Scorpion Software Corp.

Hey everyone, Im excited to announce that weve released new versions of AuthAnvil: AuthAnvil Two Factor Auth v5.6 AuthAnvil Single Sign On v4.7 AuthAnvil Password Server v2.8 This release fixes several bugs and issues from the previous versions. Our engineering team also put a significant amount of work into the installers, making them more reliable to use. One of the most exciting features is that with the new version of AuthAnvil Password Server, we now have expanded the app catalog from hundreds to thousands of workflows. You can now use AuthAnvil to automatically sign in to even more of the services and websites you use every day. Of course, we still provide you with the tools to build your own custom workflows or tailor our catalog to your needs. If youd like to have us help you through the upgrade, ask your account manager or contact our support team about purchasing a pro services engagement at help.scorpionsoft.com. If youd like to view the release notes, upgrade guides, or download the installers please follow the appropriate links below. AuthAnvil Two Factor Auth v5.6 AuthAnvil Single Sign On v4.7 AuthAnvil Password Server v2.8 Thanks for using AuthAnvil, we hope you like it -Mike from the AuthAnvil team
Read More

Well, by now you will have heard the exciting news that we have joined the team at Kaseya. If you haven’t, then watch the video below. There is a lot of official jargon and joint communication that may or may not help you understand what is going on. As people in my circle of influence know I am a man of reasonable transparency. So this will be a more personal post on just what is happening at Scorpion Software. When I founded the company more than a decade ago, the goal was always to help small and mid-sized businesses to safeguard their information. For those that may remember the early days, we had a Latin phrase all over our business collateral of “Custodit Nuntium”, which loosely translates to “protect information”. It was, and continues to be, a core belief of the organization. Over the years, the threat landscape has shifted, but a core attack vector continued to remain the same. Untrusted adversaries are gaining access to sensitive corporate resources through trusted user accounts. Usually from a weak password that was shared, stolen or guessed. And it was one of the core reasons we built solutions like AuthAnvil Two Factor Auth and RWWGuard. Since then we have added a plethora of additional integrations and agents to protect everything from desktops and servers, cloud applications and Citrix/VDI implementations, on top of standard things like firewalls, VPNs, routers and network device protection. By far the most interesting integrations have been in helping IT teams, both in mid-sized businesses and through IT Service Providers, to safeguard their infrastructure and help meet IT compliance needs. We have always been selective in our clients, mostly because there is a huge gap in what I call “security ignorance” or the “ostrich syndrome”. That’s the gap in which IT professionals believe “it will never happen to me”, or “I trust my team explicitly” when it comes to properly managing identity and access control, refusing to consider putting in process and product to address the situation that could help protect their clients, and their business liability. Quite honestly, while we have been here to educate those that want to learn, we simply don’t have time or energy to debate with those individuals who are sure they know better… and then end up putting their clients at risk anyway. I could tell you horror stories we see in the field, from a disgruntled technician let go weeks earlier who completely nuked a vSphere implementation and almost killed a manufacturing company’s ability to deliver millions in product, to a technician who was so lazy he set his RMM password to “a” (because he was tired of always having to enter his password) which was compromised and allowed an adversary to seize complete control of several key client networks. The stories are boundless, but they have a common thread amongst them… by not controlling access effectively and assuring the identity of those requesting access properly, a lot of unnecessary risk is being exposed to businesses everywhere. But we saw hope. Our most successful customers seemed to follow a simple pattern. They had process in place for managing IT operations with tools like Autotask and ConnectWise. As importantly they leveraged IT automation capabilities in RMM tools like Kaseya. In fact, we continue to find our best and largest customers are almost always using Kaseya as a cornerstone of their operations. It was one of the reasons we invested more energy in such deep integration with their platform. It didn’t hurt that Kaseya is the only RMM platform that openly embraced our security work and allowed us to work with them through the rich APIs that we built together. In the last few years we expanded our capabilities to support federation for single sign-on and automated the tedious tasks in password management, going so far as to make it possible to not only store passwords, but to also go out and change them for account holders, both within Windows systems and services all the way to changing them on the web. Nothing beats hearing some of our customers being ecstatic when, after the Heartbleed incident, they were able to click a few buttons and have AuthAnvil automatically expire at-risk passwords and go out and change them for the users without their intervention. What many of you don’t know though is a lot of our work in the last few years has been on plumbing identity and access management throughout our entire solution stack. You can see small shards of that in things like our Office 365 integration in AuthAnvil Single Sign On, where you do NOT need ADFS or DirSync and still benefit from account synchronization and federation to Microsoft Online Services without having to do anything. You can see the account syncing in 2FA through ADUS, but you don’t realize behind the scenes we have been building capabilities for a universal directory that can provision and protect accounts, regardless if they are on-premise or in the cloud. Imagine having the ability to add a user in Active Directory and then seeing the account provisioned in AuthAnvil, pushed to ConnectWise or Autotask and then finally pushed into Kaseya. Take that further and imagine that the user’s devices, as they are registered, automatically becoming trusted and given capabilities to access sensitive resources without needing another password. This is the direction we have been following. Kaseya saw that vision and asked us to join them in building it into their next generation platform. This was a very unique opportunity for both the company, and for me personally. I mean, getting so see AuthAnvil used to protect the millions of endpoints that Kaseya has exposure to is exciting. Taking it to the next level, to architect the framework to deliver identity and access management for the hundreds of millions of users and devices they are building the next generation platform for, well that’s just awesome. As part of the transition, I will be moving from the CTO position at Scorpion Software to the role of “Principle Architect – Identity and Access Management” at Kaseya. In my new role, I will work...
Read More

Today I saw a tweet that was sent to us that simply asked... If 2FA isn't available, what's your thoughts on password managers? It's an interesting question. In the midst of the threat landscape that is always shifting and requiring us to change passwords on what seems to be a far too reoccurring basis... are password managers the answer? Well lets take a step back and consider what we are trying to solve for. We have places that don't support multifactor authentication (yet), and we need to use passwords. How do we manage all of them? Store them in an app on our phone? Write them down and keep them in our wallet? Keep them in excel spreadsheets? Use server based software to store them? We are going to need passwords for some time to come. So what DO we do? First off, try not to use a password to begin with. At least, not on the cloud app if we can. There are many SaaS based applications that now can support single sign-on (SSO) with federation protocols like SAML and WS-Federation. This allow you to remove the risk of password storage on the web app, and brings it back to your business infrastructure where you have better control. If you are reading this, chances are your company uses AuthAnvil, which is DESIGNED to handle SSO for you in this regard. And because it already INCLUDES two-factor authentication (2FA), it means that indirectly, you are getting the benefit of 2FA without the risks of passwords on the end site.... even if they don't support it directly. But what if 2FA and SSO are not available? Then consider using a password management system that does. Storing passwords in software that itself is not strongly protected is just plain risky. With AuthAnvil, we protect our password management solution with both SSO and 2FA. So you can choose how best to safeguard your passwords. Then there is the management of the passwords themselves. Don't select a password manager which is really nothing more than a storage system. Select a solution that actively reviews and audits access, and can actually go out and automatically CHANGE the password for you when needed. Just today I was chatting with a customer who was so happy he could immediately expire his eBay password and have it changed immediately without his intervention past clicking "Generate" within the AuthAnvil Password Server. Then I told him about the auto-expiration option... which blew his mind. He didn't realize AuthAnvil can actually be configured to automatically go out and change the password on expiration, and that you can set the expiration to as little as 1 day... which means AuthAnvil could be changing those web passwords for you every single day with an extremely complex value, reducing your window of exposure for passwords. And then you can use it with AuthAnvil Single Sign On that will inject the credentials for you so you don't even have to enter the information. Its SSO without the fuss to sites that don't have strong login security. So to @JRHand1112 I would say.... yes password managers may be the next target. So make sure you select one that includes enhanced security options to help safeguard your credentials that DO support 2FA. And make sure you select a solution that can help you manage all these passwords that are needing to be changed quickly. Hopefully in a way to work WITH SSO and automated password changing. Don't have a solution yet? Then grab our ebook on how to select a great password management solution. Hopefully you will see why AuthAnvil might be a great solution for you.
Read More

I've never been a fan of companies newsjacking vulnerabilities when it comes to computer security. In the last week though it has been interesting to see how people tackle Heartbleed, especially in the security community where everyone seems to have snake oil to heal all that ails you. The reality is that defending against the vulnerability shouldn't be the concern. Bugs are going to happen. There is no such thing as perfect security, nor perfect code. And anyone that tells you that absolute security is possible because of what they have to sell you doesn't understand security nor the money and motives that can drive the breaches to such systems. No, what SHOULD be done is the focusing on proactive security practices and incident response. We need to think more critical about is how we can avoid such issues when possible, how to HANDLE these incidents when they come to bare, and how we remediate issues as they happen. Now is a great time to have a conversation with your customers about their password management processes. How to talk to customers about how AuthAnvil can help If you are a partner reselling AuthAnvil Password Solutions, then your discussion in the midst of everything going on about Heartbleed should be about how they could be avoiding these types of issues by eliminating the need to use passwords to begin with. Start talking about how they can use federated login with AuthAnvil Single Sign On to eliminate the risk of sharing passwords with web applications. Examples like Office 365, Google Apps, Salesforce and Microsoft Dynamics are just the tip of the iceburg on discussions about how single sign-on could really help eliminate the need to use passwords to begin with. For web applications that don't support enterprise-class single sign-on, discuss how they can use AuthAnvil Single Sign On with the SSO Assistant and the AuthAnvil Password Server together to securely store credentials that get injected for them during login. Then continue that discussion to explain how password expiration and automated password changing work within AuthAnvil. In the midst of the Heartbleed risk, they could be having AuthAnvil automatically go out to the websites and change the password for them using web workflow automation. Of course, if they aren't using AuthAnvil like that yet for their B2B web app communications, this is a perfect opportunity to offer them professional services to assist them in building the web workflows and setting them up in the AuthAnvil Password Server and AuthAnvil Single Sign On portal. The consultation time to explore what web applications they use may even expose you to more opportunities when you find they could be using AuthAnvil Two Factor Auth to help lock down access, especially for cloud apps focused around virtual desktops (VDI), terminal services and information sharing. Offering AuthAnvil as a service Many of your customers aren't going to want to go deep into the tech with you. They want YOU to handle it for them. This is the perfect time to be providing them an authentication-as-a-service (AaaS) offering that demonstrates how you can organize and control all their multifactor authentication, single sign-on and password management needs. Increase revenue opportunities for you while at the same time increasing loyalty from them. If you haven't yet set that up within your business and need more information, you should grab our free eBook on the subject.
Read More

Everyone who was ever logged into any online account understands the basic premise behind providing a username with an associated password to gain entry. However, we rarely consider just how lame the process is based on the basic security it provides. Stolen or lost passwords and unauthorized access to personal data is a huge problem. Illicitly gained passwords allow instant access with login credentials, which can provide the hacker the ability to take control of an individual’s bank account, Twitter page, or whatever is being protected online. Because of this, many companies incorporated multi-factor authentication (MFA) into the process to beef up security to a much higher level. Why Multi-Factor Authentication Works Any cyber-thief that is armed with an individual’s confidential banking information can easily steal money from the online account. However, with this information the hacker has limited access in the physical world. He or she simply cannot walk up to an ATM to withdraw money, simply because they do not also have the necessary PIN (personal identification number). It is because of the second layer of credibility that the hacker is stopped in his or her tracks standing at a physical machine in an attempt to withdraw cash. It is the PIN number that provides a second factor of authentication that verifies the credibility of the user. An ATM PIN number is the easiest way to describe multi-factor authentication. It is based on two specific factors that include “something you have” (the ATM card) along with the second factor of “something you know” (the PIN). However, an additional factor could have been used instead of “something you know.” An alternative factor could include “something you are.” Many modern-day laptops and even some newer smartphones are built with fingerprint scanners that will take a biometric measurement to determine the authenticity of the user attempting to gain access into the system. Additional biometric options include facial recognition, iris scans, handwriting analysis and voice patterns. Any one of these biometric measurements is nearly impossible to duplicate, which maximizes the potential of multi-factor authentication. Multi-Factor Authentication in Smart Phones Many companies, including Google, are coming up with creative ways of using smart phones to provide a one-time access security code. By launching the application inside the smart phone, the user simply enters the code that is being currently displayed in the prompt on their laptop, desktop, or mobile device to gain access into a restricted account. Many banking institutions use a variety of cell phone-based systems as a way to verify the users making financial online transactions. Before the transaction can be approved, the bank will automatically send an instant text message to the user’s smart phone – the number that is on record – and wait for the user to enter the displayed code located within the message. However, this method of MFA has the potential of being defeated if both the connecting device (PC, laptop, etc.) and the cell phone have been breached or compromised using malware. It can also be defeated if the thief is able to change the user’s smart phone number that is on record with the banking institution. To avoid this, any online user simply needs to keep crucial antivirus safeguards up-to-date. Security Token Devices Many businesses choose to use security tokens to provide an additional verification as their method for multi-factor authentication. Typically, these hardware devices will generate a security code that continually changes. The token is synchronized with the server at the company so that they both understand the exact password that should be typed in at that specific moment. These hardware tokens are the ideal solution for many individuals that work from remote locations where phone reception might be impossible. Additional security token devices include a USB gadget that will automatically type in a single-use password with the touch of a button. Some of these devices also allow for authentication through a scanned fingerprint through the USB port. Access from Remote Locations Many workforces are now dispersed in remote locations around the world. Employees now telecommute, performing their duties at home, or on the road. Because of this, companies require basic applications that manage access into the secure regions of their intranet, or while allowing their workforce to gain access to locations across the Internet. Multi-factor authentication is the single best method to provide secure access to employees from remote locations. Overall, MFA helps to reduce any potential for a breach in security. It can be provided in a variety of ways from magnetic stripe cards, virtual tokens, one time solutions, soft tokens, audio port tokens, smart cards or access through the USB port. The future use of multi-factor authentication appears to be bright. It provides an easy solution to prevent fraudulent identity attacks and illicit actions. It can do this because it makes it extremely difficult for any hacker to siphon away crucial data or steal the information of an individual.
Read More

Two-factor authentication (2FA) is a high level security measure that is designed to safeguard against unauthorized access into a company server or online account. Many businesses require the second layer of verification to anyone that needs to gain access into the company server. The companies that utilize the features of a managed service provider (MSP) recognize that the additional layer of safeguarding can minimize the potential of breaches and compromised accounts. The Problem with Passwords There are significant problems when companies rely simply on gaining access to online accounts and their intranet using nothing more than a username/password combination. The inability of the single factor can cause major problems when hackers gain access to crucial, confidential information concerning the company’s database. Many employees either create weak passwords that are easy to guess, or complex passwords that are easy to forget. Because of that, a managed service provider will often initiate strict policies and procedures of developing a stronger password. The MSP will often incorporate a second layer of verification (multi-factor authentication) on every login to the company server or online account. The Process of MFA Multi-factor authentication is a simple concept that requires an additional layer or two of verification before allowing access into a restricted account. The single or first layer of authentication is still required with an input of the username and associated password. However, an additional layer will also be required when the user is prompted for an additional input. This can be obtained in a variety of ways including through biometric measurements (a fingerprint scan, voice pattern, etc.), a hardware token (key fob, swipe card, smart card, etc.) or through multi-factor authentication software (a smart phone software token, desktop token, etc.). Some MSPs will actually incorporate multi-factors into the authentication process by requiring two or more layers of additional input after the acceptance of the username/word password combination. Multi-Factor Authentication Software Since the launching of the first soft token, incorporating multi-factor authentication using software seems to make better sense than any other option. Biometric measurements including iris scans, voice patterns and handwriting analysis will require an additional specific device to obtain the information. Hardware tokens need to be present at all times to be utilized. However, multi-factor authentication software can be downloaded to any mobile device or desktop computer. Studies indicate that while individuals often leave their hardware token at the office, at home, or in the car, they rarely, if ever forget to bring along their smart phone, tablet or other mobile device. Every company employee will likely have access to their smart phone at all times. Because of that, companies can save a tremendous expense of providing hardware tokens or password generators to every employee by simply allowing them to use their own device (their smart phone). Incorporating multi-factor verification is not just a process of sending a one-time password as a way to gain access into a restricted account. Through SMS, text messages can be sent to a user that is out-of-band to provide verification of his or her credentials. Even DTMF verification methods are available using voice technology, as is utilized by the banking and financial industries. Sending an SMS text is not the only method for delivering single-use passwords over the phone. Some companies deliver single-use passwords through a phone call. This allows a company to extend the ability to obtain the second layer of verification on both a mobile device and a landline telephone as well. Another Advantage There is another significant advantage to using multi-factor authentication software over biometric measures and hardware tokens. The need to provide a device that can either scan a biometric measurement or produce a single-use password through a hardware token can increase the potential for failure. Should the device break at some point, or be lost or stolen, the unit is gone forever. However, software tokens generated on smart phones owned by employees will likely be available no matter what the condition of the phone. If the smart phone is lost, stolen or outdated, the employee will simply acquire a new one and gain instant access to their software application to obtain their next single-use password, at no cost to the company. Choose Wisely With all the available options for providing the second layer of authentication when verifying the credentials of an online user, it is important to choose wisely. While every method has its advantages and disadvantages, it appears as though multi-factor authentication software makes the most sense. It provides an easy solution for the company that does not have to purchase additional equipment. It offers the employee an easy way to gain access into their restricted accounts using a device they always carry with them. Whatever method is decided by the company and their managed service provider, adding the additional second layer of authentication will help maximize the security of the company’s confidential information. Want to learn more? Download our free eBook below.
Read More

What Is Social Engineering? Social engineering is typically defined as the gentle means of getting people to follow or comply with the wishes of another to gain access to information or computer systems. The ultimate goal of any individual using social engineering is to acquire information. Typically this acquired information is used to gain unauthorized access into an online system or company server in an effort to steal an identity, commit fraud, or compromise the company’s confidential information or as a way to commit some form of espionage. Why Social Engineering Works Most individuals are extremely trusting and helpful. Nearly all of us want to be a good friend, neighbor, associate or confidant. Social engineering takes advantage of basic human behavior through clever manipulation. It preys on the cooperative and helpful inclinations of human beings for an illicit use. Individuals that utilize social engineering are very good at exploiting the vulnerabilities of basic human behavior. They work on the naïveté of individuals that simply want to be liked along with the fear of doing something wrong. In spite of all the advancements in technology there is not a single system that has been created that can overcome basic human nature. Social engineers recognize that it is humans that will create passwords, utilize the computers, bank online, and enter their confidential credit card numbers when purchasing items over the Internet. The Psychology of Social Engineering Any bad individual that has skilled themselves in the techniques of social engineering has the ability to lie convincingly to obtain the information they desire. Successful social engineers generally do a significant amount of groundwork before they make the initial launch of their attack. They will typically research the enterprise or organization that has been targeted for a cyber-attack. They may gain all the names of every employee in the company along with their email accounts and phone numbers. They may incorporate various techniques utilized by most conmen that include eavesdropping, name dropping, impersonation, and flattery. They may go the other way, and pressure individuals through intimidation or by asserting “their” authority. The Techniques There are specific well used techniques that have been proven successful in gaining results through social engineering. While not every technique works on every individual, it only requires one to make the cyber-thief successful. Although these techniques are only a small sample, they include: Exploiting Familiarity – Utilizing familiarity is the easiest way to get others to follow. When the online hacker becomes familiar with an individual, nearly anyone will lower their guard. People often act and react in a different way to individuals than to strangers. The social engineer will take their time in developing a friendship, or impersonate an individual or business through emails as a way to phish for information. Developing a Hostile Situation – Developing some type of hostile situation is nothing more than a diversionary tactic. It is no different than a magician making the audience look in one hand while he or she does something in the other. Some individuals might believe that one specific action is happening when it actually is something else entirely different. Gather and Use the Information – Many social engineers use the ability to go “dumpster diving” seeking information that appears to not be valuable, but really is. They may impersonate a manager or supervisor from another branch or office to ask important or specific questions about the company, other employees or associates. They might also mimic other websites such as Google, Facebook or even a banking institution to gather information from an unsuspecting online user. Getting the Job – This tactic is built on making the individual another member of the team. The social engineer builds trust by offering the online user something they likely desire. Offering a piece of candy or reward in return for valuable information is a simple solution to gather information. Of course, the victim never really receives the reward. Reading Specific Body Language – While it is not always possible to read body language online, social engineers are very good at reading people. By using phishing scams and other baiting tools they can watch the response of individuals that are reacting to their emails or other tactics. In time, they can direct the user down a pathway where they are more likely to give up pertinent information such as passwords or critical confidential information. Social engineering works. The process has been around a lot longer than computers. For centuries, conmen have figured out ways of obtaining information from the most unsuspecting individuals. Only by becoming aware can humans avoid the tricks of social engineers and safeguard themselves from compromising confidential information that could hurt them or their company. Need a way to help defend against social engineering? With some kind of multi-factor authentication in place, a con artist would have to not only obtain a password, but also a second factor of identity. Learn more in this free eBook.
Read More

The rise in popularity of wireless technology is an indicator of the convenience this type of connection provides. There is no greater proof of the potential for wireless technology than Wi-Fi connectivity. Most desktops, laptops, netbooks, tablets and mobile devices sold today are manufactured with all the necessary components to connect to the Internet, through wireless LAN technology. Many of the road warriors that travel on business for their company, students that enjoy doing homework off-campus and individuals visiting the local coffee shop all use the public Wi-Fi. The level of convenience it provides to easily connect through an open Wi-Fi system in a hotel, café, or other area in the public can be immeasurable at times. In all, there are significant advantages and major disadvantages that can provide both positive and negative results. The Advantages of a Public Wi-Fi System The significant advantages of connecting through a public Wi-Fi system to gain access to the Internet are numerous. Some of those include: Convenience – Public Wi-Fi wireless technology provides instant Internet access for business or personal use, from a huge assortment of convenient locations. These locations can be found in suburban and urban areas at hotels, airports, coffee shops, libraries and others. At many of these locations, the connection is free. Mobility – It has only been within the last decade that people can have Internet access outside their home or work environment. Mobile technology has made online connections available on nearly any device including smartphones. This provides huge flexibility and efficiency. Increased Productivity – In the workplace, businesses recognize the increased levels of productivity when employees can accomplish their duties outside of the office from many convenient locations. This provides the opportunity to keep in contact with the main office during the workday, or while traveling in any location around the world that has Internet connections. Deployment – In the old days, before wireless technology, Internet users could only gain access to online connections using physical cables. Today, however, the deployment system of wireless networks necessitates only a single access point that can be instantaneous when pre-set. Costs and Expandability – The cost of hardware to connect to the Internet is minimal. It is now provided in nearly every type of computer and mobile device automatically. The cost of connecting to a public Wi-Fi depends on various factors. Hotels typically charge their visiting guests a daily amount, while coffee shops, libraries and other public places offer the connection for free. The Disadvantages of a Public Wi-Fi System The significant disadvantages of connecting through a public Wi-Fi system can be substantial. An unsecured connection can cause irreparable harm to a business if the company server has been compromised from an online hacker. Other major disadvantages have to do with the inherent limiting capabilities of the technology itself. All of these include: Low-Level Security – While it is easy to set up a second layer of security on a private network system by involving a high-level form of encryption technology, a public Wi-Fi connection is built to be open. This inherent weakness in the system is easy to compromise, leaving every connected user at a disadvantage to anyone wanting to do harm. Limited Range – When standard equipment is utilized, the average range of a traditional 802.11g network system typically only has a range of 100 feet or less. While this type of range is more than sufficient for an average size house, it can put significant strains on any structure that is larger. To achieve optimal range, the provider will need to offer additional points to access or build in repeaters, which can be expensive. Reliability – Transmitting on radio frequencies, the wireless network system continually has the potential for numerous types of interference as well as other complex broadcast effects that are simply beyond the network administrator’s control. Speed – Wired connected devices through the network system can achieve 100 Mbps and upwards to 10 Gbps. Alternatively, most standard wireless networks can achieve between 1 and 54 Mbps, which is significantly slower. Many individuals are either out of touch or unaware of the problematic security issues concerning public Wi-Fi. It is extremely easy for a hacker to steal username/password combinations and breach the accounts of the user, even after they have disconnected from the public Wi-Fi. In addition to that, it is easy for a cyber-hacker to pose as a public Wi-Fi hotspot and trick the user in a variety of ways, including a man in the middle attack, to steal the user’s credentials. One way around this problem is to incorporate VPN (virtual private network) technology, and only logging into secured sites. Using multi-factor authentication solutions also serve to help create an additional layer of protection when connecting to a public Wi-Fi. There are many individuals that prey on others connected to a public network, to steal information or gain access into a company’s intranet.
Read More

Small to medium-sized businesses are quickly becoming Internet dependent and utilizing the services of the cloud to pass information back and forth. Through payment processing and data hosting, smaller businesses are seeing the value of using managed service providers (MSPs) to help run their company. The MSP can help maximize security when accepting electronic payments using the Internet. With mobile technology coming to the forefront, many businesses have developed new models and applications as a way to gain consumer trust in buying products and services online. However, it is imperative that MSPs educate their retail clients to build and maintain a strong commitment to security. This will help ensure compliance when safeguarding crucial, confidential information concerning their customer base. Many businesses turn to MSPs to maintain compliance and reduce the risks involved in doing business over the Internet. Companies that operate primarily as a merchant will understand how a managed service provider can maintain the scope of compliance when dealing with PCI DSS (Payment Credit Card Industry Data Security Standard). The service provider is expected to maintain the standards when they are involved in the transmission, storage, and processing of all debit and credit card holder information. This includes providing services that manage and control the information. It could also be a company that might have an impact on the security of the data. The MSP’s Safeguard Responsibilities In an effort to maintain the highest standards of security levels many MSPs will complete an audit at the PCI level I to validate their compliance status. The MSP will use a qualified security assessor (QSA) to demonstrate their durable security posture when protecting critical data for the client. The Client’s Safeguard Responsibilities It is imperative that the managed service provider maintain the highest level of safeguarding, protecting and managing crucial, confidential customer information. However, it is just as important to educate the retail clients to act responsibly when maintaining their end of the deal. This requires developing strong passwords and other viable second level (two-factor) authentication verifications when logging on to their intranet, extranet, or POS system. How to Educate The managed service provider fully manages of all the connections from the company intranet server to the MSP servers. The managed service provider however does not have control over the protection of passwords at the employee level. It is imperative to educate the retail client that every member of the team must develop, create, maintain and safeguard their password/username combinations to ensure no unauthorized access is obtained to the server. Additionally, it is the responsibility of the managed service provider to develop a standard where only strong passwords are accepted from the employee. By developing strong protocols, the MSP might set up a system that only accepts a combination of uppercase and lowercase letters in combination with numbers and symbols. By building a password on mnemonics, the first layer of authentication can remain secure. However, a single layer of authentication is never enough. The MSP must offer viable solutions of providing two-factor authentication that might include hardware or software solutions. These solutions could include: USB Tokens – Utilized for providing an instant logon credential, USB tokens work well in identifying the user, unless the token is stolen. Magnetic Stripe Cards – These smartcards are no larger than a credit card and hold credential information for logging on to an account. Wireless Tokens – A wireless token holds the same information as a smart card but uses RFID or Bluetooth technology to communicate wirelessly. Key Fobs– Often referred to as a “disconnected token”, these “tokens with the display” are usually an authentication token that fits comfortably in a pocket. Its functionality is based on either a time-based, or event-based list of values. Soft Tokens – Similar to a virtual token, a soft token can be utilized on both a PC and a smart phone. Smart Phone Tokens – A smartphone token is available in a variety of different options that include: Smart Phone Push Mobile Applications Mobile Signature SMS One Time Passwords Assignment to the Bearer Biometrics – A biometric system utilizes a technology of scanning an iris or fingerprint. Some biometric systems are built on facial recognition software technology or pattern technology. The software can recognize how an individual types, moves, blinks or other basic features of movement. With changing technology, and the increase of cyber-attacks from all corners of the earth, it is important that MSPs educate their clients on managing and protecting their connectivity across the Internet. Adding an additional layer of built-in, multi-factor authentication security can empower both the MSP and the client while safeguarding confidential, critical information concerning online retail sales. Struggling with PCI compliance? Check out this free whitepaper that will show you how to use AuthAnvil to fulfil the strong authentication requirements of PCI.
Read More

It was not that many years ago when securing a remote access line into the company server was a privilege for a chosen few, such as executives, the sales force, telecommuters and road warriors. However, the rise in popularity of mobile devices including tablets and smart phones, and lightweight laptops, allows access to a high-speed Internet connection from nearly anywhere. Companies are quickly seeing the advantage of having their staff perform duties out of the office using an instant remote connection to the company server. Studies indicate that well over 60% of the workforce in Europe and North America that handle information routinely perform at least a portion of their work using remote access. Some companies insist that their employees work at home as much as possible. As a response, employees find themselves doing work from coffee shops, restaurants, and hotels. Giving every employee the ability to tap in to confidential information increases productivity. However, is remote access safe? Generally, remote access allows online users to stay connected to networks using an unsecured environment, like the Internet. Remote access can be safe if the user from a distant location works within the network itself, gaining access through some pre-authorized privilege. Many office networks allow remote access set up to provide a portal for their workforce to perform their duties at home or some remote location. While there are significant advantages of working from a remote location, there are specific safety concerns that need to be considered. Safeguarding against Malware Nearly all types of remote access is performed over the Internet. It allows the connection from a remote location into the office network. However, it also can generate a high level security threat if malware, viruses, worms, or trojans can easily piggyback into the network across the transmitted lines. Sometimes, anti-virus software is simply not enough to safeguard against any intruder eager to gain unauthorized access. Protecting against Unwanted Applications Another concern over security issues using remote access is allowing the employee to utilize office network bandwidth to acquire unwanted applications, or simply for their personal use. Any online user remotely connected to the server can download and operate applications that automatically run in the background. This might include video or music streaming applications that can easily eat up the network’s bandwidth. It adds additional unwanted traffic across the network and can at times bring with it viruses or malware. Stealing Confidential Data The most detrimental component to allowing remote access into the office network is the ability for others to steal confidential data. This can happen in various ways including directly and indirectly. Security administrators in charge of the network can set restrictions and limit the remote user’s ability to access only low-level information. Another problem to consider is the ability to transmit confidential data to a remote computer or mobile device, to be stored at an off-site location. Whether on purpose or not, employees can copy pertinent confidential information, store it on their own device, and leave it open to an unprotected environment. Safeguarding against Hackers Hackers and cyber-thieves work to intercept transmissions from the remote user to the office network. Sometimes the network and the remote user have no idea that the authorized identity has been compromised. Without proper safeguards and protocols in place, documents, files and other pertinent information can easily be compromised by a hacker that is willing to exploit the data. What to Do There is a specific route that every company can take to completely safeguard the remote access activity of their workforce. Hiring the services of a managed service provider (MSP) allows the company to utilize the best safeguarding equipment available. MSPs will set up a VPN (virtual private network) on the office network system and transmit all remote activity through their own servers. Giving control over to the MSP ensures that only authorized users can gain access to the company server. The MSP will also use the most advanced encryption technology to ensure that hackers and cyber attackers cannot intercept transmitted information. Additionally, a managed service provider will likely set up multiple layers of access safeguards such as multi-factor authentication. Requiring a second or third level of identification when logging in will assure the company that only authorized users are gaining access from a remote location. The managed service provider will set up guidelines, protocols and safeguards to ensure that security is always in full force. This will avoid eavesdropping and unauthorized access no matter where the employee is logging in. With the ongoing need to allow employees to telecommute, or gain access to the office network from a remote location, it is imperative that every company utilize the benefits offered by a managed service provider. Productivity from the workforce will remain high anytime an employee has the opportunity to work from any location they please. Want to learn more about what makes a proper multi-factor auth solution? Download our free eBook below.
Read More

Connecting to the Internet through the company server is extremely integral to the process of conducting business. For small or large companies, there is often not much time to manage personnel. The hectic pace of most businesses often makes the management staff leave their employees to perform their duties independently. Whether the employees, supervisors and management staff at the company are using the computers to do work for the company, or check their personal emails, they must follow the rules. However, the only way to ensure that the rules are being met is to have strict policies firmly in place. Internet usage policies are crucial to the security and reputation of the company. Every business that utilizes computers in any capacity needs them. These policies need to be written down. Only then can every employee read them, understand them, accept them and finally sign the document agreeing to its use. Not only should this happen on the first day of their job, but the policies should be reviewed and updated, so they can be agreed to as necessary. It should be the strict policy of the company to make every employee sign an effective Internet use policy. This will show them that the company means business and that any access to the Internet must adhere to strict protocol. Effective Internet usage policies will include any and all appropriate behavior concerning online browsing through the company servers. This includes in the workplace, or from any remote location when tapping into the company intranet. An effective policy concerning personal use will detail any time restrictions that the employee is allowed to browse online, for any tasks that are not directly related to work. Additionally, the policy should include a clear understanding of acceptable websites that can be browsed and viewed. This should be clearly stated in the company AUP (acceptable use policy). Not only does this effective policy maintain integrity in the workplace, but it maximizes the security of the network infrastructure. Included in the Policy Creating an effective Internet usage policy is typically the responsibility of the IT department and human resources. Their combined efforts will ensure protection for both the company network infrastructure, and the employee. Through collaboration, an effective policy can be formulated and enforced, that is strong enough to meet the company’s needs. It is important that every employee understands that the policy is not designed as a way to snoop into their personal lives, or deny them any rights to online access. The rules, policies and guidelines help minimize any potential for legal ramifications, security breaches, or inappropriate behavior at work. Highly-developed Internet usage policies should also be created as a way to educate every online employee of all of the Internet threats and the ramifications that can be created through irresponsible web browsing. It should include details of exactly how malicious malware, viruses and worms can be downloaded unknowingly into the company servers, which could infect the entire network system. Part of the policy should include a training session about all the security aspects of connecting to the Internet. Every employee should understand specifically how their actions at the workstation, or through any remote location, could be extremely detrimental to the business network system should these protocols and policies not be followed. Making a Clear Distinction There needs to be a clear and concise distinction between using the Internet for work or for personal use. For many businesses, the Internet serves as a valuable tool and provides many advantages to the day-to-day operations of many company employees. Significant issues often arise when employees are allowed uncontrolled access to social media sites, individual email accounts, and auction websites. Any excessive personal use of the Internet while at work can create an environment where the employee shuns their responsibilities. This often diminishes their productivity. Without the proper guidelines set firmly in place, it is extremely easy for any employee to download attachments or software into the company workstation via the business infrastructure. This raises the potential for a harmful virus infection throughout the entire company network. An effective high security level Internet usage policy designed to help the company should not make the employee feel they are not to be trusted. It is often better to create a policy that allows access that is time-controlled, if it poses no moral or ethical issues. This is better than simply blocking personal Internet accessibility altogether. Many businesses see the advantage of not allowing any instant messenger, unless it is used for company business. The enforcement of quality Internet usage policies can maintain work productivity, while safeguarding the company infrastructure. The policy should be developed for anyone in the work environment that has access to the Internet. If there are no extenuating circumstances at the company level, it is usually recommended that the policy be designed to pertain to everyone. Ready to learn more? Download this free eBook and learn the effects that Cybercrime can have on small business.
Read More

For a very long time there has been much uncertainty and fear about doing business over the Internet using cloud computing technology. Much of the doubt has arisen due to misinformation or lack of knowledge on the subject. Since the beginning of time, humans have built the foundation of their relationships on trust. In the modern world, our societies could not conduct business without trust. We base everything we do on being safe in our environments that includes how we travel, and how we protect ourselves against disease. For business owners, trusting the intangible can be challenging. Using cloud computing technology requires a level of certainty that the confidential information which is being transmitted out to the world remains fully protected throughout the entire process. Alleviating Skepticism The lack of trust and high level of skepticism should be expected in both the service and manufacturing industries. The distrust of safeguarded cloud computing technology is realized in the failures and breaches of Microsoft, Google, Apple, Amazon and others. Even with these considerations, cloud computing technology is slowly turning the corner and is being recognized for the many benefits it provides. Many medium and large sized businesses have incorporated specific tactics as a way to gain trust in cloud computing. These include: A Service Level Agreement (SLA) – As more businesses make their way into the world of cloud computing technology, many service level agreements between managed service providers (MSPs), and their clientele have gotten stronger. These strong, high level SLAs have highly defined privacy procedures, to ensure that all performance measurements are tied specifically to safeguard strategies of the company. Global Privacy Regulations – Much of the distrust of cloud computing technology arose from not understanding where the confidential company data is being stored. One avenue to circumvent this problem was the development of strong global privacy regulations that could effectively deal with data flow restrictions across borders. Many of these regulations incorporate in-country compliance when maintaining security, and confidentiality of the company’s data. Pilot Test Models – One of the ways larger companies help build the trust in using cloud computing technology is to run their own pilot program as a way to test the cloud provider. This often involves a record extraction so that the company can quickly recover their data in the event the relationship between them and the cloud provider turns sour, resulting in a lockdown from the vendor. Building Trust – One of the quickest ways to help build the trust in cloud computing technology is typically demonstrated by what the cloud provider can offer. More than just automating mundane processes in the company, the cloud provider can use their extensive knowledge and expertise to enhance the company’s IT strategy, saving them time and money, while enhancing productivity and profits. The idea of turning over the majority of the IT department has often confused business owners and CEOs. Outsourcing the most critical and sensitive information in the company to others seems counterintuitive. However, there are specific benefits other than just the reduced cost of an in-house IT department including a higher level of service, better continuity, and fully enhanced security. These are usually three specific in-house IT department components that are difficult for a company to maintain on their own. Location The exact location where all the data in service is being stored and utilized in the cloud is extremely crucial. Many businesses follow compliant regulations that require that all of their information remain within the country of service. Any analysis, or transfer of data generated within the United States should be performed and stored within the boundaries of the country. The same is true for any business in South America, Europe, Asia, or any other country on the planet. Dealing with Security It is hardly a secret that doing anything online has its own inherent risk. Exposing any confidential data over a public Internet is quite similar to simply leaving it taped to the front door of the business. While nearly every passerby will simply ignore it, others will see an opportunity from its value. However, with recent advancements, most cloud providers use highly encrypted technology, virtual private networks (VPNs), transmission tunnels, and other proven safeguards as a way to transmit confidential data across an unsecured environment (the Internet). Through encryption technology, it is virtually impossible for any hacker to decipher any information even if they can gather the data during transmission. Even though the information is being transmitted over public routes, it remains confidential. One of the key components before hiring any cloud provider is to understand the quality and continuity of the service they provide. The provider should meet the implicit expectations of their clients and provide complete transparency and verification of every duty they perform. This would include all their policies and procedures on backing up data, clustering data, and every redundancy instrument in place. Until the day arrives when all breaches in the cloud no longer exist, there will still be companies that simply cannot trust cloud computing. Looking to build that trust in the cloud? Multi-factor authentication is a great way to add security without adding undue burden to the login process. Download the free eBook below to learn more about multi-factor auth.
Read More

Not all cloud storage spaces are created equal. The main reasons that businesses use cloud data centers is to improve the agility of the company and enhance its financial efficiency. However, once your data leaves the local network, it typically ends up stored in the provider’s data center, which might not be the best place for it after all. What is cloud storage? Many businesses utilize cloud storage to archive old data, facilitating remote access and information sharing, or as a repository for backing up its primary information. There are likely many appealing factors in utilizing cloud storage, including the ability to quickly expand the IT department without the burden of purchasing and developing more computer infrastructure. In the last few years, there has been a huge adoption of utilizing cloud storage. This is often a result of increased security, continuous compliance, and the ease of management at nearly every level within the company or organization. As more businesses flocked to the technology, cloud storage is significantly more affordable now than in the past. It serves as a viable solution for many SMBs (small to medium-size businesses) and even has advantages for larger organizations. Having the ability to move confidential data completely into online cloud storage, many IT service providers and IT departments are able to cut their expenditures in areas that include dedicated staffing, training, cooling, power usage, along with resilient proficiency. Utilized for Primary Data Transferring primary data from the business into the cloud is often problematic. The main goal for most administrators in charge of storage is to ensure smooth performance of production data. They often utilize lightning fast drives and links to ensure maximum throughput. This is often accomplished by positioning storage systems next to the servers as a way to minimize or diminish latency. Using cloud-based technology to store company data can produce slower performance results no matter what type of data is being transferred. This is often a result of limited bandwidth from the ISP, or the data being located at great distances requiring numerous “hops” through the internet. Working in the office, and having company data stored on the other side of the world can significantly slow down delivery times when working in real-time. Remaining in full compliance with HIPAA, PCI, SOX, GLBA and others often require that the cloud database center be located in the US. Companies can easily fall into noncompliance by selecting the wrong MSP. As a Backup Response time is never really a factor when using cloud services as an online backup. Many companies choose to use managed service providers that offer extensive backup services. MSPs can configure the system to backup automatically directly into the cloud account. At its most basic level, using the cloud for backup proves to be a natural application. While the initial backup can take hours if not days, any follow-up backup happens in incremental stages much faster. Using the cloud as a backup tool is the easiest way to circumvent local disasters, to eliminate any potential loss of data from flooding or natural weather occurrences. The only true downside to using the cloud for backup system is the amount of time it takes to restore a downed server. Transferring huge volumes of data over the Internet can slow down the restore process. As an Archiving Tool Unlike backing up which usually happens in little snippets, archiving in the cloud requires bigger chunks of confidential data more often. Additionally, the worth of the data is different than when used primarily for the business or as a backup. By its very definition, archived information is much older and will never change. As a result, managed service providers need to ensure that the process they use will securely store the data and maintain its integrity over time. The greatest advantage of using cloud technology as an archiving tool is the avoidance of having to purchase additional hardware and the ongoing costs to maintain the data. Typically, in-house archiving tends to be more costly and less reliable, then farming it out to a third-party MSP. As valuable a tool as cloud technology is for any size company, it is important to maximize the results it provides. Using an MSP that stores its servers in the company’s country of origin will ensure a faster transfer time and higher levels of security. Cloud computing and cloud storage is here to stay. However, it is up to every storage administrator to make the best decisions for the company when selecting a managed service provider. Want to learn more about how managing compliance issues, specifically PCI? Download the free whitepaper below.
Read More

There can be significant consequences when a company experiences a breach in their data security. Every few months, the headlines are filled with stories concerning security breaches of high profile companies where sensitive, confidential customer information is exposed. Not only does this cause a disruption to the company’s business, but it can ruin its reputation if the situation is not handled properly. For some companies, the data that is breached is often nothing more than the username/password combination. While critical, once the company realizes that a cyber-attack has occurred, they can immediately shut down the entire system. For them, the accounts held nothing more than general information. However, some company servers that are breached hold valuable, private information including Social Security numbers, details about credit cards or other pertinent financial information. For them, even the smallest security breach could produce significant ramifications and destroy their reputation – leading to a crushing number of lawsuits. So, exactly what is happening, and why are there so many data security breaches at a high level? What could be done as a way to reduce the potentials of a devastating security incident? If hackers can attack large corporations, could the same thing happen to my company, and how devastating would that be? It is important that every company understands the potential threats from hackers interested in viewing, exposing or stealing confidential data. Unfortunately, the headlines only report successful attacks in cyberspace that have been detected. Most likely, there are thousands of organizations that do not realize that attackers have already gained access into their security systems, and probed and identified confidential information. Hackers Look for System Vulnerabilities The biggest challenge of the cyber-attack from the hacker’s viewpoint is his or her ability to understand the company’s vulnerabilities in their system. Through a variety of ways, they can deliberately exploit the weakness without the company ever knowing it is being done. Research indicates that well over seven out of 10 small companies that have experienced some type of high-level security breach will close their doors forever within the first 12 months. The security of the business is only as strong and effective as its weakest component. Gaining access into the company’s data typically happens because there is more than one weak component in security. Because of that, it is important to take a multilevel approach to ensure the company has tightened up security as much is possible. Taking Steps So, exactly what can be done to prevent the theft of crucial, confidential information? There are significant actions that can be performed. They include: Invest in Full Protection – There are two specific ways a company can safeguard their confidential information, either by doing it in-house, or outsourcing it to a third-party managed service provider (MSP). The in-house IT department, or MSP, can utilize hardware that is security-focused to automatically detect any intrusions on the company network. Manage How Employees Use Computers – Most data security breaches are the result of an employee’s unregulated action. Often unknowingly performed by the employee, they will install software that is unauthorized, download harmful viruses, or transmit their confidential work files to a mobile device or home computer. Additionally, many employees do not follow strict company password generating protocols (if they exist) and create extremely weak passwords that are easy to decipher or guess. Incorporate Least Privilege Principle Policies – Not everyone in the company should be granted privileges to confidential information if it serves no useful purpose in doing their job. The MSP or IT department should continually review current privileges to see which ones need to be revoked because they are no longer necessary. Encrypt All Data – Because all business requirements are different, it is important to choose the best encryption technology to fit the needs of the company. There are numerous high-level encryption standards and effective algorithms available to safeguard confidential data when it is in motion (being transmitted) or at rest (in storage). Monitor All Database Activity – A managed service provider can perform real-time auditing and monitoring to ensure that all company employees are following security protocols, procedures and rules. The auditing allows the opportunity to add additional, effective security layers to prevent exposure and pilfering of crucial data from a cyber-attack. Prevention is crucial to avoid a breach in the company’s data security. The truth is that many companies never think about their information being compromised, until it happens. Only then do they experience serious consequences of a damaged reputation, which exposes them to profit crippling lawsuits. There are simple solutions that can minimize the liability of a cyber-attack. It is important that every company understands that it is not a set it and forget it problem. To remain effective, data security must be continuously reviewed and audited, so the proper adjustments can be made to make the system as secure as possible. Learn more in this free eBook below!
Read More

Most small businesses never consider that they would ever be a victim of a security breach. Many assume it could never happen to them. However, it is crucial that every small company takes all the proactive steps necessary to reduce the potential of being hacked. Research indicates that even though companies understand the high level of risk of a security breach within their organization, most simply do not put out the effort to review or update their security procedures. Most do not incorporate any type of auditing or teach employees effective ways to protect the crucial, confidential data of the business. Even though the headlines are usually filled with stories about large corporations being victimized by cyber-attacks, it is actually small companies that are much more vulnerable to being hacked. Typically, small organizations often neglect to take the steps to add effective controls as a safeguard against attack. By not having a strong enough security in place to fully protect confidential data, companies are continually putting their reputations on the line. A Constant Threat The risk of having confidential information fall into the wrong hands often poses a constant dangerous threat. This can often be an unfortunate situation for small businesses that is completely avoidable. Statistics show that more than 5% of all small businesses at some point will be a victim of a cyber-attack. These statistics indicate that it is not “if” an attack will occur, but “when”. It is important that every small business understands the weakness of their security system when connecting to the company intranet, or the public Internet. An online hacker will spend most of their time searching for the vulnerabilities of a company intranet system. Once located, they simply exploit them, to gain unauthorized access to confidential files, folders, information and crucial data. Most companies that are victims of a cyber-attack are often totally unaware that their system has been compromised. Even companies that have been hacked believe that it is a one-time incident. However, when a hacker takes the length of time necessary to penetrate into the company intranet, it is most likely that he or she will continually come back for more. Usually, once a hacker has gained access by compromising an account, they will install a secret “back door” that provides instant access the next time. This means that even if a company has been able to detect the problem, and plug the gap in their security system, the hacker simply gains unauthorized access through their installed back door. More Than Just a Firewall Is Needed Many small companies believe that a firewall is all they need as a level of security against online attack. However, a firewall is nothing more than a front door security gate that does nothing to protect the back door or the windows. In the security world, it is the job of the IT department, or managed service provider (MSP), to continually safeguard against all possible attacks, not just those that would seemingly come through the “front door.” Implementing security is not an easy action. It requires a specific skill and continuous auditing. High-level security that is both effective and total requires a well-designed blueprint that meets the needs of each individual company. High-level security requires an understanding of all the ways that a hacker can gain access. It creates the need to develop and implement a variety of solutions to minimize the potential of a cyber-attack. The Need for Training Every small and large company needs to have effective training for all of their employees. The training is based on proven protocols and policies that must be followed by every member of the workforce. This typically includes the development of strong passwords. In addition, it also should include detailed training on exactly how to avoid downloading viruses, worms, malware and other malicious products designed to do harm to the company network infrastructure. A Far-Reaching Problem Security breaches do not just happen in the office. Any compromised information can occur on a stolen or lost laptop, or through a mobile device including a smartphone or tablet. Because of that, the IT department, or managed service provider, needs to ensure that all data transmitted to and from the company intranet be encrypted. This will minimize the potential of exposing crucial confidential information, even if the hacker can capture the data while it travels across the Internet. It is important that every company big and small realizes that a data breach can happen to them. It can occur at any time. All it takes is one unauthorized individual to gain access to private or sensitive data that could lead to its exposure. The stolen information can be used for identity theft, or to do long-term damage to a company’s finances and reputation. Download our free eBook below for more stats, tips, and tricks about dealing with cybercrime and small businesses.
Read More