4 min read

Important IT Security Reminders

I recently sent this reminder out to my consulting clients.  I thought I would post this here as well in case it might be helpful for any of you.

=========

Recently, I have seen an uptick in the number of machines infected by a category of malware, known as ransomware, particularly Crypto Wall 2.0.  New IT security threats are constantly emerging.  In many ways, none of this is really anything new.  However, as your trusted IT consultant, I wanted to pass along some information that I hope might be helpful to both you and your users.  It is more important than ever to make sure you and your businesses are well protected.  With a few exceptions, we are sending this reminder to our primary contact for each account.  Feel free to distribute this as you see fit.

A note to IT professionals:

I’m providing this information to you to serve as a reminder of things to consider.  You have my permission upfront to modify this information as you deem appropriate and send it out to others who might find it helpful.

A note to those of you who are not IT professionals:

Many of these suggestions are aimed at individual computer users.  If you are not an IT person, and you work on a computer network maintained by an IT professional, you should discuss these issues with your IT pro and NOT take action on your own.  In many cases, these same problems need to be handled differently on larger corporate networks.  If I happen to be the IT pro who helps you maintain your network, I’ll be happy to discuss these issues with you further and provide specific suggestions for your environment if you would like.

Suggestions:

1) Make sure you have good/successful backups of the data you care about.  This is important for many reasons, but simply having good backups of your data provides you the foundation to be able to recover should you be impacted by any event that destroys your data.

  • Think about how often your data is backed up.  You need to be able to handle the loss of the data since your last known good backup.  If you can’t do this, you need consider backing up more often.
  • Make sure you are monitoring your backup systems on a daily basis.  All too often backup systems fail silently.
  • Your backups need to be isolated from your production systems.  For example, if your PC was infected by ransomware, it is important that your backups are located in a location that the ransomware can’t reach (isolated cloud storage / disconnected external hard disk drives, etc.).
  • Run a periodic test restore from your backup system.  This tests the system and will help you discover any issues with the system itself before you are relying on it to save your data.

2) Use an alternate web browser.  We believe that currently Google Chrome is the most secure option.  However, Firefox also has an excellent track record.

2) Run Adblock Plus.  Adblock Plus is a browser add-in that blocks most ads embedded in web pages.  Running a tool like this will help prevent you from becoming infected by a malicious ad, potentially served up on a seemingly legitimate web site.

3) Uninstall Java.  If you can’t uninstall it entirely (because you use a program that requires Java) consider disabling it in your browser.

  • If you must keep Java be sure to keep up to date with the latest versions and security patches as they are released.  You can check the version you have now, and update if needed here.  Be careful when updating Java to make sure and de-select any additional bundled downloads you may be offered.

4) Make sure you have the latest version of Adobe Flash and Adobe Reader installed.  

  • Be careful when updating these tools.  Make sure to de-select any additional bundled downloads you may be offered,
  • Also make sure you have both of these set to update automatically when Adobe releases updates.
  • Out of date, vulnerable versions of these tools are some of the most attacked versions of software because both are often exposed through your web browser.

5) Run up to date antivirus software.  If you have not already, by now some of you are thinking: “Hey wait a minute, isn’t my antivirus software supposed to protect me from this stuff ?”  The sad truth is this: it simply is not capable of doing that in the comprehensive way that you may have been lead to hope and expect.  Anti-virus / anti-malware software does protect you from some threats, but, regrettably, it is woefully inadequate alone to protect you from many of these emerging threats.  Even with that being the case, we still recommend that you run anti-virus / anti-malware software.

6) Make sure you are current on all security updates for your operating system, and that your computer is configured to install these updates as they are released automatically.

Microsoft, Apple and other operating system vendors are constantly releasing security updates to correct problems they have found.  It is important that you make sure these updates are installed on your computer.

7) Be extremely careful when clicking links in email.  Deceptive links in e‑mail messages are often used as part of phishing and spyware scams.  Clicking a deceptive link can take you to a webpage that attempts to download malicious software onto your computer.  If you have any doubt, don’t click on a link.

  • If you feel you must click on a link embedded in an email, and you have any question in your mind about its legitimacy, I would suggest copying the link and pasting it into VirusTotal here.  VirusTotal will scan the site that the link goes to for known malware etc.
  • Please be aware that VirusTotal may not identify potential phishing sites that attempt to get you to enter credentials.  Most of those sites contain no actual malware at all.  They are simply configured to trick you into giving them your personal information.

8) Check your PC for other outdated software that might be vulnerable.  While the applications we mentioned above are the most targeted, if you would like to check your PC for other applications that might also be out of date and vulnerable feel free to download and run this tool on your system.

9) Use encryption software to protect sensitive data.  Using encryption software like Microsoft Bitlocker can protect that data on your hard disk drive in the event that your PC is lost or stolen.  In addition, many newer hard disk drives support hardware based AES encryption that provides a similar level of protection implemented at the hardware level.

10) Use unique passwords for each site or service that you use.  This can be very hard to do.  However, using a password manager can help you use complex and unique passwords for each site.  Our current favorite password managers are LastPass and Roboform.

While sadly no amount of work can be done to guarantee you 100% protection, doing the things listed above will go a long way towards making your data more secure.

David Winslow