your data safer this holiday season:

• You are likely to find yourself in more crowds this time of year. Be careful not to discuss sensitive personal information or business in places such as stores, at parties, or on public transportation.
• Lock your computer screen whenever you walk away from your desk during the workday. When you leave for the evening, log out and shut your computer off as most companies run updates and security scans in off-business hours.
• Don’t disclose sensitive personal or business information on social media.
• Be sure to pick up printed documents immediately from the office printer and clear your desk before leaving it. Don’t leave papers lingering as data can fall into the wrong hands.

Get even more smart security tips online with the Pause, Think and Act security awareness video. You can also contact Oram at any time for extra assistance with ensuring a safe, smart, and successful holiday season for your business. Visit us online or call us now at (617) 933-5060.

Password managers: What you need to know about generating and securing passwords that work

October 26, 2018 by securewebsite

By Ryan O’Ramsay Barrett

Being in IT, we hear about it all of the time. A client calls us in distress because they used the same password on multiple websites, social media platforms, and their email and now they’ve been hacked. The bad guys have access to several of their digital platforms, if not all of them, and things are a mess. The worst part is, the entire scenario could have been easily avoided.

One of the simplest and most commonly recommended cybersecurity practices promoted by experts to prevent problems like the one above is for people to use a password manager. Some are free and others cost a small annual fee but all of them are highly recommended over not using one at all.

What is a Password Manager?
A password manager is a type of software that assists in generating and retrieving complex passwords with the goal of improving your cybersecurity. One of the greatest issues is that most people either use the same password on multiple accounts or their passwords as just too simple. Using the same password for multiple sites can increase the risk that you will be hacked or that your business will experience a data breach. Overly simple passwords also make people more susceptible to being victimized by cyber criminals who would love to get their hands into our bank accounts, business data, and personally identifiable information (PII).

Consider a password manager as a vault of sorts, able to store multiple passwords in an encrypted database or produce them on demand. This means you don’t have to reuse the same password for various accounts, memorize them yourself, or write them down.

Regardless of how many passwords you have or how complex they may be, a password manager can keep track of them for you. Additionally, when you need a stronger password for a new account or to better secure an existing one, a password manager can generate a new, complex password for you.

Security Benefits
According to MyGlue, more than 60 percent of all data breaches are the result of weak or stolen passwords. By using more complex passwords that feature uppercase and lowercase letters, numerals, and special symbols, that are unique to each of your accounts, you are protecting vital online information from credit card numbers to the answers to your security questions. Not only is this important in your personal life but it is imperative to your business as well. Password managers help by generating unique, complex passwords that will not be easily guessed by bad actors.

Another sobering statistic is that more than 30 percent of employees keep track of passwords by writing them on Post-it Notes, according to MyGlue. This is not a secure or suggested form of storing passwords. With a password manager, you only have to remember a single master password to access your “vault” with all of your passwords in one place.

Business efficiency is also improved with the use of a solid password manager because employees won’t have to waste time resetting passwords or searching for that sticky note that disappeared. There will also be a reduction in requests to IT for password resets.

Password managers can also simplify shopping. Payment information can be stored in your password manager so that it’s all at your fingertips when you are ready to shop online.

Risks of Password Managers
I know what you’re thinking. If a hacker gets access to your master password, that would allow them access to all of your accounts. Bad actors have also been known to breach the central vault of password managers. The good news is that there are defenses available to address both of these concerns.

First, any password manager worth its weight is going to employ multifactor authentication. This means that when you, or someone else, attempts to access your “vault” of passwords, you will be sent a text or email with an authentication code to log in. If someone were to steal your master code, you would find out via a text message or email. No one can access your credentials without having both the correct password and the right authentication code. This gives you time to change your master password and notify your password manager should a problem arise.

Vendors usually protect master vaults as well by encrypting your password information locally. That information is encrypted and stored, on servers operated by the vendors who, in most cases, employ some of the best cybersecurity measures available. Some of the free password managers don’t offer the same higher level of security that paid password managers do. Be sure to do your research before signing up with a company or touch base with us at Oram so we can recommend one that works best for your needs.

The Cost of Better Security
There are a multitude of password managers available. Some offer free versions but when it comes to the security of your business, remember that you often get what you pay for. With that in mind, at Oram we recommend paying for a password manager as many don’t cost much.

Most password managers offer some sort of free trial period and range from $12 per year to upwards of $50 a month. The cost may depend on the number of devices or users the program is being employed for.

What Oram Recommends
There are so many password managers available that it can be hard to choose one. Some offer features such as photo login options (a form of multifactor authentication), phone support, and use across a wide variety of operating systems. The two that we recommend to our clients are MyGlue and LastPass.

We highly recommend MyGlue because it offers so many options for a low price. First, as a business owner, you will know who accesses what password and when. MyGlue is easy to use, functions well with multiple operating systems and allows you to share training material with your team for the program so no one is lost. Finally, you can avoid hackers by using strong passwords that are secure, keeping your business information such as the PII of employees and clients and your proprietary data safe. MyGlue also employs the highest security measures available.

If MyGlue doesn’t fit your needs, LastPass is the next best option. LastPass works on iOS, Android, Windows, Mac, and Linux operating systems. It offers a variety of subscription options from a single user to families, teams, and enterprises and all are quite affordable. With LastPass, you can simplify online shopping, store digital records, and share passwords and notes with others securely in addition to storing and generating passwords.

If you have lingering questions or concerns about the use of password managers, please call Oram today at (617) 933-5060 or visit us online. Our team is happy to help you select and engage a password manager that meets all of your business needs.

The Dark Web: What it is, how it impacts your organization, and ways to protect your business

October 19, 2018 by securewebsite

The Dark Web sounds like the name of Hollywood’s latest horror movie. In reality, it is something much scarier. It can rob your business, negatively impact employees, and shutter companies.
While you can’t see it, the Dark Web is a huge threat to the stability and continuity of business. Knowing what it is and why it is threatening is the first step to protecting what you have built with hard work and dedication. Here is what you need to know about the Dark Web, why it’s so dangerous, and ways to best protect your organization.

What is the Dark Web?
The Dark Web is the shady side of the World Wide Web. Digital communities on the Dark Web are accessible with special software that allows users and those operating dark websites to remain anonymous and untraceable. While it offers some legitimate uses, it is estimated that more than 50 percent of all sites on the Dark Web are employed in criminal activities. This can mean everything from the theft of digital credentials to their disclosure through sale.

Your Credentials
Digital credentials such as usernames and passwords keep you and your employees connected to critical business applications, email, and other online services. Criminals know that if they can get those credentials, they can access everything from your business’s list of clients to your trade secrets and funds. This means digital credentials are some of the most valuable pieces of information floating around the Dark Web.

Credential Theft
Criminals steal credentials from login information for social media platforms such as Facebook to dates of birth and credit card numbers. The problem is that many individuals and companies often fail to realize their credentials have been stolen until it’s too late.

In more than 75 percent of cases, it is law enforcement or another third-party that notifies a victim that something is amiss. By then, it’s usually too late to prevent data theft or a serious breach that could stop your company in its tracks, lead to a loss of customers, or even bankrupt your business.

Human Resources and Payroll
Your business relies on its human resources and payroll department(s) but these valuable individuals are some of the biggest risks to your organization’s digital security. When they utilize their work email to access websites and programs such as ADP, Paychex, and Ceridian, it can open the door for criminals who have stolen their credentials.

Cybercriminals can use their stolen information to heist the personally identifiable information (PII) of other employees, access payroll information, and even steal from the company coffers. Such breaches can also lead to other criminal activity such as the identity theft of employees or customers.

Client Relations Management
The client relations management (CRM) tool your business uses allows you to communicate seamlessly with your customers. This is great for your business and it’s great for cybercriminals, too.
Pretend for a moment that you have used the same password for your eBay account as you do for your business’s HubSpot. If a hacker steals your eBay credentials, they can access your business’s HubSpot. They can now send an email to your clients pretending to be you. The hacker can ask your clients for anything they want from money to their PII. This can ruin your name and reputation with your clients and within your industry as well as that of your company.

Communications
Another risk lays in your company’s communications from Verizon to Adobe and T-Mobile. For example, if someone wants to hack your AT&T account, they may be able to reveal your payment information from a bank account or credit card. Now they have access to your accounts and can steal money from you and/or your business. Using your mobile number, they can also spoof text messages, reset your bank account password, and access your cash as well as other websites, social media platforms, and other apps you utilize.

Business tools such as email services can also become hacked with the theft of employee credentials. Whether your company uses Gmail, Yahoo, or Office365, these are all hackable. Once someone has access, they can send spoofed emails to clients pretending to be you or an employee asking for more information or even money.

Collaboration
While collaboration among employees, contractors, and vendors is typically considered a positive attribute in business, it can also put your organization at risk. Many individuals and businesses today use Dropbox as a great method of file sharing and collaboration. Such files often contain a plethora of valuable information including trade secrets, PII, and client data. A hacker can use this information to spoof emails, gather data from clients, and target them as their next victims.

Travel Services
If your business employs a travel service to help them get from point A to point B, this can be another security risk. Companies such as Expedia, Travelocity, and Orbitz typically store your credit card information along with other PII that can be devastating in the event they are breached.

Be sure to employ different login credentials for each of these websites to best protect yourself and your business. Use multi-factor authentication if it is offered and don’t store your billing information with these sites if given this as an option.

E-Commerce
Whether your company orders office supplies online from Staples/Office Depot or your business sells products through Amazon/eBay, this is yet another area of risk. Again, stolen credentials can allow for the theft of PII and access to financial information that can drain your bank account before you realize what has happened.

Banking & Finance
Programs such as QuickBooks or Freshdesk or banking apps from financial organizations such as Bank of America or Wells Fargo can also lead to problems when it comes to credentials. If a hacker steals access to your bank accounts, credit cards, or financial programs, it can be truly devastating for your business.

Imagine having all of your accounts wiped out. How will you pay your employees, cover your business mortgage, or pay out contractors? Once the money is gone, the likelihood you will ever see it again is minimal, as hackers can be very difficult to trace and, even if you do get it back, how will you cover your business expenses in the meantime?

Social Media
If your employees or business are on social media, which most are, this can put your business at higher risk for a breach. Pages on social media can be easily spoofed or copied. A cybercriminal can invite your friends and followers, steal their information, and worse. This can ruin your reputation whether the hacker takes an unpopular political stand on the false page or accesses more people to victimize through spoofing of their personal or business pages.

Other Employee Risks
In addition to the threat of employees having their work credentials stolen, their personal credentials can also put your business at risk if they end up in the wrong hands. For example, if an employee uses their LinkedIn credentials such as their username and password for work in QuickBooks, they can expose your company to a breach. Employees should be trained to use unique usernames and passwords for each program, app, and website they use. This is true not just for work but also for their private internet use as well.

While it can be cumbersome to keep track of different usernames and passwords for each website or app they use, there are password management tools such as MyGlue or LastPass that can keep track of them all. While some of these password management programs are free, some do have a minimal cost associated with them. Remember, you get what you pay for in business. Some of the free apps are poorly encrypted locally on your own device so if you get hacked, the bad guys will still have access to your information. We advise working with a larger company so you know they have the manpower and ability to keep your information safe and secure.

Users often have the same password for multiple services such as network logons, social media, and online stores. This greatly increases the potential for a breach. Train and retrain your employees on cybersecurity. It is worth the investment as is paying a small annual fee for a secure password management tool. Consider this well spent money as an operating expense just as you do with your marketing budget.

Combating the Dark Web
At Oram, our experts are able to search the Dark Web so you don’t have to. Using Dark Web ID from ID Agent, our experts search for your personally identifiable Information (PII) on the Dark Web to determine if you are at risk of experiencing a breach. This gives you time to protect your information, notify your bank or lender, and change passwords before you experience a breach.

How Dark Web ID Works
Dark Web ID is a commercial solution to detecting compromised credentials in real time on the Dark Web. It offers the same advanced credential monitoring capabilities that are employed by Fortune 500 companies. This specially designed software connects to multiple Dark Web services including Tor, I2P, and Freenet where it searches for compromised credentials. With this proprietary software, you don’t have to expose your own software, hardware, or network to these high-risk services directly.

By searching the most secretive and covert corners of the internet, Dark Web ID locates compromised credentials associated with your business, contractors, and personnel. If we find credentials that compromise your company, we notify you immediately BEFORE you become the victim of identity theft, data loss, or a breach. The real-time awareness of compromised credentials Dark Web ID provides means you will know if your PII has been stolen so you can safeguard both your personal and business assets before it’s too late.

Be Prepared
The more information you have, the more valuable it is and the more prepared you can be. We employ extensive logging and reporting capabilities that allow us to track your credentials and the credentials of your employees on the Dark Web. As a result, we can triage incidents quickly and create effective policies and procedures to reduce the risk to your business.

How It Helps Businesses
We use the Dark Web ID as a tool to identify compromises throughout your organization that could put your company at risk for a data loss or major breach. With this software, we are able to monitor the Dark Web 24 hours a day, seven days a week, 365 days a year. It is so effective, it reports more than 80,000 compromised emails daily. In addition to email, the program searches and monitors the following platforms frequented by cybercriminals:

• Hidden chat rooms
• Private websites
• Peer-to-peer networks
• Internet relay chat (IRC) channels
• Social media platforms
• Black market sites
• 640,000+ botnets

Predictable Patterns
While it is good practice to be prepared for a breach, it’s even better to have a warning that one could be coming. Using Dark Web ID, we can identify industry patterns. If we see that your industry is starting to come under attack, we can share that intelligence with you to best protect your employees, your business, and your consultants.

Prevention is the Best Medicine
While a network attack may be inevitable, they can be made less destructive and costly. With proactive monitoring of stolen and compromised credentials, you can be alerted to prevent losses before they happen. With alerts that tell you when your credentials have been stolen, you can respond immediately to prevent a breach.

By employing monitoring services and software such as Dark Web ID, your company can move toward compliance with data breach and privacy laws. Our experts can even help you develop and implement a data breach response plan.

If you would like more information about the Dark Web, Dark Web ID, or reducing cyber risks to your business, please call Oram today at (617) 933-5060 or visit us online.

October is National Cyber Security Awareness Month

October 9, 2018 by securewebsite

A look at cyber awareness and tips for protecting yourself online

Whether you are turning on the television, checking the daily newsfeed online, or reading a magazine, you’re sure to hear about the breach of a major business such as Yahoo, a data leak by the government, or hackers attacking a local school. Over the last two decades, cybersecurity has been legislated to protect consumers, businesses, and the government alike. There’s a need for greater awareness of cyber security and how people can best protect themselves and their businesses. That is the purpose behind National Cyber Security Awareness Month (NCSAM) which has been celebrated every October for the last 15 years.

The History of NCSAM
Developed as a collaborative effort between industry and the U.S. government, the purpose of NCSAM is to ensure every American has the necessary resources to stay safer and more secure online as well as advance awareness of the threats we all face when we log on. Launched in 2003, NCSAM was conceived by the U.S. Department of Homeland Security and the National Cyber Security Alliance.

According to the National Cyber Security Alliance, the goal was to reach as many people and businesses as possible to educate them about cybersecurity. The target audience consists of consumers, small and medium-sized business, corporations, educational institutions and young people across the country.

STOP. THINK. CONNECT.
This year marks the 8^th anniversary of the STOP. THINK. CONNECT.™ campaign used during NCSAM which offers tips and advice for everyone from the daily internet user to business owners.

The message to consumers of every age is clear. We are all warned to stop and think before connecting which means doing things to protect ourselves before we get online. We are warned to “Keep a Clean Machine,” “Protect Your Personal Information,” and “Connect with Care.” But what does all of this really mean?

Keep a Clean Machine
All of your internet-connected devices should be kept free of malware and other infections such as viruses as they can interrupt your connectivity at home and at work as well as spread to others. A dirty machine can also threaten your safety and the safety of others online. This is especially true when it comes to malware that connects your devices to botnets, which are networks of computers controlled by cybercriminals that can steal your information and make money from it.

There are several things you can do to keep a clean machine including:

Use the Latest Software– Ensure you have the newest security software, web browser and operating systems to offer the best defense against known viruses, malware, and other threats.
Automate Updates– Most software programs automatically update to defend against threats. Keep auto updates turned on and turn your computer off each night so updates will occur when you reboot.
Protect Every Device– In addition to computers, be sure to turn on auto updates for all devices including smartphones, laptops, and tablets.
Plug & Scan– External devices such as USBs can harbor viruses and malware. Use security to scan them before using.
Get Rid of Garbage– Delete links, emails, tweets, posts, etc. that look suspicious. These are ways cybercriminals compromise your computer. If it’s not from a trusted source, trash it. Don’t open it.
Hot Spot Smarts– Limit the business you conduct when away from your home or office. Be sure to adjust the security settings on your device to limit who can access it.
Act Fast– If you think your machine is infected, get help fast to remove viruses and malware before they can spread or cause more damage.

Protect Your Personal Information
Each one of us has the responsibility of protecting our personally identifiable information (PII) online. If your personal information ends up in the wrong hands, there could be serious consequences from a breach in your social media or theft from your business to your identity being stolen and your bank account being wiped out.

While you may have worked hard to protect that information, all of us must still assume our personal information has been leaked because hacks happen all of the time. Here are some tips for protecting your PII online from the New York Times:

Use Different Passwords– Across multiple sites from Facebook to your bank account, NEVER use the same password in more than one place. Doing this allows a hacker that gets your password in one place to use it in another. Password managers such as 1Password or LastPass can help you keep track of them all.
Never Your Social- Never use your social security number as a username or password. This is especially true in the face of the recent Equifax breach.
Be Suspicious- Treat everything online with an abundance of suspicion. Hackers send emails, notices, letters, etc. posing as people you know and businesses you solicit to gain information. Contact a business or individual requesting PII online by calling them directly before deleting the email as they may need it to press charges or stop the cybercriminal from targeting others.
Use Stronger Passwords- Sites such as LastPass can help you create unique passwords for each site you visit and save them for you in a protected database. If you create your own, be sure to use uppercase and lowercase letters, numerals, and special characters in each password.
Employ Extra Security- Passwords are not enough. If a site allows you to use secondary or two-factor authentication, enable those features. When you enter your password, you will receive a message with a one-time login code to allow you to finish logging in.

Connect with Care
Many web users are very quick to click whether it be on an email, a link, or an attachment. Slow down and take time to examine what it is you are about to click before you do so. Ensure you know who an email is from before opening it. If you don’t know the sender or aren’t expecting an email, delete it without opening it.

If you receive an email from a person or business you know and the email address looks familiar, feel free to open it. Once open, look at the email itself. Does it sound like it’s from the sender or does it seem odd? If the English is suddenly broken, the business logo is not right or is missing, or something else is off about the email, do not click on any links or attachments. Contact the person or business directly to see if they have sent you something via email.

Use care when connecting to public Wi-Fi. This is especially true if you are conducting business such as banking or shopping online. Use only trusted secure connections when using portable devices outside of the home or office.

Be Web Wise
Personal information about anyone is now easy to find online. This is especially true with the advent and use of social media. That means we all have to be wise when it comes to using the web. The first thing you should know is how your information gets online. Here are some ways you may inadvertently be sharing your personal information:

Posting on social media
“Checking in” through social location sites such as Foursquare
Commenting on blogs or shopping sites
Creating online wish lists online at sites like Amazon or Pinterest
Sharing videos or photos online
Using online games
Giving location data when uploading photos online

If you are on social media, check to see if you can change your privacy settings to limit what others can see about you or who has access to your information. Be sure to read the privacy policy of any company before sharing your information with them to ensure they don’t sell it to third parties. You’ll also want to ensure that your data is backed up at home and at the office in the event of ransomware, other cyber attacks, or even a computer shutdown.

Be a Good Online Citizen
Being a good online citizen involves employing the Golden Rule of treating others online the way you would like to be treated and using common sense. Don’t visit unsecured sites and don’t forward emails from unknown sources to others.

Be aware of how the action of one person can damage an entire online community. For example, one employee surfing unsecured sites through your business network can open the door for malware, viruses, and cybercriminals. Have common expectations in your home and office about what is an acceptable use of the network and what types of sites should be avoided.

Report cybercrime and breaches immediately. These should be reported not only to your internal technology personnel but to law enforcement as well. By reporting such issues, you are helping others avoid becoming victims, too, and stopping cybercriminals in their tracks.

Own Your Online Presence
This means safeguarding your own personal information and activity. For example, data should be treated like money. It should be protected. This means everything from your birthdate and personal address to the names of your children and pets which are often used as passwords. It can be easy for a hacker to get into your accounts with such personal information floating around on the web.

Be careful about who you share information with. For example, you may get “friend” requests from people you don’t know on social media. Simply delete the request. This is not being rude, it’s being prudent. Also, don’t send login information via email. Email can easily be hacked without the proper, updated security in place. If you get a request for information from a business online, call them to see if the request was really from them and provide any data they may need that way.

Lock Down Your Login
One of the main points of the STOP. THINK. CONNECT.™ campaign is to Lock Down Your Login. There are several ways you can ensure your login information stays secure. Here are six tips to get you there:

Protect accounts with strong authentication
Keep security software updated
Avoid phishing by thinking before clicking
Use unique passwords for every site
Protect your mobile devices
Employ trusted security tools

Our Responsibility
Staying safe online and protecting those we are connected with is everyone’s responsibility. Because the world has become so digital, we are more interconnected than ever before. From our desktops to our tablets, phones to laptops, we find ourselves working, playing, learning, and living online. That means all of us has a responsibility to try to stay as safe as possible by adhering to the advice of cyber experts.

National Cyber Security Awareness Month is a chance for us all to become more aware of the threats we face online and ways to protect ourselves and others. For more information, safety tips, and ways to get involved in NCSAM, visit the National Cyber Security Alliance online or contact Oram at (617) 933-5060.

Ransomware: A Guide for Protecting Todays Businesses

August 21, 2018 by securewebsite

Ransomware has become one of the top threats to businesses in today’s global and digital society. It has become such a danger in fact that a late 2017 report from Cybersecurity Ventures predicted that the global cost of cybercrime would reach $6 trillion by 2021 with ransomware playing a major role in that total. Furthermore, Cisco’s 2017 Annual Cybersecurity Report showed ransomware is increasing by 350 percent each year and a business falls victim to a ransomware attack every 40 seconds. Last year’s worldwide attack in May 2017 of the WannaCry ransomware caused complete and utter chaos around the globe and begged the question of what’s next.

So what is a business owner to do? For starters, you must know what you’re up against. Next, there are steps for preventing the threat from opening the door to your business. Here’s your guide to ransomware and how to stop it before it stops your business.

What Ransomware Is
Ransomware is a malicious malware that targets the private files of your business. While malware can cause some annoying problems or create more malicious issues such as reformatting a disk or deleting files, ransomware is different. Ransomware is a malware that infects computers and restricts access to files, stopping businesses in their tracks.

When you run into ransomware, you will know it because it will notify a system’s user that it has been attacked. The notification will come after the damage has been done and your information is already encrypted. A cybercriminal will use the ransomware to demand a ransom, typically money or cryptocurrency, in exchange for the safe return of files. If the funds are not paid, the cybercriminal responsible may delete or publish your private business files. If you do pay, you may still not get your data back anyway as the hacker responsible can simply take the money and run.

Like a virus that can attack the body, ransomware can attack an entire network. And like viruses, ransomware can morph and adapt from the way they spread to the way they encrypt data. This means a business must approach protection on a multitude of fronts and be ready to adapt to new protections as they are developed.

Means of Protection
Your IT provider should offer you protection through at least six areas. By securing a variety of entryways and providing layers of protection, your business will be safer from all threats including ransomware. At Oram, we take a six-step approach to protecting our clients against ransomware and other cyber threats.

Patching
The most basic layer of security is to monitor and patch all computers and applications on an ongoing basis. We address all known operating system security vulnerabilities with the latest patches. This measure is the first step in protecting your operating system particularly when a flaw has been uncovered. Your company’s outside business IT partner or in-house professionals should be providing the latest patches to ensure your operating systems are running at peak performance while ensuring any system vulnerabilities are addressed.

Anti-Virus and Network Monitoring
Businesses are being targeted every day through a plethora of avenues: email, ad networks, mobile applications, etc. This is why the second part of a best-in-class security network employs both anti-virus and network monitoring. These two pieces of the security puzzle examine all traffic on your business network and all files. The anti-virus employs a filter to protect them from all known threats. Your anti-virus should be updated regularly in order to identify the latest viral threats.

Backup and Disaster Recovery
One of the things cybercriminals bank on is that your business didn’t think ahead in terms of implementing backup and disaster recovery. That’s why this step is a must, especially where ransomware is concerned. There can sometimes be gaps between when a threat is introduced to your network and remediation of the full system.

To ensure that your data is safe, it’s best to have a full system backup in place to protect your back-office systems. This will enable your business to stay on top of things if and when an attack occurs and it provides a recovery option for unknown threats. In the event of a catastrophic failure or a ransomware attack, a good backup can get your business back online fast.

Endpoint Backup
Though backup and disaster recovery provides a layer of protection for your back-office systems, businesses should also have backup and recovery of data for all devices. Devices such as laptops and tablets create, share, and store business data. Should a device become lost or a cybercriminal capture your proprietary data and sensitive information from these devices, your business will still be covered. This can have a significant impact on your business productivity and profitability. Your endpoint program should offer real-time data backup on such endpoint devices to prevent the compromise of business-critical information and keep your organization moving full-steam ahead.

Secure File Sync and Share
In today’s global society, being able to work remotely, collaboratively, and securely from any device anywhere is a modern business necessity. With the proper software in place, your employees can securely collaborate from any location on any device including their smartphones and tablets. Such a system can allow you to grant access and editing controls for specific documents including those in Word, Excel, and PowerPoint. Such software also allows you to recover documents employees may have accidentally deleted or that have been lost due to malicious activity.

Education and Awareness
One of the best steps you can take in protecting your business against ransomware or other digital threats is to educate and train your employees. With proper cybersecurity awareness training, you can turn your employees into your most important layer of defense. They should be trained and provided with educational materials about cybersecurity risks, new ransomware strains, and the best practices for spotting phishing attempts, suspicious emails, and other security risks. Additionally, they should be provided a simple and quick way to report any suspicious activity. By empowering your employees with such training, they can become proactive in the fight against cyber threats to your business.

Small ransoms are just the beginning of the ransomware threat and it is only expected to get increasingly worse. This is why it is so imperative for businesses to stay ahead of cybercriminals when it comes to security. While such protection may seem overwhelming, it’s nothing when compared with the downtime, stress, and financial cost of dealing with a ransomware attack. If you need assistance in protecting your business against ransomware, contact Oram Corporate Advisors today for a free consultation at (617) 933-5060.

« Previous Page