Q and A

If you suspected your business was compromised by a cyber attacker, what would you do first to find help? If your first thought is to search online, what would your keywords be in the search?

We encounter this all the time and would like to offer some concrete suggestions.

First, contact a local IT firm that either specializes in cybersecurity instead of a local break-fix shop. Usually, you will be searching for Managed Service Providers. MSP’s are better suited to both understand and have the tools readily available to best assist you.

With any compromise, there are two immediate goals. Identify the ingress point and sever access. This process includes looking at your network equipment, servers, and computing endpoints.

Once the entry point has been determined and blocked, it’s time to complete a network forensics review. During this time, each machine is run through several virus and malware scans. In addition, we utilize a threat hunting service that can detect current and past malware footholds.

An often-overlooked part of the process is reviewing the firewall and server configuration to ensure no external access is permitted to internal systems. Eight out of ten times the main ingress point is a firewall rule allowing access to an internal server or other computing resource.

A common error is getting a compromised server cleaned, then putting it back into service too soon. Checking the network level rules before placing servers back in operation is a best practice to avoid more downtime or re-infection.

Ensure that all of your computing devices have next generation anti-virus solutions. Have an enterprise class router with active security services. Always use a VPN to access internal systems from outside instead of Remote Desktop Connections or other similar software, especially when dealing with PII or your own financial data.

Double check your backup policy and data retention rules. Test your backup with a fire drill at least quarterly. Use a company, like us, that offers fully managed backup with human monitors.

With a few simple steps, you can improve your security posture, mitigate your risks, and recover faster from an attack.

 

How would you deal with a website developer who is holding your website information hostage and can’t update information?

We think it’s regrettable that certain firms or professionals would behave like this, but we have seen it occur far too often.

Since 2006, our team has been actively helping clients manage their domains as part of the IT stack for this very reason. Your domain is a critical part of your identity and overall IT infrastructure as it directly relates not only to your website, but your email.

A web host should never NEED to own your domain or even register it for you. Having a central IT controller like PremierePC in the mix can help as we manage the domain, and then any vendors who need access to records or changes.

With this in mind, let’s focus on the problem listed. First, attempt to gain access to the website control panel or hosting account. This is the root level of access and will be your best bet to re-gain control. If that is not possible, then a local admin account to the CMS or FTP account could be used.

If the provider is unwilling to provide access to services that you pay for then legal action may be needed. While this process is going on, if possible, securing your domain before brining any legal challenges will be a wise move.

In closing, keep your domains registered yourself and where possible purchase your own hosting and have your web team build your site there. Use a trusted third party like PremierePC to help manage and control these items and act as your trusted advisor and consultant to ensure no changes are being made that will have adverse consequences. Most importantly, your domain never NEED to move to your web host for them to host a website, we firmly believe that whoever provides and manages your email platform should be in charge of the domain and DNS.

You can learn more about our domain and managed DNS program using the links below.

https://www.premierepc.net/business-hosting/domains/

https://www.premierepc.net/business-hosting/managed-dns/

How are you protecting the PII (Personally Identifiable Information) of your clients, customers or members?

As others are stating, sharing the specifics of these plans can open you up to risk, so it is best to share generally about this topic.

PII is a big deal and you can be responsible for it even though you didn’t initially send it.

Let’s cover the basics of what PII is and isn’t.

Personally Identifying Information (PII) is defined as any information about an individual maintained by an agency, including:
(1) any information that can be used to distinguish or trace an individual’s identity, such as: Name, Social Security Number, Date and place of birth, Mother’s maiden name, Biometric records

2) any other information that is linked or linkable to an individual, such as: Medical, Educational, Financial, Employment information.

PII can be sensitive or non-sensitive.
*Non-sensitive PII information:
– Can be transmitted in an unencrypted form without resulting in harm to the individual.
– Can be easily gathered from public records, phone books, corporate directories and websites.

Sensitive PII information:
– When disclosed, could result in harm to the individual whose privacy has been breached.
– Should be encrypted in transit and when data is at rest.
Personally identifiable financial information (PIFI) is any information that a consumer provides to a financial institution that would not be available publicly.
PIFI may include information such as:
– An individual’s name
– Personal contact details
– Bank account number
– Credit Card number
– Social Security number
– And more
PIFI generally contains private and confidential data visible only to authorized personnel.
The term is mainly applied in an operating environment where security, privacy and authenticity of financial information is the primary objective. The data stored within PIFI is used for a set of different applications and/or business services.
For example, an online e-commerce site may contact a consumer’s bank and use PIFI from the bank’s server to identify and validate a buyer’s credit card.
Under the Gramm-Leach-Bliley Act, financial institutions must alert their customers to privacy policies and practices and avoid the disclosure of nonpublic personal information about consumers to third parties without consumers’ consent.
Financial institutions must also establish appropriate standards for protect PIFI.

OK, you still there? I know that was a lot of text, but it’s a great guideline to helping you understand WHAT you need to protect.

So, HOW do we protect PII? A few best practices include:

Identify where you are storing PII. Many file management services will offer this, you can also purchase software audits or have a professional consultant come in.

Determine the sensitivity of the PII you store.

Remove any legacy PII that is no longer needed for active work. Use a retention policy and retire data as quickly as you can.

Encrypt PII in transit and at rest.

We strongly suggest that you NEVER EVER EVER email PII. Consider scans to encrypted network folders or secure cloud services like Egnyte with proper roles and permissions.

Email compromise is the number one method for bad actors to gain access and steal PII. Having strong inbound and outbound email compliance solution can help prevent attacks and mitigate leaks.

PERMISSIONS. Not everyone in your organization needs access to PII, properly storing this data by user role and access permissions will help mitigate many risks.

Educate your team on the critical nature of PII. We suggest at least an annual security awareness training session or PII refresher.

Have a standard onboarding and offboarding process for your team. Do not COPY permissions from users.

If you can, have a dedicate compliance officer who can check and audit your internal process at least quarterly.

There is a lot to understanding and protecting PII. Having a trusted partner like PremierePC can help you avoid many pitfalls, implement complicated solutions, and assist your team in driving compliance.