Category: information security

Posted on

Business Data Loss is a Growing Problem

The portable computer was the secret business weapon of yesterday and is today’s essential business tool. The processing power, portability, storage, and connectivity available with laptops, tablets and smartphones has created a seamless extension to the office. Business users can work with their applications and data from just about anywhere. While mobile devices are valuable when it comes to conducting business, they also pose additional security risks. Increased efficiency, mobility, and accessibility can also mean an increased potential for a data breach or business data loss.

The workforce of today is mobile enabled. Business users, owners and managers, accounting advisors and business consultants can access all the information and analytical capability they need to perform their jobs and make informed business decisions, capturing and collecting important information while keeping productivity at the highest levels no matter where they are.

“87% of businesses rely on their employees to use their personal mobile devices to access company apps”, according to a post by Perillon. Some studies have estimated that as much as 80% of the data a company has (like customer files, contracts, financial data, product specifications) might be stored on portable devices. This means that mobility comes with risk, which is why Mendelson Consulting and Noobeh cloud services utilize cloud-based platforms and services to keep data safe and secure.

According to business data loss statistics compiled by Businessdit.com, the two most common causes of data loss are hardware failure (40%) and human error (29%). Overall, malware causes 35% of all data loss, taking advantage of the 21% of files that businesses are not protecting at all.

The stats show that it takes approximately 206 days on average to even detect a data breach, the costs of downtime and losses average around $1,410 per minute for small businesses, and 22% of SMBs close after a ransomware attack.

Data loss or theft can create big business and legal problems, too. Customer or client privacy may be compromised, sensitive information may be exposed, and confidential plans may be made public if a business doesn’t take steps to secure mobile data.

“The average cost of a data breach in 2021 was $4.24 million. That’s a huge increase from the $3.86 million cost in 2020. And it’s only going to get more expensive in the future. Companies need to be prepared to deal with the fallout from a data breach, which can include everything from legal costs to damage to their reputation.”

Businessdit.com

There’s an old saying that there are only two types of businesses: those who have lost their data and those who will. Imagine the potential chaos, risk exposure, reputation damage and the expense of losing your valuable business data or having it exposed to unauthorized parties.

While computing mobility delivers a host of advantages to the business and the user, care must be taken to ensure security, privacy, and confidentiality of the business information and protecting against business data loss.

Increased exposure to liability is a reality for any mobile business, and the risk is only multiplied by the number of systems a company has in the field. Smart businesses reduce risk by deploying secure yet versatile platforms for their workers that allow data to be stored and protected in centralized environments rather than on individual computing devices.

Via the cloud, businesses of all kinds are reaping the benefits of new and innovative service delivery, achieving the freedom and functionality a mobile working model demands. Mendelson Consulting and Noobeh cloud services have the cloud solutions and managed IT services that provide the mobile capability businesses need, but with the additional protection, additional security, and ongoing management that the value of the data demands.

jm bunny feetMake sense?

J

Posted on

QBonAzure: QuickBooks on Microsoft Azure Delivers Great Success for Small Business


For any business, the resilience and agility of IT systems can mean the difference between performing adequately and performing with great success. When a business elects to run their QuickBooks applications and data on the Microsoft Azure cloud via QuickBooks on Azure (QBonAzure) from Noobeh, they gain numerous advantages not available with locally installed IT.

Microsoft Azure is a highly available platform, meaning that it has built-in redundancy to ensure that applications and data are always accessible, even in the event of a hardware failure. Businesses running on the platform never have to worry about whether or not their server is aging and may fail due to hardware issues.

The platform also allows Noobeh to easily scale each client’s system up or down as needed, without the need for additional installation work. This allows each client business to quickly respond to changes in demand and grow their operations as needed.

With Microsoft Azure, Noobeh can provide from a broad range of security features that are built-in as well as enhancing protection with advanced features and services from Azure, Microsoft 365 and more. This all goes to help protect against data breaches and unauthorized access to sensitive information.

Azure has a global footprint, with data centers in multiple regions around the world. Noobeh provides services from all US-based Microsoft Azure regions, allowing businesses to host their QuickBooks in the location closest to their users, reducing latency and improving performance.

Azure also offers a wide range of services that may be integrated with QuickBooks or other business data, such as analytics, artificial intelligence, and machine learning. This allows businesses to gain deeper insights into their financial data and make more informed decisions.

For businesses focused on compliance, Azure meets a wide range of industry standards and regulations, such as HIPAA, SOC 2, and PCI DSS. This can help businesses meet their compliance requirements and avoid penalties.

Overall, hosting QuickBooks on the Microsoft Azure platform can provide businesses with high availability, scalability, security, global reach, integration, and compliance advantages that can help them run their operations more efficiently and effectively.

Noobeh cloud services and QuickBooks on Azure utilize only the Microsoft cloud for their client deployments so that each business client has the benefits of big enterprise technology without the big enterprise price.

jm bunny feetMake Sense?
J

Posted on

4 Rules of Thumb for Better IT Security

Your business is a target. The simple fact of being in business makes it so. There are a lot of bad actors out there who will go to great lengths to get your personal and financial information, and they have many different and innovative approaches to get it. There are some small steps any business can take to make a big impact in protecting business data.

Here we present our 4 Rules of Thumb for better IT security; a starting place if you’re looking for somewhere to begin.

We can’t stress enough that every business should make it a priority to implement some basic information/technology security standards and regular employee training. Having more discussion on the subject helps everyone in the company learn and shows that management is paying attention. Remember that business data isn’t just word documents and spreadsheets. It’s banking and financial and other information, employee information like social security numbers and direct deposit info, customer, vendor information and more. For even a small business, the possibility data exposure or loss isn’t trivial.

NOOBEH cloud services works to keep your QuickBooks on Azure cloud deployment more secure in a variety of ways, but we always start with a few essential policies. These rules and policies can mean the difference between a small IT annoyance or catastrophic failure and data encryption, loss, or exfiltration. If you haven’t implemented these four essential policies in your business IT environment, today is the day to start.

  1. Always use strong passwords, at least 10 to 12 characters, and make them complex. Require passwords to be updated periodically. Don’t reuse passwords and avoid common words or phrases.
  2. Don’t let users operate with permissions greater than required. In applications, consider restricting functionality based on the role or job requirements. On servers and PCs (Windows, Mac, whatever), make sure users are operating as “standard” users rather than system administrators. When you reduce the permissions granted to users you prevent their accounts from performing possibly harmful actions in the system, like installing malware or damaging programs, modifying settings, or even creating backdoor user accounts.
  3. Control user account information and manage it closely. Simply knowing what user accounts exist can give hackers and phishers enough information to begin targeting logins and applying methods to crack them. Part of this includes making sure to remove or disable accounts for user accounts that are no longer needed. Every unused account that remains enabled is just another point of vulnerability. Protect system and administrative accounts and directories (like Microsoft Active Directory). Make certain that you only grant access to sensitive system and account information when absolutely necessary, and only to a completely trusted source. Also make sure to have at least one “break the glass” (back door) admin account you can use if the regular administrative account(s) become compromised.
  4. Limit the installed software to what is needed for the business and keep it current. Make sure operating systems and applications are up to date, and keep browsers and plugins updated to make sure they don’t become the weak link.

Cyber criminals are delivering waves of cyber-attacks that are both highly coordinated and far more advanced than ever before seen. Endpoint attacks have become complicated multi-stage operations, ransomware hits small business and enterprises alike, and stealth crypto mining got criminals into unsuspecting corporate networks. The year has been awash with massive data leaks, expensive ransomware payouts and the realization of a completely new and extremely complicated threat landscape. The bad guys have upped their threat game in a big way.

Diligence is required to help protect valuable business information assets. Following these four rules of thumb will help the business avoid becoming easy prey and can provide a foundation for greater system security and a more streamlined approach to identity management, applications and access.

jm bunny feetMake Sense?
J

Posted on

Love It or Leave It? QuickBooks Desktop Needs Internet Explorer 11 and Microsoft Uninstalls It.

We all know that software companies recommend running current versions of their frameworks and applications. Often for security reasons, software developers regularly update their products to make them more capable of avoiding or fending off attack of various kinds. New feature and integration delivery and updated compatibility requirements are also big drivers of software updates. Especially as online threats increase and attack potential skyrockets, businesses need to keep their systems updated and secure, and a regular cadence of updates and upgrades makes good sense… but only when the potential impacts of the upgrade have been thoroughly explored. With Windows 10 and 11 and the improved Edge browser (improved over IE), users are loving the enhancements and features. QuickBooks desktop users, on the other hand, might have preferred that Microsoft just leave Windows browsers alone.

The Internet Explorer 11 desktop application will be retired and go out of support on June 15, 2022

Microsoft is removing Internet Explorer 11 on some Windows 10 computers, and it doesn’t come with Windows 11. According to Microsoft:

The future of Internet Explorer (“IE”) on Windows 10 is in Microsoft Edge. What does this mean for commercial organizations, IT admins, developers, and end users? Microsoft Edge brings you a faster, more secure, and more modern web experience than Internet Explorer. Also, Microsoft Edge with Internet Explorer mode (“IE mode”), is the only browser with built-in compatibility for legacy IE-based sites and apps.

As announced today, Microsoft Edge with IE mode is officially replacing the Internet Explorer 11 desktop application on Windows 10. As a result, the Internet Explorer 11 desktop application will go out of support and be retired on June 15, 2022 for certain versions of Windows 10.

Internet Explorer 11 has been an old technology browser for many years now, so it isn’t surprising that Microsoft is moving ahead with Edge. Browsers are used for far more than just viewing static web pages or bulletin-board chat rooms, so they have grown into frameworks that support a wide variety of processes and procedures. As browsers go, IE11 just doesn’t cut it any longer. But there is a hitch that can really mess up the (literally) millions of QuickBooks desktop users out there who innocently update their computers when Microsoft pushes it via Windows update.

IE11 gets removed from the machine, but QuickBooks desktop 2021 and earlier are dependent on IE11 to run

A little dependency is unavoidable in any good relationship where cooperation and compromise are involved. But being a little too dependent on another can be unhealthy and put a lot of stress on the relationship. Dependencies are among the things to consider any time a software update or upgrade is about to be installed. What relationship does the software about to be updated have to other applications or services installed? Is the new version going to get along with the other applications on the system, or will it even run on the current system? These are the things which should be closely looked at to avoid problems post-update.

Many users are already reporting problems opening their QuickBooks desktop software due to IE being removed from their Windows 10 computers. Microsoft has announced the retirement of IE11, but most users either don’t pay attention to those notices or they don’t really understand the implications. These are among the things that Mendelson Consulting and the NOOBEH cloud services teams pay attention to for you, so that we can help you avoid the things that keep your business from doing business.

If you find that your QuickBooks desktop software will no longer run due to IE having been disabled or removed on your computer, you can link here to find instructions on how to disable and enable Internet Explorer on Windows 10. This will get IE re-installed on your computer so that you can make your QuickBooks desktop software work again.

QuickBooks Desktop 2022 versions are compatible with Windows 11 and Edge browser

QuickBooks Desktop 2022 versions, including Pro, Premier and Enterprise editions, are certified as fully compatible with Windows 11 64-bit, but only if you have installed R3 or later. Other year versions of QuickBooks (and QB 2022 desktop running a prior update release level) may experience unexpected issues including problems with browser compatibility.

What’s the benefit of modernizing if it breaks your business?

Updating application software often means also updating your operating platforms. To keep your business running smoothly, you need to make sure to keep your computers and your application software up to date. It makes no sense to fix a vulnerability in one place but leave another open. Yet sometimes your software vendors don’t do things in an order that works for you, and you end up breaking something that the business depends on. This is where companies find additional value in what Mendelson Consulting and NOOBEH cloud services offer.

For customers running their QuickBooks desktop applications on the Microsoft cloud with NOOBEH, we got you covered. Among the many benefits of working with Mendelson Consulting and NOOBEH cloud services is that we help keep your business software and systems working for you, not against you. We stay up to date with the latest changes to platforms and software systems to ensure that compatibility and performance isn’t compromised. We help businesses leave their old systems and migrate to modern, agile cloud platforms that businesses love.

jm bunny feetMake Sense?

J

Posted on

Microsoft 365: Stay Updated or Lose Connectivity and Support

Microsoft Office is a staple of business software, setting the standard for productivity applications across the globe. Unfortunately, popularity often means “target” and the bad guys out there are gunning for your system, looking for vulnerabilities they can exploit. This is among the reasons to make sure your Office applications are staying up-to-date with the latest fixes and security features. The easiest way to do this is to turn on automatic updating for Windows via Microsoft Update so that your system gets Office updates for earlier versions of Office you might have installed, such as Office 2010 or an Office volume license install.

Security updates aren’t the only reasons to keep your systems up to date. Sometimes an update addresses compatibility with other applications or services. In recent days, Microsoft has reminded businesses of the roadmap for Microsoft 365 services where certain versions of the Office and Microsoft 365 applications will stop communicating with the Office 365 and Microsoft 365 services.

Microsoft Outlook for Windows

Effective as of November 1, 2021, older versions of Outlook for Windows (starting with Outlook 2007), will be unable to connect with Office 365 and Microsoft 365 services, including hosted Exchange mailboxes. Versions that are only a little bit out of date might work, but are likely to experience connectivity issues with the back-end services. Here’s the list of retired versions of Outlook for Windows:

  • Office 2007 All Versions
  • Office 2010 All Versions
  • Office 2013 Versions prior to 15.0.4971.1000 of Office 2013 (Service Pack 1 with the October 2017 Update)
  • Office 2016 MSI Versions prior to 16.0.4600.1000 of Office 2016 (With the November 2017 Update, KB 4051890)
  • Microsoft 365 Apps for enterprise;(formerly Office 365 ProPlus) 1705 and older
  • Microsoft 365 Apps for business(formerly Office 365 Business) 1705 and older

OneDrive sync on Windows

Microsoft is now aligning the OneDrive sync on Windows systems with the Windows operating system support lifecycle policy.  In short, OneDrive sync on Windows will only be supported on supported versions of Windows beginning in January 1, 2022, If your version of Windows is no longer being supported, then the OneDrive sync on those machines will no longer receive updates or fixes of any sort.

  • Windows 7 and Windows 8.1 will be supported until January 10, 2023
  • Windows 8 reached end of support on January 12, 2016

If you are running the OneDrive sync app on Windows 8.1, you will no longer receive feature updates but will receive security fixes until January 10, 2023.

If you are running the OneDrive sync app on Windows 7 (and are participating in the Extended Security Update (ESU) program), you will continue to receive critical and important security updates until January 10, 2023. Extended Security Updates don’t include new features, customer-requested non-security updates, or design change requests.

If you are running the OneDrive sync app on Windows 8, you will no longer receive updates or fixes of any kind, as Windows 8 is no longer supported.

Businesses concerned with keeping their systems up and running should take care to ensure that PCs and servers are updated with current, supported operating systems and application software. Ignoring PC updates and Windows upgrades can create unnecessary disruption and leads to lost productivity and lost profits. For PCs, Windows 10 or 11 is the OS to be running. For Windows servers, Server 2019 is the most current version.

Mendelson Consulting’s NOOBEH Cloud Services team knows how important it is to keep your core operating software and applications current, compatible and supported. That’s why we only deploy modern servers and current operating systems on the Microsoft Cloud platform, ensuring our hosted clients have the foundation they need to keep workers performing and operations running.

jm bunny feetMake Sense?

J

Posted on

The Question You Never Want to Have to Ask

Why MFA Shouldn’t Be Optional

“Do you offer any help for decrypting files due to ransomware?”

This is a question we are asked with more frequency than ever before. And, sadly, it is often followed up with the information that their files were on “an internal server that was missed in the backup protocol by IT”.

Email phishing and brute force attacks are the most common methods cyber criminals use to get into your business network where they can set up to initiate ransomware attacks. The ransomware (malware) encrypts your data, which becomes unrecoverable without the decryption key. Usually, the only way to recover from a malware/ransomware attack is to rebuild systems and restore data from backups. If you have backups.

A “brute force” attack is typically used to get personal information such as passwords or passphrases, usernames, and Personal Identification Numbers (PINS). Scripts or specialized apps are used to carry out a string of continuous attempts to get the information desired. Cybersecurity researchers at Coveware analyzed ransomware attacks during the second quarter of 2021 and found that phishing and brute force attacks on unsecured desktops (remote and local) are among the most popular entry points for starting ransomware attacks. This is at least partly because it is relatively cheap and can be highly effective.

Phishing attacks are when cyber criminals send emails containing a malicious file attachment or hyperlink directing to a compromised website that delivers ransomware. Attacks against desktop logins include methods where cyber criminals use brute force to leverage weak or default usernames and passwords – or even get access because they got legitimate login credentials via a phishing email.

Software vulnerabilities and web-based application services are also among the popular vectors for delivering ransomware or exposing corporate networks to cyber criminals. While this type of attack is somewhat less frequent than the others, they are often leveraged by some of the most sophisticated and disruptive ransomware groups and nation/state bad actors.

  • Sodinokibi – also known as REvil – is responsible for some of the most high-profile ransomware attacks this year, including the massive ransomware attack on customers of Kaseya.
  • Contij – one of the most high-profile attacks by the group was the attack against the Irish healthcare system. Healthcare services across Ireland remained disrupted for months.
  • Avaddon – ransomware distributed via phishing emails.
  • Mespinoza and Hello Kitty are new forms of ransomware recently identified.

All of these have a common purpose in that they take advantage of weaknesses in security and exploit phishing tactics to lay the foundation for an attack on your network and possibly others.

Keeping systems updated, applying security patches and application software updates is an important aspect to keeping things secure. Known vulnerabilities can be exploited to gain access to the network, so keeping up with updates as the vendor supplies them has become more important than ever.

To help protect networks from being compromised, businesses should also apply multi-factor authentication (MFA) to desktop and applications.

MFA is an important tool to help stop intruders from breaching accounts and gaining access to the corporate network, and it can be the difference between keeping your data safe and working or discovering your files are digitally encrypted and completely unusable. Data encryption changes the data into code, and only the decryption key can read the code and return the data to a useable form. If you don’t have the key, the data typically cannot be decrypted.

Cyberattacks continue to evolve in their sophistication and frequency, and consequences of such attacks are growing. Private companies and public agencies alike must adapt their security techniques and embrace new security technologies while providing more end-user education and training.

Mendelson Consulting and NOOBEH Cloud Services take security very seriously and we have the experience and expertise to assist businesses with transforming their operations to be more efficient and effective. Our cloud team works exclusively with private tenant accounts on Microsoft Azure, and offers MFA security and other solutions to protect local and remote resources, helping keep your valuable information safe and available when you need it.

“How can we get started?” is the question you should be asking.

jm bunny feetMake Sense?
J