Remote Workers are Significantly Vulnerable to Hacking

The COVID-19 pandemic has forced millions to work from home.

In the tech industry, we call home computers and home networks unmanaged endpoints - unmanaged because we don’t control those devices and we have no idea how they’re configured.

There’s a whole bunch of risk that comes with unmanaged endpoints:

1. The operating system of home computers are often neglected. They could be lesser versions of Microsoft Windows or MacOS and haven’t received critical updates or patches.

2. The software or settings that we introduce into corporate environments to safeguard our computers aren’t implemented with unmanaged endpoints.

3. Disaster recovery options on unmanaged endpoints is challenging because data may be stored on the local hard drive of these machines. There may not be any data backups.

4. Privacy and confidentiality of corporate data may also be at risk because, again, such data is stored on an unmanaged hard drive. Who knows if the local admin password on the PC is set to a reasonable level as to disallow root-level access.

5. The use case of home machines are very different from business machines. There’s likely to be more risky behaviors (browsing, downloading, installing by end users) associated with these endpoints taken on by teenagers and children.

6. The networking equipment - like the home router and wifi access point - likely hasn’t been patched, updated, or even its root password rotated from its default setting.

And all of this spells big trouble for the small business.

The challenge is to transform these unmanaged assets into managed ones, and, to inspect the networking environment for potential risks and, well, you know … do something about it!

We help small business use technology better. That includes three critical solutions to help protect small business while distance-working.

1. Ongoing Endpoint Monitoring and Protection.

2. Online Backups.

3. Remote Support.

Our Endpoint Monitoring and Protection software reports vulnerabilities back to us so we can take corrective action. It turns an unmanaged endpoint into a managed one. It helps identify areas where the operating system may be vulnerable, or, when somebody installs a risky program. It also includes an antivirus, anti-malware, safe browsing, and intrusion protection system that counters typical threats to a user’s machine.

Our Online Backup solution is all about recovering the company’s data in addition to the user’s data while they’re using their own PC for company business. In the event of failure or if their machine is hit by a ransomware, we can recover the user’s data to a restored machine.

Our Remote Support is part of what we offer. It’s a human eye to look at the user’s network and can make recommendations to improve their security posture. We can red-flag issues that are unmitigated risks so that they can be dealt with; otherwise, we can help safeguard the remote employee with a few simple changes. And of course, if the user gets in a jam with their tech, we’re there to help so they can get back to work.

In all, our approach is to mitigate risk to the small business and to the employee by taking preventative measures. Instead of just reacting to failure - hoping that everything is okay with an unmanaged asset - we help our clients move beyond hope. We help small businesses have confidence in their ability to function and serve their customers.

That’s how we add value.

R

Ransomware Disaster Recovery for Professionals: Attorneys, Doctors, CPAs, Financial Advisors

I wanted to take a few minutes to explain how business professionals - Consultants, Attorneys, Doctors, CPA's, and Financial Analysts specifically - can prepare their practice to recover from a cryptoware attack made against their data processing systems.

I'm signaling-out these professionals because they usually have non-disclosure, fiduciary obligations, confidentiality agreements, or legal mandates to safeguard their clients' data. 

The nature and risk of that data is therefore more consequential than most; extra precautions should be exercised both protect data from unauthorized disclosure as well as restore operations.

This write-up may get a bit lengthy and for that I must apologize, still, I think it's a good blueprint to help draft a roadmap for your firm.

I'll be writing it in pieces over the next week and I'll provide hyperlink updates within this post to the latest posts that I complete.

Guiding Principles

• We Do Not Pay Ransoms. A terrible strategy that only promotes more attacks. People who weaponize your data processing systems shouldn't be compensated.
  

• Invulnerability Isn't Possible; Failure Is Inevitable. There's no way to guarantee absolute computer security or to avoid systems failure. It will happen. The risk must be planned for.
  

• Disasters are Disasters. Planning for a ransomware attack is just the same as planning for an earthquake, a flood, or a fire. Our disaster recovery plan may be universally-applied.
  

• Access Control. Only authorized people should have access to confidential information. That means strong authentication, managed risk, and low attack profiles.
  

• Separation of Systems. We will design systems that are independent of each other and quarantine sections of risk so that firewalls exist between computing environments.
  

• Layers of Recovery Options. Instead of depending on just one data recovery option, we will use many options to give us an opportunity to recover from a disaster.
  

• Leverage Encryption Everywhere. Throughout our data ecosystem, we will leverage encryption wherever possible to prevent what could be compromised from being used.
  

• Asset Management and Maintenance. A good best-practice that keeps our firm on-top of emergent threats.

Please feel free to contact me if you have any questions about what you're reading in this series.

If you have concerns about your own practice and your disaster recovery planning, contact me. I'd be happy to help.

R

Addressing Friction - Kauffman FastTrac Facilitator Presentation

Today, I’m delivering a presentation on process improvement and workflow analysis.

Here are the presentation materials.