Two-Factor Authentication and Complex Passwords: Extra Protection for Your Identity

Have you ever stopped at a gas station and been asked to enter a PIN number or maybe your zip code while paying at the pump? Recently I stopped at a gas station far off the beaten path and, to my delight, was asked to enter both! Being asked for two separate types of information is a form of “Two-Factor” or “Multi-factor” authentication that proves your identity more than one time.

Unfortunately, in our world of cybercrime and digital fraud, our identities and data are on the cybercriminal’s radar 24/7. Fortunately, there are ways to reduce the risk of your personal information being compromised.

Two easy ways to add a layer of security to our identities and data, both personally and professionally, is to practice Two-Factor Authentication (also known as 2FA) and exercise good password hygiene.

What is 2FA? It is an added layer of defense used to protect the security of your accounts beyond a simple username and password. 2FA is commonly derived by picking two of these three options: Something you know (i.e., password), something you have (i.e., smart card) and something you are (i.e., fingerprint). Historically, “know” and “have” have been commonly used requirements; however, biometric continues to increase in popularity. To increase your security, consider adding 2FA to your online accounts and mobile devices.

Use complex passwords that do not contain any easily identifiable personal information such as name variations, family members or identifiable numeric sequences. A commonly acceptable complexity level is to use three of these four character types: upper case letters, lower case letters, numerals, and special characters. As an example: Sp3cialP@ssword! is an acceptable password; SpecialPassword is not.

Also, random passphrases are gaining acceptance. Random passphrases provide an excellent combination of memorability, easy typing, and security. For example: awesome cat office kittendog. Utilizing complex passwords or passphrases should be used in conjunction withchanging them on a regular basis (passwords every 60-90 days and passphrases every 4-6 months) and assigning a unique one to each different account. Consider using a password manager to keep it all straight.

Take steps to safeguard your identity and your online accounts. It is not if you will be targeted, but when. Your security begins with your commitment to these two easy steps.

HCI stands for Hyper-Converged Infrastructure and is an IT framework that combines storage, computing and networking functionality into a single software solution or appliance. Hyperconverged solutions contain a hypervisor (virtual machine monitor) for virtualized computing, virtualized networking and software-defined storage functionality.

HCI solutions typically run on standardized hardware assets with the added value being in the software-defined elements managed within the hypervisor. Capacity in an HCI is described as nodes, with multiple nodes being clustered together to create large pools of shared compute and storage resources. Since these storage, compute, and network elements are now all software-defined, virtualized across an underlying pool of hardware, resources management can be facilitated across all instances, and the entire environment becomes simpler to manage via a single interface.

As data volumes increase, response times shorten, and data center infrastructures age, IT managers are most likely evaluating or moving towards Software-Defined Storage (SDS) to get more performance out of the same physical footprint. HCI extends that cost, maintenance and space savings to the whole computing stack by combining compute, network and storage functionality into a single, easy-to-manage appliance.

HCI can lower infrastructure total cost of ownership (TCO) by requiring less hardware, thereby lowering your datacenter footprint, which results in lower power, cooling and maintenance costs. A recent study by Enterprise Strategy Group (ESG) cited a 61% lower datacenter facility cost when using HCI.

HCI can also reduce operational expenses as its modular nature requires less administration, reduces deployment times and simplifies management. The same ESG study from 2016 found that HCI could reduce personnel costs by up to 77% by minimizing the number of silos, people, and hours spent performing routine administration and maintenance tasks. Finally, hyperconverged systems scale seamlessly. Adding capacity is as easy as adding a node, and all nodes are managed via the same single interface.

Hyperconverged infrastructure is the next phase of the evolution of the data center. The hardware-defined systems of the past are showing their age, rigidness and inability to serve the needs of modern consumers. Converged infrastructures have been compressed and their elements have been virtualized and software-defined, removing the silos from IT.

Just as we no longer carry around a phone, camera and GPS separately, but rather carry around a converged device containing software-defined elements within a single form factor, the days of silos within the data center are numbered. HCI can help you meet your IT performance objectives, while decreasing maintenance costs and data center sprawl. With HCI, you can start small with a department-level project and scale rapidly due to the node and cluster nature of virtualization.

With many HCI vendors on the market, making the right decision will take some planning and forethought. It is a good idea to either do an internal audit or consult with a third-party vendor or business partner to help your stakeholders define their needs and priorities. If you are already working with a vendor to help you move further along the software-defined storage value paradigm/scale, it makes sense to start with them. However, beware of vendor lock-in, keep your options open and define project success before implementing aspects of the HCI value proposition.

If your business is growing, that’s great news! However, if your growing business is using all-purpose, popular accounting software, such as QuickBooks, there’s a good chance that you will soon need a software that can better manage your growth. This is where Sage 100cloud ERP is a fit. Let’s take a closer look at 8 reasons your business should consider upgrading to Sage 100cloud.

1. Deeper insight for better, faster decision-making: Sage 100cloud features at-a-glance dashboards and has powerful, customizable reporting and analytics that give you the ability to drill down into the details that matter when it comes to managing your business. With this information readily available, you can make faster decisions, stay on budget, and identify new revenue and profit opportunities.

2. Confidence in your accounting: Sage 100cloud is designed to handle the complex accounting needs of growing businesses. By eliminating spreadsheets and other archaic practices, you will have a far more accurate view of your company’s finances, confidence in the face of an audit, and the tools you need to accelerate financial close.

3. Sage 100cloud leaves room for the future: Your business is growing. Who knows where you could be three, five, or ten years from now? Sage 100cloud can grow with you and easily expands to suit needs as they arise. The modular design of Sage 100cloud allows companies to choose the functionality that best suits their business needs now, and as your needs change, you can quickly add users and modules.

4. Simple migration: The switch from your current accounting software to Sage 100cloud will be relatively hassle-free with minimal disruptions.

5. Finally work the way you want to: Sage 100cloud has flexibility that allows user-level Modify/adjust on-site elements to improve relevance and likelihood of ranking for specific terms aligned with the page. and role-based dashboards so you have instant access to the information you want and need to be at your best.

6. It’s easy to use: A larger system means it’s more complex, right? Not when it comes to user experiences. Yes, Sage 100cloud is more complex under the surface to help you manage your more complex business needs, but it is not more complex to use. Unlike other ERP systems, Sage 100cloud has an intuitive, user-centered design so you can focus on your work, not on figuring out the software.

7. Increased visibility and tracking: With Sage 100cloud you will be able to see more than financial information, you can access up-to-the minute information across your organization; from financial to shop-floor and everything in between. You will be able to track inventory in a single or multiple locations.

8. Streamline the back office with integration and automation: Stop wasting time and money on manual data entry and other non-value-added manual processes. Seamless integration between CRM, ecommerce, and financials allows you to eliminate data entry errors and operate an end-to-end business system, automating and integrating everything from accounts receivable management to payroll, sales orders, and everything in between.

If you believe that it may be time to upgrade to Sage 100cloud, our software consultants can explain how these 8 benefits could be a perfect fit for your business, and help you make an informed decision.

Additional Sage 100cloud ERP resources

Business Accounting Software Solutions

Sage 100cloud ERP

The Number 1 Customer-Requested Add-on For Sage 100

In previous versions of Windows, the operating system was serviced with major upgrades (such as Windows 7, Windows 8, and Windows 8.1), service packs, and updates released each month on Patch Tuesday. Windows 10 leverages the “Windows as a Service” (WaaS) model by releasing two types of updates: Feature Updates, sometimes referred to as build updates, and Quality Updates.

Feature Updates are released twice each year and add/update functionality to Windows 10. Feature Updates released recently are Creators Update, Fall Creators Update, and most recently the April 2018 Update. Each build of Windows 10 has a lifecycle of roughly 1.5 years before reaching End of Service.

What this means:

• Microsoft has begun to handle their Feature Updates exclusively.
• IT service providers no longer have the ability to deploy updates from a management service.
• Feature Updates will be automatically installed by Microsoft unless deferred.
  
  • Each Feature Update can be deferred up to 365 days, but cannot be denied. After 365 days from the release, your system will get the update.

Servicing Channels are an option

Don’t lose hope though, there are “Servicing Channels” that you can use to change how Windows 10 is deployed and patched in your environment.

• Semi-annual Channel
  • Feature Updates are available once released by Microsoft.
  • The standard Servicing Channel can be deferred up to 365 days.
• Long-term Servicing Channel
  • Should be used only on specialized devices. Not a recommended option for all machines in an environment.
    • POS Systems
    • Media Systems
    • Medical Equipment
  • Feature Updates are not automatically installed and are released every 2-3 years.
  • Quality Updates are still available once released to ensure security.
  • Does not include Windows 10 Integrated applications such as Edge, Microsoft Store, Cortana, etc.

Quality Updates are monthly updates that roll entire sets of updates into one. In previous versions of Windows, the number of updates each month was overwhelming, and updates could be missed, causing fragmented security on each system. With the Quality Updates, each new month’s update supersedes the previous month and includes all previous Quality Updates. This makes patching more well-rounded and simple.

The Big Picture

Windows 10 is quite different than previous versions of Windows, but Microsoft is set on ensuring security for these systems. Management of devices has been simplified by giving Microsoft more control over which version is installed and supported. Instead of releasing new versions of Windows every three to five years, Microsoft will continue improving Windows 10 with each Feature Update, changing the Operating System gradually as opposed to a sharp contrast seen in version changes such as that of Windows 7 to Windows 8.

There is no anticipated end for Windows 10. Instead of releasing major new versions like Windows XP, Vista, and Windows 7, Windows 10 is just supposed to continually change. If you need assistance with managing updates for Windows in your organization, contact the professionals at Yeo & Yeo Technology.

IT security is a moving target. With cybercriminals using new ransomware and hacking tools to attempt to steal your data every day, security safeguards need to be in place to stay HIPAA compliant. We have created a safeguards checklist to help your organization stay HIPAA compliant. 

When breaking down the technical safeguards for IT security within HIPAA compliance, five standards need to be followed under the Security Rule:

Access Control – The ability or the means necessary to read, write, modify, or communicate data/information or otherwise use any system resource.

Audit Controls – Hardware, software, and/or procedural mechanisms that record and examine activity in information systems that contain or use electronic protected health information (ePHI).

Integrity – The property that data or information have not been altered or destroyed in an unauthorized manner.

Authentication – Procedures to verify that a person or entity seeking access to ePHI is the one claimed.

Transmission Security – Technical security measures to guard against unauthorized access to ePHI that is being transmitted over an electronic communications network.

Each of the five standards have nine sub-standards that also need to be checked off. Some sub-standards are required, while others are suggested:

Access Control – Unique User Identification (required): Assign a unique name and/or number for identifying and tracking user identity.

Access Control – Emergency Access Procedure (required): Establish (and implement as needed) procedures for obtaining necessary ePHI during an emergency.

Access Control – Automatic Logoff (addressable): Implement electronic procedures that terminate an electronic session after a predetermined time of inactivity.

Access Control – Encryption and Decryption (addressable): Implement a mechanism to encrypt and decrypt ePHI.

Audit Controls (required): Implement hardware, software, and/or procedural mechanisms that record and examine activity in information systems that contain or use ePHI.

Integrity – Mechanism to Authenticate ePHI (addressable): Implement electronic mechanisms to corroborate that ePHI has not been altered or destroyed in an unauthorized manner.

Authentication (required): Implement procedures to verify that a person or entity seeking access to ePHI is the one claimed.

Transmission Security – Integrity Controls (addressable): Implement security measures to ensure that electronically transmitted ePHI is not improperly modified without detection until disposed of.

Transmission Security – Encryption (addressable): Implement a mechanism to encrypt ePHI whenever deemed appropriate.

There are many layers to HIPAA compliance, and various options for managing risk to the security of sensitive health information. If you would like to know more about how Yeo & Yeo Technology can help your business become compliant, contact us today.

Collaboration can make any business better. Nielsen research found that collaboration increases creative output, and that collaborative teams are more likely to identify concepts that will perform well with their target customer group. Beyond just performance, collaboration fosters teamwork and enhances employee morale.

Here are seven technologies that are helping businesses drive collaboration right now.

Video conferencing

Video conferencing has become a go-to collaboration for companies of all sizes. Once limited to boardrooms and large meeting venues, its reach and accessibility have been greatly expanded thanks to the cloud and new PC-based and mobile solutions. Because it replicates nearly all facets of communication, from tone of voice to facial cues, video conferencing solutions inspire the camaraderie and empathy that are critical to collaborative solutions. Besides increasing productivity and fostering stronger, connected relationships among employees, clients, and vendors, video collaboration can also help businesses reduce travel costs.

Interactive white boards

Widely used in academia, interactive whiteboard has been adopted by the business world as a critical collaboration and productivity tool. The No. 1 way interactive whiteboards can improve workflow in business is by increasing engagement in collaborative productions, according to this recent article.

Interactive whiteboards boost communication, make document annotation easier and more effective, and enable a greater range of data sharing and interconnectivity when they include mobile capabilities. Touch-screen whiteboards eliminate the need for a mouse or pointer, making them even more collaborative.

Next-generation projectors

This is a collaborative that has been around for a long time, but the latest generation of projection equipment takes its capabilities to a whole new level. For example, Epson’s BrightLink Pro line combines the qualities traditionally sought in a high-end business projector–brightness, widescreen resolution and split-screen capability– with features and versatility that allow it to function as a multimedia collaborative core in a unified communications solution. It integrates the utility of a whiteboard, projector, and interactive display; easily connects to video conferencing equipment; turns nearly any flat surface into an interactive area where users can annotate; and provides connectivity for mobile devices.

Workspace innovations

Architecture and engineering may be “old school” technologies, but they can have a tremendous impact on driving collaboration when applied to workspaces. Research published in the Harvard Business Review (HBR) concluded that office space is not just an amortized asset but a strategic tool for growth. Much of its value lies in its ability to bust silos by increasing encounters and unplanned interactions–i.e., opportunities for collaboration–between knowledge workers both inside and outside the organization. The HBR article documented increases in productivity, size of business network, and size of social circle among workers using collaborative workspaces such as co-working spaces and huddle rooms.

Social platforms for business

Collaboration has become an essential part of the employee experience, according to the “Forrester Wave: Enterprise Collaboration Report, Q4 2016.” Collaboration apps and platforms allow businesses to share information, locate professionals, coordinate projects, discuss best practices, and build communities within and across the organization. Among the top-rated enterprise social networking platforms for 2017 are Atlassian, HipChat, Asana, Slack, Igloo, Bloomfire, Yammer, and Basecamp. Many of these solutions now incorporate Facebook-like social media aspects, which makes them more attractive to employees, especially millennials.

Machine learning tools

More and more businesses are using machine learning, a form of artificial intelligence, to make their operations faster and more efficient, according to professionals at Accenture, but the same can improve collaboration among workers. Collokia, for example, provides a variety of plug-ins that run in a company’s natural work environment and use machine learning to collect information and map employee skills. It analyzes the collective experience to help eliminate repeated mistakes, accelerate learning, better leverage unknown skills, and automatically connect people with other colleagues, research, solutions, and sources of knowledge.

Crowdsourcing tools

Maximizing positive outcomes from workplace collaboration requires vertical as well as horizontal technologies. Horizontal tools enable peer-to-peer collaboration (among employees or with peers at other organizations), while vertical tools ease collaboration between company leaders and those they manage. Research shows that passion/employee engagement is a key driver of organizational performance, and participation drives engagement. Crowdsourcing tools allow companies to harness the wisdom of the crowd, not just from their own employees, but also from customers, partners, even the public at large. Spigit, a leader in this space, uses analytics and algorithms to help businesses identify their best crowdsourced ideas, assess associated costs and risks, and predict future value. POPin is a tool that helps leaders unite and engage the organization in solving how to achieve strategic goals.

Driving new opportunities

The old saying, “two heads are better than one,” certainly holds up in the digital-driven age. is driving collaboration in ways we could not have imagined a decade ago. Tools we rely on today will likely get even better in the future; and they’re sure to be joined by some entirely new contenders to create unprecedented opportunity for businesses of all sizes.

This content was produced on behalf of Epson by Inc. Studio.
© 2018

Ransomware and cybercrime continue to be in the news cycle, claiming more victims every day. Microsoft has developed a new level of protection for Office 365 home and personal users with an update that can detect ransomware and help restore files from OneDrive.

“If an attack is detected, (users) will be alerted through an email, mobile, or desktop notification and guided through a recovery process where you’ll find the date and time of attack preselected in Files Restore, making the process simple and easy to use,” said Kirk Koenigsbauer, corporate vice president of Microsoft Office. “As these threats evolve, we are continuously improving detection capabilities to help keep you safe from the most advanced ransomware.”

Later in 2018, Microsoft is planning to add a security-enhancing link-checking feature to Word, Excel, and PowerPoint. When users click on embedded links to websites that serve up malware or are associated with phishing scams, the apps will point users to a warning screen that alerts them to the threat and urges them to turn back.

Yeo & Yeo Technology is a proud Microsoft Partner. If you have questions about Microsoft Office 365, contact us today.

As a business professional who works in an environment that relies heavily on IT, you are undoubtedly aware of downtime. All of a sudden, something on your PC stops functioning, and the waiting begins. You call on your internal technicians to get your system up and running, and you’re back to work. However, have you thought about how much that downtime is truly costing your business?

According to StorageCraft, businesses with a weak disaster recovery plan experience 29 hours of downtime annually, as compared to those with a solid plan, at 1.2 hours of downtime. Also, according to the 2017 Veeam Availability Report, while downtime costs vary, the average annual cost of downtime for enterprise companies is $21.8 million, up from $16 million in 2016.

To limit downtime, it is important to know what causes it. Unstable networks, cyberattacks, natural disasters and employee mistakes can take your system offline. No matter the reason, downtime disrupts operations and reduces profit. Your should work to increase productivity, not work against it.

Downtime cannot be totally eliminated, but with the right Managed Service Provider (MSP) and a sound managed services plan, it can be limited.

Following are some services you should look for from an MSP to ensure your is up and running efficiently:

1. 24/7 monitoring and support of your network
2. Data backup and disaster recovery
3. Access to certified professionals
4. Access to the latest hardware and software updates
5. Cost-effective monthly fees

When it comes to avoiding downtime, nothing is more effective than ensuring your IT infrastructure is secure and managed correctly. When your organization’s is maintained and controlled, you can serve your clients better.

Learn more about YYTECH’s Services.

Yeo & Yeo Technology will join Yeo & Yeo CPAs & Business Consultants at the Michigan Manufacturers Association’s (MMA) MFG Forum on Wednesday, May 9, at the Suburban Collection Showplace in Novi.

Read more about the event at yeoandyeo.com.

is a powerful thing for small business owners, regardless of what type of business they run. Using can help entrepreneurs do amazing things, such as save money, streamline business processes, promote products and services in new ways, and work more productively.

Collaboration is a powerful tool for all small business owners, regardless of industry or type of business you have. It is the connections you form with others, and the ways you collaborate with those connections, that will help you grow your business to new levels. If you are not convinced that collaboration is really worth the time and effort, here are five reasons why you should care about collaboration in your small business.

1. Collaboration can inspire you.

It is easy to get into a routine during the day-to-day operations of your business and forget that there may be a better way to do something, different techniques to try, and new tools that can save you time and money.

While you can read blogs, magazines, and books for inspiration, if you are not communicating, sharing, and discussing that information, the benefits are limited. It is vital to get outside of your own head in order to get a fresh perspective, trigger your creativity, review incoming information objectively, and add new contexts to the data you are gathering so you can use it effectively. Going beyond what you do and see each day to explore collaboration can be inspiring and help you think in a new way.

2. Collaboration helps you grow your network.

Successful entrepreneurs have a common interest in meeting new people and building a list of contacts and colleagues.

Being successful in business requires that you consistently make connections and form alliances. Imagine how your business would dwindle if you continued to network with and sell to the same group over and over again.

While every contact you make may not result in collaboration, every time you reach out to someone to explore the possibility, you are expanding your network.

3. Collaboration is educational.

One of the biggest benefits of collaboration is the opportunity for learning. In fact, every interaction you have with someone outside of your immediate circle can teach you something valuable. Some of the most successful collaborations involve two professionals who bring two very different skill sets, perspectives, and strengths to the table. When this happens, you are certain to be surrounded by learning opportunities.

4. Collaboration can help you save money.

Many collaborative relationships involve splitting intellectual contribution, hands-on work and, sometimes, expenses. If you collaborate with another business and part of the terms involve sharing development and marketing expenses, you can double your budget while reducing costs.

In this case, you can be fairly certain you will be getting a bigger bang for your buck than you would be if using only your own resources, provided all of the parties involved are equally invested in the success of the collaboration.

5. Collaboration solves problems.

There is a reason why crowdsourcing is so popular; there is an undeniable power in numbers. If one person can’t accomplish something on his or her own, two or three or more people may be able to get it done.

At its heart is Office itself—the familiar Office applications businesses use everyday—now offered as a cloud service, so it’s always up to date. But Office 365 is also so much more. It’s about bringing enterprise-grade services to organizations of all sizes, from online meetings to sharing documents to business-class email.

This infographic shows three ways Office 365 can improve collaboration.

Microsoft has announced that it’s newest version of Office, Microsoft Office 2019, will only be supported on Windows 10. Expected to ship in the second half of 2018, Office 2019 will introduce a number of new features such as improved inking; data analysis, new formulas and charts for Excel; and visual-animation such as PowerPoint Morph and Zoom. 

Office 2019 is expected to have a shorter support cycle than its previous versions; Five years of mainstream support followed by only two years of extended support. 
 
 Yeo & Yeo Technology will continue to release information about Office 2019 and its launch date approaches. 

Yeo & Yeo Technology’s Business Applications Group specializes in working with clients to get more from their business software through custom programming and reporting solutions. Many of these clients look to information to improve their daily processes and resources, making them more competitive in their industry.

Recently, a manufacturing client of YYTECH identified a need to improve how they create and track their customer quotes. They were using a Microsoft Excel based system to produce their quotes and found their salespeople were often missing crucial options, resulting in pricing issues. In addition to not pricing their jobs correctly, there were no analysis reports on quote wins or losses and their quotes overall were not very uniform in their appearance.

The Business Applications Group created a custom program that allowed them to enter, track, and print their customer quotes. The program incorporated their business rules so their quotes were uniform and required certain fields to be filled in before completing the process. This immediately increased the accuracy of their quotes and allowed them to archive their quotes for easy retrieval and analysis.

This is one example of how the Business Applications Group’s custom programming and reporting solutions work with businesses to streamline operations and improve the accuracy of their information systems.

Business Applications Group Services

• Business Accounting Software
• Accounting and Financials
• Bar Code Scanning
• Core Accounting
• ERP Software

One of the fundamental foundations of a healthy lifestyle is the food pyramid. We’ve all seen the food pyramid, how food groups are divided and how it’s changed over the years as we have learned more about what’s best for our bodies. The vital parts of managed services can be divided the same way and are constantly evolving. 

Managed Services diet plan

Ingredients

• Access to 24/7 Support
  
• Onsite Consultation and Analysis
  
• Remote Connectivity
  
• Yeo Helpdesk Assistance
  
• Warranty Repair and Facilitation
  
• IT Procurement Assistance
  
• Weekly Hard Drive Defragmentation
  
• Weekly Deletion of Windows and IE Temp Files
  
• Monitoring of Servers
  
• Monitoring of Workstations
  
• Monitoring of Backups
  
• Monitoring of Network including Switches, Router and Firewall
  
• Monitoring of Messaging Services including Email and Spam
  
• Microsoft Software Patching and Updates
  
• Antivirus Software Patching and Updates
  
• Network Device Patching and Software Updates
  
• Third Party Application Patching 

Experience and qualifications

Implementation at your speed

Disaster Recovery

Improved concentration on business

Cyber security is a continuous battle, not only for organizations, but IT professionals too. Staying informed can be a daily and sometimes hourly chore. This is why YYTECH developed Critical Info Email Alerts. If there is a threat, recall or vulnerability that could affect our clients, they are alerted as soon as possible.

Here’s an example of our two most recent Critical Info alerts:

• Meltdown and Spectre Vulnerability
• HP Battery Recall

If you would like to have Critical Info Alerts sent directly to your inbox, visit our Contact Us page, fill out the form and check the “Critical Info Email Alerts” box before submitting.

U.S. manufacturers are optimistic about their businesses and the industry, according to the Leading Edge Alliance National Manufacturing Outlook Survey. With 455 participants, the survey report contains the expectations and opinions of manufacturing executives who produce a wide variety of products.

Click here to read about the challenges the respondents face, the key strategies that the best-run manufacturers believe will be most effective, and the outlook for 2018.

This blog post is provided by our partners at KnowBe4.

The second-annual Cyren-Osterman Research U.S. security survey shows a significant disconnect between rising IT security spending and a low level of confidence in current protection, among many topics covered in the 24-page report, IT Security at SMBs: 2017 Benchmarking Survey, available for free download.

Security Budgets Up Sharply

On average, survey respondents reported that IT security budgets grew a robust 17% during the past 12 months. That’s on top of a 21% increase reported one year ago in the first annual Cyren-Osterman Research survey. However, sixty-eght percent of businesses reported one or more breaches or infections during the prior 12 months, and significantly less than half believe they are well prepared to meet priority threats like ransomware, phishing and zero-day exploits.

The survey focuses on the current web and email security status and priorities of IT and security managers at organizations with 100 to 3,000 employees. The survey results allow security personnel to benchmark their own security posture and planning against their peers.

• Security breaches are prevalent – Slightly more than two-thirds of the organizations surveyed – 68 percent – reported that they had experienced one or more breaches or infections during the past 12 months, with 29 percent reporting a successful phishing attack and 18 percent a ransomware infection that had gotten past their security defenses.
• Ransomware is the #1 concern – Ransomware surged from fourth place in the 2016 Cyren-Osterman Research survey to the top of the heap of issues about which IT and security managers are concerned or extremely concerned (62 percent), slightly edging phishing (61 percent), and data breaches (54 percent).
• Security concerns rule, controlling employees doesn’t – While threat categories are the top concerns among U.S. SMB security decision makers, only 24 percent expressed concern about shadow IT, with even fewer giving importance to controlling employee web behavior. (Our comment: this is a recipe for disaster)
• Security effectiveness trumps cost – and everything else – Security effectiveness (85 percent) and speed of defense against new threats (74 percent) markedly outdistanced all other capabilities that were rated (reporting, user experience, management ease, etc.). Cost considerations were among the lowest-rated factors in evaluating a security solution.
• Stopping threats in HTTPS is a priority – Fifty-nine percent rated as highly or extremely important the ability to perform SSL traffic inspection for threats, ranking it fourth among desired features in a web security solution. Fifty five percent indicated they have deployed an SSL inspection capability, which contrasts with a far lower deployment rate of 19 percent found in a similar survey in the UK in February 2017.
• Few think highly of their current protection – Most SMB decision makers believe that the security deployed for their organizations is not doing well, with the largest “security gaps” around the threats of greatest concern. For example, while 61 percent rate phishing a top concern, only 39 percent rate their protection highly.
• IT security investment is exploding at SMBs – Presumably driven by the poor opinion of current security, and the reality and risk of recurring infections and breaches, SMB IT security budgets jumped significantly for the second year in a row, rising 17 percent on average in the past year, following a 23 percent increase reported in the 2016 Cyren-Osterman Research survey.
• SMBs have limited IT security staff – Respondents indicated that they generally have a low number of dedicated IT security staff members available to deal with security issues. We found that over half (52 percent) of the organizations surveyed have two or fewer security staff members, with the figure rising to 80 percent for the smallest cohort, with 100-500 employees.
• Mobile device security is lagging behind – While 70 percent protect remote offices and roaming laptop use, only half protect company owned mobile devices, dropping to one-fifth providing protection of BYOD mobile devices, even if they connect to the corporate network.
• Preference growing and nearly equal for cloud-based SaaS vs. on-premises – The preference in terms of deployment model for security solutions is now nearly equally divided, with 32 percent preferring on-premises solutions, and 29 percent preferring cloud-based SaaS – with the latter up sharply from 21 percent in the 2016 Cyren-Osterman Research survey.
• Email security is now predominantly done in the cloud – Fifty-seven percent of SMBs rely on SaaS security for their email, considering together those who subscribe to a SaaS Secure Email Gateway (28 percent) and those who rely on the security provided by their SaaS or hosted email service provider (29 percent).
• Cloud-based web security is moving up the adoption curve – Eighteen percent of SMBs reported that they subscribe to SaaS web security, with another 16 percent reporting deployment of “hybrid” cloud and on-premises solutions, and six percent relying on a hosted virtual appliance.
• Security breaches cost significant staff time (and money) – After a security breach, organizations reported an average of 152 person-hours in IT staff time devoted to addressing the problem.

Download the full report here: https://blog.cyren.com/articles/survey-finds-security-investment-increasing-but-not-security

Cybersecurity for your Organization

Take a moment and think about all of the security features that are used to keep your organization’s network safe. There are passwords and firewalls that help keep the bad guys from your vital information. But all of these security measures don’t mean a thing if someone clicks a malware link inside an email.

As phishing attacks have grown, so too has the emphasis on Cybersecurity. One tool that many organizations have begun to deploy is security awareness training as a way to educate employees. In fact, having knowledge on malware and phishing is as important as having proper antivirus and firewall protection.

On September 6, Equifax, one of the three major credit reporting companies, announced a cybersecurity incident potentially impacting approximately 143 million U.S. consumers. Criminals exploited a U.S. website application vulnerability to gain access to certain files. Based on the company’s investigation, the unauthorized access occurred from mid-May through July 2017.

Equifax, one of the three major credit reporting companies, announced a cybersecurity incident potentially impacting approximately 143 million U.S. consumers. Criminals exploited a U.S. website application vulnerability to gain access to certain files. Based on the company’s investigation, the unauthorized access occurred from mid-May through July 2017.

According to Equifax, “The information accessed primarily includes names, social security numbers, birth dates, addresses and, in some instances, driver’s license numbers. In addition, credit card numbers for approximately 209,000 U.S. consumers, and certain dispute documents with personal identifying information for approximately 182,000 U.S. consumers, were accessed.”

Equifax has established a dedicated website, www.equifaxsecurity2017.com, to help consumers determine if their information has been potentially impacted. In addition to the website, Equifax will send direct mail notices to consumers whose credit card numbers or dispute documents with personal identifying information were impacted. If your information has been compromised, Equifax is providing free identity theft protection and credit file monitoring services. As with any contractual service, be sure to read all terms and conditions.

Please visit www.equifaxsecurity2017.com to learn more about the incident and determine if your information may have been affected.