The password is the main way we identify ourselves online. We need these to access nearly every account and service we use. Hackers know this and often target this area. One way to minimize the chance of your accounts being hacked is by using different passwords for every account. However, the issue is that remembering them all isn't always easy. A password management system can help, but what type of system is the best?

Below is a brief overview of the four types of password management system you can use.

1. Cloud or Internet-based These systems are usually cloud based and accessed through an app or browser plugin. Apps ordinarily store your passwords, or generate one to use, and will automatically apply this when you visit a site that requires a password. These systems are great for breaking the one password habit, However, because they store all of your passwords in one place, they could become a target for hackers.

2. Cloud or Internet-based with two-factor authentication The next step up from the cloud-based password management system is one that supports two-factor authentication. Your passwords are still stored in the cloud, but you will need to provide another piece of information before you can access sites.

The interesting thing is that many of the cloud based password systems actually offer this in their premium offerings. So, not only do you get better password protection, but it's with the same system meaning you likely won't have to switch.

The cloud based systems are a good idea if you use more than one system on a regular basis and if you work from outside of the office.

3. Computer-based Computer-based password management systems are similar to the cloud versions, only the passwords are stored on your computer, and accessed using a master password. Because many hackers usually don't go after individual hard drives - they have to get through your network and then find the program and try to break the password - the chances of your passwords being exposed are minimized.

The only problem with systems like these is that you normally have to log in for the service to work. If you forget to log out and someone walks by, they will be able to access everything. However, for the manager who wants a secure system, this is a better option than the cloud based versions.

4. USB-based There are a number of USB devices that have a smart card in them that can store passwords. When you plug in the USB to your computer, the software on the USB can input the stored passwords when needed. These devices are typically more expensive, with some costing as much as USD$100, but they offer the highest amount of security as your passwords are kept with you.

The main downside to these devices is that they aren't the biggest and are usually about the size of a standard USB stick. This means that they are easier to lose, making getting your passwords back even tougher.

If you are looking for a better way to keep track of your passwords, please contact us today to see how we can help.

The Internet, still in its early phases, is seeing a dramatic increase in the number of users. Unfortunately, this growth has also seen an increase in the number of cyber criminals and attacks against websites. The latest major attack was perpetrated against LivingSocial. If you have an account with this website, you may want to pay attention.

LivingSocial is a daily deals website that focuses on bringing bargains and original deals to users based on their geographical location. In late April, news broke that the website had suffered a massive cyber attack with 50 million accounts being compromised.

From the reports we have seen, the attack targeted accounts world-wide with only account holders in Thailand, Indonesia, South Korea and the Philippines being unaffected. An email sent out by Tim O'Shaughnessy, LivingSocial's CEO shortly after the incident said, "We recently experienced a cyber-attack on our computer systems that resulted in unauthorized access to some customer data from our servers. We are actively working with law enforcement to investigate this issue."

The company assured users that their credit card data had not been compromised, as they are kept in another database. Account passwords were also encrypted, which means they are harder to crack but not impossible.

What should you do? If you have a LivingSocial account, we recommend that you go and change your password immediately. This can be done by:

1. Going to LivingSocial's forgot your password page.
2. Entering the email address you used to sign up for the account with.
3. Pressing Reset Password.
4. Checking your email for an email from LivingSocial and following the instructions in the email.

It is advisable to pick a new password, one that is as different as possible from your old password and, as always, the longer, the better.

Is there anything I can to do protect my company? If you are a business owner who has websites that encourage customers to sign up for updates, accounts, etc. you may be wondering how you can keep your user's information secure from cyber attack. In truth, you can't keep your important information 100% secure, if a hacker is committed enough, they will be able to get the information they need or wreak the havoc they want to. But what you can do is to make it as hard as possible for cybercriminals to get your information. This could be as simple as using multiple databases to store different bits of information, or as complex as using the latest encryption methods and systems.

Each business is unique, and the best way to ensure your valuable data is secure is to work with an IT partner who takes the time to get to know your security needs and develop a solution that is as near to 100% secure as possible.

If you are worried about the security of your systems, contact us today. We may have the perfect solution that will meet your needs and budget.

Security is an important issue for many business owners and managers. Many work with their IT department or an IT partner to ensure their network and systems are secure from threats. But what about your email, social media and bank accounts? The weakest link of these online accounts is your password, hackers know this and that’s what they target. Do you take steps to ensure that you have a strong password?

If you want to minimize the chances of your password being hacked, here are five things you should NOT do.

1. Don’t pick short passwords

While short passwords are easier to remember, they are also easier and quicker to hack. The most common way to hack passwords is by using brute force: Developing a list of every possible password, then trying this list with a username.

Using a mid-range computer like the one many have on their desk, with a normal Internet connection, you can develop a list of all potential passwords astonishingly quickly. For example it would take 11.9 seconds to generate a list of all possible passwords using five lowercase characters (a,b,c,d,etc.) only. It will take about 2.15 hours to develop a list of all possible passwords using five of any computer character. Once a hacker has the list, they just have to try every potential password with your user name.

On the other hand, a list of all 8 character passwords with at least one special character (!,@,%,etc.) and one capital letter would take this computer 2.14 centuries to develop. In other words, the longer the password, the harder it will be to hack. That being said, longer passwords aren’t impossible to hack, they just take more time. So, most hackers will usually go after the shorter passwords first.

2. Don’t use the same password

The way most hackers work is that they assume users have the same password for different accounts. If they can get one password, it’s as simple as looking through that account’s information for any related accounts and trying the original password with the other accounts. If one of these happens to be your email where you have kept bank information, you will likely see your bank account drained.

It’s therefore important to use a different password for every online account. They key here is to try and use a password that’s as different as possible. Don’t just add a number or character onto the end of a word. If you have trouble remembering all of your passwords, try using a password manager like LastPass.

3. Don’t use words from the dictionary or all numbers

This article published last year on ZDnet highlights the 25 most popular passwords. Notice that more than 15 contain words from the dictionary, and most of the rest are strings of common numbers. To have a secure password, most security experts agree that you should not use words from the dictionary or number combinations that are beside each other (e.g., 1234).

4. Don’t use standard number substitutions

Some users have passwords where they replace letters with a number that looks similar, for example: h31lo (hello). Most new password hacking tools actually have combinations like this built in and will try a normal word, followed by replacing letters with similar numbers. It’s best to avoid this.

5. Don’t use available information as a password

What we mean by this is using information that can be easily found on the Internet. For example, doing a quick search for your name will likely return your email address and social media profiles. If you have pictures of your kids, spouse, pets, family, their dates of birth, etc. on your Facebook profile and have put their names in captions, it’s possible for a hacker to see this (assuming the pictures are shared with the public).

You can bet that they will try these names as your password. You would be surprised with the amount of personal information on the web. We suggest searching for yourself using your email address(s), social media profile names, etc. and seeing what information can be found. If your passwords are close to what you find, it would be a good idea to change them immediately.

There are numerous things you can do to minimize the chance that your passwords are stolen and accounts hacked.

 

While being one of the most useful business tools ever invented, email can also be a hinderance. Because of its generally open nature, when anyone can get an email address, criminals have taken their operations online in the form of email frauds or scams. This can be a big issue for business owners, and knowing how to determine if an email is legitimate or not is important.

Here's five tips to help you spot email frauds or scams.

Look at the email address One of the easiest ways to spot a fraudulent email or scam is by looking at the email address of the sender. Many credit card application scams use third party email services like Gmail or Yahoo. Some scammers go so far as to set up accounts in the name of the company e.g., AMEX_121@gmail.com.

Sophisticated scammers will actually try to copy the legitimate company's email account - a practice called spoofing. They will usually have a few changes like a missing letter from the address, or an extra . added.

The easiest thing you can do is look for the sender's site on the Internet. For example: You get an email from AMEX OPEN (American Express's small business credit card) and notice that the sender's email address just doesn't look right. Go to Google and search for amex fraud. You'll likely find the fraud page which tells you exactly how the company sends emails. If the sender is a smaller company, most of these will have email contact addresses right on the site, take a look and compare the two. If they are different, the email is likely a scam.

Look at the sender's website If you think an email is fraudulent, try looking up the website associated with the sender. Should you be unable to find the site, it's likely a scam.

If you find a website, click through some pages to see if there is anything that looks out of place. For example a website selling a new financial service has pages with Coming Soon or you get errors when you try to load the page. If it looks fishy, it likely is - delete the email.

It would also be a good idea to go to archive.org's Wayback Machine, copy and paste the website's URL into the The Wayback Machine Search bar and hit Take me back. This will bring up previous versions of the website. If you see that the site in question was something completely different a few months to a year ago (e.g., it is a financial services page now, but six months ago it was a page selling prescription drugs), chances are high it's a fraud.

Call them Many scammers will put phone numbers into emails to make them look more legitimate. If you are unsure about whether this email is legitimate or not, why not try calling the number? Many scammers run more than one fraud operating at the same time and may answer the phone with another name, or not at all.

Similarly, if you call a local number of a supposedly small business and get routed directly to voicemail, it's likely fraud.

Look carefully at the body of the message The body of the email can also be a great way to suss out email scammers and potential fraud. Because many fraudulent emails originate outside of the major English speaking countries, there will often be language that just sounds different from the way people write in your area. One great example of this would be a line like 'We wish to sell you a great product.'

You should also look for spelling errors, grammar mistakes or inconsistencies. While some fraudulent emails will have minor spelling inconsistencies, others will spell common words wrong. If you see mistakes like 'our product are a great deals', this should raise a warning flag.

Spelling and grammar errors are a part of business communication, so don't expect a perfect email from all companies, especially if you see that the company is located overseas. It's the emails with mistakes supposedly coming from companies in your area that should really raise alarm.

The sender asks for money or passwords It's kind of an unwritten rule that when sending out emails you never ask for a person's credit card number or account passwords. Banks, large companies and many social networks will never ask you for passwords or account information, credit card numbers, pin codes, etc of any kind over email. If you notice that an email selling something asks for you to reply with a credit card details so you can make a purchase, it's best to delete the email as it's likely a fraud.

Email fraud is a big deal, and unfortunately it will likely become even more common in the near future. This means you should be able to spot potentially fraudulent emails. If you think an email is a scam, it's best to just delete it immediately. Don't respond or forward it to colleagues or employees. If you need to let people know, write another email that describes the suspected email but has no links. You can also forward a screenshot to your colleagues or friends to illustrate the scam.

Looking for more ways you can protect your company? Contact us today. We can work with you to develop a security system that will meet your needs.

Myths have always been a part of human culture, and can be found in nearly every aspect of life, including the computer. One of the larger computer-based myths revolves around malware, more specifically the virus. Many users are familiar with the concept but have a tough time distinguishing between what is true and what isn’t. Are you one of them?

Here are five common myths about viruses that confuse people, and the truths associated with them. Before we delve deeper it would be a good idea to explain what a virus is.

A virus is a computer program that infects a computer and can generally copy itself and infect other computers. Most viruses aim to cause havoc by either deleting important files or rendering a computer inoperable. Most viruses have to be installed by the user, and usually come hidden as programs, browser plugins, etc.

You may hear the term malware used interchangeably with virus. Malware is short for malicious software and is more of an umbrella term that covers any software that aims to cause harm. A virus is simply a type of malware.

Myth 1: Error messages = virus
A common thought many have when their computer shows an error message is that they must have a virus. In truth, bugs in the software, a faulty hard drive, memory or even issues with your virus scanner are more likely the cause. The same goes with if your computer crashes, it likely could be because of something other than a virus.

When you do see error messages, or your computer crashes while trying to run a program or open a file, you should scan for viruses, just to rule it out.

Myth 2: Computers can infect themselves
It’s not uncommon to have clients bring their computers to a techie exclaiming that a virus has magically appeared on the system all by itself. Despite what some may believe, viruses cannot infect computers by themselves. Users have to physically open an infected program, or visit a site that hosts the virus and download it.

To minimize the chance of being infected you should steer clear of any adult oriented sites – they are often loaded with viruses, torrent sites, etc. A good rule of thumb is: If the site has illegal or ‘adult’ content, it likely has viruses that can and will infect your system if visited, or files downloaded from there.

Myth 3: Only PCs can get viruses
If you read the news, you likely know that many of the big viruses and malware infect mostly systems running Windows. This has led users to believe that other systems like Apple’s OS X are virus free.

The truth of the matter is: All systems could be infected by a virus, it’s just that the vast majority of them are written to target Windows machines. This is because most computers run Windows. That being said, there is an increasing number of threats to OS X and Linux, as these systems are becoming more popular. If this trend keeps up, we will see an exponential rise in the number of viruses infecting these systems.

Myth 4: If I reinstall Windows and copy all my old files over, I’ll be ok
Some believe that if their system has been infected, they can simply copy their files onto a hard drive, or backup solution, reinstall Windows and then copy their files back and the virus will be gone.

To be honest, wiping your hard drive and reinstalling Windows will normally get rid of any viruses. However, if the virus is in the files you backed up, your computer will be infected when you move the files back and open them. The key here is that if your system is infected, you need to scan the files and remove the virus before you put them back onto your system.

Myth 5: Firewalls protect networks from viruses
Windows comes with a firewall built into the OS, and many users have been somewhat misled as to what it actually does, and that firewalls can protect from viruses. That’s actually a half truth. Firewalls are actually for network traffic, their main job is to keep networks and computers connected to the network secure; they don’t scan for viruses.

Where they could help is if a virus is sending data to a computer outside of your network. In theory, a firewall will pick up this traffic and alert you to it, or stop the flow of data outright. Some of the bigger viruses actually turn off the firewall, rendering your whole network open to malware attacks.

What can I do?
There are many things you can do to minimize the chances of infection. The most important is to install a virus scanner on all of your systems, keep it up to date and run it regularly. But a defensive strategy like this isn’t enough, you need to be proactive by:

• Not installing programs from sources you don’t know or trust
• Being weary of any program that asks you for your password
• Not installing any browser add-ons or plugins suggested by websites. Instead, download them from the browser’s app store, or the developer’s website.

If you are worried about the security of your systems and network, call us today. Our team of security experts can work with you to provide a plan that will meet your needs.

The Internet has seeped into nearly every aspect of our daily lives, it's hard not to be connected these days. Think about the number of websites you have accounts with, and how all of these sites now have some form of personal information of yours. The question is, what exactly do these sites do with your information? The answer lies in the Terms of Service, which are always evolving and hard to keep track of. Luckily, a new website makes it a lot easier to monitor all of these changes.

Terms of Service for websites change on a fairly regular basis, and many of us simply have no way of knowing if and when such changes have been made, and what exactly has been changed. That's why a group of lawyers and professionals started Docracy. According to the website, "Docracy is a home for contracts and other legal documents, socially curated by the communities that use them." The company aims to make legal documents freely available.

Part of this site is the Terms of Service section which is a database of over 1,000 popular websites' Terms of Service and Privacy policies. It tracks them and notes when changes are made, and highlights these changes so they are easily found.

If you visit the site here, you can see a list of changes that companies have recently made, and clicking on one should give you basic change information. Clicking on See Full Changes will bring up the full doc with the recent changes highlighted.

Selecting See Full Directory will bring up every policy that the website tracks, and allow you to read them.

Is this useful for my business? Online law is very complicated, and many companies that run websites that you may have accounts with often don't make it easy for you to find legal contracts or policies. A good example of where Docracy is helpful is if you want to know who exactly owns your content stored on a popular cloud service. You can go to Docracy's database and quickly find the related Terms of Service. From there you can download the document and look through it, or view it on the site.

Basically this site can help you get a clearer picture on the various contracts you sign with websites, and how these websites plan to use your data. For many business owners, knowing exactly what other companies are going to do with your data can help you find a more secure solution. After all, being prepared with the correct knowledge is half the battle.

If you would like to learn more about Docracy, or how a change to a Terms of Service could affect your business please contact us today.

The Internet has become ingrained in nearly everything we do. There are many people who are barely disconnected these days. While this development is great for companies, that arguably get more out of employees as a result, there is a downside. In general, people are more than willing to share their personal and private information online. This can ruin reputations, or worse still, open you to identity theft, risks which highlight the need to secure your online information.

Here's three things you can do to help secure your personal data shared online.

1. Realize your online actions are risky Read any tech related blog, or even syndicated news articles and it's not hard to see that identity theft and cybercrime in general is not only serious, but on the rise. Let's face it, our online actions are risky. As with any plan, the first step is realizing that there is a problem that needs to be fixed. The first step is to educate yourself about online security, what steps you should take, and what exactly it is.

For example, here's a great article written in the middle of February about how different age groups react to Facebook changes, and if they take steps to minimize who can view their personal data. It's kind of interesting to see that the younger generations take more steps to secure their profiles than their parents, yet you still see people with reputation damaging pictures that can be viewed by anyone.

2. Take matters into your own hands Many people already know their personal information online is at risk, but there are further things you should do to minimize any dangers:

1. Don't rely on websites to keep you secure - Websites like Facebook are companies. They exist to make money. How do they do it? Often by selling information you have given them access to. That's not saying site owners don't look out for their customers' best interests - many do. What you need to do though is look at all the sites you have accounts with and ensure your information is secure to the level you are happy with.
2. Provide the least amount of information possible - Think about the last time you joined a social network, or mailing list. You likely were asked to provide your name, address, birthday, etc. Did you know that you don't have to provide all the information requested? Most sites only require your name and birthday, the rest is optional - usually used to provide better service or targeted ads. Many sites will put an asterisk beside required information to let you know that you have to supply this.
3. Think twice before signing up - It's a good idea when signing up for a new account to think twice. Do you really need this account? Or can you get by without it?
4. Use separate email accounts and passwords - Setting up different email accounts is a good idea. One should be for personal use, so the address is given only to people you know. Another could be for all of your online accounts, with a final one strictly for password recovery. It would be best to make the addresses as different as possible. Beyond that you should have separate passwords for each account and every service. This will limit hackers from being able to gain access to multiple accounts.
5. Secure your browsing - Almost every website that asks users to sign up for accounts offers a secure version of the site. Enter https://www. before the site address, e.g., https://www.facebook.com. https is a secure communications protocol that ensures one is communicating directly with the website - you're actually looking at Facebook, not a phishing site designed to steal passwords.

3. Encourage others to think It's not enough to just take action yourself. Encouraging colleagues, friends and family to also take steps to protect their online information and identities, is worthwhile. There are many great ways to help spread the word about safety, including the National Cyber Security website, which has information on Internet related security. Check it out, and share it!

If you would like to learn about how we can help you keep your information and data safe online, please contact us today for a comprehensive solution!

The number of tech gadgets we own has been growing, as has the number of criminals targeting high value goods like laptops and smartphones. While it is more likely to not happen, there is still a chance your laptop or phone could be stolen or go missing. When it does, you could lose important data, especially if you use this for your work too. To help increase the chances of finding your device you can install a program that tracks it.

Prey is an Open Source - free - program that you can install on your computer or mobile device and track it when it's missing, or been stolen.

How it works First you have to download the software - from here - onto your computer (Windows, Mac or Linux are supported), and sign up for an account. You have a couple of options here: You can either sign up for an account with Prey and access a control panel through the website, or install it as a standalone which is recommended for advanced users as it requires some server configuration.

If you chose to go with the Web option you sign up for an account and install the software then register your main device along with extra ones like an Android, or your iOS device. Once you have downloaded Prey and linked them together, you are ready.

When your device is lost, you log into the Web Control Panel on Prey's site and can report it as missing. You can also turn on different actions which allow you to track the computer's location, network status and hardware usage. There are also other options like the ability to snap a picture using the webcam (if you have one), or even sound an alarm. You can even lock the system or phone ensuring people can't access it.

For mobiles, you can send these a text (from the Web Control Panel) which will initiate the established options you have pre-set for when your phone goes missing.

How Prey finds your device's location depends on the device. For laptops, it can turn-on your Wi-Fi connection and try to connect to the nearest access points. It can take the IP address of each Wi-Fi access point and from there get an approximate location - in some areas as close as 200 feet. On your phone, it turns on the GPS (if available) and tries to connect to Wi-Fi networks in range. These two combined can generate a fairly accurate location.

All this tracking information is sent to your inbox in the form of a report, which can be tailored to meet your needs.

What makes this program different from other similar ones is that it can be installed across multiple platforms and managed from one account. It's also free, which makes it even more attractive. There is also a Pro version which allows you to track more devices, for a monthly fee (USD$5 for 3 devices up to USD$399 a month for 500 devices).

Prey is just one of the many device tracking programs, and installing one may be a good idea, to give you a greater chance of retrieval if your phone or computer is lost or stolen. Do you use one already? If so, which one? If you would like to learn more about Prey and the other device tracking programs please let us know, we may have a great solution for you.

Social media has become a large part of both individual users' lives and company business. These platforms allow us to communicate with ease, while sharing information, and generally creating an interactive community. As with any group, security is an issue. We expect to be secure, but there are times when the security of your information could be breached.

It only took one month for the first major security breach of a social network, and this time it happened to Twitter. On the first of February, Twitter announced on their blog that slightly over 250,000 accounts had been compromised.

At this time, Twitter doesn't know who is responsible for the attack but according to the blog post they know that, "The attackers may have had access to limited user information – usernames, email addresses, session tokens and encrypted/salted versions of passwords."

Yes, the hackers did get access to passwords, although the company noted that they got the 'encrypted/salted' versions, this means they didn't actually get the passwords themselves. To get the account passwords they would have to decrypt the information first, something many hacker's don't bother with.

What does this mean for my company? If you or your company has a Twitter account, you would have already have received an email if your account was breached. While 250,000 sounds like a high number, keep in mind that there are over 72 million active accounts (users who post more than once a week).

While this is a drop in the proverbial bucket, it's still a security threat that you should act upon. At the very least you should take steps to change your password. You can do this by logging into Twitter and pressing the cog in the top right of the tool bar. Select Settings followed by Password. Enter your current password, followed by a new password and verify it. Press Save changes and you are done.

It is a good idea to pick a completely new password, one with numbers, letters and if possible special characters like !, $ or ^. At the very least, it should be different from any other passwords you use.

Looking to learn more about the security breach or if Twitter is right for your business? Give us a shout, we'd be happy to talk social media with you.

The security of a company's networks and devices is a common issue many managers and owners face. There are a near constant stream of new threats brought to light, some of which are more important than others. The majority of the time these threats are to the software, but a recent one is hardware based and puts millions of systems at risk.

At the end of January, numerous news and tech media services issued warnings about UPnP (Universal Plug and Play) enabled devices. This was taken to be a big issue because of the widespread adoption of these devices and the fact that many of them have little to no security measures, which could open whole systems to attacks. Many business owners and managers are wondering what exactly is UPnP and how it can open systems to attack.

UPnP defined UPnP is a protocol or code that allows networked devices like laptops, computers, Wi-Fi routers, and many modern mobile devices, to search for and discover other devices connected to, or wanting to connect to, the same network. This protocol also allows these devices to connect to one-another and share information, Internet connection and media.

A good example of UPnP in use is your laptop. When you first connect your laptop to your router, you likely have to enter a password and maybe even the router's network name. Without UPnP you would have to find the network and enter the password each time you want to connect to the Internet. With UPnP, your laptop can automatically connect whenever it's in range.

Why is UPnP a security threat? UPnP has been in use for the better part of seven years and has since come to be found in nearly every device that connects to the Internet - pretty much everything. While it was written for devices in the home e.g., Wi-Fi routers, many businesses also use these devices because they are often easier to set up and cost less than their enterprise counterparts.

Because of the sheer number of devices that use this protocol, and the fact that it's engineered to respond to any request to connect to the device, it makes sense that this could be a security issue. A recent study tested the security of UPnP and revealed some interesting results.

Rapid7, the company that conducted the study, sent UPnP discovery requests to every routable IPv4 address. - IPv4 (Internet Protocol version 4) is a set of protocols for sending information from one computer to another on the Internet. A routable IPv4 address is one that can be contacted by anyone on the Internet. They found that over 80 million addresses used UPnP, and 17 million of these exposed the protocol that enables easy connection to the system or device. This can be easily exploited by hackers.

In other words, 17 million systems, many of which could be businesses, are open to attack through the UPnP device. This security threat opens networks to denial-of-service attacks which make resources, including the Internet, unavailable to the user. One example of a popular denial-of-service attack is a hacker making your website unavailable to others.

Can we do anything? Most experts are recommending that you disable UPnP on your networked devices. The first thing you should do however is to conduct a scan for vulnerable UPnP devices on your network. Tools like ScanNow (for Windows) can help you search. For many, this is a daunting prospect, as the chance of creating more issues is just too great.

We recommend contacting an expert like ourselves, who can conduct a security analysis and advise you on steps you can take to ensure you are secure. So, if you are worried about the security of your systems, give us a call today. We may have a solution for you.