Initially a problem affecting only large organizations and governments, ransomware is now a scourge impacting SMEs. Indeed, their cybersecurity budgets are generally smaller than large companies, SMEs are easy prey for malicious people. But what is ransomware, also known as Ransomware in English? Ransomware is malicious programs that encrypt your data to make it inaccessible without the attacker’s key. To get the key, and therefore your data, you have to pay a ransom. A new trend is in addition to encrypting your data, attackers exfiltrate it to sell it on the black market; giving them a second source of income.

How is the attack going?

An employee receives a malicious email inviting him to click on a link or visits a hacked site that contains malware. The employee runs the software and the software scans local files and files on the network and encrypts anything of value (word, pdf, excel, cad, etc.). When the job is completed, a message appears on the user’s screen telling them how to pay the ransom.

How can I protect myself from it?

Having local backups is not enough to protect you from this attack as your backups could also end up being encrypted by ransomware, thus trapping you. Your backups must therefore be hosted externally, on a disconnected hard drive or at a cloud provider, for example.

Some antiviruses also offer ransomware detection which can effectively block malware.

Finally, reducing access to files to employees who really need them can greatly limit the damage in the event of an attack. If employees only need to read purchase orders, giving them write permissions puts your business at risk.

Need help?

Our team of professionals is at your disposal to guide you in making decisions related to information technology. Contact us for more information!

The post Ransomware appeared first on CertiNET.

The analysis of the most recent attack on the services of the Canada Revenue Agency (CRA) is not yet complete as we already know what could have enabled this attack: passwords reused from another site having been hacked. The CRA’s case is not isolated, over 15 billion accounts (username and password combinations) are currently for sale on the darkweb.

Too many people reuse the same usernames (often email) and passwords on different sites, allowing malicious people who have successfully hacked into one website to reuse these accounts on other sites; including government or banking sites.

How can I protect myself from it?

Starting with the most sensitive sites and systems, especially those containing confidential or financial information, a unique and strong password should be used by every employee with access to these systems. Users having an identity on nearly a hundred sites and systems, how to get there? Here are some possible solutions:

Single sign-on (SSO)

This technological solution makes it possible to delegate the authentication of a site or system to an entity dedicated to performing the authentication. Very practical for the user who then has only one strong password to remember, the fact of having a dedicated and centralized system makes it possible to monitor unsuccessful connection attempts and to add controls add-ons such as multi-factor authentication.

Multi-factor authentication

There are three (3) ways to authenticate a user: by what he knows (ex: password), by what he is (ex: fingerprint) and by what he has (ex: a house key). So how much more than one authentication factor is multi-factor authentication. When you withdraw money at the counter, for example, you must provide your bank card (owns) and your PIN (knows). By combining a 2nd factor authentication with your password, you make it even more difficult for an attacker to steal your digital identity. There are many free mobile apps that can help you.

Password manager

The previous two solutions require that the site or the system support these features. When this is not the case, the password manager can still be used. This allows you to generate and save all your passwords. Some even offer you to fill in the fields for you when you authenticate. Several free apps can help you.

Need help?

Our team of professionals is at your disposal to guide you in making decisions related to information technology. Contact us for more information!

[i] https://resources.digitalshadows.com/whitepapers-and-reports/from-exposure-to-takeover

The post Password and authentication appeared first on CertiNET.

You’ve probably heard of cloud computing in the past few years, but what is cloud computing? Is this a solution for large companies only?

Cloud computing is the process of renting IT equipment, such as an application, CPU time, or disk space, and accessing it remotely, usually over the Internet.

This solution can be very beneficial in reducing your operating and maintenance costs, increasing your speed, getting started and growing quickly without having to invest huge sums of money. There are three types of cloud (SaaS, PaaS and IaaS), although subcategories have been added over time by marketing from some vendors.

Amazon Web Services (AWS), Microsoft Azure, and Google Cloud Platform (GCP) are the biggest players in the market, but other smaller players are worth considering because they may offer better prices for certain services.

Software as a Service (SaaS)

A SaaS is an application hosted and maintained by the provider. With a subscription, the customer can consume this application remotely without worrying about the infrastructure of the servers behind. Updating servers, making backups, configuring server security are all supplier responsibilities. The customer for his part must manage access to his instance of the application and manage the content.

Common examples: Office 365, Salesforce, Microsoft Dynamics, Gmail, Dropbox, Zoom

Platform as a Service (PaaS)

Do you do software development but can’t afford to manage the infrastructure to do it? A PaaS can be the solution by offering you components such as databases, web services or others without having to manage the servers supporting them.

Infrastructure as a Service (IaaS)

Need to run a big report that takes several hours on your server, but don’t want to invest several thousand dollars for a task that only runs a few times a month? Why not rent one or even several servers for a few hours a month? For prices ranging from pennies to dollars an hour you can use a state-of-the-art server without having to find a place to store it. In an IaaS mode you are however responsible for all the security of the server as if it were your own, but nothing prevents you from destroying it and starting a new one each time you use it since you can even schedule the creation and destruction. of a server!

Need help?

Our team of professionals is at your disposal to guide you in making decisions related to information technology. Contact us for more information!

The post Cloud appeared first on CertiNET.