Recommended Best Practices to Reduce Cyber Supply Chain Risks

What is a supply chain attack, and how does it affect your organization? A supply chain attack is a type of cyberattack that targets an organization's external suppliers and vendors. This can lead to financial losses, damage to reputation, and costly recovery efforts.

Cyber supply chain risk management is an essential component of any organization and is critical to maintaining order and protecting the bottom line. It involves identifying and mitigating potential risks from various sources, such as third-party vendors, their products and services, and other external factors.

By implementing best practices, organizations can mitigate the impact of a cyberattack and ensure that their security standards are met. Additionally, proactive measures can be implemented to further protect against cyberattacks, such as regular security audits and employee training. By taking the time to assess and address potential risks, organizations can reduce the likelihood of a successful attack and ensure the security of their data and resources.

Recommended Security Practices

Adopting best practices is essential in managing data, systems, software, and networks. Preventative measures are far more beneficial than reactive solutions when addressing supply chain risks. Some of these practices include:

• Having a comprehensive cyber defense strategy. This involves taking a proactive and holistic approach to protecting your business from threats within your supply chain. Focus on identifying and assessing potential vulnerabilities, implementing robust security measures to prevent attacks, and developing contingency plans in case of a breach.

• Conducting regular security awareness training. Educate all employees about how even a minor mistake on their part could severely compromise security. Train them to identify and avoid potential threats, especially those from your supply chain. Remember that drafting and implementing an effective security awareness training program should not be a one-time affair. It should take place regularly to ensure all stakeholders are on the same page.

• Implementing access control. Enabling an access control gateway allows verified users to access your business data, including those in your supply chain, and helps minimize the risk to sensitive data. Both authentication (verifying the user's identity) and authorization (verifying access to specific data) are crucial in implementing a robust access control strategy. Additionally, you can restrict access and permission for third-party programs.

• Continuously monitoring for vulnerabilities. Continuously monitoring and reviewing the various elements and activities within your supply chain can help identify and address potential security threats or vulnerabilities before a cybercriminal takes advantage of them. This can be achieved with tools and technologies, such as sensors, tracking systems, and real-time data analytics. Continuous monitoring can also help you identify and address any bottlenecks or inefficiencies in your supply chain, leading to improved efficiency and cost savings.

• Installing the latest security patches. This practice enhances security by ensuring that all systems and devices are protected against known vulnerabilities and threats. Usually, software updates that fix bugs and other vulnerabilities that hackers might exploit are included in security patches. By installing these patches promptly, you can help safeguard your business against potential attacks or disruptions and reduce the risk of other negative consequences.

• Developing an incident response strategy. An incident response strategy is a plan of action that outlines ways to handle unexpected events or disruptions, including those resulting from a supply chain attack. This strategy helps ensure that your organization is prepared to respond effectively to any potential security breaches or other issues that may arise. Some components of a supply chain incident response strategy may include identifying potential threats and vulnerabilities, establishing clear communication channels and protocols, and identifying key stakeholders who should be involved in the response process.

• Partnering with an IT service provider. Partnering with an IT service provider can help reduce supply chain vulnerabilities by providing expert support and guidance in cybersecurity, data protection, and network infrastructure. This can help reduce the risk of data breaches and other cyber threats and ensure your systems are up-to-date and secure. An IT service provider can help you implement and maintain robust security protocols and processes to help you strengthen your supply chain security and protect your business from potential threats.

Adopt these best practices before it's too late. Supply chain security is a complicated and multifaceted issue, and the best practices suggested above are the start of what you need to do to avoid security incidents. Trying to put all of these measures in place can be daunting.

One effective way to begin is by partnering with an IT service provider. They can provide the support and guidance you need to ensure your business has a secure and safe future. Don't go it alone – get in touch today and let them help you take the first steps towards a safer future.

LastPass Compromised

This week, LastPass posted more information about a recent compromise that impacted their customers, and it’s much worse than they initially thought. As reported by The Verge, hackers were able to copy customers’ databases. While these are encrypted, which should make it difficult for a hacker to actually see anything login info in your LastPass account, if you do not have a strong Master Password, it’s possible that they could brute force your password. Additionally, some reports have speculated that metadata, such as which sites the passwords were to, may have been compromised. This type of information can also be valuable, as specific information about you can be used in a Spear Phishing attack.

Using a password vault is important because it allows you to store and manage your passwords in one central location securely. This is especially important because it is common for people to use the same or similar passwords for multiple accounts, which can leave them vulnerable to security breaches. Using a password vault, you can create unique, strong passwords for each account and protect them with a single master password. This helps to reduce the risk of your accounts being compromised and keeps your personal information more secure. Additionally, password vaults often have features such as automatic password generation and two-factor authentication, which can further enhance the security of your accounts.

Unfortunately, this has been a bit of a pattern for LastPass this year, and at this point, we recommend moving off of LastPass and rotating your passwords. We recommend working with our partner, 1Password. 1Password is architected in an extremely secure way, and offers many great features.

If you would like to learn more about 1Password and how it can help your organization, or want some assistance migrating off of LastPass into 1Password, please reach out to us.

Myths About Business Cloud Backup Platforms

If you're a business owner, you've probably heard a lot of talk about cloud backups and why they're essential for protecting your data. But with all the hype and misinformation out there, it's easy to get confused about cloud backup and how it can benefit your business. In this blog post, we'll demystify some common myths about business cloud backups and explain why hiring a managed IT services company can help you implement and maintain an effective cloud backup solution.

Myth #1: A cloud backup is the same thing as storing data on a remote server

Many people assume that a cloud backup is simply a way of storing data on a remote server, but this is not the case. A cloud backup is a separate system that is designed specifically for backing up data and ensuring that it is secure and easily accessible in the event of a disaster or data loss. This means that a cloud backup is not the same thing as simply storing data on a remote server, and it provides a higher level of protection and reliability.

Myth #2: Cloud backups are expensive and only for large businesses

Another common myth about cloud backups is that they are only for large businesses with deep pockets. In reality, cloud backups can be affordable for businesses of any size, and the cost is often offset by the peace of mind and increased productivity that comes from knowing that your data is safe and secure. A managed IT services company can also help you implement a cloud backup solution tailored to your specific business needs and budget.

Myth #3: A cloud backup is a one-time process

Cloud backup is not a one-time process but rather an ongoing process requiring regular maintenance and updates to ensure your data is always protected. This is where a managed IT services company can be beneficial. By hiring a managed IT services company, you can trust that your cloud backup solution will be monitored and maintained on an ongoing basis, giving you the peace of mind that your data is always safe and secure.

In conclusion, business cloud backups are an essential tool for protecting your data and ensuring that your business can continue to operate smoothly in the event of a disaster or data loss. Despite some common misconceptions, cloud backups are affordable and effective for businesses of any size. Hiring a managed IT services company can help you implement and maintain a cloud backup solution tailored to your needs. Don't leave your business data vulnerable - consider implementing a cloud backup solution today.

Technology Budgeting 101 for Small Businesses

A new year is just around the corner, and this is a great time to work on your budget for next year.

It’s important to understand that technology shouldn't be an afterthought in today’s highly digitized world. It is essential to budget for your technology needs to continue to help innovate, protect, and accelerate your business goals.

In this blog post, we’ll explore a few key things to keep in mind while budgeting for your IT needs.

Always assess your business needs

Technology advances rapidly, and regular technology refreshes become increasingly essential for any company hoping to stay successful. Rather than simply assuming you'll need the same IT budget as last year, take the time to assess your organization’s current needs and how upgrading or moving to different platforms might help your company meet those needs.

Like most technology-backed businesses, you should allocate your IT budget to improve these areas:

Routine IT services

It’s important to start with the day-to-day support of your technology and users. Nearly every business relies on technology to run its daily operations. If the day-to-day support of that technology is neglected, chances are more significant issues will pop up down the road, and they often happen with abysmal timing. Employees also need a resource to help them with their technology to be successful at their job. Technology should help people do their jobs, not get in the way of what they are trying to do. Making sure you budget for supporting the critical technology you already need and having the budget to maintain it is an essential first step with your IT budget.

Projects

Businesses are great at planning projects and other business initiatives during the year, but the technology infrastructure to support those projects is often an afterthought. Working with IT to ensure the infrastructure and technology are in place to support the business initiatives during the year is essential.

Refreshes and upgrades

Another critical aspect of your IT budget should include refreshing or upgrading your infrastructure. Technology moves quickly, so upgrades can often have significant performance impacts.

Additionally, as equipment ages, it becomes increasingly likely that a hardware failure could lead to expensive downtime. Recent supply chain issues have exacerbated the problem, making it often difficult to replace quickly in an emergency. It is essential to work with IT to develop a lifecycle strategy for all critical technology infrastructure to prevent these potential risks and keep things running well.

Security

Nearly everything is online these days; unfortunately, cybersecurity events are happening more frequently than ever. Attackers are becoming more sophisticated, and planning for cybersecurity is becoming more necessary. The unfortunate reality is that even if cybersecurity was never a concern in the past, that does not mean you are safe from everything in the future. You don’t need to throw every security tool available into your environment. Still, you should work with IT to identify the highest cybersecurity risks to your business and begin by budgeting to address those gaps.

Accidents or incidents

Unfortunately, you can never predict everything you need during the year. It is essential to set some budget aside for things you can’t anticipate, such as accidental damage, theft, or any other things that could happen.

An IT service provider might be what you need

An IT service provider like 2Fifteen can guide you through anything IT-related, including cybersecurity, backup, compliance, budgeting, and more.

Internal support: Internal IT department or IT team

The most common type of support is through an internal IT department or IT team. Usually, businesses with a committed IT team are enterprises, while small businesses may have only one IT staff member or none at all.

External support: Outsourced IT service provider

An external IT service provider, like 2Fifteen, can support your business in multiple ways, such as assessing your IT infrastructure to formulate a plan for budgeting decisions, providing advice on the best IT solutions, and assisting with implementation and setup.

Hybrid support: A combination of internal and external IT services

If you have an existing internal IT team but have areas they cannot cover, you can outsource those areas to an external specialist.

Outsourcing your IT needs or opting for hybrid support alongside your internal IT team can reduce stress since our specialists can help lighten the load and show you the right way to prepare a budget. To get started, contact us today for a no-obligation consultation.

Why Passwords Can Be Your Business’s Weakest Point

In today's digital world, safeguarding your organization's online assets is critical. Unfortunately, poor password hygiene practices by some employees cause problems for many small businesses, leaving them vulnerable to hackers.

Cybercriminals are constantly trying to find new ways to break into business systems. Sadly, too often, they succeed thanks to weak passwords. In fact, nearly 50% of cyberattacks last year involved weak or stolen passwords.* This calls for small businesses like yours to step up and take password security seriously and implement strong password policies.

Password best practices

When your team is aware of password best practices, they can significantly ramp up your cybersecurity.

Use a password manager

One of the most important things to keep your passwords safe is to use a password manager. A password manager helps you create and store strong passwords for all your online accounts. Password managers can also help you keep track of your passwords and ensure they are unique for each account.

Implement single sign-on (SSO)

Single sign-on is a popular password solution that allows users to access multiple applications with one set of credentials. This means that you only need to remember one password to access all your online accounts.

While SSO is a convenient solution, remember that all your accounts are only as secure as your SSO password. So, if you're using SSO, make a strong, unique password that you don't use for anything else.

Avoid reusing passwords on multiple accounts

If a hacker gains access to one of your accounts, they will try to use that same password to access your other accounts. By having different passwords for different accounts, you can limit the damage that a hacker can cause.

However, avoid jotting down your passwords on a piece of paper and instead depend on a safe solution like using a reliable password manager.

Make use of multi-factor authentication (MFA)

One of the best ways to protect your online accounts is to use multi-factor authentication (MFA). In addition to your password, MFA requires you to enter a code from your phone or another device. Even if someone knows your password, this method makes it much more difficult for them to compromise your account.

While MFA is not perfect, it is a robust security measure that can assist in the protection of your online accounts. We recommend that you begin using MFA if you haven't already. If you use MFA, make sure each account has a strong and unique code.

Don’t use the information available on your social media

Many people use social media to connect with friends and family, stay up to date on current events, or share their thoughts and experiences with others. However, social media can also be a source of valuable personal information for criminals.

When creating passwords, you must avoid using information easily obtainable on your social media accounts. This includes your name, birth date, and other details that could be used to guess your password. Taking this precaution can help keep your accounts safe and secure.

An IT service provider can help you

As cyberattacks become more sophisticated, you may not be able to devote sufficient time and effort to combat them. As an IT service provider, we can help implement a Password Manager, ensure that password policies are in place to ensure strong passwords and consult with you on other ways to help keep you and your business safe. We also partner with market-leading 1Password to help businesses set up and maintain their password vaults.

Schedule a no-obligation consultation with us today to learn more about how we can help protect you from poor password hygiene, and how we can help set you and your business up with 1Password.

Now that you know how to keep your passwords safe, download our infographic by clicking here to learn how to keep your email inbox safe.

Source:

* Verizon DBIR 2022

Busting Four Popular Cybersecurity Myths

As the business world becomes increasingly digitized, you’ll have to tackle several dangers that come with doing business online. Cybercriminals nowadays have several methods to target organizations, from credential hacks to sophisticated ransomware attacks.

This is why it’s critical to think about measures to protect your organization in every possible way. If you are unfamiliar with technology and the cyber threat landscape, it might be hard to know the best strategy to protect your organization. With so much noise about cybersecurity, it can be challenging to distinguish between myth and fact. 

Understanding current and evolving technology risks, as well as the truths behind them, is critical for providing a secure direction for your business. This blog can help you with that, and after reading it, you'll have a better idea of the threat landscape and how to protect your business against it.

Cybersecurity myths debunked

Busting the top cybersecurity myths is essential to keep your business safe:

Myth #1: Cybersecurity is just one solution

There are many different aspects to cybersecurity and they’re all crucial in keeping your business safe. A robust cybersecurity posture includes several layers of defense, including employee security awareness training, physical security measures, and several layers of defenses for your network and devices. You can create a solid cybersecurity strategy for your business by considering all these measures.

Myth #2: Only large businesses become the victims of cyberattacks

Small businesses are typically not going to be targeted with sophisticated personalized attacks that you read about on the news, however, small businesses are still a big target for cybercrime. Often small businesses won’t have the resources to implement enterprise-grade tools and won’t be able to employ a team of security specialists to monitor everything happening on their network and assets, which can make them low-hanging fruit for compromise.

Myth #3: Antivirus software is enough protection

Antivirus tools only protect one dimension of security and are far from a complete solution. Only implementing antivirus software without a more complete security posture would be similar to only locking one door on a house and expecting the whole house to be secure.

Myth #4: I'm not responsible for cybersecurity

Your IT team can help implement the right tools and policies for cyber security, however, everyone in the organization needs to be involved in protecting your business from outside threats. Compromises are getting more sophisticated every day, and your employees need to be aware of what to look for in suspicious emails, downloads, or even social engineering calls. The best way to have an effective cybersecurity program is to have everyone involved.

An IT service provider can help

Cybersecurity is a critical part of any modern business, and it can be intimidating to see how much is involved in protecting your business. This is where an IT service provider, like us, can help.

We have the experience and expertise to handle matters such as cybersecurity, backup, compliance, and much more for our customers. We're always up to date on the latest security landscape and provide you with the tools and guidance you need to stay safe. Contact us today to learn more about how we can help you secure your business.

Want to learn more? Get our eBook that highlights the importance of security awareness training in your cybersecurity strategy. Download it here.

Reduce CAPTCHAs with iOS 16

One of the underrated features that launched with iOS 16 is the release of a new technology called Private Access Tokens. This is a new method for verifying the identity of a device from the internet in a secure and private way. This means websites don’t need to throw CAPTCHA challenges if they support this to try to determine if traffic is legitimate or bot-generated.

To ensure this is enabled, you can go to Settings > Apple ID > Password & Security > Automatic Verification. It should be enabled by default.

Cloudflare, one of our partners, is one of the companies that helped design and implement this technology. Read more details about it on their blog post here - How to enable Private Access Tokens in iOS 16 and stop seeing CAPTCHAs

Google Drive Quicksearch

Recently I found out that if you have the Google Drive Desktop app installed on Mac, you can invoke a quick search function that works much like Spotlight, but for your Google Drive data. I don’t know what this feature is actually called. It’s likely not quick search, but I also didn’t have anything else to call it.

If you have it installed and signed in, simply press command + option + G and it pulls up a search box.

It’s worth noting that in more recent versions of Drive Desktop, you can directly enable Spotlight indexing as well in the preferences, however I’ve had mixed luck with how well it works, and honestly for me if I’m searching for something in Drive, I know it’s there and I like having the mental separation between the two.

How to Build Trust Using Technology

To make the most of your technology to build trust with customers, employees, and other stakeholders, here are some of the most effective areas to focus on:

REPUTATION

Are you using technology from well-known and trusted vendors? Using technology that is already known and trusted in the marketplace can help you build a trustworthy reputation. Borrow from their trustworthiness to boost your own.

SECURITY

Organizational data breaches have become increasingly common in recent years, with world events making the situation worse. Protecting customer and employee data is critical to building trust. Make sure you have effective measures in place to keep sensitive information secure.

USER EXPERIENCE

Technology and processes can be harnessed to create trust-building foundations among employees, customers, and partners. For example, integrating technologies can save time and serve as a reliable foundation. Inefficient or incompatible technologies can create friction and confusion, damaging productivity. If you take the time to select and integrate the right technologies, it can make a big difference.

Similarly, thoughtful processes that consider the user experience can reduce confusion and friction and make it easier for employees to work with you.

BACKUPS, DISASTER RECOVERY, AND INCIDENT RESPONSE

It is more important than ever to ensure that your business-critical data is backed up.  Companies are relying on cloud services more than ever, which can definitely help with the resiliency of your data, but there are still scenarios where that data could be lost, damaged, or encrypted by ransomware.  We can help you determine which data is the most critical to your business, where it lives, and the best way to back up that data.  We work with you and your business needs to design a disaster recovery plan that meets the specific needs of you and your business.

COMPLIANCE

Is your business compliant with data privacy regulations? Before assuming you are, make sure with a solid foundation (like the National Institute of Standards and Technology Cybersecurity Framework or NIST CSF) and routine reporting that measures compliance. Protecting customer data is a great way to build trust.

FLEXIBILITY

Remote and hybrid work has become more and more popular over the last several years and is a trend that isn’t going anywhere any time soon. Offering employees the flexibility to work from different locations is a great way to build trust and loyalty with your organization - which can, in turn, improve the customer experience. However, you’ll need to make sure you have the necessary technologies in place to ensure that employees can work safely and provide top-notch service remotely.

Partner for success

Trust-building technology can be difficult for SMBs to handle on their own, but collaborating with an MSP like us can offload the heavy lifting. We can help with tasks like disaster recovery, compliance, security, and much more. We work as a partner with you so that you can concentrate on your day-to-day operations and big-picture business goals, safe in the knowledge that your customers' data is protected.

Interested in learning more about how we can help?

The Case for Trust-Building as a Small Business

There is a strong connection between trust and prosperity. In fact, when trust levels are high, businesses tend to grow faster. According to McKinsey and Company, Harvard Business Review, Forrester Research, and many other reputable organizations, trust is the connecting fabric upon which innovation and business success are built.

You might think that trust-building isn't crucial for small to medium-sized businesses (SMBs), but it is critical if you want to achieve your business objectives and keep your employees and customers satisfied. While you might not expect a technology company like ours to discuss trust, we care about your business objectives and believe it is essential for your people, processes, and technology.

Building trust is essential for any organization, whether it's a startup or a Fortune 500 company. It gives employees the confidence to take chances and innovate, gives customers the confidence to buy from and collaborate with you, and gives partners the confidence to do business with you. But how do you create a foundation for trust?

Leverage processes and technology

Building trust is not easy, and it often takes time and effort to develop. Luckily, there are a few things companies can do to succeed.

INTEGRATE TECHNOLOGIES

Technology integration is one of the most important considerations for businesses today. Not only do neatly integrated technologies save time and serve as a reliable foundation, but they can also reduce friction within your company. Inefficient or incompatible technologies can create chaos and confusion, slowing down workflows and damaging productivity. 

If you take the time to select and integrate the right technologies, it can make all the difference in terms of organizational efficiency and success.

DEPLOY THOUGHTFUL PROCESSES

Thoughtful processes that consider the user experience can reduce confusion and opportunities for conflict and make it easier for employees to work for you. Friction arises when an individual’s expectations do not match the actual experience. When this occurs, it can lead to conflict as people attempt to shift responsibility or blame. 

Thoughtful processes can help ensure that everyone’s expectations are met, minimizing the chances of a conflict.

SECURE DATA

When it comes to organizational data breaches, customers and employees are quick to lose trust in companies that can’t protect their sensitive data. Implementing measures to secure your customer and employee data is one way to help rebuild trust. In doing so, you are not only protecting your customers and employees, but also your bottom line.

Every day there are headlines about breaches of different companies and organizations, and the trend is only accelerating.  It’s more important than ever to ensure you are taking the appropriate steps to protect your company and customer data.

Choose the right partner

Since trust-building can be so challenging for SMBs to handle alone, collaborating with a managed service provider (MSP) like 2Fifteen is extremely beneficial. MSPs can help with tasks such as disaster recovery, compliance, security, and much more. Working with an MSP such as us will allow you to concentrate on your core competencies, safe in the knowledge that your company and customer data is protected.

Interested in learning more about how we can help?  Contact us for more information

Improved email notifications for Google Calendar invites

Over the next 2 weeks, Google will be rolling out a new layout for email calendar invitations that will provide a better view of the event, meeting information, guests, and more. Additionally, Google is adding some clarity when someone changes a calendar event, where it will more clearly call out what specifically changed.

For more information read this post on the Google Workspace Updates blog.