June Technology Quick Tips

I’ve deleted an important file – can I get it back?

If you’ve checked your recycle bin and it’s not there, don’t panic. If you have a working backup, your file should be recoverable. Just don’t do anything else… call an expert (we can help).

Why do I keep losing connection to the office Wi-Fi?

It may be that your router is overloaded. Restart your device and try again. If that doesn’t work, try connecting on another device – this should tell you if it’s a device or router issue.

I’ve noticed a new Admin account appear on my network. How did that happen?

If no one in the business has created this account, you may have an intruder in your network. Contact your IT support to investigate it immediately.

Information used in this article was provided by our partners at MSP Marketing Edge.

According to Armorblox’s 2023 Email Security Threat Report, the financial services industry as a target has increased by 72% over 2022 and was the single largest target of financial fraud attacks, representing 49% of all such attacks. When breaking down the specific types of financial fraud, it doesn’t get any better for the financial industry:

51% of invoice fraud attacks targeted the financial services industry
42% of payroll fraud attacks
63% of payment fraud

To make matters worse, nearly one-quarter (22%) of financial fraud attacks successfully bypassed native email security controls, according to Armorblox. That means 1 in 5 email-based attacks made it all the way to the inbox.

Here are some ways you can boost your cybersecurity resilience and prevent cyberattacks:

Prepare for phishing attempts, and don’t click on suspicious links. Malicious links can come from anywhere — instant messenger apps, email, forum posts, etc. Never click links you don’t need to click or that you didn’t expect to receive, and consider implementing security awareness training to help your employees recognize financial fraud and other phishing-based threats, stopping them before they do actual damage.
Use a VPN while working with business data. Whether you connect to remote company sources and services, or if your work doesn’t require those activities and you just need to browse some web resources and use telecommunication tools, use a Virtual Private Network (VPN). VPNs encrypt all your traffic, making it secure against attackers who may attempt to capture your data in transit.
Keep your passwords and your working space to yourself. Ensure that your passwords — and your employees’ passwords — are strong and private. Never share passwords with anyone. Use different and long passwords for every service. Where possible, use multi-factor authentication for an extra layer of security.

In conclusion, the financial services industry has witnessed a significant 72% increase in financial fraud phishing attacks. To enhance cybersecurity resilience and safeguard against these threats, organizations should prioritize measures like security awareness training, VPN usage, and strong password practices. Learn more about Yeo & Yeo Technology’s cybersecurity solutions or contact us today.

Information in this article was provided by our partners at KnowBe4.

The eSentire Threat Response Unit recently discovered a scamming activity conducted via a fake QuickBooks installer. The infection typically starts when a user searches for “QuickBooks download” on Google, and the first search result leads them to a malicious website hosting a fake QuickBooks installer.

Affected users reported being unable to access one of their QuickBooks files and, upon opening the file, received a warning message instructing them to call a phone number that appeared to be from Intuit Technical Support. However, the number was part of a scam. When victims called the number, the malicious actor would offer to sell the service to “repair” the files for $800 to $2,000. The malicious actor claimed to be from “QB Exclusive” and used ZoHo Assist (remote support software) to achieve the remote session on the victim’s machine.

How can you prevent this cyberattack?

Before downloading QuickBooks, check that the software is coming from a legitimate installer. Legitimate QuickBooks installer certificates are issued to Intuit, Inc.
Note that the legitimate QuickBooks files are located under C:\Users\Public\Public Documents\Intuit\QuickBooks\ by default. Any files located under a different folder are suspicious.
If you receive a pop-up, think before taking any action. Always be suspicious of urgent messages or those asking for immediate payment in return for product support.

For more information on this QuickBooks scam, refer to the full eSentire article.

The 3-2-1 backup rule is a widely accepted set of best practices for data backup and restoration based on the idea that an organization should use three copies of its data stored in two different formats, with one copy stored off-site.

The rule is designed to keep data safe from any potential disaster, whether a malicious attack, system failure, or physical disaster. It’s also designed to ensure the organization can recover its data quickly and efficiently in an emergency.

Incorporating redundancy into an organization’s overall backup strategy, the 3-2-1 rule helps minimize the risk of complete data loss. It ensures that businesses can continue to operate and scale even in the face of disaster.

How to store your backups

As attitudes, practices, and solutions surrounding data storage have evolved over the years, so too have the technologies used to store backups. Today, backup and disaster recovery isn’t just a theoretical concept — it’s an essential function critical to business operations.

Organizations, from SMBs to large enterprises, have various options, from cloud storage to physical media and everything in between. Many opt for a hybrid approach that combines both physical and cloud storage solutions, which can include using both an on-site and off-site storage facility, as well as a cloud-based backup solution.

When considering backup solutions, consider the following criteria:

Cost:The cost of storing backups can add up quickly, so it’s important to consider the total cost of ownership (TCO) when selecting a storage solution.
Accessibility:Accessing backups in a timely manner is essential to any backup strategy. It’s important to consider the potential latency when selecting a storage solution and whether it will meet the organization’s accessibility needs.
Security:Data security is of paramount importance when it comes to backups. Select a storage solution that offers encryption and other security measures to ensure that backups remain secure.

How often should you backup

Backing up data regularly is essential to a successful backup strategy. How often an organization should back up its data will depend on the type of data it stores, the frequency of changes, and its tolerance for data loss.

In general, it’s recommended that organizations backup their data daily. This ensures that the most up-to-date version of the data is available in case of emergency and minimizes the chances of data loss or corruption. Some organizations may also consider creating weekly or monthly backups to store archived copies of their data.

Other best practices for data backup

While the 3-2-1 rule provides a comprehensive starting point for a backup and disaster recovery strategy, there are additional best practices that organizations can use to ensure that data is secure:

Automate backups:Automating backups can help ensure that data is backed up regularly and reduce the risk of data loss or corruption.
Ensure that backups are encrypted: Encrypting backups is an essential step in protecting data. It’s important to ensure that backups are stored using industry-standard encryption protocols and that proper key management is in place.
Monitor backups:Regularly monitoring backups can help ensure that the backup process runs smoothly and that data is backed up correctly.
Invest in a reliable off-site backup provider: Having a reliable, secure, and cost-effective off-site backup provider is essential to any good data recovery strategy.

Conclusion

The 3-2-1 backup rule is a widely accepted set of best practices for data backup and restoration. Incorporating redundancy into an organization’s overall backup strategy, the 3-2-1 rule helps minimize the risk of complete data loss. It ensures that businesses can continue to operate and scale even in the face of disaster. Organizations should consider automation, encryption, and monitoring of their backups to further protect their data and should invest in a reliable off-site backup provider to ensure that their data is securely stored. Looking to implement a data backup solution? Contact Yeo & Yeo Technology.

Information in this article was provided by our partners at ConnectWise.

The latest Phishing Activity Trends Report from the Anti-Phishing Working Group (APWG) shows an unrelenting upward trend in phishing attacks per quarter. According to the report:

The number of unique email subjects increased by 99.2%, totaling over 250,000 in Q4
The number of brands impersonated decreased slightly by 4% to 1780
The number of unique phishing websites increased slightly by 6% to just over 1.3 million

In essence, it appears that more unique campaigns are the answer – after all, there are only so many brands that have a broad appeal. It is interesting to see that the number of phishing websites is not increasing with the unique email subjects. However, the “unique” email subjects may simply be variations on a theme aimed at using the same phishing website to capture credentials, banking details, etc.

The scarier part of this report is that 150% continual growth.

Source: APWG

This growth is a mix of new threat actors getting into the game, the increase of “as a service” cyberattacks, and the fact that successful attacks are also increasing in numbers.

Organizations need to prevent these attacks before they truly start. And with the seemingly never-ending growth in phishing, implementing Security Awareness Training is becoming increasingly important. If you’re ready to start building your human firewall, contact us today.

Information in this article was provided by our partners at KnowBe4.

New data shows how likely it is for your organization to succumb to a ransomware attack, whether you can recover your data, and what’s inhibiting a proper security posture.

According to CyberEdge’s Cyberthreat Defense Report, in 2023:

7% of organizations were victims of a ransomware attack
7% of those paid a ransom
73% were able to recover data
Only 21.6% experienced solely the encryption of data and no other form of extortion

Nearly 78% of victim organizations experienced one or more additional forms of extortion (CyberEdge mentions threatening to release data publicly, notifying customers or media, and committing a DDoS attack as examples of additional threats mentioned by respondents).

IT decision-makers were asked to rate on a scale of 1-5 (5 being the highest) the top inhibitors of establishing and maintaining an adequate defense. The greatest inhibitor (with an average rank of 3.66) was a need for more skilled personnel.

In second place, with an average ranking of 3.63, is low-security awareness among employees – something only addressed by creating a proper security culture with Security Awareness Training at the center.

These findings underscore the urgency for organizations to prioritize cybersecurity measures and invest in enhancing their defenses against ransomware attacks. If you have any questions or concerns about cybersecurity, please do not hesitate to contact us. Our team of professionals is here to help you safeguard your systems and data.

Information in this article was provided by our partners at KnowBe4.

Cybersecurity professionals continue to warn that advanced chatbots like ChatGPT are making it easier for cybercriminals to craft phishing emails with pristine spelling and grammar, the Guardian reports.

Corey Thomas, CEO of Rapid7, stated, “Every hacker can now use AI that deals with misspellings and poor grammar. The idea that you can rely on looking for bad grammar or spelling to spot a phishing attack is no longer the case. We used to say that you could identify phishing attacks because the emails look a certain way. That no longer works.”

The Guardian points to a recent report by Europol outlining the potential malicious uses of AI technology.

“In Europol’s advisory report, the organization highlighted a similar set of potential problems caused by the rise of AI chatbots, including fraud and social engineering, disinformation and cybercrime,” the Guardian says. “The systems are also useful for walking would-be criminals through the steps required to harm others, it said. ‘The possibility to use the model to provide specific steps by asking contextual questions means it is significantly easier for malicious actors to better understand and subsequently carry out various types of crime.’”

Max Heinemeyer, Chief Product Officer at Darktrace, said AI technology would be particularly useful for spear phishing emails.

“Even if somebody said, ‘don’t worry about ChatGPT, it’s going to be commercialized,’ well, the genie is out of the bottle,” Heinemeyer said. “This type of technology is being used for better and more scalable social engineering. AI allows you to craft very believable ‘spear-phishing’ emails and other written communication with very little effort, especially compared to what you had to do before.”

Heinemeyer added, “I can just crawl your social media and put it to GPT, and it creates a super-believable tailored email. Even if I’m not knowledgeable of the English language, I can craft something indistinguishable from a human.”

Security awareness training can help your employees keep up with evolving social engineering tactics and detect advanced phishing attacks. Learn more about the value of security awareness training in our Phishing by Industry Benchmarking Report.

Information in this article was provided by our partners at KnowBe4.

Compromised websites (legitimate sites that have been successfully compromised to support social engineering) are serving visitors fake Google Chrome update error messages.

“Google Chrome users who use the browser regularly should be wary of a new attack campaign that distributes malware by posing as a Google Chrome update error message,” Trend Micro warns. “The attack campaign has been operational since February 2023 and has a large impact area.”

The message displayed reads, “UPDATE EXCEPTION. An error occurred in Chrome automatic update. Please install the update package manually later, or wait for the next automatic update.” A link is provided at the bottom of the bogus error message that takes the user to what’s misrepresented as a link that will support a Chrome manual update. In fact, the link will download a ZIP file that contains an EXE file. The payload is a cryptojacking Monero miner.

A cryptojacker is bad enough since it will drain power and degrade device performance. This one also carries the potential for compromising sensitive information, particularly credentials, and serving as staging for further attacks.

This campaign may be more effective for its routine, innocent look. There are no spectacular threats, no promises of instant wealth, just a notice about a failed update.

Users can become desensitized to the potential risks bogus messages concerning IT issues carry with them. Informed users are your last line of defense against attacks like these. New school security awareness training can help any organization sustain that line of defense and create a strong security culture.

Information in this article was provided by our partners at KnowBe4.

Cybersecurity is not just a technological challenge but increasingly a social and behavioral one. No matter their tech savviness, people are often duped by social engineering scams, like CEO fraud, because of their familiarity and immediacy factors.

Bad actors have the know-how to tap into the “mental shortcuts” called cognitive biases and manipulate employees into compromising sensitive information or systems. Here are the top cognitive biases hackers use the most:

Hyperbolic Discounting: Choosing immediate rewards over rewards that come later.
Example: Free coupon or special deal scams
Habit: The tendency of users to follow recurring habits.
Example: Phishing emails delivered at a specific time of day
Recency Effect: Remembering the most recently presented information or events best.
Example: Phishing attacks referencing current events
Halo Effect: When positive impressions of a person, company, etc., influence your overall feeling of that person or company.
Example: Scam messages from well-known brands
Loss Aversion: The tendency to prefer avoiding losses to acquiring equivalent gains.
Example: Phishing attacks threatening credit score damage
Ostrich Effect: Avoiding unpleasant information (hiding your head in the sand).
Example: Phishing emails warning action should be taken quickly, or else
Authority Bias: Attributing greater accuracy to the opinion of an authoritative figure.
Example: Hackers spoofing important messages from the CEO
Optimism Bias: Overestimating the probability of positive events while underestimating the probability of adverse events.
Example: Phishing emails will offer fake job opportunities or insider information
Curiosity Effect: Acting to resolve curiosity even if it could lead to negative consequences.
Example: Phishing attacks offering limited-time offers or secret information

A comprehensive security awareness training program can help employees understand these behaviors and spot social engineering attacks. Contact us to learn more.

Information used in this article was provided by our partners at KnowBe4.

According to Statista, an estimated 22 billion IoT devices were in use worldwide in 2020, projected to increase to 31 billion by 2025. With IoT devices growing in number, IoT cyberattacks are also on the rise.

What does the IoT include?

Smart thermostats, appliances, and lighting
Smart speakers like Google Home and Amazon Alexa
Fitness bands and smartwatches

People living in large urban environments are surrounded by thousands of trackable objects every moment.

The IoT is growing faster than our ability to secure it.

The increasing number of IoT devices being connected to the internet has led to significant cybersecurity concerns, including:

Inadequate security controls: Many IoT devices are not designed with security in mind and may lack basic security controls such as encryption, secure passwords, and regular software updates.
Data privacy: IoT devices collect a vast amount of data, including personal and sensitive information. If this data is not adequately secured, hackers can intercept or steal it.
Lack of visibility and control: IoT devices may be deployed in remote or uncontrolled environments, making it difficult for organizations to monitor and manage them.

As more employees work remotely using IoT devices, companies must ensure that their networks and data remain secure. Here are some actions that companies can take to improve cybersecurity for remote and in-office workers in the IoT world:

Develop a comprehensive cybersecurity policy: Companies should develop a cybersecurity policy that covers remote work and IoT devices. This policy should include guidelines for securing IoT devices, using secure networks, and accessing company data from remote locations.
Use secure networks: Employees should be required to connect to company networks using Virtual Private Networks (VPNs) or other secure methods. This can help to prevent unauthorized access and data breaches.
Turn off IoT devices during meetings: These devices constantly collect data; you never know who may be listening or when. Keep your clients’ and organizations’ information safe by encouraging employees to turn off their devices during meetings and calls.
Provide cybersecurity training: Companies should regularly train employees on best practices for cybersecurity, including how to identify and respond to cyber threats.

With the increasing prevalence of smart devices, taking proactive steps to protect your organization and employees is crucial. If you have any questions or concerns about cybersecurity, please do not hesitate to contact us. Our team of professionals is here to help you safeguard your data and stay safe online.

Information used in this article was provided by our partners at KnowBe4.

Cybercriminals use increasingly sophisticated techniques to bypass security. So, the more barriers you put in their way, the harder you make it for them to break into your systems. According to Microsoft, MFA prevents 99.9% of automated assaults on its platforms, websites, and online services. If that wasn’t enough, here are our top 6 reasons to adopt MFA in your business today.

1. It can protect your business from weak passwords

According to Cybernews, passwords like ‘123456’ and ‘Passw0rd’ are amongst the most commonly used. Weak passwords open the door to all kinds of data breaches. ‘Password-dumper’ malware, which steals login credentials from victims’ devices, was involved in a third of malware-related data breaches in 2020. And 80% of hacking-related breaches involved passwords in some way.

MFA prevents this. Because while cybercriminals may still try to steal your password, they are less likely to have access to your second and third identification factors – such as your fingerprint.

2. It prevents other methods of password theft

Even if a cybercriminal can’t break into your network to steal passwords, they have other methods that are equally successful. ‘Phishing’ attacks trick victims into giving away sensitive information using scam emails, SMS, or phone calls. And ‘pharming’ involves redirecting a website’s traffic to a fake site, run by criminals, where they steal data or install malware.

So even if you’re tricked into entering credentials in this way, the fraudsters still won’t be able to access your accounts without another form of authentication.

3. It makes using unmanaged devices more secure

Ideally, all your remote and hybrid workers will be on secure devices and internet connections, using security managed by your IT professional. But be honest – how many times have you logged onto your email account during the weekend using your personal laptop?

It might feel harmless, but it could allow an intruder to access not only your unmanaged device but also your router and, eventually, the company network. If you use MFA, you can be less concerned about a cybercriminal gaining access this way, thanks to the additional layers of security.

4. It allows your other security tools to perform properly

If a criminal steals over-simple login credentials, they can bypass antivirus software and firewalls like an authorized employee could – with some knowledge. This allows them to disarm your security and wreak havoc, all without you noticing anything is amiss.

With MFA in place, this can’t happen. Cybercriminals can’t use stolen credentials to access your network because they can’t pass these second and even third identity checks. MFA can also act as an alert that your accounts are at risk. If someone attempts to log in, you’ll receive a secondary authorization prompt you didn’t request. This can be immediately reported to ensure everything is safe and sound.

5. It keeps you compliant

When you handle and store sensitive data, your business must comply with local laws stating that you need robust authentication processes in place. MFA is a strong tool to keep the private data of customers, suppliers, and employees out of the wrong hands.

6. It can save a lot of stress

There’s always something to worry about as a business owner. Putting strong security measures like MFA in place can take a lot of weight off your shoulders. Better still, there’s less chance of an employee making an innocent mistake and revealing their credentials to a fake login site (we still highly recommend regular cybersecurity awareness training, though.)

Adopting MFA

MFA isn’t the answer to all your cybersecurity prayers. But it slams the door on most of today’s cybercrimes. So, if you don’t already have it enabled across your network and its systems, you might be leaving that door open to a cyberattack anytime.

MFA solutions are just one of the services we provide our clients daily. If you’re worried about protecting your business, get in touch now.

Information used in this article was provided by our partners at MSP Marketing Edge.

New data provides a multi-faceted look at the changing face of phishing attacks. This data includes who’s being targeted, the tactics used, and why phishing attacks continue to work.

If 2022 is any indication of what the remainder of this year will hold for organizations fending off cyberattacks, cybersecurity efforts are going to need a whole lot more emphasis.

According to Zscaler’s newly-released ThreatLabz 2023 Phishing Report, we get a view into the attack trends throughout 2022 that provide insight into what we should expect more of this year.

According to the report:

The number of phishing attacks rose 47% overall
The United States and the U.K. were the top two targeted countries
Education, finance, and government were the top three sectors, with attacks on education skyrocketing by 576%
Microsoft, OneDrive, and Binance were the top three impersonated brands

We’ve seen growth in phishing attacks for the last number of years. So, the increased growth Zscaler highlights cumulative year-over-year growth. It’s why we continue to see phishing as the most common form of cyberattack. This is also why no cybersecurity defense is complete without including Security Awareness Training to protect the organization when security solutions can’t.

Information in this article was provided by our partners at KnowBe4.

What’s the best way to ensure my people follow security best practices?

If you have good security in place and you’re regularly training your people – but find you’re still seeing human-error security issues – consider creating a strict policy that sets out the rules they need to follow and the consequences of not doing so.

How can I tell if all my applications are up to date?

It can be a big task to ensure everything is up to date and patched as required. An IT health check will show you everything you need to do. We can help with that. Just get in touch.

I have an in-house IT tech, but I need extra help. Should I outsource it all?

It doesn’t have to be an either/or solution. An external IT specialist can work seamlessly with an in-house team with great results.

Information used in this article was provided by our partners at MSP Marketing Edge.

Professional instructors from the SANS Institute recently detailed what they cite as the most dangerous forms of cyberattacks for 2023. Some of the key themes included the intersection of AI with attack patterns and the ways that attackers are taking advantage of flexible development environments.

1. SEO-Boosted Attacks

Just as regular businesses utilize search engine optimization (SEO) to boost the rankings of certain terms for the sake of marketing their products and driving traffic to revenue-generating sites, the bad guys also turn to SEO. In their case, they use it to boost the rankings of their malware-laden sites to send more victims their way.

2. Malvertising

Similar to how marketers utilize both organic search techniques via SEO and paid search techniques utilizing advertising, cybercriminals are doing the same. Drive-by attacks are also similarly fueled by malicious advertising (malvertising) campaigns that artificially boost the rankings of sites for certain keywords.

3. Developers as a Target

Developers are an extremely enticing target as they usually have elevated privileges across IT and business systems. Many systems they use can be subverted to poison the software supply chain, and they tend to work on machines that are less locked down than the average user to enable them to experiment with code and ship software daily.

4. Offensive Uses of AI

With the explosion of large language models (LLMs) like ChatGPT, defenders should expect attackers — even very non-technical ones — to ramp up their development of exploits and zero-day discovery utilizing these AI tools.

5. Weaponizing AI for Social Engineering

In addition to technical offensive uses of AI, expect attackers this year to drastically ramp up their use of AI to make their social engineering and impersonation attempts highly believable, warned Heather Mahalik, director of digital intelligence for Cellebrite and digital forensics and incident response lead for SANS.

Protect Your Organization

Organizations must stay vigilant and implement robust security measures to safeguard against these evolving threats. From security awareness training to XDR and SIEM solutions, Yeo & Yeo Technology is here to help. Get in touch.

Source: https://www.darkreading.com/attacks-breaches/sans-lists-top-5-most-dangerous-cyberattacks-in-2023

Several shocks have hit a world economy already weakened by the pandemic: higher-than-expected inflation worldwide, which is triggering tighter financial conditions, along with further negative impacts on supply chains from the war in Ukraine.

In fact, two-thirds (63%) of adults are worried about their finances now, compared to one-third (36%) during the pandemic, and 57% expect their financial worry to continue to rise.

This worry translates into pressure on salary increases by employees seeking to offset the increasing cost of living. Yet at the same time, companies may face pressure to halt hiring and reduce headcount costs.

As organizations navigate ongoing uncertainty and unpredictability, business resilience has never been more critical. As caretakers of the organization, there are multiple ways HR can support the business and its employees while building business resilience.

1. Manage fixed costs tightly

Your people are your biggest asset and, therefore, the highest cost – but keeping your top talent will pay dividends, as they could be the linchpins needed to ride out the economic storm successfully.

If you’re fearful that valued employees might be at risk of being laid off, look at your data to see if you can create a strong business case for retaining them. Any key performing indicators (KPIs) or productivity stats might be beneficial here.

Likewise, if their requests for a salary increase will cause them to leave, can you be smart and offer other incentives such as a four-day work week or a training course or qualification if there’s pressure on fixed costs?

Focus on productivity – ensure you’re paying for performance – and look at ways to boost employee productivity sustainably.

2. Increase total compensation through variable cost incentives

Consider using bonuses, stock grants, and other incentives to offset lower base salaries, and offer gift cards or equivalent (company-branded items, especially clothing) to help maintain motivation.

Be open and transparent about pay and benefits, communicating how the grading system works and how wage levels and salary increases are decided. If employees understand what’s happening at the top, they are more likely to respond better than if they feel they are being kept in the dark.

Finally, consider well-being incentives, offer additional paid time off, and remember recognition and spot awards as additional ways of recognizing successes in your workforce.

3. Offer flexibility as a financial incentive

Flexibility is a strong bargaining chip for most employees. A shorter working week – condensing someone’s hours into four days, for example – or offering an employee the chance to work part-time could hold a lot of weight with some employees.

Likewise, unpaid sabbaticals can be the perfect motivator for an employee considering traveling or taking some unpaid leave.

Although remote hybrid working feels like the norm, perhaps your company isn’t offering it as freely as possible. Investigate to see if there’s even more flexibility in how employees work that could be offered as an incentive.

4. Personalize employee experiences

Adjust management styles and deploy situational leadership where necessary to suit individuals and teams or squads and communicate early and often. Being open and transparent in discussing company performance will make employees feel valued.

Providing employees with more autonomy in decision-making where possible and creating a listening culture so you can act on feedback and communicate necessary actions or suggestions are all ways of generating personalized employee experiences.

Also, look at offering stretch assignments, growth opportunities, and meaningful and worthwhile work, as well as automating low-value or tedious work.

Behind every downturn is the chance to innovate

These things are just some of the tools are your disposal to enable you to not only support your employees but create an adaptive organization that’s agile, flexible, and resilient and one that can quickly respond to ongoing uncertainty and changing priorities.

Coupled with an agile, flexible cloud HR platform, you can enable rapid, data-driven decision-making, easily tailor employee experiences for individuals and teams, and support changing global policies and local compliance. Being prepared is always a smart move in uncertain times. That much is certain.

Information used in this article was provided by our partners at Sage.

ChatGPT is a chatbot that uses artificial intelligence, allowing you to talk to it in a very human way. It’s been making the news worldwide for some of the remarkable possibilities it seems to be creating. But what exactly is it, and why is it making such waves?

ChatGPT is trained on real human language. It can answer questions and compose documents, like emails, essays, and computer code. The exciting thing is that it allows you to have a natural-feeling conversation with it to generate different responses – perhaps adding more detail or asking it to use less technical language.

It was created by the research company OpenAI and funded and managed by some of the most influential names in tech. And while it’s still in its research and feedback-collection phase, it’s currently free to use (with limitations).

It’s different from a search engine because it’s designed with conversation in mind. While it can answer questions, it doesn’t search the internet for information. Everything is learned from training data (it has no knowledge past 2021). So, while many people have started using ChatGPT to write essays and articles, the facts may not be accurate. In fact, the tech media website CNET recently had to issue multiple major corrections after it created 78 articles using the chatbot.

Because it’s trained on vast amounts of text published online by humans, it’s had trouble telling fact from fiction and has also been found to reproduce some unwanted biases.

It’s not changing the world just yet. But it’s already clear that there is massive potential for individuals and businesses.

Information used in this article was provided by our partners at MSP Marketing Edge.

A threat is considered any malicious software or attack attempt launched at a vulnerability or weakness in your network infrastructure. There are nine major threat categories affecting most organizations today. They are:

Human error. This is the most common source of cyber threats. Most of these are social engineering attacks that play on the emotional state of endpoint users within the network’s infrastructure. Phishing is a prime example.
Unauthorized access. Hackers constantly use the latest techniques, tactics, and tips to infiltrate networks. These unauthorized users can potentially wreak havoc on internal infrastructure if they successfully bypass cybersecurity measures. Endpoint user error can also allow unauthorized access to the network through clicking a malicious link or opening an infectious file.
Unauthorized users misusing data. Once inside, threat actors, unscrupulous employees, or employees without the proper knowledge of cybersecurity best practices may change, remove, or misuse data without proper approval or authorization.
Data breaches and leaks. Hackers, incorrect cloud configurations, and careless endpoint users can all lead to data breaches or leaks. If sensitive data like personally identifiable information is leaked, this could be potentially catastrophic for your business. Depending on your industry, the breach could land you in legal trouble – potentially owing large sums of money in fines or sanctions. Data loss prevention investment is essential to mitigate or avoid these consequences.
Loss or corruption of data. If hackers successfully execute a data breach or your backup and disaster recovery (BDR) processes aren’t up to par, it could result in significant data loss or corruption.
Service disruption. In business, time is money. Any downtime for your system could cost future business and current revenue. Whether the downtime was accidental or intentional, service disruption costs you both money and reputation.
System failure. Digital threat actors may try to overwhelm and crash a system rather than send a malicious file or link. Any system failure, much like service disruption, can cause data loss or a costly pause in business operations.
Weather events or natural disasters. Natural disasters can cause significant damage and outages to critical server hardware and cloud resources. Fortunately, cloud technology alleviates this risk since business owners can migrate their important digital assets to cloud storage out of harm’s way.
Adversarial threats. These threats include any outside actors who maliciously and intentionally attack your systems. They can be perpetrated by hacker groups, unauthorized users, unscrupulous inside users, careless endpoint users, and more.

Cybersecurity risk management can help your organization

Cybersecurity risk management is an ongoing process of identifying, analyzing, evaluating, and addressing your organization’s cybersecurity threats. Your systems can be compromised in several ways, and, unfortunately, that list continues to grow. Effective cybersecurity risk management is about adopting an attitude of – “it’s not a matter of ‘if’ your networks get compromised; it’s a matter of ‘when.’”

How cybersecurity risk management works

While every business is different, there are general steps that can help organizations align to cybersecurity and risk management best practices. Professionals agree on four main stages of a sound cybersecurity risk management plan:

Identification – gauge the ability of your organization to identify current or future cyber threats. Call out and inventory any loopholes or vulnerabilities to the digital infrastructure that could affect daily business operations.
Assessment – Once risks are identified, they should be evaluated to see the level of threat they pose to your business. You and your team should also consider the potential impact of each identified threat.
Control – Suggest tools, techniques, tips, and technology that can be used to help you and your team minimize your organization’s cybersecurity risk.
Review – Take time to constantly review, update, and improve your controls to mitigate your cybersecurity risk. Adding, removing, or recalibrating security protocols will improve the system over time.

Getting started with cybersecurity risk management

One of the simplest ways to get started with cybersecurity risk management is to choose the right partner, and Yeo & Yeo Technology is here to help. We can help you choose the best tools for your business model and your team. Get in touch.

Information used in this article was provided by our partners at ConnectWise.

Your security stack is the foundation of your cybersecurity protection. Whether you’re building a stack from scratch or making updates and changes to your existing setup, it’s a task that needs to be done correctly and with cybersecurity best practices in mind.

Tech Stack

Determining your needs

The first step in properly building your security stack is assessing your needs. In general, there are six areas of business risk most organizations are likely to face:

Network perimeter security. This is a business’s first line of defense. It concerns risks of initial threat detection, remediation, and hardening endpoint terminals.
Internal security. Human error and data mismanagement can often lead to leaks or breaches from the inside. This usually happens when information is passed back and forth during internal communications. Internal security seeks to limit those occurrences and other internal threats – widely considered the most dangerous threat to cybersecurity.
Physical security. This risk area concerns the security of a system’s software and hardware. Mitigating this risk involves cybersecurity frameworks like Access Control and Zero Trust.
Incident response. No matter your cybersecurity setup, it won’t always offer 100% protection. How to respond to threats that get through the defenses is an integral part of a business’s risk and overall cybersecurity plan.
Long-term response. Businesses also need to focus on learning and reporting after successful attacks. Cyber forensics and in-depth reporting of previous cyber threats provide the necessary knowledge to strengthen defenses moving forward.
Cloud security. As the interest in cloud technology grows, so does the potential risk. 95% of security professionals have expressed some concern about the security of public cloud systems. This means that cloud security systems will need to keep pace as these environments become more complex.

Keep these six key areas in mind as you assess your current cybersecurity infrastructure and look for opportunities to optimize your security stack.

Essential tools for your security stack

One thing remains constant no matter how different security stacks can be. That constant is the fact that you need to use the right tools. As mentioned, it’s easy to become overwhelmed by the wealth of options and include too many tools when building your stack.

Here are five must-have tools when building your security stack (in alphabetical order):

Cloud security posture management (CSPM)
Endpoint detection and response (EDR) tools
Mobile device management (MDM)
Penetration testing capabilities
Remote access platform

Building your cybersecurity stack effectively is a balancing act. In theory, it’s easy to assume that the more tools you include, the better your protection will be. While this is true to a point, there is a point of diminishing returns.

Along with that, adding too many tools can make your stack overly complex and, ultimately, leave your system open to vulnerabilities. The goal is to build an IT security stack that includes as many useful tools as possible but doesn’t take away from its primary purpose.

Are you interested in building a comprehensive security stack for your business? We’re here to help. Contact us today.

My employees want fewer video meetings. Should we cut down?

Yes, if you can condense or combine them. Follow in the footsteps of big tech companies like Shopify and reduce the number of big meetings you hold. Your people will be happier, and you’ll likely save a lot of time.

I think I’ve clicked an unsafe link. What should I do?

The faster you act, the less damage or data loss you’ll have. Get in touch with your IT support partner immediately. It’s always a good idea to have a response and recovery strategy in place for when this happens.

I know I need a password manager, but which is best?

Good question… and there are lots of options. Different businesses have different requirements, so it all depends on you. We’d be happy to make a recommendation once we understand your needs. Get in touch.

Information used in this article was provided by our partners at MSP Marketing Edge.

Even as employees return to the office or enter a hybrid work schedule, wellness, and productivity remain top of mind for most organizations.

Why Does Employee Wellness Matter?

One of the biggest health concerns impacting wellness is physical inactivity. According to the World Health Organization (WHO), people who lead a sedentary lifestyle are at an increased risk of:

Cardiovascular diseases
Diabetes
Obesity
Colon cancer
High blood pressure
Osteoporosis
Depression
Anxiety

Another employee health concern is work-related musculoskeletal disorders (MSDs). About 1.8 million workers report MSDs like carpal tunnel and back injuries, and about 600,000 workers must take time off to recover from those injuries.

The work environment can positively or negatively impact these health risks and more, including productivity and overall satisfaction. That’s why employee wellness, which also encompasses mental health, is important to the individual and the company.

How to Improve Employee Wellness

One way employers can improve the work environment and positively impact employees’ well-being is through ergonomics. This means replacing a one-size-fits-all approach to an office set-up with individual accommodations that support employee safety, comfort, and health anywhere they work.

Enabling Well-Being at Home

For many, working from home means finding quiet corners and carving out workspaces in crowded homes shared by multiple workers or students. As a result, it’s not unusual to have a makeshift workstation that doesn’t provide good ergonomics.

As an employer, try these tips to help improve wellness for work-from-home employees:

Learn more about each employee’s working environment
Ask workers about their individual workspace needs
Provide ergonomic standing desks and monitor arms to encourage more movement
Schedule virtual lunches or social events to lift morale

Enabling Well-Being at the Office

Ergonomics is also essential for traditional office spaces where many employees struggle to create a comfortable, personalized set-up like they have at home.

Consider these options for your office:

Offer a standardized set of ergonomic products for employees to choose from
Provide personalized ergonomic assessments with a certified professional to ensure workspaces meet the needs of each user
Ask for feedback from employees about changes

Remember, the investment is worth it if employee wellness helps increase productivity and morale.

Enabling Well-Being for Hybrid Workers

Hybrid workers may be the employees who need ergonomic support the most. A 2022 survey showed that employees with a hybrid schedule reported that it was more emotionally draining than fully remote work and more taxing than full-time office-based work.

A hybrid worker has a different working environment and routine on different days of the week, making it difficult to adjust to each setting. Many hybrid employees use shared workspaces, which takes time and effort to adjust.

Try offering these solutions to meet the needs of hybrid workers:

Mobile standing desks that can be moved around the office for individual work or collaboration
A height-adjustable standing desk converter so each employee can quickly find their most comfortable working height, sitting or standing
Monitor mounts, monitor stands, and monitor arms that support personalized screen views

How to Put an Employee Wellness Plan in Place

Every organization and employee culture is different, so there’s no set way to implement an employee wellness plan. That said, here are a few steps to get you started:

Assess the current state of employee wellness and where to improve.
Plan for changes that need to be made and prepare management accordingly.
Implement changes through communication and culture shifts.
Evaluate the effectiveness of changes and adjust for future success.

In ever-changing work environments, it is vital to support employee wellness to care for employees, and to help boost productivity and efficiency. Want to learn more about ergonomic solutions for your organizations? Contact us today.

Information used in this article was provided by our partners at Ergotron.