Cyber Security: Good, Better, Best

With some products you buy, the brand name really doesn’t matter. Socks, for example. Does anyone really care what brand of socks you wear? The answer is no – especially if you’re wearing jeans and no one can even see them. The same is true with pillow cases, in most cases, and pencils. You get the idea.

Cyber SecurityBut when you’re talking about cyber security—that’s a different story. You don’t want to experience first-hand the chaos that hackers can unleash if they’re given half a chance. If they can bring “the most technologically advanced system of government in the world” to its knees, like Russian hackers did to Estonia ten years ago, what chance does your online business have if hackers decide to target it? Only one: Trust Guard.

With such crazy cyber security threats floating around out there, might I suggest that you consider a trusted partner to do the dirty work of protecting your business while increasing your trustworthiness to online shoppers. Perhaps it would help to see an example of how Trust Guard’s Security Scanned outdoes the equivalent service of a competitor, Security Metrics.

Both of these services scan for vulnerabilities, but Trust Guard scans for more vulnerabilities and security holes and is more user-friendly than Security Metrics. Trust Guard also provides a proven security seal for your website—a small image that makes it clear to the online customer that your site has passed its security scan.

This in turn engenders trust among shoppers, which leads to more conversions. Because of the innovative methods of Trust Guard Security Scanned trust seals and scanning service, you get to enjoy an average of 15% more sales than you would without them.

Plus, Trust Guard has the best satisfaction guarantee in the industry: a 60-day double-your-money-back guarantee. How can you go wrong? So buy whatever socks or pencils float your boat. Just remember that the company that you choose to protect the your online assets needs to be not good, not better, but the best; it needs to be Trust Guard.

 

CNBC: Hackers Are Targeting School Websites

According to an article from CNBC, hackers are now targeting school websites – including elementary and high schools. Universities like Harvard and the University of Louisville have been hacked. As have state departments of education, like Indiana’s. Even elementary, junior and high schools have been attacked by cyber criminals.

I guess it just took CNBC to talk about it before people realized the dangers for students, parents, teachers and admin when accessing their schools’ websites.

The article mentions that a hacking group named “The Dark Overlord,” known for hacking Netflix, has recently been linked to a series of attacks on school districts in three different states.  CNN mentioned that in a Montana school district, for example, more than 30 schools shutdown for three days. The Wall Street Journal reports that cyber-thieves have attacked more than three dozen schools. But there have been more than that.

“Schools have long been targets for cyber-thieves and criminals,” writes the Department of Education. “We are writing to let you know of a new threat, where the criminals are seeking to extort money from school districts and other educational institutions on the threat of releasing sensitive data from student records.”

'These grades won't do at all! Go to your room, hack into your school's computer and change these!'The Department of Education says the hackers are probably targeting districts “with weak data security, or well-known vulnerabilities that enable the attackers to gain access to sensitive data.” It advises districts to conduct security audits and patch vulnerable systems, train staff on data security best practices, and review sensitive data to make sure no outside actors can access it.

According to Mary Kavaney, the chief operating officer of the Global Cyber Alliance, school environments often don’t have a lot of technology resources dedicated to security, but they could have some of the most sought after personal information on people, including social security numbers, birth dates, and medical and financial information.

The Department of Education’s letter confirmed that threats like these have now been observed multiple times, stating, “In some cases, this has included threats of violence, shaming, or bullying the children unless payment is received.”

“These attacks are being actively investigated by the FBI, and it is important to note that none of the threats of violence have thus far been judged to be credible,” explains the department. In order to protect private information that can be stolen and used for extortion, the Department of Education suggests that schools conduct security audits like those offered by Trust Guard and that they train staff and students on data security best practices like secure passwords.

Cyber crime has been happening since the creation of the internet. With more than 30,000 WordPress sites being hacked on a daily basis, schools, districts, and state education departments need to start monitoring their sites for vulnerabilities on a daily basis. If you are a student, parent or teacher, visit TrustGuard.com for more information on how to keep your private information safe.


Special thanks to these two articles for much of the content in this article:
http://money.cnn.com/2017/10/18/technology/business/hackers-schools-montana/index.html
https://www.cnbc.com/2017/10/24/department-of-education-warns-that-hackers-are-now-targeting-schools.html

 

More Hackers Are Doing More Damage

If you’re concerned about cyber security these days—and you should be—reading the headlines isn’t exactly going to give you any peace of mind. Sometimes it seems that hackers just have the upper hand.

Equifax_LogoOne such headline from TheRegister.co.uk tells us that “Energy sector biz hackers are back and badder than ever before.” Cyber security firm Symantec believes that a resurgent group of hackers dubbed “Dragonfly 2.0” poses more of a threat than ever. They were apparently behind a massive attack on the Ukraine’s electrical grid, which affected hundreds of thousands of people. The group now poses a threat to the electrical grids of Western nations.

Newsweek reports that the recent attack on HBO caused the loss of seven times more data than the Sony cyber attack, which back in 2014 gizmodo.com called possibly “the worst corporate hack in history.” The losses of data include things like employee medical records, Social Security numbers and TV show scripts.

And then there is the Equifax hack that lost personal data of 143 million people—yes, that’s a million. And the list goes on and on.

It would seem a good time to take cyber security seriously by using Trust Guard. If they’re on your side, they will scan for the more than 75,500 known vulnerabilities so any hacker-inviting weakness in your computer system can be fixed before the hackers can put you in a fix.

The name of the game is staying ahead of the bad guys, and you almost certainly can’t do that on your own. Trust Guard will also provide you with a Trust Seal for your web site so visitors can see that their personal data will be protected if they make a purchase on your site.

Don’t let your business make it on the hacking headlines; let Trust Guard worry about warding off hackers so you can focus on your business.  


Sources:
http://gizmodo.com/the-sony-pictures-hack-exposed-budgets-layoffs-and-3-1665739357/1666122168
http://www.newsweek.com/hbo-cyberattack-sony-hack-leak-game-thrones-645450
https://www.theregister.co.uk/2017/09/06/energy_sector_attacks
https://us.norton.com/internetsecurity-emerging-threats-143-million-people-exposed-in-equifax-data-breach.html?om_em_cid=hho_email_US_BLST_ACT_2017_09_databreach_Equifax

 

What You Should Know about the Equifax Breach

What: Data collected by Equifax, one of the three credit report giants, was hacked. “This is clearly a disappointing event for our company, and one that strikes at the heart of who we are and what we do. I apologize to consumers and our business customers for the concern and frustration this causes,” said Richard F. Smith, Equifax CEO, in a statement. 

When: In early August, Mandiant (a cybersecurity firm) was approached by Equifax to figure out what was going on, according to CNN News. Mandiant aided in the investigation and determined from May 13 through July 30 a spate of hacks occurred.

Who: 143 million Equifax customers have been affected. Their information, including social security numbers, addresses and birth dates were accessible by hackers.

Soon after the breach was announced to the public, Susan Mauldin, former chief security officer and Dave Webb, former chief information officer, retired.

How: Like many of these cases, the how is still a mystery. But Apache Struts, a tool used for Equifax’s online dispute portal, has become the scapegoat, being blamed for vulnerabilities, making the breach easier for hackers.

Apache Struts released this statement:

“We as the Apache Struts PMC want to make clear that the development team puts enormous efforts in securing and hardening the software we produce, and fixing problems whenever they come to our attention. In alignment with the Apache security policies, once we get notified of a possible security issue, we privately work with the reporting entity to reproduce and fix the problem…”

What you can do: If you believe you might have been impacted, visit Equifax’s Cybersecurity Incident & Important Consumer Information page: https://www.equifaxsecurity2017.com/.

What is Vulnerability Scanning?

There are different types of vulnerability scanning as well as different software for each. But what is it exactly?

A vulnerability scanner is a software or an application developed to scan computers, networks, and even websites for possible security threats. It is responsible for the analysis of how strong or weak a computer’s or a server’s defenses are. By scanning, the users and technicians will know, or at least have an overview of, what threats or issues they are dealing with in terms of the security of a network, website, computer, or server.

Vulnerability ScanningIf you are to choose the right vulnerability scanner, then you first need to know the main kinds to understand your options better. There are at least two main categories I’d like to talk about.

Network Vulnerability Scanners

These scanners are often installed into one machine and are configured to access and scan multiple computers and networks. These are programmed to detect vulnerabilities of the devices, alerting the user or an IT person if there are mis-configured settings or if the treat is coming from either a pre-installed application or a user-installed application. The network vulnerability scanner works on anything that has to do with firewalls, networks, web servers, and system administration. They deal with high-profile information but not individual files since they are not installed directly onto the host.

Hosted Vulnerability Scanners

These scanners are installed on the host (the computer or system being scanned). These types of scanners take care of the low-profile information such as passwords, operating systems of the computers they were installed in, suspicious files downloaded, and file system checks.

Despite having technology to do all the job for the security of your computer, network, servers, and everything in the cloud, it is also crucial that you understand their limitations.

Vulnerability scanners are coded software that, at some point in time, may fail to do what you expect them to do. They are programmed to take snapshots of your system’s security status at a given time. It is highly recommended that users regularly scan their devices to get the most updated (if not the exact) security status of the systems and files therein. Trust Guard currently scans for 75,575 security holes. 


JonnaArticle written by Jonna Lindawan

Jonna is a startup VA business owner who loves helping her clients grow their businesses through her skills in writing, customer service, research, data entry, transcription, social media management, and admin support. Visit her website here.

Website Security Threats and Solutions

What is website security? Is it really important? Well, if you are a business owner and you have a website or you are responsible for managing or maintaining your company’s websites, then it is definitely important that you know website security threats and solutions.

Not all IT people know everything about securing a website. Just like not all doctors know how to cure every sickness. Believe it or not, when you go to school to study programming, computer engineering, or web development, you’ll find that there’s not much in the curriculum that would tell you how to create secure codes. You are simply taught to create a code that will run a software and later in life, as you experience failures in your newly developed software, you begin to think of a solution. You then create another software or a code to combat the weak link in your existing software.

Website Security Threats and Solutions
In other words, no one is truly secure online until someone finds a 
security tool or creates a new code better than the previous one.

For beginners, learning about web security may look like an intimidating feat because of the technical verbiage and profound coding involved. But once you get an understanding of its importance and why you need to know at least the basics, you’ll love every jargon!

So what are the problems of ignoring website security threats?

  • It can put your business or personal information at risk.
  • It can jeopardize your customers’ computers if you are running an e-commerce website or your readers’ if you are running a blog. This is because viruses and malware follow loopholes in the system. They see one, they get in, then move to the next, and so forth, infecting every computer they get into until someone finally figures out something is wrong and finds a solution for it.

Where do you start?

  1.   Always make sure your website’s software is up to date.
  2.   As much as possible, do not allow uploading of files to your website as this can be a total security risk.
  3.   Use an HTTPS protocol instead of just HTTP (SSL certificates).
  4.   Use web security tools like Trust Guard’s security scanning services to check for holes used by hackers.

 

Jonna LindawanArticle written by Jonna Lindawan
Jonna is a startup VA business owner who loves helping her clients grow their businesses through her skills in writing, customer service, research, data entry, transcription, social media management, and admin support. Visit her website here.

Online Payment Security Options

Special thanks to a friend for sharing an article about online payment security options from fitsmallbusiness.com. You can read it here.

One of the initial points of the article was discussing the differences in security needed based on whether or not you used a hosted or self-hosted checkout page. The most important reason for this is to know who is responsible for scanning the site for security holes – you or the company hosting the checkout process. Here is a snippet from the article my friend shared with me:

Online payment security starts with a secure checkout. That means the order checkout forms that collect customer data are hosted securely, data is properly encrypted during transmission, and any stored payment information is protected.

There are two types of online checkouts that you can use: A self-hosted checkout or a hosted checkout.

online website securityWhat is a Self-hosted Checkout?

A self-hosted checkout collects and transmits customer payment data on your store’s servers. This puts the security risk on you and makes you responsible for managing secure data connection, transmission, and storage systems Even if you use a top e-commerce platform, you can be responsible for handling security. Not all e-commerce platforms ensure secure checkouts with every payment processor.

What is a Hosted Checkout?

With a hosted checkout, sensitive payment data is entered directly into your secure payment provider’s system via a secure, encrypted connection called SSL (secure sockets layer authentication). Simply put, sensitive data never touches your store’s servers. In some cases your e-commerce platform ensures this, in others, your payment provider makes it happen. Either way, using a hosted checkout takes the bulk of e-commerce security risks off your shoulders.

This is one reason why hosted checkout providers like Square, Paypal, and Stripe are so popular.

How do You Choose?

Wondering why anyone would choose a self-hosted checkout over a secure hosted checkout? That’s a good question. For most small online sellers, a hosted checkout delivers everything needed to process payments in a tidy, secure package. But for others, factors such as checkout customization and lower credit card processing costs can come into play. In these cases, the flexibility that self-hosted checkouts offer can be worth the security headaches.

However, even if your checkout pages are hosted, it’s always a good idea to scan and secure your website from vulnerabilities accessible by hackers. Trust Guard provides trust seals and security scanning to help you protect your site and keep it safe.

Cyber Security Can Get Personal!

In 2013, Brian Krebs taught someone a lesson in cyber security. He had earned the unwanted attention of a man calling himself The Fly, or Flycracker, later revealed to be a 26-year-old career thief named Sergey Vovnenko. Krebs tracked Vovnenko to a forum where he brokered the sale of credit card information. Krebs found out that Vovnenko was going to do his best to damage Krebs’s reputation – maybe even land him in jail.

The plan was to have heroin delivered to Krebs, then to call the police. It didn’t work out that way. Krebs called the police first, notifying them of Sergey’s plan. The heroin came a few days after he gave his statement to law enforcement. Krebs turned it over to the cops and went to work, trying to find Vovenko.

Cyber security can get personal

Vovnenko fits a profile Krebs says applies to many in the world of information crime: young, arrogant and frankly sadistic, with a chip on his shoulder. Investigators are prone to boil down credit card stealing operations and mass identity thefts to simple greed. But often, it’s much more than that. “These guys have such huge egos,” he said. “What are they after? How much is enough? You make $100 grand a month, is that not enough?”

Krebs thinks some hackers just really enjoy messing things up and attacking people or doing it as a power trip.

After Vovnenko failed to frame him, Krebs wrote about the experience in a blog post, which the Guardian republished. He says he thinks the post embarrassed Vovnenko, who then sent Krebs’s wife a funeral flower arrangement. Says Krebs, “He had it delivered to our house with a note to her, just to her, saying, ‘Dear Jennifer, you married the wrong guy, but we’ll always take care of you. Rest in peace, Brian.'” And at that point, Krebs was so mad that he really wanted to know who the jerk was.

It didn’t take Krebs long to find out that Vovnenko, just like the people he stole from, shared passwords between the administrator account on his identity theft forum, and the Gmail address he used to do his dirty work. After a little digging, Krebs learned that Vovnenko didn’t trust his fiancee and had her every keystroke logged and secretly sent to the Gmail account; in those messages was every possible personal detail about Vovnenko’s life.

Here are some of those details: Vovnenko lived in Naples, Italy. He had a son and he married his one-time untrusted fiancee. Vovnenko bought stolen Italian credit card information. He also printed and embossed credit cards on machines he owned himself and cashed out the cards through high-end Italian retailers in the fashionable city.

Krebs decided to get in touch with Vovnenko. Running organized crime was one thing; a Ukrainian running an identity theft ring and printing stolen credit cards in the Camorra’s backyard was another. The Camorra is an Italian Mafia-type crime syndicate, or secret society, located in the region of Campania and its capital Naples.

“I just reached out to him and said, ‘Hey, how’s Italy? How’s your son Max?’” Krebs recalls. “And he said ‘Ahahaha, I wait for FBI.’

“I said: ‘It’s not the FBI you have to worry about.’” Should the Camorra be displeased with Vovnenko, bad thinks were sure to happen.

Vovnenko fell afoul of Italian authorities and spent “a while” in what he called “Naples’ worst prison” in a letter of apology he wrote to Krebs. Krebs thinks Vovnenko was in a 12-step program. Vovnenko told his victim that he “forgave” him for posting a picture and Vovnenko’s address on the website “Krebs on Security” when Vovnenko was arrested.

There are many times that hackers outfool security professionals. Daily security scanning can help. And all it takes is for people like Brian Krebs and Trust Guard to help take down these criminals – even if it is one at a time. The key is to find them before it gets personal.

 


 

Special thanks to The Guardian for supplying much of the information found in this article.