Mark Flores, Author at Infinity Networking

August 21, 2020

Cybersecurity and Compliance is Important for All Companies

If your company has regulatory compliance requirements, please read on. But even if it doesn’t – you should still read this.

What is IT Compliance?

IT Compliance means conforming to a set of rules, policies, standards or laws for your company’s specific industry for the protection of sensitive information and IT resources. Examples of which entities would require compliance include federal and state laws, industry regulations, contractual obligations and insurance policy requirements.

You may be surprised to know that all businesses are regulated. Besides the common regulations for HIPAA (medical record privacy) and PCI (credit card processing), all states have data breach notification laws. Many states also have laws protecting the private information of customers, including social security numbers, driver’s license numbers and credit card numbers.

You may think, “We do not collect any of that information so we have nothing to protect.” Are you sure? And can you prove it if your company was investigated? For example, there was a known case where a former CFO had created a spreadsheet of all the employees’ social security numbers and bank account numbers so he could easily access the information and not have to look them up one by one in a secured database. The current CFO did not do this, but the spreadsheet still existed on his workstation and even included the CEO’s personal information!

So even though your company may not have any particular regulatory laws or compliance standards that are mandated by industry, the confidence to declare and prove that your company does not have unsecured personal information is a valuable asset.

Law, Regulation or Framework

IT Compliance can be organized at three different levels.

Law – The most absolute of compliance regulations have been made into Laws (or Acts). Any industry governed by these laws must not only safeguard their sensitive data, but must also be able to prove that the data is secure and that they are actively and proactively ensuring that their data is secure. Examples of regulatory laws include HIPAA (healthcare), GLBA (financial), FISMA (federal agencies), CCPA (California consumers), SOX (corporate governance), ITAR (US defense sales and services)

Rules – Although not laws, many industries have strict rules that they must adhere to and in most cases require independent audit and certification. Examples of industry rules include PCI-DSS (credit card privacy), DFARS and CMMC (US defense industry), FDIC (banking), HIPAA Security Rule (electronic health industry privacy), Title 21 CFR Part 11 (electronic records/signatures for biotech)

Frameworks – Neither laws, nor rules, frameworks are broad (and detailed) scopes of IT security concepts that many industries outline and define to assist with creating effective IT policies and procedures to secure data and IT systems. Examples of frameworks include NIST CSF (cybersecurity framework), NIST 800-53 (US federal information system privacy controls), NIST 800-171 (controlled unclassified information for non-federal information systems), ISO 27001 (international standard for information security) and ITSM (security framework for IT service providers).

What does my company need to do?

All companies, whether or not they are governed by laws, rules or frameworks should give some basic thought to their own cybersecurity standards. Statistically, businesses of all sizes are being actively targeted by criminals or malicious entities. A proper cybersecurity plan includes three co-equal areas of security compliance:

Policies (a written statement of the company’s general stance on IT-related subjects, such as passwords, internet access, backups, etc.)
Procedures (more specific details about how things are performed, such as which backup or antivirus applications are implemented, how a terminated employee is offboarded, etc.)
Evidence (how your company documents changes to policies and procedures or deviations, exceptions and violations of security)

How Infinity Networking can help your company

Here is a list of the ways we can help your company attain proper cybersecurity standards, maintain those standards and create ongoing assurances that your company’s IT security is working and up-to-date.

Get the Basics in Place

Your company should have a good antivirus application installed on all workstations, laptops and servers
Your servers and critical workstations should be backed up or imaged regularly and the backups should be tested on a regular basis
All of the operating systems on your workstations and servers should have the latest security patches and service packs
Your company’s network should have a commercial-grade firewall between it and the internet
You should know who is accessing your network data and remove anyone who is not authorized

Infinity Networking’s Managed IT Services is a valuable asset for your company to maintain a healthy IT infrastructure. Get more information about Managed IT Services.

NIST CSF (Cybersecurity Framework)

The NIST CSF has been adopted and used by many agencies and organizations because of its high-level, streamlined approach to cybersecurity. The NIST CSF has five components:

Identify – Hardware, software and data should be identified and located
Protect – IT systems should be protected by firewalls, antivirus, backups, etc.
Detect – IT systems should be scanned or audited regularly to find changes or intrusions
Respond – There should be a procedure in place to respond to any security breaches or intrusions into an IT system and report/record the incident
Recover – In the event of a breach of security or data loss, there should be a procedure in place to recover lost data and remedy any vulnerabilities

When all five of these components are properly addressed, a company can be assured that they have a strong foundation of effective cybersecurity policies and procedures.

Infinity Networking’s Network Security Assessment is based on the NIST CSF and will run an automated scan of your network’s resources to identify the security features you have enabled as well as any issues that should be addressed. We can also assist you in creating a remediation plan to fill the holes.

Specialized Compliance Standards

In addition to the general NIST CSF framework, Infinity Networking can also assist in the scanning, detection, remediation and documentation for more specific compliance requirements such as:

CMMC (Cybersecurity Maturity Model Certification)
GDPR (General Data Protection Regulation)
HIPAA (Health Insurance Portability and Accountability Act)
PCI-DSS (Payment Card Industry Data Security Standard)
Cyber Insurance
Microsoft Cloud Services (Office 365, Teams, SharePoint, OneDrive, Azure)

SPECIAL OFFER

If you would like a comprehensive, detailed security scan of your company’s network, including the identification of personally identifying information (PII), network security settings and external access testing, we are offering a one-time $300 service which includes the configuration and implementation of the network scan, the creation of customized reports and a detailed remediation plan to address any problems.

In addition, if you would like to have ongoing, monthly scans of your network or if you have a specific compliance requirement listed above, we will apply the one-time scan fee to your first month’s charges for our specialized Compliance Manager application. This service is installed at your location and automatically runs on a monthly basis, providing you with regular detailed reports that can be used as evidence for audits and requests for proof of compliance.

Please contact us if you have any questions, would like to see a demo or would like to view samples of the security reports. We can also discuss the next steps needed to implement a comprehensive Security Scan for your company.

Mark Flores

August 21, 2020

August 14, 2020

Quick Fix to Speed Up Windows 10

You probably don’t know that your Windows 10 operating system boots up each time with a number of unneeded applications configured to run in the background all the time. More likely than not, you either don’t use them or even know that they were automatically installed with Windows 10. These extra start-up programs can contribute to a loss of available system memory and other resources, which in turn slows down your machine’s performance. Here’s how to check which programs are starting in the background, how you can disable them yourself and speed up Windows 10.

Open Settings (Start > Gear Icon) and then go to the Privacy section.

Scroll down the left side and find Background apps

Scroll through the Background apps and toggle off any applications that you are not using regularly.

When you are done, simply close the window and enjoy all the extra resources you have just freed up!

Mark Flores

August 14, 2020

April 25, 2020

5 Tools for Working from Home

5 Tools for Working from Home

During the current stay-at-home restrictions, the success of a business is relying more on the ability to provide employees with a means of working remotely. Here are five tools that can be utilized by companies to keep their employees productive and useful.

Remote Workstation Applications

One of the most popular solutions for remote workers is the use of a Remote Workstation Application such as Connectwise Control, LogMeIn, Teamviewer or RemotePC. These applications allow a remote employee to use a web browser to remotely control their workstation at the office and work on their own familiar machine. Remote file copying and printing are convenient features that many of these applications provide. Pricing varies by product so be sure to research their respective per-user costs and capabilities.

Security Concerns: Commercial (paid) remote workstation applications all provide secure, encrypted connections between the remote user and the office workstation. However, any time a connection is allowed to be made from a remote location through the company firewall, there are risks to allowing unauthorized access to a company’s internal network resources to anyone who has credentials to the remote access application. It is highly recommended that all employees using remote access applications use some form of multi-factor authentication (one time session code sent via email or text or smartphone app).

Remote Desktop Services (Terminal Services)

Before the popularity of remote workstation applications, many companies leveraged Remote Desktop Services (formerly called Terminal Services). A dedicated server on a corporate network hosts multiple remote users at the same time and provides a virtual workstation for them to access network resources. Although the remote desktop is not a physical workstation, the remote desktop services allows each user to customize their own desktop experience and run most of their network applications in their remote sessions. Remote Desktop Services are still utilized by many companies but due to the necessity of expensive hardware and network resources, this option is not as viable to many small businesses.

Security Concerns: Unless remote desktop services are used over a VPN (see below), this solution is usually visible from the internet (public-facing) side of a company firewall and therefore a common target for exploitation or hacking. Remote desktop services do not provide any security or encryption so it is imperative to utilize a VPN when using this solution to avoid offering easy access to a company’s private network.

File Sync and Share (FSS)

Other popular applications that remote workers can use are File Sync and Share (FSS) services such as Datto Workplace, Dropbox, Box, OneDrive or iCloud. These services offer a hybrid combination of storage in the cloud while also creating a copy on the user’s machines and keeping the documents in all locations in sync. A remote worker could have access to documents on their business workstation, home computer, laptop or even their smartphone or tablet. Some of these services were designed for non-commercial use so companies who want to utilize FSS should be sure that the provider offers proper security and safeguards.

Security Concerns: Most FSS services encrypt communication and file transfers to and from the cloud to the local workstations. However, most of these solutions are configured to establish the link once, save the credentials and then there is no further prompt for a login. So the primary security of FSS relies on the endpoint workstations using screen lock timeouts and password protected logins which are the most important considerations for securely protecting data.

FTP Service

Another older service that many companies used was FTP (file transfer protocol). Before the advent of the cloud, companies would dedicate local storage on their own network servers and allow access to the storage using a service called FTP. But since alternative storage solutions such as FSS and cloud services are becoming more cost-effective, many companies are moving away from FTP for allowing remote access to company files.

Security Concerns: FTP uses common and well-known network ports that must be opened on a company firewall so they are the constant target of exploitation and hacking. Since the files that an FTP service provides access to are located on a company’s private network, it is imperative that all security measures are taken to reduce outside threats. In most cases, FTPs should be avoided due to these security vulnerabilities.

VPN (Virtual Private Networking)

Still widely used by businesses of all sizes, a VPN relies on a client application on a remote machine to make a secure, encrypted connection directly with the internal network of a company. This allows a remote user’s workstation or laptop to be connected to their company’s internal network from the outside (e.g. at home or a hotel). It is a more complex procedure to set up a VPN connection and proper security measures must be followed since the connection bypassed a company’s firewalls and allows direct access to the network. The main drawbacks of a VPN are the setup and hardware costs as well as the reduced speed of the encrypted connection. A VPN is still a viable option for companies who have the resources to employ the technology.

Security Concerns: A VPN is a highly secured application as long as the remote user does not allow unauthorized access their offsite machine.

Infinity Networking is now offering extended trials of Connectwise Control for remote workstation access as well as extended trials of Datto Workplace, an enterprise-grade File Sync and Share solution that provides a more robust file sharing service than its commercial-grade competitors. For more information or to enable a trial of these products, please read further or sign up HERE.

Mark Flores

April 25, 2020

February 24, 2020

The Greatest Threat to your Company’s Cybersecurity

The Greatest Threat to your Company’s Cybersecurity

No matter how much you have invested in your firewall or how effective your antivirus or anti-malware applications, you are still not protected from the most common means of intrusion by a hacker, virus or ransomware – YOU! (and your employees)

Nearly every news-worthy story of celebrities, high ranking government officials or well-established institutions have had their computers, accounts or networks compromised by the most insidious, common weakness – human nature. According to Webroot’s 2020 Cybersecurity Report, cybersecurity breaches will be increasing this year.

Just as allowing a stranger through your home’s front door is asking for trouble, opening an email from someone who seems legitimate can be just as dangerous. And the bad guys are getting much better at gaining your trust. There are two methods they use to fool you:

Phishing

Not too long ago, the bad guys would send batches of emails to random people and make the email look like it came from a bank or a well-known website like eBay or Amazon or Walmart. The email might inform the recipient that their password had expired or that their account had some suspicious activity. The email then requested that the user change their password through a link which asked for their old password and then to select a new one. However, these emails did not come from a legitimate source and the website, which looked very legitimate, collected their credentials and stored it for future abuse. These poor victims had been ‘phished’.

Due to news reports and better cybersecurity awareness, the average computer user started to become more aware of these attempts to steal their information and credentials, so the bad guys had to change their tactic slightly.

Spear Phishing

When you receive an email, one of the first things you look at is the sender. Is it from someone I know? Maybe a relative or a coworker? Is it from a business or website that I use? If the email passes this mental screening, most people will just open the email. But what if the bad guys can make it look like it came from a trusted source? From your Uncle Jerry or your credit card company? They may even include the last four digits of your credit card number.

The bad guys are getting good – really good at fooling you. They are not content to just send out random emails to random people, but are gathering information about you – where you work, who you communicate with, online companies where you shop, etc. How do they know about Uncle Jerry? Well, you keep posting about him on Facebook. Social media websites are literally databases of information about you, your company, your relatives and where you shop. So it is not very difficult to create a custom tailored email that includes a few nuggets of personal information to lower your defenses. And when you open that personalized email – you have been Spear Phished!

So what can you do?

The best defense is common sense. Be constantly aware of an email’s ‘red flags’. Here are a few examples of common red flags:

If you receive a notice that your package from FedEx needs your attention, but you are not expecting something from FedEx, that should be a red flag.
If you recognize the company or service and they may even include your account number, but the sender has an unusual or foreign email address, that should be a red flag.
If the email has a lot of misspellings or contains very poor grammar (and is not from your 6 year old niece), that is a red flag.
If you receive an email to reset your password but you did not initiate it, that should be a red flag. If unsure, close the email and go to the website directly through your browser, but never click on the unsolicited link.
If the email is of an urgent nature and requests sensitive information, that is a red flag (you can always confirm with a quick phone call if it’s that urgent).

But as mentioned before, we are all human and we get tired, bored and have to go through hundreds of monotonous emails every week. It is not surprising that we miss a few of these red flag clues. If you think that you have clicked on something that you shouldn’t have, the best thing you can do is let an IT professional know and run a malware scan on your computer.

When someone tells me that they think they were hacked or they clicked on a suspicious link, I tell them that the first thing they should do is change their password. The second thing to do is run a virus scan on the machine they used to open the suspicious link.

If you think you are a victim of a phishing or spear phishing email, you can contact Infinity Networking and we will help you assess your situation.

If your business would like to know more about Security Awareness Training for its employees, Infinity Networking offers a free trial of Webroot’s Security Awareness Training with simulated phishing emails and a library of security awareness training videos.

Mark Flores

February 24, 2020

January 23, 2020

Top Technology Concerns for 2020

The top technology concerns for 2020 will likely be important for both businesses and consumers alike. These include Cybersecurity, Privacy and more refined, targeted Ransomware. Although future articles will go into more detail about each of them, here are the basics and why you should be paying attention.

Cybersecurity

This term has been tossed around for so many years, most people cannot clearly define it but it is a commonly used catchphrase. Its origins evolved from society’s use of the prefix ‘cyber’, which in Greek has do to with steering or governance and was first popularized by a mathematician in the 1940’s with the term cybernetics. But over the years, attaching cyber- to a word makes it seem futuristic. So instead of computer security, or network security, people started using the catchy term ‘cybersecurity’. It is used to describe many aspects of computer or network security, but for more current application, it can be best described as an awareness of how we secure our use of technology to only allow access to our data to those entities whom we have granted access. In this definition, cybersecurity would encompass concepts such as password management, encryption, firewalls, network perimeter security, antivirus/anti-malware, authentication methods, etc.

Cybersecurity is not just for businesses. Computer data, both corporate and personal can be valuable to others, especially those who would exploit it. Therefore, we must be diligent in protecting our personal data as well as keeping our business data secure.

Privacy

On almost a weekly basis we hear about a new data breach at a large company that has compromised the private information of everyday people. As a society, we can only trust that when we provide personal data such as name, address, date of birth, social security numbers or credit card information, this information is kept safe from the bad guys who would use it against us. But just as diligently as we strive to protect our personal data, others are constantly working to uncover it. Although we have very little control over our data once it is in someone else’s possession, we must still be diligent about whom we give our personal information. New laws in California and the European Union now give the public certain rights to review and remove personal information that we have provided. Common sense is the best defense when protecting your personal information.

Only give your information for legitimate reasons to verified requests.
Only give the information that is necessary and nothing extra.
Be cautious and feel free to question anyone requesting your personal information.

Ransomware

In 2019, ransomware cost business more than $8 billion, with an average ransomware attack cost of $133,000. One of the most widely used methods that hackers are still using to extort money from companies and individuals is with the use of targeted ransomware. By gaining access to a computer or network, usually by an email attack or an exploited network vulnerability, the files and folders of a network are locked by encryption so the users can no longer access them. Conveniently, when someone tries to open an encrypted file, a notification will appear with instructions for how to pay the hacker to decrypt and unlock their network files. The ransom payments are requested by using untraceable bitcoin transactions and in most cases, the encrypted files are unlocked successfully. If the hackers did not follow through on their promise to unlock the files, no one would pay the ransom.

As a business or individual, if this should happen to your data, your options are limited. If you are diligent with your backups, you can simply restore your data from an unencrypted date before the hackers gained access. Or, you can lose your data permanently. Or you can pay the ransom. For some companies, it is easier and more cost effective to pay the ransom and many have done just that. Of course, this does nothing to combat this illegal activity and may even be encouraging its success.

Our advice regarding Ransomware is:

Be diligent with your email – know how to identify a phishing attack
Employ reliable and frequent backups
Never enter your credentials from an email request unless you are the one initiating it (password reset, e.g.)
Keep your computer security patches up to date

If you are a victim of Ransomware:

Disconnect the network/computer from the internet
Stop any backups that are running (you will be backing up the infected files)
Restore your files from backup if possible
Try to find the point of entry for the hackers (suspicious email, open remote access) and only reconnect to the internet once the method of access has been determined or you may end up back I the same place all over again.
Contact an IT professional for expert advice

The Infinity Networking Technology Advice Blog will be providing useful information about these topics and more through the coming year. Please sign up for notification when a new blog article is published. And if you are worried about the data you give us – here is our privacy policy.

Mark Flores

January 23, 2020

April 1, 2019

Introduction to Business Continuity and Disaster Recovery (BCDR) – What is it and why does my business need it?

BCDR is an acronym for Business Continuity and Disaster Recovery. Many people equate this term with data backup, but that would not be accurate. BCDR encompasses more than just the backup and recovery of lost data files. It is a detailed plan describing how a company would continue to do business in both the short or long term if something minor or catastrophic occurred such as fire, theft, natural disaster, power loss or failed equipment. A proper BCDR plan will usually include the following information in detail, specific to the decisions of business owners and high level management:

What are the responsibilities of key personnel for planning, training and testing of procedures
What is the plan for a loss of business facility; where and how will the business be relocated temporarily?
Which personnel will be assigned to recovery teams; by organization or department?
What are the procedures that each recovery team will follow and in what order?
And of course, how will the company’s critical data be preserved, recovered and restored?

Why does my business need a BCDR plan?

For many businesses, having a Business Continuity plan for IT systems is not optional – certain compliance standards require that companies have a written plan in place that is actively reviewed and kept up to date. Examples of types of compliance standards that require a BCDR plan include ISO 9001, GDPR, NIST, HIPAA, FDA GxP and 21 CFR Part 11.

But even if you are not obligated by compliance requirements, a BCDR plan is something that all businesses should have. As the saying goes – it is not a matter of “if” something happens to your data, but “when”. No data medium or hardware will work indefinitely. There will come a time when an employee accidentally deletes an important file or a workstation’s hard drive fails and having a clearly defined plan to recover from these scenarios is what a BCDR plan is all about.

In the next part, we will discuss BCDR in detail with regards to IT systems and some options for ensuring your company does not lose information and gets back up and running with as little downtime as possible.

Mark Flores

April 1, 2019

March 4, 2019

Change Your Default Passwords

One of the most commonly overlooked security vulnerabilities on a corporate network can also be easily exploited – the Default Password. With so much emphasis about our own personal passwords; the need to frequently change them and to keep them complex and and unguessable, companies often forget that many computers, servers and network devices come pre-configured with default passwords. For example, if you order a Netgear router for your internet and WiFi connections, the device has a default username/password to configure the device of admin/password. Routers, switches and sometimes even operating systems often come with a simple login which can be easily Googled or perhaps have no password at all! A few years ago, some enterprising bad operators were using telephones to access the neglected configuration credentials of onsite phone systems.

What you can/should do:

1) If you use a in-house phone system (Panasonic, Avaya, Nortel, ShoreTel, etc.) contact your phone provider right now and ask if they have changed the default password for your system. Some of our clients discovered that their phone systems had been hacked and were making hundreds of toll calls overseas after hours on their dime!

2) If you do not know the login and password for your internet router or WiFi access point (not your WiFi password, but rather the credentials used to configure the device), find out from the person managing it if they have changed the default password.

3) Do the same with your Camera and Security systems or any other devices that can be accessed from the internet.

4) Audit your workstations and servers to make sure that the Administrator and Guest accounts are either disabled or that strong passwords have been assigned to them.

Infinity Networking can run a complimentary Network Security Scan to help you identify potential security holes in you company’s network. Contact us for you free assessment today.

Mark Flores

March 4, 2019

April 27, 2018

Small Business IT Checklist

I know from experience that many businesses chug along nicely with their network running on autopilot. Then something happens; a computer crashes, a virus infects the server, a file is accidentally deleted. It is at times like this that many business owners will suddenly be acutely aware of how ‘hands-off’ they have been with one of the most critical parts of their business – their IT systems. As the saying goes, it is not a matter of if but rather when a network will have a problem. Here is a checklist of the most common IT questions that every business should be able to answer or should find an answer asap.

Backups – Protecting your data is at the top of the list. Do you have a reliable backup solution for your servers and workstations and have you tested the backups to be sure they work?
Antivirus – Are all of the workstations and servers on your network protected with an up-to-date antivirus and anti-malware application? How are you notified if a machine gets infected?
Inventory – IT equipment can become outdated or obsolete before you know it. An accurate and updated inventory of your network, including purchase date and warranty information is a valuable asset.
Firewall – The first line of defense protecting your company’s machines from the wild west of the internet is a firewall appliance. Some companies may be trusting the security features of the router provided by their ISP, but they shouldn’t. Investing in an enterprise-grade network firewall will beef up the poor protection of a simple internet router.
Updates – Software companies are constantly working to counteract malicious entities who are continually trying to find weaknesses in their products. It is very important that companies have a way of ensuring that security updates are installed on all machines in a timely manner. Do you have a way of knowing which machines have the latest security updates and which may be missing?
Software Licensing – Although many software companies are employing user or subscription-based licensing models, I have found some companies using bootlegged, cracked or illegal software. A good network-wide software inventory, which includes licensing information will ensure that every machine has a valid license and protect your company from possible legal ramifications.
Procedures – A company’s network is an ever-changing collection of workstations, servers, routers, switches, software applications and users – each with their own purposes, security requirements and procedures. Documenting your company’s IT policies and procedures with a method of changing them when necessary will help keep your IT infrastructure organized and under your control.

Infinity Networking can help your company with any of the items on this small business IT checklist. Please contact us today for a free consultation.

Mark Flores

April 27, 2018

April 20, 2018

Upgrade or Replace?

As your network equipment gets older, technology continues to progress and businesses will need to decide if it would be smarter to upgrade their aging computers or replace them. Many businesses try to postpone or delay upgrades of their IT systems to save money, however they also need to realize that these IT systems are some of the most important assets that keep a business running. This guide will help you navigate the pros and cons of this important decision.

General Rules of Thumb – When considering what to do with an older system or aging software, there are few commonly held principles among IT professionals.

The useful life expectancy of most business computers is about 4-5 years
Most operating systems can be useful for 4-6 years or more, but they are usually supported by the manufacturer for years beyond that time
As the components of a computer get older, replacement parts become harder to find and thus more expensive
Newer operating systems and business applications require more powerful hardware to run efficiently

Reasons to Upgrade

If you purchased your system just before a new version of the operating system or a business application was released, you should take advantage of the newer version and upgrade. Some companies offer ‘software assurance’ which allows you to upgrade to a more recent version of software for free during a certain time period
If your machine’s primary function requires better hardware performance, such as accounting or graphic design applications and is not performing well, then an upgrade of the hardware (RAM, graphics, hard drive, CPU, etc.) would be advised
If you find that your hard drive space is getting used up faster than you expected and your machine is less than 5 years old, you should have a trusted computer professional upgrade your hard drive to a larger size (either through a disk-cloning procedure or a backup and restore)

Reasons to Replace

Older computers may still work fine after years of faithful service. But just like an aging automobile, it is inevitable that sooner or later an older machine will likely fail at some point and require expensive repairs or replacement. Rather than waiting for the problem to occur (and the costs of downtime and lost productivity), it is best to replace aging systems every 4 to 5 years
One of the important reasons to consider upgrading an operating system (OS) are the advancements in security that have been implemented in the more recent version. Although older OSes continue to be supplemented by security patches and hot-fixes (as long as they are still under the manufacturer’s extended support – unlike Windows XP), newer operating systems such as Windows 10 come with built in advanced security features that are designed to protect against modern IT security threats…
…Which leads to the domino-effect reason for replacement; once you have a newer OS, you may find that your existing hardware is either incompatible or under-performing, which means you will need to Upgrade or Replace

Budgeting for Success

In a seemingly never-ending cycle of IT repair, replace and upgrade expenses, the best way to prepare your company for this treadmill is by creating a realistic IT budget. In an upcoming article, I will go into more detail about how to create an IT budget as part of a comprehensive Company IT Plan. For now, take inventory of your existing workstations, servers and network devices and determine approximately when they were purchased. Choose a few of the oldest candidates and start to budget for their replacement. Six months later, rinse and repeat until you have no network devices older than 4-5 years. You will have saved your company from an inevitable headache down the road.

Mark Flores

April 20, 2018

April 18, 2018

Notes from the Field – Remote Access; a Common Threat to a Business Network

I believe that many of the IT-related issues I encounter during site visits or the advice I provide for a client based on real-world experience could be a benefit to other companies as well. This is the first installment of a continuing series of Blog posts called “Notes from the Field” – observations, advice and warnings about IT issues I have come across that may be of interest to your business.

Companies can spend thousands of dollars hardening their cyber-defenses. They may have invested in a top rated firewall appliance, employed enterprise-grade antivirus and malware protection on each workstation or they may even use comprehensive cloud-based security services. Many companies, however, have a common but often hidden security threat that they don’t even know about. And the worst part is that these threats come from within their own organization.

Almost every company for whom I provide IT support has employees who have installed Remote Access software on their workstations. In almost all cases, they have installed this software for legitimate reasons; they need access to their files from home, they wish to remotely control their machines while traveling, etc. Popular Remote Access applications include LogMeIn, Teamviewer, GoToMyPC, VNC, Windows Remote Desktop and Chrome Remote Desktop.

Although these programs may be convenient and they may even utilize strong encryption, they are also designed to bypass a company’s firewall protection unless the firewall is configured to specifically block these applications. Obviously, there are many legitimate reasons to use Remote Access software. But a company that does not monitor the use of these applications is opening doors straight into the company’s private and important data. An employee who is using a simple login and password (most Remote Access applications do not require password complexity or multi-factor authentication) can easily give full control of your business’ internal network to anyone they wish without you ever knowing. How do you feel about a terminated employee who still has back door access to the network?

Here are a few simple things that your business can do:

1) Decide on a company policy for remote network access and inform your employees.

2) Find Remote Access applications already installed on your company’s workstations. You may need to run a network security scan, a network software inventory or just go around to every workstation and check manually.

3) Configure each workstation so users cannot install their own software. This is usually done by Group Policy.

4) Configure your company’s firewall to block Remote Access applications.

5) If you do need to allow some users remote access, standardize on a commercial application that requires strong password security, includes encryption and has a way to audit usage. When a user does not need remote access any longer, uninstall the application or change the password.

If your company is concerned about hidden Remote Access applications within your network, Infinity Networking can assist you in identifying and mitigating this possible threat. Contact us today to request a network security scan.

Mark Flores

April 18, 2018

Posted by Mark Flores

Cybersecurity and Compliance is Important for All Companies

Quick Fix to Speed Up Windows 10

5 Tools for Working from Home

The Greatest Threat to your Company’s Cybersecurity