Category: risk management

Posted on

Considering Cybersecurity as Cloud Work Expands

When the pandemic forced many business users to move to remote work, it also forced the network security “boundary” to expand greatly and with great speed. Companies quickly adapted their tools and work so that it could be done somewhat effectively even as the employee working environment changed.  But new security models to match with new working models have not as quickly been adopted.

Business cloud workloads grew, by some estimates, as much as 20% just in the first 6 months of 2020. Yet many of those businesses electing to bring cloud working models to their business also made of the mistake of not expanding their security as they expanded the cloud network. This leaves systems and information vulnerable. Phishing, ransomware, credential theft and web app attacks have increased, catching businesses in their vulnerable states.

“In April to June of 2020 alone, security incidents increased by 188%.”

Even more than on-premises systems, it was the external cloud-based data and applications that were under attack because so many companies expanded their use of cloud services without enhanced security as part of the plan. Any expansion to include the cloud as network also significantly increases security risks. One report found that 35% of businesses made their cloud storage openly accessible to the public, allowing anyone to access it via the internet.

Don’t let your critical information be exposed or put at risk. When you begin using a cloud service, make sure to also address security for the new working mode or it could lead to lost or leaked information or a system breach.

Mendelson Consulting and NOOBEH cloud services take security very seriously. We help our clients keep their applications and data working properly and have a focus on methods to keep information safe regardless of what cloud you work on.

jm bunny feetMake Sense?

J

1 ( https://duo.com/blog/growing-security-safely-in-canada )

Posted on

Finance Department Participation in Supply Chain Management

When most businesses approach Supply Chain Management, the focus is on the item or product – the physical thing that ultimately gets delivered somewhere, somehow. What many businesses do not consider is that the orchestration and timing of “supply chain” activities can have significant impacts on financial performance, reporting and cash flow. The current processes could just be working just “okay”, and not delivering the financial benefit that might be obtained through modernization of technologies and transformations in approaches. The key is to get the right people involved.

One big aspect of seeking to integrate electronic commerce and collaboration with customers, suppliers and payment services is the recognition that supply chain activities involving orders, invoices, payments, and remittances are directly related to finances, revenue recognition and cash management.

For any project to be successful, it should include execs from both the supply chain and finance areas so that all concerns relating to event timing may be addressed to allow proper treatment in the financial statements. After all, the same things that trigger supply chain activities (orders etc) are the same documents which drive finance. When the information is accurate and timely, and when the inefficient manual processes can be replaced with electronic workflows, the business is best positioned to improve cash flow and overall financial performance as well as business value.

Unfortunately, few business owners have a real understanding of the costs associated with manual entry activities and how the direct financial impacts they have. The speed and accuracy of processing orders and invoicing customers means faster cash in, and leveraging the speed of electronic data interchange with suppliers so that “just in time” orders may be placed and logistics processes more fully enabled means cash out when necessary and not ahead of time.

“… using a digital transaction for payments allowed [businesses] to hold on to cash longer and better control the timing of the release of funds, something more difficult to control when mailing a physical check. Check fraud remains rampant across many industries. According to an AFP payment fraud and control survey, 70% of U.S. organizations reported check fraud in 2019, responsible for more than $18 billion in losses.” –

source: What Every CFO Needs to Know About Supply Chains; Study published by DiCentral and Lehigh University; 2012

For example, there are many studies which show that purchase orders that are not sent digitally are most often manually processed, and that this manual processing may be done by any number of departments in the company – but most often the job falls to finance. Rather than looking to eliminate the manual entry of data and the errors and delays that come along with it, businesses execs first looked to where the lowest labor cost rests and had them handle the extra data input.

A digital strategy that transforms inefficient manual process into efficient electronic workflows is the better solution. While many companies have approached streamlining of activities by exchanging manual entry operations for data file formatting and imports, they still have not solved the problem as would be with an integration that takes even less human time and effort.

The real goal of any business improvement effort is to improve overall business value. By bringing in finance along with supply chain execs to the “digital transformation” discussion, the business is much better positioned to make real progress in areas that directly impact cash performance as well as long-term business value. It comes down to having all the information and being able to weigh the risks against the potential rewards to be gained from the contemplated changes.

jm bunny feetMake Sense?

J

Posted on

Update your Mac to keep getting Office application updates

Microsoft’s upcoming November 2020 update has some direct impacts to users running macOS, especially if running macOS 10.31 or earlier. As of November 10, 2020, existing Microsoft 365 for Mac users running macOS 10.13 or earlier will not receive any further Office application updates. If the machine is upgraded to macOS10.14 or later, updates will be allowed to proceed on that computer.

With the Microsoft 365 for Mac November 2020 update, users running macOS must be running 10.14 Mojave or later in order to continue to receive updates for Office applications, and any new installs of Microsoft 365 for Mac will require macOS 10.14 or later.

Word, Excel, PowerPoint, Outlook and OneNote are the applications included which will no longer receive updates – including security updates – if the macOS they’re running on is too outdated.

Among the benefits of using Microsoft 365 is that the software is always kept up to date, including enhancements and new features as well as security and safety updates that help keep the software (and the associated data) more secure. You may continue with the older version of macOS, and your Office applications will continue to work. But losing out on updates not only keeps you from benefitting from the most current capabilities of the software (and getting full value from your subscription), but it also puts your security and compliance at risk.

Microsoft 365 applications are continuously updated with new features, connected services and enhancements to security. Modern operating system platforms are necessary to support some of these improvements, requiring users to update their computer operating systems as well as the applications running on them. With the Microsoft 365 November update, Mac users need to be running one of the three most recent versions of macOS to keep their Office applications recent, too.

Make Sense?

J

Posted on

Building A Solid Foundation for Business Cybersecurity

The cybersecurity threat landscape has changed dramatically in the last few years. No longer primarily a big-business concern, cybersecurity has become a key focus of businesses small and large. Attacks on SMBs are on the rise, perhaps because they represent a plentiful and often easy target. And the cost of damage and disruption to business just keeps going up.

Cybersecurity is not a problem you can simply throw a bunch of money and tools at to fix.

No matter how much great software or fancy systems you implement, the people will always be a big part of the equation. The root cause of over half the data breaches reported is a result of negligent employees or contractors.

That means that nearly half of all attacks are being executed through phishing or social engineering. The only tool you can apply to this problem is education. Efforts should be focused on security awareness and training workers to be more cautious to the point of almost being paranoid. Better to be safe than sorry in this case.

Training workers to be more careful as they work with emails, documents and websites is part of it, but there is much more to making sure the business is addressing the entire cybersecurity issue. NIST (National Institute of Standards and Technology) offers a wide variety of information and guides that businesses can use to learn more about and implement cybersecurity practices. Among these resources is the Cybersecurity Framework.

According to NIST, “the Framework focuses on using business drivers to guide cybersecurity activities and considering cybersecurity risks as part of the organization’s risk management processes.” It is a highly useful tool in helping the business align and prioritize activities with business requirements, risk tolerances and resources. The standard framework includes elements that are consistent and common across sectors and critical infrastructure, so it can be oriented to any business.

Even if the business is not prepared to delve into the details of a comprehensive cybersecurity policy and guideline, a basic outline and approach cannot be avoided without asking for disaster.

Putting this squarely into the Risk Management category, there is an ongoing process of identifying, assessing, and responding to risk situations or conditions. To manage the risk, businesses need to consider the likelihood that an event will occur and what the potential impact is as a result.

Knowing the acceptable level of risk for reaching the business objective is the risk tolerance. If a business understands its risk tolerance, the company can prioritize cybersecurity activities and make informed decisions about cybersecurity expenditures.

There are five key functions to consider as it relates to cybersecurity risk: Identification, Protection, Detection, Response and Recovery. How the business addresses each of these in the context of the systems and activities is essentially the business’s cybersecurity posture, a high-level and somewhat strategic view of the organization’s management of cybersecurity risk.

The key to building a solid foundation for  business cybersecurity practice is to establish a platform where all the business applications and data can be identified and access secured.

User desktops, productivity applications, operational software and business data can be hosted on private cloud servers, allowing the business to fully-manage data and application access. The server-based model reduces or eliminates the need to sync data to devices, and remote desktops keep user environments secure, patched and up-to-date.

Our consultants can’t write your cybersecurity policies or determine your risk tolerance, but we can help implement a solution that improves fault tolerance, resilience, and recovery.

Make Sense?

J

Posted on

Office 2013 Loses Support for Commercial Office 365 Services

If you’re not on a subscription for your Office desktop applications, you may lose access to your email box and other services.  Why? Because Microsoft announced that, effective October 13th, 2020, Office 365 services (like OneDrive, Hosted Exchange and more) will only support client connectivity from subscription clients or perpetual clients with mainstream support.

Basically this means that Office 2013 is about to be no fun any more.

You won’t be able to use Office 2013 Outlook to connect to your Microsoft-hosted Exchange mailbox, and your Word and Excel won’t connect to OneDrive.  If you are with a hosting provider who supplies your Office licenses as part of the service, cross your fingers and hope that it isn’t Office 2013. It will be pretty frustrating if your Outlook suddenly has problems accessing your Microsoft-hosted mailbox.

Like many other products, a lot of the functionality in the desktop software has been turned into web service and the Microsoft Office applications are a great example. With cloud connectivity being the focus, desktop solutions are more frequently leveraging online resources to extend and expand their capabilities. This also means they’re more frequently turning from one-time software purchases to subscription service.

After October, Microsoft’s ongoing investments in the Office 365 cloud services – including Exchange Online, SharePoint Online, and OneDrive for Business – will be made based on “post-Office 2013 requirements”.  Now is the time to migrate your Office 2013 to Microsoft 365 Apps (formerly Office 365 ProPlus). We highly recommend this move anyway, so businesses can take advantage of using their Office applications seamlessly on Azure servers as well as their local PC desktops and mobile devices.

Users of Office 2016 and Office 2019 have a little more time before their software no longer supports the cloud services. That end date is currently October 2023. You can find the support lifecycle site for Office mainstream support dates here.

It isn’t that Microsoft plans to actively block older Office clients from connecting to Office 365 services. It’s just that older applications may have performance or reliability issues when they try to connect to the constantly-updated cloud services.  Increased security risks are certain and users may even find that they are no longer compliant with certain requirements. The big thing is that Microsoft support will likely not be able to resolve issues related to unsupported connections.

The days of buying software once and running it forever are just about over.

Developers have recognized that cloud services can expand and enhance their solutions in ways that static local installation can’t. For many businesses, it becomes easier and ultimately more efficient to migrate to subscription service for IT platform and software. Azure cloud servers, for example, allow businesses to always have modern infrastructure that is more fault tolerant and agile than on-premises hardware.

Combing these benefits with software that is cloud-connected and always up to date means the business never faces lost productivity or revenues due to outdated systems or lost compatibility with newer solutions.

Make Sense?

J

Posted on

Windows Server 2012/R2 Not Aging Well, Loses Support for Microsoft 365 Apps

Lots of people loved (and continue to love and use) Windows Server 2012/R2. This Windows Server release introduced several new and improved features that made it a cornerstone of business and service provider networks worldwide. Notable improvements in virtualization with Hyper-V, along with improvements in storage, networking, remote access and server administration features, made 2012/R2 a necessary upgrade from the 2003 and 2008 versions still present in many networks.

Sadly, even though Release 2 (R2) for Server 2012 was largely a new OS due to its features and capabilities, it did not receive a new lifecycle end date and instead inherited the end dates for 2012 version. And an extended lifecycle end-date doesn’t guarantee extended usefulness or compatibility.

Windows Server 2012 began with mainstream support on October 30, 2012 and that mainstream support ended in January 2018, including for R2. Extended support for 2012/R2 goes through January 2023, but that is only if you are paying for Software Assurance for your licenses.

During this period where extended support may still be available for the OS, there is no guarantee that it will remain as a supported platform for your application software. An example of this is the Microsoft Office 365 Apps suite formerly known as ProPlus. The Office 365 apps, which include Outlook, Word, Excel, Powerpoint and more, are staples of business users worldwide. These applications are no longer supported on Windows Server 2012/R2.

Microsoft 365 Apps ended support on Windows Server 2012/R2 on January 14, 2020.

Innovative features and functionality continues to be released for the Microsoft 365 Apps and Microsoft needs to know that the platforms running the applications will work properly with those innovations. As the software is improved and new capabilities introduced, stability and performance issues can plague the install when it is running on older or unsupported operating systems.

Microsoft has pointed out that any Microsoft 365 Apps updated to version 2005 or later will result with functionality and stability problems because there are changes that are specifically not compatible with Windows 8 and Windows Server 2012.

The pace of change is increasing no matter what industry you are in. With technology adoption rates rising faster than ever in all sectors, business owners cannot rely upon outdated systems if their operations are to remain competitive. Application software as well as the operating system platforms it runs on must be regularly updated in order to provide the reliable performance and useful functionality demanded by today’s business users.

jmbunnyfeetMake Sense?

J