What you need to know about Petya, the latest Cyberattack

Another hack has impacted the business world. Named, Petya, this attack exploited holes the WannaCry attack highlighted. Since WannaCry was defeated so quickly, many firms did not patch the vulnerability.

The Petya attack started in Kiev, the capital of Ukraine, when the ATMs stopped working. Workers at the old Chernobyl nuclear plant were forced to manually monitor radiation levels after their computers failed.1 Shipping giant Maersk had to shut down several systems once it realized it was affected. According to the company, “The breakdown affected all business units at Maersk, including container shipping, port and tug boat operations, oil and gas production, drilling services, and oil tankers.”2 Roughly 76 ports, including Los Angeles, were affected. The Port of New York & New Jersey released a tweet announcing its APM terminals were closed Tuesday afternoon. It is estimated that this attack compromised over 2,000 computers in a dozen countries including the UK, US, France, Germany, and Australia.

What lessons can we learn from this?

  • Never pay the ransom. You are dealing with criminals and cannot trust that they will give you the codes needed to unlock your data. Furthermore, it encourages them to continue hacking computers as they are compensated for it.
  • Backups are important. Instead of relying on a criminal to obtain your locked files, restore them from a backup.
  • Patches are key. The reason many of the machines became compromised is that they were missing important patches. Make sure you are regularly updating your machines to ensure loopholes are shut and your infrastructure is protected.

If you’re ready to protect your organization, it pays to work with a Managed IT Services/Managed Cloud Services company, like Bryley Systems, to ensure that you’re taking the right steps. Bryley will recommend solutions to eliminate weak links in your security chain, and help you develop an organization-wide policy to help prevent data loss.

Please contact us at 978.562.6077 or by email at ITExperts@Bryley.com. We’re here to help.

 

1 Perlroth, Nicole, Mark Scott, & Sheera Frenkel. New York Times. “Cyberattack Hits Ukraine Then Spreads Internationally.” 27 June 2017.

  1. CNBC. “Cyberattack hits the world’s biggest shipping company.” 27 June 2017.

McGoogan, Cara. Yahoo Finance.Petya cyber attack: Everything to know about the global ransomware outbreak.” 27 June 2017.

Securing your Organization’s Computer System and Company Data

Cybercrime can have severe consequences for organizations that are victimized. “Cyber criminals want your company’s financial data, customer lists, credit card information, intellectual property, and anything else they can sell. Besides the immediate impact on your organizations’ ability to operate (for example, ransomware can shut you down), there are significant costs associated with a data breach.”1 These costs include:

  • Potential fines from regulatory agencies for failure to protect personal identification data (PI) or personal financial information (for example a credit card number). Some fines have been in million dollar multiples.
  • Loss of customers.
  • Loss of business reputation.
  • Inability to attract new customers or clients.
  • The cost of notifying all persons and businesses that had their data breached.
  • Costs of providing credit monitoring and identity theft protection for all involved.
  • The potential cost of defending a class action lawsuit against your company for failure to adequately protect sensitive information.

The following tips contain some best practices for keeping your organizations’ computer system, programs, and data, safe from prying eyes.

  • Make sure your firewall is on so that intruders cannot access your system from the internet.
  • Install security software and keep it updated.
  • Filter all email for computer viruses.
  • The more popular a program used by your business is, the more appealing it is a target for cyber criminals. Criminals know that many users do not regularly patch their programs against malware infections, so popular programs give them a wider pool for targeting. Make sure that your computer programs are updated as soon as a security patch is released.
  • Exercise caution when using free 3rd party software claiming they check for software updates. Free software may be bundled with malicious software.
  • Instruct employees that they should never open emails from unknown senders since they might be a source of infection to your company’s computer system. Attached malware might be anything from a virus to ransomware.
  • Tell your employees they should check with senders they know if an email has a suspicious attachment. A phone call to the sender can help avoid the consequences of a data breach.
  • Inform employees they should not open websites they are not familiar with and they should make sure the address bar is the site they want to visit. A random click could take them to a website that is just waiting to download malware onto your company computer system.
  • Buy your software from a reputable buyer and never use pirated software as it may be infected with malware.
  • Before using thumb drives and other portable media, scan them with security software to ensure they are virus.

Protecting your company’s data and infrastructure should be a top priority, but you do not need to do it alone.  The Bryley security team has the training and expertise to protect your company’s data and infrastructure. Please contact us at 844.449.8770 or by email at ITExperts@Bryley.com. We’re here for you.

Resources:
1 https://www.us-cert.gov/ncas/tips (US Computer Emergency Readiness Team)
https://www.consumer.ftc.gov/articles/0272-how-keep-your-personal-information-secure (Consumer Information / Federal Trade Commission
https://www.adp.com/who-we-are/data-security-and-privacy/safeguard-your-data/minimize-the-risk-of-computer-viruses-and-malware.aspx (ADP)
www.smallbusinesscomputing.com (Small Business Computing)
https://resource.elq.symantec.com (Symantec)
http://guides.wsj.com/small-business/technology/ (Wall Street Journal)

 

Bryley Named #14 By Worcester Business Journal

We are excited to announce that Bryley Systems was recently named 14th for IT Service Providers by the Worcester Business Journal. It is a testament to our commitment to our clients and putting their interests first.

Each year, the Worcester Business Journal (WBJ) compiles and publishes a list of IT Service Providers throughout Central Massachusetts. The list, published on June 12, 2017, ranked Bryley Systems among the top 15 organizations surveyed. Rankings are determined based on survey results, federal filings and Web sites.

Bryley has consistently ranked well on the WBJ list for the last 3 years.

If you are looking for a business partner to help you navigate the ever-changing technology and cybersecurity landscape, we’re here for you. For more information about Bryley’s full array of Managed IT Services, Managed Cloud Services, and Cybersecurity Services please contact us at 978.562.6077 or by email at ITExperts@Bryley.com.

 

Fireball – A New Malware Threat

A new malware has cropped up on the heels of “WannaCry”.  It is called “Fireball” and has been detected in more than 250 million computers and 20% of corporate networks across the globe.  According to security firm, Check Point, this malware originated in China, and is believed to be “possible the largest infection operation in history.”1

What makes Fireball unique from other malware is that it is used primarily to “manipulate web traffic to generate revenue from online advertisements, transforming browsers into ‘zombies’.”2 generate fake clicks and traffic for the creator, Rafotech, a Beijing advertising firm.  Check Point further warns that Fireball “serves as a ‘prominent distributor’ of more malware,”2 meaning it can cause further viruses to gain access your data and cause more harm.

How can you tell if your computer is infected? “Check by opening your web browser. Is your homepage set to the same website? Are you able to modify it? Is your default search engine the same? Check your browser’s extensions. Do they look familiar? If you answered no to any of these questions, your PC may be compromised.”2

How can you protect yourself and your organization from these threats?

  • Install anti-malware software and ensure it is up-to-date.
  • Conduct regular scans of your environment.
  • Perform updates and patches as they are approved.
  • Enhance your firewall to detect malware before it enters your environment.

These are but a few of the “Best Practices” that can be employed to safeguard your data and business. If you’re ready to protect your organization, it pays to work with a Managed IT Services/Managed Cloud Services company, like Bryley Systems, to ensure that you’re taking the right steps. Bryley will recommend solutions to eliminate weak links in your security chain, and help you develop an organization-wide policy to help prevent data loss.

Please contact us at 978.562.6077 or by email at ITExperts@Bryley.com. We’re here to help.

 

1 Morris, David Z.  Fortune.Chinese ‘Fireball’ Malware infects 250 Million Computers.” June 2017.

2 Channel 5 News. ”Your computer may be infected with ‘zombie’ malware that hijacks browsers.” June 2017.

What you need to know about the OneLogin Breach

OneLogin, a single sign-on service that allows users to access multiple sites and applications using just one password confirmed on June 1st that its systems had been breached and login information had been exposed. According to the firm, this breach affects “all customers served by our US data centre” and the hackers had “the ability to decrypt encrypted data”1. This is the second time within the past year that the firm had its security breached.1

So, how can you protect your data from a breach? One way is to have two-factor authentication, which is a method used to confirm a user’s claimed identity by utilizing a combination of two different components, generally something you know with something you have. For example, when you withdraw money from an ATM, only the correct combination of a PIN (something you know) with the bank card (something you have), will grant the transaction to take place.

One of the safest ways to ensure your data is protected is to encrypt it before placing it in the Cloud or with a single sign-on provider, such as OneLogin. Provided your encryption key has not been generated from a simple password, your data will be protected from any breach to your provider, as the provider does not have the password to gain access to your information.

It is vital that one stays vigilant when it comes to protecting your passwords and data. Even the most difficult password can be deciphered if given enough time. Therefore, it is important to regularly change your passwords and ensure they are strong. We have more information on the Do’s and Don’ts of Password management on our blog.

For more information on password and security, connect with Bryley’s cybersecurity experts by calling us at 844.449.8770 or emailing us at ITExperts@Bryley.com.

 

1 Fiveash, Kelly. Ars Technica. “OneLogin suffers breach – customer data said to be exposed, decrypted.” June 2017.

BBC News. “Password manager OneLogin hit by data breach.” June 2017

 

Why Backups are Critical in Fighting Ransomware

Ransomware – usually Crypto Locker and its variants – is a form of cyber-malware based on encryption software that seeks payment (ransom) to undo the damage; when infected, the malware typically encrypts all data files, rendering them useless until the ransom is paid.  (Encryption software scrambles a files’ contents and creates an encryption key, essentially a code used to reverse the process.  Unless you have this key and the encryption software, the files remain unreadable.)

Recently, hospitals and police departments have become victims of ransomware.  Hollywood Presbyterian Medical Center was forced to pay a $17,000 ransom in bitcoin to regain control of their computer systems and after repeated attempts to decrypt their data, the Tewksbury Police Department was forced to pay the $500 ransom.

Other than paying the ransom, which is risky and not recommended since it potentially makes you more of a target in the future, the only way to thwart ransomware is by restoring the corrupted files through a backup that was created before the infection.

A properly planned and implemented backup process is vital since data stored on a network server represents many hours of effort over time, making it impractical and usually impossible to recreate.  A properly functioning, multi-point-in-time backup is necessary to provide restoration under these and other scenarios:

  • A server fails
  • A file is deleted
  • A template is written over
  • An application upgrade fails and must be restored
  • A document is inadvertently changed and saved by a user

A backup should be a complete, recoverable copy of not just data, but the entire server/network environment.  It should have these properties:

  • Sequenced over many days
  • Complete image
  • Offsite storage

If you’re ready to get serious about protecting your business data, select a talented Managed IT Services/Managed Cloud Services company, like Bryley Systems, to help you double-check your IT infrastructure, recommend solutions to eliminate weak links in your security chain, and help you develop an organization-wide policy to help prevent data loss. Please contact us at 978.562.6077 or by email at ITExperts@Bryley.com. We’re here to help.

Why are people so against paying for IT Support?

I’d be rich if I had a $5 dollar bill (inflation) every time I heard:

  • “My son/daughter/niece/nephew (pick one) who is only 2/4/6/8 (pick one) years old was able to solve my computer problem; why do I need you?”
  • Lisa, a senior VP in our marketing department, handles our IT.”
  • “I’m moving to the Cloud, so I won’t need IT support.”
  • “I looked up the answer on Google; it was easy to fix.”

Sure, anyone with technical interest and aptitude can address IT-support issues, particularly those at the lower, end-user level (comprised of printers, computers, and mobile devices).  Many organizations have that one Lisa/Joe/Patty who helps with IT-support issues (in addition to working their full-time job) or is the dedicated IT resource within the organization; they feel it is cost-effective to have an internal IT person or an IT department, often citing the need for a warm body onsite who can respond instantly, particularly when the President can’t sync her iPhone.

However, IT is a complex field with many moving parts; it is difficult to be proficient, let alone expert, in all areas.  For example:

  • Lisa designed the computer network to be reliable, secure, and robust, but is overqualified (and not cost-effective) helping someone print a document.
  • Joe can change toners, but does not know what to do when the Internet is down; especially troublesome when your primary application is Cloud-based.
  • Patty configures Windows desktop computers and iPhones for employees, but cannot verify that the firewall is doing its job.

Basically, IT is a multi-facet discipline; successful IT support personnel have:

  • An understanding of the components (desktop computers, mobile devices, servers, firewalls, routers, Cloud, etc.) and their interdependencies.
  • A step-by-step troubleshooting mentality that works well under pressure.
  • A willingness to stay current with constantly changing and emerging topics.

IT is an expense, but also an enabler; it is usually fundamental to an organization’s success, often representing an opportunity to get ahead of a less-savvy competitor.  Given the breadth of technology options and the potential to develop new business or reduce costs, more organizations trust (and outsource) their critical IT functions to a Managed IT Services Provider (MSP) or a Total IT Services Provider (TSP).

Truly effective MSP/TSP companies are dedicated to remaining IT savvy while focused on the business requirements and concerns of their clients.  These companies share similar characteristics:

  • A broad, experienced service team with varying levels of competence:
    • Technician (Level-1) – End-user oriented and experienced in the devices common to end-users: Mobile devices, PCs, MACs, printers, scanners, and the like.  They should work well with others, be experienced in end-user operating systems (Microsoft Windows, Google Android, MAC iOS), and have excellent troubleshooting skills.
    • Engineer (Level-2) – Network-device oriented and experienced in Cloud, servers, virtualization, Ethernet switches, firewalls, routers, Wireless Access Points, and other network devices. They must be good troubleshooters and understand network-level IT components.
    • Consultant (Level-3) – Implementers of Cloud-based solutions and local and wide-area networks. Social skills are expected; business skills are a must.
    • Chief Technical Officers (God-level) – Architects of Cloud-based/ hybrid-Cloud solutions and wide area networks. They must understand the technical functionality of all of the moving parts, while keeping the business needs and consequences in clear focus.
  • A proven, capable management team that can focus technicians, engineers, and consultants on the tasks at hand while preparing them, skill-wise, for an ever-changing world.
  • A defined set of business-oriented processes designed to manage, optimize, and secure (coincidently, Manage ● Optimize ● Secure is our tagline) their client’s network environments. These processes are not static, but tend to be ever-evolving and striving toward proactive automation and perfection.

In sum:

  • IT is a complex, changing discipline of multiple levels,
  • IT can enable new opportunities or reduce costs,
  • IT can make or break an organization, and
  • MSPs/TSPs can maximize your IT potential!

If you are looking for a business partner to help you navigate the ever-changing technology and cybersecurity landscape, we’re here for you. For more information about Bryley’s full array of Managed IT Services, Managed Cloud Services, and Cybersecurity Services please contact us at 978.562.6077 or by email at ITExperts@Bryley.com.

What Can we Learn from the Netflix Leak?

Netflix was in the news recently for a mishap with its production company. A cybercriminal that goes by the name “thedarkoverlord” was able to breach postproduction company Larson Studios, and has claimed to have “stolen unreleased content from ABC, Fox, National Geographic and IFC.”1 After Netflix refused to pay the ransom, the cybercriminals released the first 10 episodes of Season 5 of “Orange Is The New Black” on Friday, April 28th via Twitter. When they did not receive the desired response (payment), the released the remaining nine episodes of the season the following day.1

This is the latest high-profile breach in the past year (LinkedIn, Twitter, IRS just to name a few). According to a report published by Verizon, ransomware attacks have “increased in the past five years and were up 50 percent in 2016 compared with 2015…”1

This breach is a reminder to stay vigilant and maintain your safeguards. Here are some tips on how to avoid finding yourself in this type of predicament:

  1. Create a Firewall. While most operating systems come with their own firewalls, they are typically only designed to protect one machine. To protect yourself from attacks and malware, it is best to invest in a network firewall.
  2. Encrypt Your Data. A firewall is considered the first line of defense, encrypting your data provides that extra layer of security. You do not want them to be able to through the firewall and have easy access to your proprietary information.
  3. Have Policies in Place. You can have all the devices and systems in place, but if your employees are not well-versed in their roles of protecting the data, all your effort will be for not. Instead, make sure employees know how to treat the data and the steps they need to take to avoid any potential issues. One of the core policies that should be implemented is a password policy. Employees should be prompted to change their password a minimum of every 90 days (less depending upon your industry). Passwords should be complex and include numbers, letters, and symbols.
  4. Have a regular review of your infrastructure. You go to the doctor for regular checkups, you should do the same for your company’s infrastructure. It can often be difficult to do on your own as you may not have all the knowledge and expertise or the bandwidth to conduct a proper evaluation. Do not be afraid to ask an MSP, such as Bryley, to conduct a network assessment and evaluate your infrastructure. They have expertise and breadth of knowledge that will prove valuable and can highlight what you are doing well and areas where you can improve.

If you would like to improve your cybersecurity plan, or to inquire about Bryley’s full array of our Managed Cloud Services and Managed IT Services, please contact us at 844.449.8770 or by email at ITExperts@Bryley.com. We’re here for you.

 

1 Perlroth, Nicole and Matthew Haag. Hacker Leaks Episodes From Netflix Show and Threatens Other Networks. 29 April 2017.
http://www.cbsnews.com/news/irs-identity-theft-online-hackers-social-security-number-get-transcript/
http://www.cnbc.com/2017/03/15/turkey-twitter-accounts-hacked-germany-netherlands-nazis-forbes.html
http://www.verizonenterprise.com/verizon-insights-lab/dbir/2017/

Beware!! Google Docs Phishing Scam

If you recently received an email asking you to open a Google Docs, and you don’t know the sender, don’t open it! Chances are, this is a phishing email designed to have you click on a link and gain access to your information.

The email looks similar to a true Google invitation, but there are key differences.

The bogus email does not provide the name of the shared document and lacks the Google Docs icon.

The real email includes the name of the document, with the Google Docs icon .

Google is aware of this issue and issued a statement Wednesday saying, “We’ve removed the fake pages, pushed updates through Safe Browsing, and our abuse team is working to prevent this kind of spoofing from happening again. We encourage users to report phishing emails in Gmail.”

We all face the grueling task of trying to manage our email. While email is a very convenient mode of communication and most of it is genuine, knowing the signs of phishing emails will prevent you from unleashing a disaster.

When in doubt, don’t click! Contact your IT administrator. And remember, legitimate organizations will never ask you to disclose personal data via email.

For more information, please see “Recommended Practices – Part 4: Email Use” in the November 2014 edition of Bryley Information and Tips (BITs).

Read this case study about a particularly vicious attack that Bryley remediated.

Bryley Systems specializes in protecting you from malware. Contact us at 978.562.6077 or by email at ITExperts@Bryley.com. We’re here for you.

Interested in more security news? 

Sign up for our monthly newsletter to receive the latest cybersecurity updates right in your inbox!

Newsletter Signup

5 Steps to Avoid Ransomware

Coffee in hand, you’re preparing to read through your new emails as you start your day. You anticipate a productive day today. Yesterday you stayed 3 hours late to complete your big presentation, 2 days ahead of schedule, and you’re basking in the glow of the satisfaction of a difficult job well done and being ready early. How often does that happen?

You have Outlook open and are starting to review the newest emails when all of a sudden, a window pops up with bold text:

!!! IMPORTANT INFORMATION !!!

All of your files are encrypted with RSA-2048 and AES-128 ciphers.

Huh?!?! What does this mean?

It means your day has taken a turn for the worse… You have just been notified that the Locky Ransomware has just completed its work on your system by encrypting all of your files (rendering them useless) and is now demanding payment from you to get your files back. Depending on the sophistication of the Locky variant, it will ask you for anything between 1-15 Bitcoins (Bitcoins are trading for $1,205.00 at this time). This may depend on what it perceives the value of the stolen files to be. Server infections typically demand larger sums. Instructions are included on how to make payment with the guarantee that if payment is made, you will receive a key to unlock your precious files.

What can you do? Your mind is racing. How can this happen?!?! Your heart rate is increasing rapidly! Put down that coffee… take a few deep breaths. This represents anything from an irritating interruption to a disaster of epic proportions. What you have done up to this point will determine the impact of this event.

If you have good backups, this represents a minor inconvenience. If you don’t have backups at all … you will have to decide if you’re going to count your losses and move forward or consider paying the Ransom. After all, there is honor among thieves … or is there???

How can you avoid being in this situation?

There are several things that can be done before you are in this situation to “reduce your surface of vulnerability” and to recover without great loss.

    1. Backup your data.
      Good backups cure many woes. You may not use your backups for months or even years, but when the need arises, you want to be sure you can recover to a point where you can feel whole again.
    2. Purchase Advanced AntiVirus and AntiMalware and keep it up to date.
      Many of todays Advanced AntiVirus/AntiMalware programs will monitor your system for behavior that looks like ransomware at work and shut it down before it gets too far. Some will not.
    3. Do not open attachments or click on links in the email from unknown sources.
      If you need to open attachments, scan them for malware first. Many people are fooled by Human Engineered emails that “look” legitimate but have attachments or links that are masked in some clever way.
    4. Limit user access to data they need.
      Although this doesn’t help with avoidance, it will certainly help to minimize the impact if it happens. If everyone has access to everything, that means if one person becomes infected, they have the capability to cause encryption of ALL data they can see.
    5. Train your staff on proper Business Security Best Practices and to be aware and vigilant. If your data is important to your business, it needs to be handled as such.

 

 

 

There are other “Best Practices” that can be employed to safeguard your data and business. Take a proactive approach and avoid the reactive. In the long run, the reactive approach will cost much more in time, money, and grief. Give Bryley Systems a call (844.449.8770) to discuss what you can do to improve your overall security, efficiency, and cost … and enjoy that coffee!