#1: Communication and Collaboration Solutions

Let’s face facts… you’re going to have to be able to work with your remote workers in order to accomplish what needs to be done, so you need to make sure you have a solution that maintains open lines of communication between you and your staff. All of the solutions that a business should use to enable communications while in-house should also be leveraged by a remote workforce, including email, chat platforms, video conferencing, and Voice over Internet Protocol.

On top of that, your line of business apps and the everyday software your staff needs should be available to remote workers. A prime example of a necessary solution for your remote employees is a file sharing platform that allows your team to work side-by-side on documents and data… whether or not they’re actually side-by-side.

#2: Project Management Tools

Time management is one of the biggest challenges inherent in remote work, so giving your staff direction through project management software can help your remote workers stay on task, while keeping the team as a whole apprised of progress towards a shared goal. In this way, project management solutions can help your team more efficiently reach their objectives - while keeping all members more accountable for what they need to accomplish.

This can be a considerable benefit, especially if an employee is going from a structured office environment to the more laissez-faire arrangement that remote work provides. Looming deadlines, combined with a fluid schedule, have been known to increase work-related stress. A reliable project management solution can return some of the structure to a remote worker’s day, giving them the purpose, they need to accomplish their goals.

#3: Cybersecurity

Any of the benefits of remote work are rendered moot if this remote work leads to a breach or some other security incident. This means that your remote workforce needs to be equipped with the same cybersecurity measures that you should have protecting your business’ on-premise infrastructure.

As a result, you will want to be sure that you’re having your remote workers utilize multi-factor authentication measures, and that their solutions are equipped with fully up-to-date security software. In order to connect back to your business’ network resource, they should also be leveraging virtual private networks to fully ensure your business’ data remains secure while in transit.

In many ways, a password management system would also be classified as a cybersecurity need - especially where remote workers (and thereby, remote access) are involved. 

#4: Time-Tracking Software

Finally, you need to make sure that your remote employees are spending their time effectively, as well as that you are properly reimbursing them for their time. There are many tools to help track how time is being spent while in the office, and these tools work equally as well for remote workers.

Whether you need to track how long a task took for billing and invoicing purposes, you’re trying to optimize your workflows, or you are simply ensuring that your team is being efficient and productive, understanding how time is spent during the workday is crucial. Implementing time-tracking software for remote workers can simplify payroll, allowing you to focus on other pressing business matters.

Coleman Technologies can help you out, by introducing the solutions that will make your remote working strategy far simpler. To learn more about what we can accomplish for you, reach out to us at (604) 513-9428.

How a Company Acquires Your Data

For a company to get your data, all they really have to do is ask you for it. Think about what happens each time you make a purchase online, or even create an account—you’re handing over your contact information, and usually pairing it to one of your financial resources.

Obviously, you’re subconsciously entrusting them with this information, assuming that they will keep it sufficiently protected and secure.

Here’s the thing: not all companies are totally deserving of this trust. Quite a few companies will make some extra money by bundling their contact lists and selling them off to other companies. This is considered a common enough practice but is fortunately looked upon more and more negatively as data protection is being prioritized more.

Even if this practice goes away, you still have no control over the company’s data security practices. Consider what information of yours could be exposed if that company was to be breached:

• Your name
• Your birthday
• Your credit card information
• Your contact information

These are all forms of personally identifiable information (PII), and this isn’t even a comprehensive list of the data that these companies will collect. Plus, if they were to suffer a data breach, the onus is still on you.

One of the biggest flaws of the Internet today is the questionable privacy of any activity. Anything you do on the Internet adds to a massive data trail that describes you, from the content you’ve streamed, the messages you’ve sent, everything.

As you might imagine, there’s a lot of value to be had from this kind of data.

How to Protect Yourself by Protecting Your Data

Due to this data’s value, you must do everything you can to protect it. Here are a few good ways to start:

1. Use good passwords: Password hygiene and resiliency is the part of your online security that you have the most control over, so make sure that you aren’t taking any shortcuts that will undercut their effectiveness in protecting your accounts. Passphrases are often considered a more secure, but easier-to-remember, alternative to the password.
   
   
2. Review the Terms of Service: For each account you’ve created, you need to check the fine print to see how they are using the data you provide.
   
   
3. Track your finances: One of the most effective ways to find out if your security has been undermined is to keep an eye on your financial activities. Find a resource you can trust to give you these insights.
   
   
4. Avoid public Wi-Fi whenever possible: Public Wi-Fi signals are a favorite hunting ground for many cyberattacks. Your data plan is a much safer alternative to these.

Coleman Technologies has the experience and know-how to keep your business safe from many cyberattacks. To learn more about how we can help, reach out to us at (604) 513-9428.

Some of the best cybersecurity methods are practices developed over the past few years. This is because social engineering, specifically phishing, has become a major problem. There are billions of phishing emails sent each year, and some of those are so convincing that even people who have had some basic cybersecurity training fall victim to them. To fight this, security firms have started to look to tomorrow’s technologies to help them mitigate risk today. 

Artificial Intelligence - The Future of Cybersecurity 

One of the most effective ways of combating this rise in hacking is to use the most dynamic technology you have access to and make a tool that will help you mitigate the massive risks. One way is to reduce the effectiveness of these hacks. In this case the technology is artificial intelligence.

When we talk about artificial intelligence, we are talking about having a machine that learns as it is continually exposed to threats. This will work to solve common issues at first, but as these systems advance, and are exposed to user behaviors, they will be able to replace access management systems. Since the AI will be constantly monitoring systems, as well as user behaviors, workplace roles, and common actions, it will be able to recognize a person without, the need for password-protected accounts and creating ubiquitously secure endpoints. If the system recognized any deviations, an additional form of authentication such as biometrics would grant or deny access. 

Cost will initially be a factor for businesses, especially small and medium-sized businesses, but as large companies begin to truly trust these platforms, they will have viable endpoint-protection systems for small businesses. 

Cybercrime Accelerates with 5G

5G and beyond will bring a lot of changes to the user experience, of course, but it will also make huge changes to cybersecurity. Before long, the AI systems that are being developed to thwart today’s cyberthreats will become essential systems for the sustainability of mobile computing. Just think about how much cyberthreats have multiplied over the past decade after the jump from 3G to 4G. The jump to 5G isn’t going to any less dramatic.

It will be crucial for cybersecurity professionals to be able to leverage systems that are both ubiquitously available to search through large streams of data while also being capable of learning on the fly in order to ascertain what data is potentially malicious and what data is less so.

Luckily there are still years before these types of systems will be needed. Unfortunately, there are enough threats out there to be a major problem going forward. The IT professionals at Coleman Technologies can help you protect your hardware and data. Give us a call at (604) 513-9428 today!

The URL

Before we get into the manipulation of the URL, let’s define its parts. 

The first part of the URL is called the protocol, which tells the computing network which language is being used to communicate on said network. Most of the time, the URL will use the protocol “HTTP”. The HyperText Transfer Protocol makes it possible to exchange web pages. Other protocols that are used include File Transfer Protocol, News, and Mailto. 

The second part of the URL is the ID and password, which makes it possible to access secure servers on the network. This part is typically removed because the password will be visible and transfer unencrypted over the computer network.

The third part of the URL is the server name. It allows users to access information stored on specific servers whether through a domain or the IP address associated with the server. 

The fourth part of the URL is the port number. This number is associated with a service and tells the server what type of resources are being requested. The default port is port 80, which can be left off the URL as long as the information that is being requested is associated with port 80.

Finally, the fifth, and last, part of the URL is the path. The path gives direct access to the resources found tied to the IP (or domain).

Manipulating the URL

By manipulating parts of the URL, a hacker can gain access to web pages found on servers that they wouldn’t normally have access to. Most users will visit a website and then use the links provided by the website. This will get them to where they need to go without much problem, but it creates their own perimeters.

When a hacker wants to test the site for vulnerabilities, he’ll start by manually modifying the parameters to try different values. If the web designer hasn’t anticipated this behavior, a hacker could potentially obtain access to a typically-protected part of the website. This trial and error method, where a hacker tests directories and file extensions randomly to find important information can be automated, allowing hackers to get through whole websites in seconds. 

With this method they can try searching for directories that make it possible to control the site, scripts that reveal information about the site, or for hidden files. 

Directory traversal attacks, also known as path traversal attacks, are also popular. This is where the hacker will modify the tree structure path in a URL to force a server to access unauthorized parts of the website. On vulnerable servers, hackers will be able to move through directories simply.

What You Can Do?

Securing your server against URL attacks is important. You need to ensure that all of your software is updated with the latest threat definitions, and keeping a detailed configuration will keep users in their lanes, even those who know all the tricks. 

The IT experts at Coleman Technologies can help you keep your business’ IT infrastructure from working against you. Call us today at (604) 513-9428 for more information about how to maintain your organization’s network security.

In this blog, we do our best to give people the knowledge they need to protect themselves and their organizations while operating online. With all the digital tools that we all have come to rely on, it’s important to understand the result of a data breach on organizations and their customers. In today’s blog, we go through six of the most devastating data breaches that happened in 2023. 

T-Mobile 

At the very beginning of 2023, telecommunications giant T-Mobile announced that it had suffered what ended up being the most noteworthy data breaches of the entire year. Cybercriminals were able to use the T-Mobile API to steal data…for months. When T-Mobile found out about the attack, more than 37 million customers had their personal data exposed. Unfortunately for the company, they were the victims of a second breach only months later that cost the business more than $100 million to remediate. Overall customer names, billing addresses, phone numbers, and emails were leaked online. 

Mailchimp

Also early in 2023, digital marketing company Mailchimp discovered a data breach that affected user accounts and employee information and credentials. They were the victim of a social engineering attack that was unfortunately successful. Victims had their names, store web addresses and email addresses stolen. 

ChatGPT

One of the major innovators of AI was the victim of a serious cyberattack in March of 2023. The attack exposed the first and last names of users and their email addresses along with access to payment addresses and the last four digits of their credit cards. Open AI, ChatGPT’s parent company, was forced to take the service down briefly to address the breach.

Yum! Brands

The parent company of major fast food chains KFC, Taco Bell, and Pizza Hut was attacked in April of 2023. When it was discovered, the breach was thought to have only affected corporate data, but after careful consideration, it was found that some employee personal data was exposed in the breach. The result was stark as the company was forced to close down hundreds of locations outside of the United States and continues to pay handsomely for the breach.

Activision

One of the largest and most successful video game publishers: Activision found they were hacked in February 2023, a breach that occurred in December of 2022. The company's release schedule was unearthed and so was some employee data. A third-party security contractor found that the breach was the result of an SMS phishing attack.  Employee emails, phone numbers, salary details, and work locations were exposed in the breach.

PharMerica

In the largest data breach of a HIPAA-covered entity in 2023, the pharmacy provider PharMerica reported that 5.8 million individuals’ personal information was exposed in March of 2023. The breach was the result of a sophisticated attack carried out by the ransomware group “Money Message.” Some of the information exposed in the breach includes names, addresses, dates of birth, Social Security numbers, individual prescription information, and health insurance data. 

These are the extreme examples, but your business is just as (or more) susceptible to a data breach than any of them. That’s why you need to take your cybersecurity strategies seriously. If you would like to learn more about what you can do to keep your business as secure as it can be, including strategies for employee training, data, network security, and much more, give us a call today at (604) 513-9428.

The past few years have seen some of history’s greatest data breaches. For instance, the most notorious of these attacks, the Equifax breach, Yahoo, and Marriott-Starwood, resulted in a combined total of 3.5 billion accounts breached.

This means, statistically speaking, you would have a pretty good chance of picking a data breach victim of the past few years by randomly selecting two human beings from the entirety of planet Earth’s population.

Crunching the numbers, there has been an increase of security breaches of 67 percent since 2014.

What Does this Mean? Is Anything Secure Anymore?

Interestingly, there is a plus side to these enormous data breaches happening in the public eye, thanks to a few key points:

• It brings attention to these kinds of crimes - Thanks to disasters like the Equifax breach, more Canadians are aware of the impact of cybercrime. This kind of awareness is crucial to encouraging improved security.
• There is too much data for cybercriminals to practically use. This one can be chalked up to statistics… the more data that a given cache has, the less of a chance that your data is pulled up in an attack.

To clarify, we aren’t trying to sugarcoat the severity of a data breach, but having said that, the past few years’ cybersecurity threats have really given us all an example to consider. With new compliances, regulations, and other mandates being put into play, businesses are certainly considering these threats.

What About Small Businesses?

There is a tendency to overlook small businesses when discussing data breaches. After all, the ones that have struck large targets (like Yahoo, Target, eBay, Sony, and many others) almost always get a headline, along with the attacks that focus on municipalities, like the ones that targeted Wasaga Beach, Ontario and Midland, Ontario with ransomware.

What aren’t heard about so much, unfortunately, are the attacks that lead to much smaller companies shutting their doors for good… a side effect of the limited number of victims per attack, and the relatively casual approach that many have towards security. Unfortunately, a Verizon survey shows just how misguided the assumption that a smaller business size will protect it from threats, when 43 percent of businesses breached would be classified as small.

Security Needs to Be a Priority

Fortunately, there are ways that you can reinforce your business’ cybersecurity, especially with the help of Coleman Technologies and our experienced cybersecurity professionals. Call (604) 513-9428 to get in touch with us, so we can help evaluate and fulfill your business’ needs.

The Internet of Things is everywhere and that means that it’s important to understand how much of a potential security risk these devices can be. From smart speakers to smartphones, it's important that you understand how these devices can create problematic situations. In this week’s blog we will discuss how you can protect yourself against IoT vulnerabilities at home.

Why the IoT Is So Insecure

There are several factors to why the Internet of Things is insecure. The first is that the demand for smart devices has created a situation where manufacturers are trying to get as many devices out on the market as possible and in their haste, they don’t do enough to build secure environments. Another reason is that many people don’t have the security acumen to do the things needed to improve security for a network that features a lot of IoT devices. 

These smart devices are super useful, but if they were to be hacked, it can cause a lot of problems for you. If not secured, hackers can gain access to webcams, access your heating and lighting systems if they are connected to the Internet, gain access to account information—or even financial information, deploy malware, and even turn your smart devices into agents of chaos (also known as a botnet).

How to Secure IoT Devices on Your Network

Obviously, with so much at stake, you will want to know some actions to take to properly secure these devices. Much of what can be done are good strategies to secure your network in general. These actions include:

• Secure your router - Obviously, securing your router has a major effect on your ability to keep your network, and therefore your IoT tools, secure. You will want to change the SSID and password of your wireless network.
• Start a guest network - A great way to ensure that your IoT devices aren’t going to negatively affect your network is to create alternative networks that separate these devices from your core computing infrastructure. 
• Change all individual device passwords - This may take some time, but if security is your aim, you can do worse than actively changing every device’s login credentials and passwords frequently. 
• Use complex and unique passwords - One of the best ways to secure password-protected digital assets is to make sure to build passwords with security in mind. Use all types of different strategies including a combination of upper and lower case letters, numbers, and symbols to give yourself the best chance at maintaining security. 
• Use two-factor authentication - Adding security to your strategy, two-factor authentication can be a really useful tool; especially with IoT devices that often lack the strong security features of more complex computing devices. 

IoT is becoming increasingly important at work and at home, so doing what you can to keep from dealing with attacks and other digital issues is important. If you would like more useful security tips, or you just would like to have a conversation about how to best secure your IoT, give us a call today at (604) 513-9428.

Your business’ computing infrastructure is a pretty resilient system. It has all types of tools added on to keep malicious code, bad actors, and even sabotage from ruining the good thing you have. This reliability has led to hackers changing the way that they go about their business. Nowadays, most of the attacks that affect businesses are phishing attacks. In today’s blog we will go through the elements of a phishing attack and how you can protect your business from them.

There are really four things you have to be aware of when you are considering if you’re looking at a phishing email. Let’s go through them now:

There is a Real Sense of Urgency to the Message

While a lot of the messages that we get in business have a demanding tone, there is something extraordinarily panicked about a phishing message. Essentially, phishing messages will urge the reader to take immediate action. This action could be in the form of clicking on links, downloading attachments, or giving over credentials that the scammer will then use to infiltrate organizational computing networks to deploy malware or siphon data.

Poor Grammar and Spelling

Many of these messages are created with the notion that the reader will be fooled by the overall legitimacy of the message. Many times they are subterfuge emails sent from a would-be financial institution or an insurance carrier; some business that has legitimacy. Typically, there are signs within the message itself that are blatant signs of its illegitimacy. Variables like misspelled words, poor use of grammar, and other red flags can tip users that the message is not legitimate. 

The Domain Is Wrong for the Message

When someone sends an official email from a business, typically the domain name of the email address that is sending the email will represent the organization that the message is coming from. If the address doesn’t come from the organization that is sending the message, that is a giant red flag. Most reputable organizations pay good money to host their own domain and if the address you are getting a message from doesn’t represent that, you have to believe that it is a scam. 

Suspicious Tone to the Message

You know the type of messages that you typically get. If a message you receive doesn’t meet the criteria of “normal”, you should immediately look to verify with the presumed sender of the message that it is legitimate. If it feels off, it probably is. Make sure you get this confirmation through a different means of communication.

Phishing attacks are everywhere. If you get messages that don't feel right, don’t interact with them—follow up. For more great tips and tricks return to our blog soon. 

Small businesses have a lot to worry about in terms of technology, but one of the things that often gets overlooked is network security. Some small businesses feel that they are too small to be considered a viable target for hackers, but they are wrong; all businesses have data valuable for hackers in some form.

Imagine for a moment just how much sensitive data your business stores on its network. You have payroll records, including bank account numbers and routing numbers, personally identifiable information, contact information, and all of the details about your relations with your clients, as well. It doesn’t really matter what industry your business is in. All businesses should take security seriously. Here are some reasons why your organization should prioritize security.

Security is Proactive, Not Reactive

Imagine that your workday is disrupted by a security discrepancy that puts your entire infrastructure at risk, all because someone clicked on the wrong link in an email and downloaded an infected attachment. You now have to contend with the countless issues related to that threat. You can dodge these issues by protecting your business ahead of time so that they don’t affect you in the slightest. Imagine that same scenario, but with an adequate spam or phishing blocker. All of a sudden, that security solution paid for itself simply by preventing the downtime that clicking on such a link would cause.

Security Protects Your Business’ Future

If you were in the market for a new good or service, would you want to work with a company that doesn’t take your security and privacy seriously? This is one big reason why you need to protect your infrastructure; it protects the longevity of your organization. Businesses that let security fall to the wayside often lose clients because they don’t want to work with a business that is unreliable. When a business cannot obtain new clients due to word of mouth and online reviews soiling their reputation, that business is doomed to fail.

Security Keeps Your Bottom Line in Check

Businesses that fall victim to security threats or data breaches might become subject to fines as a result of exposing the wrong data to hackers. These fines, put in place by regulatory bodies, are preventative measures to encourage businesses to do the right thing and protect their infrastructures in a way that is consumer-friendly. These fines can be quite expensive, too, depending on the industry and the infraction. Cover all your bases now so you don’t have to pay up later down the road.

Coleman Technologies can help your business implement security solutions that work for you. We can help you implement the strategies and tools you can use to keep your business safe both now and well into the future. To learn more, call us today at (604) 513-9428.

Tesla’s Near-Sabotage

In August 2020, a Russian businessman was indicted on charges of conspiracy to intentionally cause damage to a protected computer after he attempted to recruit a current Tesla employee to install malicious software on the automaker’s Gigafactory network. 

According to court documents, the hacker, 27-year-old Egor Igorevich Kriuchkov, contacted an unnamed Tesla employee who he had previously come into contact with in 2016. Using Facebook-owned messaging app WhatsApp, Kriuchkov set a meeting with the employee on August 3, 2020. At this meeting Kriuchkov offered the employee money to help him steal data from the company with the use of malware. 

The attack was to work as follows: they would simulate a Distributed Denial of Service (DDoS) attack and with access provided by the employee, Kriuchkov and his associates would infiltrate the network and steal data, at which point, the hacking team would demand a ransom for the stolen data. 

Court documents suggest that when Kriuchkov attempted to follow up with the employee to smooth out the details, they weren’t alone in the meeting. The employee had reached out to the Federal Bureau of Investigation. The FBI surveyed the meeting, where Kriuchkov repeated the particulars of his proposed scam and admitted that his hacking collective had stolen from other companies, with the help of sitting employees. The employee also received assurances that one of his/her coworkers could be blamed for the breach. 

Ultimately, the FBI collected enough evidence against Kriuchkov to make an arrest. He now faces up to five years in prison.

This outlines just how important your employees are to your business’ data protection and cybersecurity initiatives. 

How to Minimize Insider Threats

Education is a big deal. If you want someone to do something proficiently, they’ll need training. Here are a few suggestions on how to make cybersecurity a priority to your staff. 

Build Your Company Culture Around Cybersecurity

To ensure that you have the best chance to ward off insider threats, make cybersecurity a priority. In doing so, you will unify your team’s efforts to help protect your business.

Educate Your Staff on Emerging Threats

Cybersecurity is a big issue. It’s not as if one thing will protect your network and infrastructure from all the threats it faces. To get help from your employees, you will need to commit to educating them on the threats they could encounter in their day-to-day routines. 

Train Your Staff About Cybercrime

Sure, it is helpful to train your staff on the cybersecurity best practices, but without context chances are it won’t stick. By telling them what could happen as a result of negligence, you can get their attention. The more they understand how their actions could cause major problems for your company, the more they will be diligent to ensure to do the right things.

If you would like some help figuring out your company’s security training platform, or if you need to talk to one of our consultants about getting some security tools designed specifically for your company, we can help. Call us today at (604) 513-9428.

Shadow IT
In a lot of ways, productivity is a lot like the thing it produces, money. People will do anything to get more of it. Businesses, have a plan; and, while they also want to maximize productivity and money, they typically don’t put their whole enterprise in jeopardy to get a little bit more of it. Shadow IT is the process in which an employee will download and use a piece of software that hasn’t been tested or passed by a company’s IT administrator to try and get a little more done.

Often times, the employee is just showing initiative, with no real knowledge that by downloading and utilizing a certain off-brand software that they have just put their whole business in danger. This wouldn’t be such a major deal if it was an isolated incident, but studies show that nearly 80 percent of all employees admit to utilizing software that wasn’t selected, tested, and released for use by their IT administrator. These apps may have vulnerabilities that would-be infiltrators can take advantage of. That is why it is important to utilize the software that has been vetted by the company, even if that means losing out on a bit of productivity.

Cryptojacking
There are well over 1,500 different cryptocurrencies, and in 2018 crytojacking, the strategy of using malware to use a target computer’s resources to mine for cryptocurrency was a major problem for businesses. Since this is a computationally complex task, it significantly reduces the computer’s effectiveness and longevity. As a result, cryptojacking has become en vogue for hackers and others looking to mine cryptocurrency without the investment necessary to do it.

Most studies show that the effect of cryptojacking could get way worse in 2019 since the value of cryptocurrency has fallen significantly over the past year. This means more machines mining for crypto are necessary, and thus more attacks. Users are just learning how these attacks are carried out and how to protect their business against them.

Ransomware
While there was a reported reduction in the number of ransomware cases in 2018, it still remains a major concern for any business looking to build a comprehensive network security strategy. Ransomware, of course, is a strain of malware that encrypts parts of or entire computing systems and then demands payment in cryptocurrency in a set amount of time for safe return of the files/access.

Hackers using ransomware have taken to targeting healthcare organizations’ networks for the breadth of the sensitive data they hold on them. They’ve also began to target operational technology systems, since, as with healthcare, costs of restoration of these systems (rather than payment) are prohibitive. This produces a little more urgency to get the problem resolved.

Unsecured Internet of Things
The Internet of Things keeps expanding, but so does the security threats to networks as a result of security-light devices. With more and more devices presenting security problems for businesses and individuals alike, it becomes important to ascertain exactly what devices are present on your network at any given time. Remember, even if a security-less IoT device is connected to a network-attached smartphone, it still offers up a major vulnerability.

While this is a major threat, there has been a push to improve the security of IoT devices as of late. With more security-minded companies developing useful smart products, these concerns will begin to take a back seat. But until that shift has been well documented, you’ll want to be diligent in the manner in which you utilize IoT devices.

Phishing
No business goes very long without getting some type of phishing email. In fact, it is estimated that 156 million phishing emails are sent every day, making it the most used practice by hackers everywhere. The way it works is that since most accounts are secure enough not to be guessed outright, hackers search for ways for people to help them gain access to the accounts they want to get in to. Nearly every successful cyber attack begins with a successful phishing scheme.

A specific example called business email compromise (BEC) which targets specific members of an organization is responsible for over $12 billion in losses across the globe. Once thought to be an email scam that could be mitigated with strong spam filters, today’s phishing scam is taking on a new shape by utilizing text messaging, instant messaging, phone calls, and even the seemingly-benign social media quiz to gain access to business networks.

2019 is lining up to be another stellar year for business technology, and as more tech is used, more threats come with them. If you would like any more information about how to prioritize network security, give our IT experts a call at (604) 513-9428 today.

The two vulnerabilities were patched off of Microsoft’s typical “patch Tuesday” due to the urgency. Most Microsoft patches are released on the second Tuesday of the month. The fact that these two were released ahead of time might seem like an insignificant occurrence, but the reality is this event is a major red flag.

Internet Explorer Zero-Day

The most significant patch was for a zero-day vulnerability that was found in Internet Explorer. It may be hard to believe, but people are indeed still using this antique browser to surf the web. The term zero-day suggests that the vulnerability that was discovered, had already been exploited by ill-minded cybercriminals. 

While not much information has been released on the event, Microsoft did call it a remote code execution exploit that, if accessed, could have given a user control of another user’s account. The attack requires phishing someone who is exploring the internet on Internet Explorer, and luring them onto a malicious website. Once there, an attacker would be able to gain access over the victim. 

Internet Explorer is such a forgotten browser that the event did not spark a lot of controversy. This is largely due to the fact that Internet Explorer makes up just two percent of the active market share. However, for the relatively small amount of users that continue to surf, an event like this is still a huge disaster. 

Microsoft Defender DOS Bug

The second patch that Microsoft expedited was a denial of service vulnerability in Microsoft Defender. The antivirus program comes standard in all Windows 10 PCs, and truly is the core of Windows 10’s sterling security record. 

The bug that was discovered wasn’t necessarily obvious, or easily exploitable. In order to do so, the attacker would need the ability to read, understand, and write code. Doing so would allow them to disable Windows Defender components, giving the attacker access. This would give them free rein to do whatever malicious act they chose to deploy. 

Patches aren’t optional. If you are worried about your business’ vulnerability, speak to one of our experts at Coleman Technologies. We have the know-how to keep your software up to date. Give us a call at (604) 513-9428 today! 

When security breaches and data breaches are mentioned in the same breath so often, it’s easy to look at them as one and the same. However, we want to take a moment to explain the differentiating factors between the two, as it could be all the most important for protecting your business in the future.

Defining the Security Breach

A security breach can be explained as unauthorized access to company-owned accounts. This happens when people, or other machines, gain access to an account without the appropriate authorization. This could include the device, the network, a website, a server, or any other part of your IT infrastructure.

Defining the Data Breach

Compare this to the data breach, which is a specific type of security breach that involves unauthorized access to data, like computer files or documents. This also includes the alteration and destruction of data.

Why Does This Difference Matter?

Data breaches are indeed a security breach, albeit a very specific one. However, it’s important to know the differences between the two because of the semantics involved with regulations and other data protection laws out there. There are specific definitions for what constitutes a data breach. To put this into perspective, consider this scenario; when encrypted data is accessed and stolen, would it be considered a security breach or a data breach?

And now you see where the definitions come into play. We always try to encourage our readers to avoid security breaches at all costs, which is why we recommend software like firewalls and antiviruses that can proactively prevent these types of issues. Furthermore, we also recommend that you implement patch management and routine maintenance into your technology strategy to keep these systems ready to protect your business. Combine all of this with security training and complex passwords or multi-factor authentication, and you have an adequate security system in place that can keep most threats at bay.

Coleman Technologies knows and understands your plight, and we would be happy to discuss with you what you can do to better protect your business. To learn more, call us today at (604) 513-9428.