How are you protecting the PII (Personally Identifiable Information) of your clients, customers or members?
As others are stating, sharing the specifics of these plans can open you up to risk, so it is best to share generally about this topic.
PII is a big deal and you can be responsible for it even though you didn’t initially send it.
Let’s cover the basics of what PII is and isn’t.
Personally Identifying Information (PII) is defined as any information about an individual maintained by an agency, including:
(1) any information that can be used to distinguish or trace an individual’s identity, such as: Name, Social Security Number, Date and place of birth, Mother’s maiden name, Biometric records
2) any other information that is linked or linkable to an individual, such as: Medical, Educational, Financial, Employment information.
PII can be sensitive or non-sensitive.
*Non-sensitive PII information:
– Can be transmitted in an unencrypted form without resulting in harm to the individual.
– Can be easily gathered from public records, phone books, corporate directories and websites.
Sensitive PII information:
– When disclosed, could result in harm to the individual whose privacy has been breached.
– Should be encrypted in transit and when data is at rest.
Personally identifiable financial information (PIFI) is any information that a consumer provides to a financial institution that would not be available publicly.
PIFI may include information such as:
– An individual’s name
– Personal contact details
– Bank account number
– Credit Card number
– Social Security number
– And more
PIFI generally contains private and confidential data visible only to authorized personnel.
The term is mainly applied in an operating environment where security, privacy and authenticity of financial information is the primary objective. The data stored within PIFI is used for a set of different applications and/or business services.
For example, an online e-commerce site may contact a consumer’s bank and use PIFI from the bank’s server to identify and validate a buyer’s credit card.
Under the Gramm-Leach-Bliley Act, financial institutions must alert their customers to privacy policies and practices and avoid the disclosure of nonpublic personal information about consumers to third parties without consumers’ consent.
Financial institutions must also establish appropriate standards for protect PIFI.
OK, you still there? I know that was a lot of text, but it’s a great guideline to helping you understand WHAT you need to protect.
So, HOW do we protect PII? A few best practices include:
Identify where you are storing PII. Many file management services will offer this, you can also purchase software audits or have a professional consultant come in.
Determine the sensitivity of the PII you store.
Remove any legacy PII that is no longer needed for active work. Use a retention policy and retire data as quickly as you can.
Encrypt PII in transit and at rest.
We strongly suggest that you NEVER EVER EVER email PII. Consider scans to encrypted network folders or secure cloud services like Egnyte with proper roles and permissions.
Email compromise is the number one method for bad actors to gain access and steal PII. Having strong inbound and outbound email compliance solution can help prevent attacks and mitigate leaks.
PERMISSIONS. Not everyone in your organization needs access to PII, properly storing this data by user role and access permissions will help mitigate many risks.
Educate your team on the critical nature of PII. We suggest at least an annual security awareness training session or PII refresher.
Have a standard onboarding and offboarding process for your team. Do not COPY permissions from users.
If you can, have a dedicate compliance officer who can check and audit your internal process at least quarterly.
There is a lot to understanding and protecting PII. Having a trusted partner like PremierePC can help you avoid many pitfalls, implement complicated solutions, and assist your team in driving compliance.
What is a Phishing Attack? What can I do to Protect My Data?
Phishing emails, texts and phone calls try to trick you into visiting a malicious website, handing over a password, or downloading a file. This works in email attacks because people often spend the whole day at work clicking on links and downloading files as part of their jobs. Hackers know this and try to take advantage of your habit to click without thinking.
Number one defense: PAUSE BEFORE CLICKING
Beat phishing by calling the sender and locking down your personal and business information. Deploy MFA to your user base to help protect data, even if they do click.
Employee oversight due to lack of training is the number one way hackers gain access to your company’s data. Regular security training is imperative to mitigate these threats. Learn more…
Download our phishing handout here.
Email Security, Compalince and Encryption
Are you only relying on your email platform’s baked in spam filtering? You could be leaving yourself open to a range of threats.
What is email filtering?
Most major email providers use built in settings to move emails to “junk” or “spam.” These settings work great for unwanted advertising. However, they are not as effective in blocking incoming phishing emails that are designed to steal your personal information. These settings also do not prevent users from visiting websites known to contain malware.
How does it work?
Email filtering analyzes incoming emails for common trigger words, problematic content or design of the email, previously flagged IP addresses or senders, etc. Emails from unknown senders containing links or attached documents may also set off these phishing filters.
Phishing filters will typically move flagged emails to an additional inbox and place them “on hold” until you release, block, or allow it.
Releasing an email sends it to your normal inbox to be opened. In the future you will have to continue approving emails from the sender. If an email is blocked, then the email is rejected and the sender will be now be blocked from sending you future emails.
What are other ways to protect my network?
How can PremierePC help?
Learn more about our email security and compliance offerings and overarching cybersecurity support.
All services sold by the user by the month, no long-term commitments or up-front fees. Services are limited to managed service plan clients.
Q and A : Cyber Attacks
We encounter this all the time and would like to offer some concrete suggestions.
First, contact a local IT firm that either specializes in cybersecurity instead of a local break-fix shop. Usually, you will be searching for Managed Service Providers. MSP’s are better suited to both understand and have the tools readily available to best assist you.
With any compromise, there are two immediate goals. Identify the ingress point and sever access. This process includes looking at your network equipment, servers, and computing endpoints.
Once the entry point has been determined and blocked, it’s time to complete a network forensics review. During this time, each machine is run through several virus and malware scans. In addition, we utilize a threat hunting service that can detect current and past malware footholds.
An often-overlooked part of the process is reviewing the firewall and server configuration to ensure no external access is permitted to internal systems. Eight out of ten times the main ingress point is a firewall rule allowing access to an internal server or other computing resource.
A common error is getting a compromised server cleaned, then putting it back into service too soon. Checking the network level rules before placing servers back in operation is a best practice to avoid more downtime or re-infection.
Ensure that all of your computing devices have next generation anti-virus solutions. Have an enterprise class router with active security services. Always use a VPN to access internal systems from outside instead of Remote Desktop Connections or other similar software, especially when dealing with PII or your own financial data.
Double check your backup policy and data retention rules. Test your backup with a fire drill at least quarterly. Use a company, like us, that offers fully managed backup with human monitors.
With a few simple steps, you can improve your security posture, mitigate your risks, and recover faster from an attack.
Secure File Sharing and Content Collaboration with Egnyte
We have been using Egnyte for over nine years, before wide-spread cloud adoption was a thing. Egnyte has continued to invest in their platform and in our opinion, it is the strongest cloud sharing service available. When compared to SharePoint, OneDrive, Google Drive, and others, there is no real comparison. A few of our reasons are below.
User adoption:
Egnyte is so easy to learn and pick up that almost anyone in the organization can do it with minimal training. Where training is needed, helpful guides and resources are available and take just minutes, not hours or days, to learn.
Flexibility of access methods:
We can deploy Egnyte in just about any configuration that makes sense – cloud only, hybrid, or local. You can have the benefits of a cloud solution with the speed and security benefits of local storage. No other solution, SharePoint included, can boast this with as much simplicity and value as Egnyte can.
No cumbersome VPN services, no compromise on security. No problem.
Platform:
You get more than just file sharing. You also get backup, revisioning, and collaboration tools; as well as multi-point integrations with industry leading products such as Microsoft 365.
Secure sharing:
Egnyte allows you to securely share both inside and outside your organization, ensuring compliance and PII remains protected while offering an intuitive way to share and engage your team, clients, and vendors.
Search:
Gain contextual search for all things stored in Egnyte allowing you to quickly and deeply understand your data. The engine is turnkey and ready to go from day one. No training data sets, integration work, or complex scripting required to get started. With simple reports, alerts, and triggered workflows, you don’t need a team of engineers to operate it either.
Compliance:
Help drive good compliance practices by limiting and being able to report on who has access to your data, both inside and outside the organization. With full audit logs, access trails, and deep user permissions, layer on Egnyte Protect for the most automated and comprehensive experience.
Monitor CyberSecurity Breaches: They Are Happening.
Reusing passwords, or a similar version of the same password, means if one of these accounts is hacked, all of them are hacked. This will happen in a matter of seconds.
Now what?
PremierePC offers a wide variety of cybersecurity solutions to help mitigate and plan for attacks. They will happen. Will you be ready?
Dark Web Monitoring (DWM)
A Zero-Touch Solution. No need to share access to your server, domain, or DNS settings.
How can we protect against human error?
Regular security training and awareness allows employees to know what to look for, and how to stop phishing attacks from successfully gaining entry into your network. This is a very effective defense against cybercrime.
This solution is INCLUDED with our Dark Web ID solution. No additional costs to layer on a proactive security awareness program.
Ready to know what the bad guys know?
Access your free scan now
**Submitting your contact information in this form does not put your information at risk. We will simply use your provided information to compare to information we find on the dark web by searching typical hacker sites, over 500 distinct Internet relay chatroom channels, 600,000 private websites, and 600 twitter feeds. We will then set up a brief meeting with you to review your results.
Q and A : Protecting important info
As with any intelligent Backup and Disaster Recovery (BDR) planning, a layered approach is always best.
The first step is to identify what is important. You nay have an idea, but test this out be simulating a loss. Turn off your server or shared resources and see what you truly can’t live without.
Once you have a firm idea of what you need, we can focus on how to secure it.
We utilize several tools.
Utilizing cloud services is a great start, but they are not immune to data loss. A common misconception about Google and Office 365 is that your data is backed up. It’s not. It is far less likely to be lost due to hardware failures like local data, not to mention human error. Do you backup your cloud email service?
Where possible, use intelligent file sharing solutions. We offer such a service that acts as your file share, revision platform, and can help drive compliance.
We also provide our clients with access to a human managed backup platform where we can store server images, system states, and file level backups. When something does go wrong, we are quickly able to get them back up and running.
Q and A : Issues with web developer
We think it’s regrettable that certain firms or professionals would behave like this, but we have seen it occur far too often.
Since 2006, our team has been actively helping clients manage their domains as part of the IT stack for this very reason. Your domain is a critical part of your identity and overall IT infrastructure as it directly relates not only to your website, but your email.
A web host should never NEED to own your domain or even register it for you. Having a central IT controller like PremierePC in the mix can help as we manage the domain, and then any vendors who need access to records or changes.
With this in mind, let’s focus on the problem listed. First, attempt to gain access to the website control panel or hosting account. This is the root level of access and will be your best bet to re-gain control. If that is not possible, then a local admin account to the CMS or FTP account could be used.
If the provider is unwilling to provide access to services that you pay for then legal action may be needed. While this process is going on, if possible, securing your domain before brining any legal challenges will be a wise move.
In closing, keep your domains registered yourself and where possible purchase your own hosting and have your web team build your site there. Use a trusted third party like PremierePC to help manage and control these items and act as your trusted advisor and consultant to ensure no changes are being made that will have adverse consequences. Most importantly, your domain never NEED to move to your web host for them to host a website, we firmly believe that whoever provides and manages your email platform should be in charge of the domain and DNS.
You can learn more about our domain and managed DNS program using the links below.
https://www.premierepc.net/business-hosting/domains/
https://www.premierepc.net/business-hosting/managed-dns/
Q and A : Website importance
Short answer, YES!
Longer answer. A web presence is critical to being found online and having a site this is mobile responsive or optimized is even better for SEO.
With that said, you do not need to invest a fortune. For many small business sites, a few pages with a list of services, contact info, as well as some history and context if all that people are looking for. You can easily use web page builders to help get the basics. We advise clients to stay away from proprietary platforms like Squarespace, Weebly, and the GoDaddy website builder as these builders will not allow you to easily port your site. Instead, opt for managed WordPress sites which are more difficult to get into, but will allow you to port and move your site as you grow and add new features.
PremierePC offers a full array of business hosting solutions to our service plan clients. We can handle the domain, dns, hosting, and WordPress build and ongoing management.
If you need help crafting a way forward, give us a ring and we can help guide you on the journey.
Q and A : Protecting PII
As others are stating, sharing the specifics of these plans can open you up to risk, so it is best to share generally about this topic.
PII is a big deal and you can be responsible for it even though you didn’t initially send it.
Let’s cover the basics of what PII is and isn’t.
Personally Identifying Information (PII) is defined as any information about an individual maintained by an agency, including:
(1) any information that can be used to distinguish or trace an individual’s identity, such as: Name, Social Security Number, Date and place of birth, Mother’s maiden name, Biometric records
2) any other information that is linked or linkable to an individual, such as: Medical, Educational, Financial, Employment information.
PII can be sensitive or non-sensitive.
*Non-sensitive PII information:
– Can be transmitted in an unencrypted form without resulting in harm to the individual.
– Can be easily gathered from public records, phone books, corporate directories and websites.
Sensitive PII information:
– When disclosed, could result in harm to the individual whose privacy has been breached.
– Should be encrypted in transit and when data is at rest.
Personally identifiable financial information (PIFI) is any information that a consumer provides to a financial institution that would not be available publicly.
PIFI may include information such as:
– An individual’s name
– Personal contact details
– Bank account number
– Credit Card number
– Social Security number
– And more
PIFI generally contains private and confidential data visible only to authorized personnel.
The term is mainly applied in an operating environment where security, privacy and authenticity of financial information is the primary objective. The data stored within PIFI is used for a set of different applications and/or business services.
For example, an online e-commerce site may contact a consumer’s bank and use PIFI from the bank’s server to identify and validate a buyer’s credit card.
Under the Gramm-Leach-Bliley Act, financial institutions must alert their customers to privacy policies and practices and avoid the disclosure of nonpublic personal information about consumers to third parties without consumers’ consent.
Financial institutions must also establish appropriate standards for protect PIFI.
OK, you still there? I know that was a lot of text, but it’s a great guideline to helping you understand WHAT you need to protect.
So, HOW do we protect PII? A few best practices include:
Identify where you are storing PII. Many file management services will offer this, you can also purchase software audits or have a professional consultant come in.
Determine the sensitivity of the PII you store.
Remove any legacy PII that is no longer needed for active work. Use a retention policy and retire data as quickly as you can.
Encrypt PII in transit and at rest.
We strongly suggest that you NEVER EVER EVER email PII. Consider scans to encrypted network folders or secure cloud services like Egnyte with proper roles and permissions.
Email compromise is the number one method for bad actors to gain access and steal PII. Having strong inbound and outbound email compliance solution can help prevent attacks and mitigate leaks.
PERMISSIONS. Not everyone in your organization needs access to PII, properly storing this data by user role and access permissions will help mitigate many risks.
Educate your team on the critical nature of PII. We suggest at least an annual security awareness training session or PII refresher.
Have a standard onboarding and offboarding process for your team. Do not COPY permissions from users.
If you can, have a dedicate compliance officer who can check and audit your internal process at least quarterly.
There is a lot to understanding and protecting PII. Having a trusted partner like PremierePC can help you avoid many pitfalls, implement complicated solutions, and assist your team in driving compliance.
Q and A : Remote work
How Has Your Business Overcome Spear Phishing under these new circumstances?
Remote work, deemed the “next normal,” increases productivity and employee retention while reducing environmental impact.
The COVID-19 pandemic has increased remote work dramatically; one source finds 88% of organizations have encouraged or required employees to work from home.
Enter hackers.
Remote work + distracted employees + new scam opportunities = a hacker’s dreams come true.
Coronavirus-related spear-phishing attacks have increased by 667% since February.
So, what can you do to protect your business?
Email security, encryption, archiving, and backup
We offer a full compliance platform and can also custom craft a plan based on your needs. Inbound filtering can be enabled in a matter of days, outbound encryption for the users that need it, archiving for compliance or even layering on backup for your cloud email to protect against data loss.
Awareness around dark web compromises.
Monitor your entire domain for users and credentials which have already been compromised. Get alerts on new activity. Priced per domain, setup same day with no changes needed to your technology setup.
Scheduled end-user security awareness training
At no additional cost to our dark web monitor, we offer automated awareness training and testing. We help you detect staff weakness and provide training to build them up.
Pair this with a 90 minute virtual training session with our team to give yourself a jump start.
Remote monitoring and management for managing and protecting networks and devices
Having a Managed IT provider on call to help with problems large and small can give your team the confidence they need to work smart and safe.