phishing – Technology News and Information by SeniorDBA

5 Common Types of Cyber Attacks

Cybersecurity is a crucial aspect of any organization that relies on digital systems and networks. Cyberattacks can cause significant damage to the reputation, operations, and finances of a business, as well as compromise the privacy and security of its customers and employees. Therefore, it is important to understand the different types of cybersecurity attacks, how they are used, and how they can be prevented.

In this blog post, we will discuss 5 common types of cybersecurity attacks that every organization should be aware of and prepared to remediate.

Types of Attacks

1. Malware
Malware is a term that encompasses various types of malicious software, such as viruses, worms, trojans, ransomware, spyware, adware, and more. Malware can infect a computer or device through phishing emails, malicious links, downloads, or removable media. Malware can perform various harmful actions, such as deleting or encrypting data, stealing information, spying on user activity, displaying unwanted ads, or hijacking system resources.

To prevent malware attacks, organizations should use antivirus software and firewalls, update their systems and applications regularly, avoid opening suspicious attachments or links, and educate their employees on how to recognize and avoid phishing emails.

Continue reading “5 Common Types of Cyber Attacks”

How to Create a Secure Windows 10 Workstation for Beginners

If you are new to Windows 10 and want to create a secure workstation for your personal or professional use, this blog post is for you. In this post, I will show you how to set up a Windows 10 workstation with some basic security features that will help you protect your data and privacy. Here are the steps you need to follow:

Continue reading “How to Create a Secure Windows 10 Workstation for Beginners”

How to Report Smishing to Your Cell Phone Service Provider

Smishing is a type of phishing scam that targets your cell phone through text messages. The goal of smishing is to trick you into clicking on a malicious link, downloading a harmful attachment, or revealing your personal or financial information.

Smishing can be very dangerous and costly, as it can expose you to identity theft, fraud, malware, or unwanted charges on your phone bill. It is important to know how to report smishing to your cell phone service provider if you receive a suspicious text message.

Here are the step-by-step instructions for reporting smishing to your cell phone service provider:

Continue reading “How to Report Smishing to Your Cell Phone Service Provider”

Cybersecurity Tips for Grandparents in 2022

As we approach Grandparents Day on September 11th, we need to help educate our friends and family on a few easy to communicate cybersecurity tips to help them stay safe. Sometimes it can be difficult to communicate technical information in a way that non-technical people can understand and retain.

Stay Skeptical

Some people, especially older people, assume the best from people they interact with, even in a virtual environment. You should encourage them to never assume that a stranger online is a trustworthy person. Even if the message appears to come from someone they know, they should exercise caution when anything arrives via email, instant messaging apps, or social media. If in doubt, throw it out!

Don’t click that link

A phishing attack typically begins with an unsolicited email or social media message in which the fraudster impersonates a trusted entity and attempts to persuade you to hand over your sensitive data, such as credit card details or login credentials. Be wary of clicking on links or opening attachments in emails even if the message appears to be from a known and trusted source.

There is no free lunch

You didn’t win anything and you should never trade something of value for a chance any winning something. A message might warn you that time is limited and you don’t want to miss an opportunity to get a free prize, but never send money or your valuable information to collect a free prize. Never send anything of value (credit card data, gift cards, etc.) in response to these types of messages.

Never Send Money

Romance scams have been high on the list of the most common scams against seniors for many years, which may not be surprising in the sense that loneliness is one of the most common issues many seniors face. Never send money to anyone for any reason because it is probably a scam. Even if it is a loved one needing bail money, call the jail or bail bondsman directly to arrange payment.

When in doubt, Hang up

If you feel a con artist is on the other end of the phone, hang up immediately. If they are threatening you with jail time if you don’t send money, hang up and call the police to let them know what is happening.

Cybersecurity Tips for Your Family

You often see cybersecurity tips and techniques for corporate environments, but what about tips for your friends and family? What are the basic ways your family can stay safe while online? Share these tips with you friends and family, including your older family members.

The important thing to remember is the internet is a collection of people from all over the world, including criminals. They will prey on the weak and uninformed to steal everything from them, and a little awareness can prevent someone you care about from being a victim of crime.

Think Before Clicking – While using the internet on your personal computer, tablet, or cellphone always think before you click that link in an email or text message. Do you know where that link with take you, and does it contain potential malware? Links in mails and text messages that claim to be password recovery solutions or links to online bank statements are among the most popular methods used by hackers to trick you and gain your personal information. When in doubt, don’t click suspicious links.
Use Strong Passwords – People have a tendency to underestimate the importance of passwords and will often select weak passwords. Your password is much like the deadbolt used to secure your home. That security feature is something you need to use in order to keep criminals out of your house. Your password is the deadbolt to your online accounts. You should select a long and complex password for your online accounts, and each account should have a unique password. Don’t use weak passwords or the same password on two or more accounts. A strong password is one that is really hard for someone to guess and is at least 10 characters long, with lots of numbers, letters, and symbols.
Use a Password Manager – A password manager is a program that saves all your passwords in one place, and those passwords are secured with encryption. You can access them with one long password. This makes it easy to create very long complex passwords for every online account, and you don’t have to worry about remembering them or writing them down. For those people that are technology averse, you can get a password book at the local bookstore to jot down their passwords. While not as easy as one on your device, it may be a suitable alternative for some people.
Set up Multi-factor Authentication (MFA) – If I can guess someone’s password, there is nothing that keeps me from logging into your account as you, but just setting up MFA makes that type of attack really hard. When possible, enable MFA on all your online accounts. It is a simple way to prevent unauthorized access to your accounts. MFA is usually a message or code copied from your cellphone as a second method of authenticating you to a website. It sounds much harder to use than it really is, and it can save your private data from being stolen.
Apply Updates – When a vendor is notified that there is a security issue with their software, they will usually issue a patch within a few weeks to block those types of future attacks. You should frequently check for patches for your devices and apply them as soon as you can because this will help keep the bad guys out of your laptop, tablet, or cellphone.
Use Anti-Virus Software – You can do everything correctly and you still might get malware onto your laptop. A good anti-virus program can be your last line of defense to block the execution of the malware and save your data. While not 100% effective, it is a layer of defense that can save you at the very last second when you really need help.
Avoid Debit Cards for Online Payments – When paying online, avoid using a debit card. If the debit card number is stolen, a fraudulent charge can empty your checking account, causing other payments to fail. Yes, you can work with your bank to have the fraudulent charges reversed, but this can take several days. During this time, you may not have access to other sources of cash, leading to major headaches.
Social Media is Dangerous – Reading and posting on social media sites can be educational and informative. It can also be very dangerous. People often aren’t who they say they are, and they will attempt to commit fraud. They will lie to you to steal your money, identity, or personal data. Limit what you say on social media. Avoid sharing personal details, like your home or work address, birthdays, information about your children, sensitive photographs, or images of identifying documents like airline tickets or driver’s licenses. Even a picture of your house key can invite an unwanted visitor to your home.
Backup Your Data – If it is important to you, you should have a copy of the data somewhere safe. All those pictures on your cellphone could be deleted by malware in seconds. Tax documents could be encrypted and you might have to pay thousands to get them back. By making a copy of the data, usually by copying the data to the cloud, you can avoid those concerns and feel safer in the process.

Just having a brief conversation about these topics with someone you care about can help them avoid a major issue down the road. Wouldn’t you rather answer a few questions about how to avoid phishing emails than a few questions about how to get their deleted files back?

8 Small Business Cybersecurity Tips

There are about 80 million businesses worldwide who meet the “small or medium business” (SMB) definition. Businesses with less than 300 employees can’t always afford someone to tell them what they can do to develop a more mature security posture or how to educate employees to be smarter about their cybersecurity practices. Most of the successful cybersecurity attacks are with small businesses and small government entities. Since the average cyberattack will cost them about $200k and a ransomware attack can force them out of business, we should talk about the basics of cybersecurity defense.

Make sure you require complex passwords for every system. This means changing any vendor default passwords, not allowing simple or common passwords, and teaching your employees how to select a good password.
Configure Multi-Factor Authentication (MFA) on all accounts. Just by requiring MFA to access business accounts you can prevent about 99% of all online attacks. The hackers might steal or guess your password, but it is much harder to access something like your cellphone.
Use a separate account for performing administrative tasks for all your on-premise and cloud business accounts. Use this new account to only perform administrative actions, not to browse the internet or check email, and your risk of account compromise is significantly reduced.
Install, properly configure, and use an antivirus solution that accesses the cloud to better protect your systems from the internet threats. This includes all your user computers and all servers.
Backup your important files to the cloud. Using an automated solution to automatically backup your files to the cloud can prevent a successful ransomware attack from locking you out of your critical files.
Don’t allow your users to configure email auto-forwarding rules in O365. If your account is hacked, one of the first things the attacker will do is configure auto-forwarding rules to exfiltrate your data to their systems across the internet. If you prevent this activity, it will slow down the attack and allow you more time to react. With alerts configured, you will get an email when the attacker attempts to create a new rule, giving you notice that an attack is underway.
Use your available online tools to get tips and suggestions. Things like the Microsoft O365 Secure Score can be a really helpful source of useful tips and techniques for leveraging many more security settings to improve your overall security, and these tips are free just for having an O365 account.
Educate your users about the threats on the internet. Billions of users have internet access, and not all of them have your best interests in mind. Warn users about sharing too much personal information on social media, discuss how to identify phishing emails, and provide guidance on who they need to contact if they aren’t sure about clicking on a link.

You need to think about how you use the services and systems that you have access to each day and determine what data you share has value, what processes are at a high risk, and how a malicious user might monetize your activity. A little work today can pay big dividends during an attack.

Follow these simple tips to start getting some confidence around your security posture, and build on each item as threats and systems change.

Coming Soon: Microsoft Defender for Office 365 Changes

Microsoft is updating Defender for Office 365 soon to help protect customers from embedded email threats while they are previewing quarantined emails. Microsoft is rolling out more quarantine management features that will help allow IT professionals and end users to better investigate quarantined emails:

Quarantine folder policy and user release request workflow
Customer organization branding
Streamlined email submission from the quarantine portal
Robust release of bulk quarantined emails
Secured preview of quarantined emails
Quarantine support for shared mailboxes

Microsoft Defender for Office 365 (previously Office 365 Advanced Threat Protection) provides world-class protection for enterprise email accounts against threats that include business email compromise and credential phishing. They even have some features that help with automated attack remediation.

These new enhancements should help limit risk to unwanted or malicious content by providing additional security controls to help block embedded threats to help prevent threat actors from knowing their intended victim has loaded an image or other embedded content in the quarantine preview.

“We’re changing the way users preview quarantined messages to provide additional security against embedded threats,” Microsoft explains on the Microsoft 365 roadmap. The idea is to provide some additional controls when previewing an email to make sure the threats are contained and the sender is less likely to know you have contained the suspicious email. With this change some components in quarantined messages will be distorted and not displayed by default. To see the full contents of the message, users can choose to reveal the full message.”

Other new features will allow for more control over quarantine items, release workflow options, corporate branding, and support for shared mailboxes.

Microsoft also plans on adding more intelligence around what kinds of attacks are targeting your business and options around how to deal with ongoing threats.

Cybersecurity Awareness Training

Every organization should have an employee cybersecurity awareness training program to help educate all employees about their responsibilities in keeping corporate assets secure, how to secure their computer systems, and help them develop a basic understanding of how to secure their internet accounts from compromise.

Most cyberattacks are coming from hackers, organized crime, and state sponsored attackers in the form of phishing emails, compromised attachments, and malicious links. Users have to be trained on their role in securing the environment. Users must be given the training and awareness to identify threats and avoid making a poor decision or a simple mistake that could cost the business millions of dollars in lost revenue or ransomware payments.

The basics of user cybersecurity awareness training is specific coursework, usually video-based, that helps all employees understand the general threats in todays internet-based workforce, how they fit into that threat landscape, how they become a target for hackers, and what they can do to keep their corporate assets secure from attack. This type of information is usually easily transferable to the employee’s personal life. Your personal Twitter or Facebook account isn’t a corporate asset, but the techniques and methods in the training can usually be applied to those online accounts to make them more secure as well.

What is Cybersecurity?

Cybersecurity is the process of protecting networks, systems, data, and programs from digital attacks. Cyberattacks are usually organized and planned attacks intended to gain unauthortized access to business or personal computer systems to allow changing, stealing, or destroying sensitive information. This activity can lead to unplanned business interruptions or subject the victims to extortion in order to get continued access to their data or to prevent the release of sensitive data to the internet.

Understanding Cybersecurity

Cyberattacks are often launched by people employed by organized crime or malicious state actors and are constantly evolving their attacks from one technique to the next as older techniques become less effective and newly discovered vulnerabilities are weaponized.

You don’t have to be a cybersecurity expert to understand the risk and learn how to provide some basic protection for your systems and critical data. This article is intended to provise some basic guideance and to send you in the correct direction to become more effective in protecting your personal or business data.

Continue reading “What is Cybersecurity?”

Securing Windows 10

A Windows 10 laptop right out of the box is not a truly secure laptop. Building a secure laptop using Windows 10 will take a little work. Microsoft has done a good job balancing usability and security, making sure the device is mostly compatible with what an average person wants to do without security getting in the way.

If you want a secure laptop there are some tweaks you need to make to get your laptop to the next level of security. Some are done by default, but you should make sure you have the settings correct, and some of off by default so you’ll need to configure the settings and turn them on.

I’ll go through some of the settings to show you how you can go from default settings to secure, but you have to understand there are always more things you can do to make your Windows 10 device even more secure. Continue reading “Securing Windows 10”

Protecting High-Profile Employees from Cyber Attacks

As you look to protect your employees from a cyberattack, there are specific steps you must take that include training your employees how to detect and avoid phishing emails, training all employees on how to select and protect a complex password, helping employees configure and use MFA for all their business accounts, providing secure laptops to remote workers, etc. But what about those employees that present a higher risk, based on their knowledge, location, system access, or activity? Higher profile targets have a greater risk of attack and breach of essential data, so what can you do to provide elevated security?

As with a lot of things in life, a “one size fits all” type of security may not adequately protect these high-profile accounts from compromise. Many of your users may be low risk users that aren’t subject to a concentrated attack. All accounts must be protected to prevent a successful attack on a common user from being leveraged to gain access to the privileged accounts. Privileged accounts (usually an administrator-level account) must be protected to prevent an attacker from using stolen credentials used by these privileged accounts to gain elevated access to the network and company resources.

Traditional high-profile accounts also belong to executive members, members of the finance team, the payroll department, and accounts used to control corporate social media accounts. Continue reading “Protecting High-Profile Employees from Cyber Attacks”

Cybersecurity Tips for 2020

As we get ready for 2020, we need to help educate our friends and family on a few easy to communicate cybersecurity tips to help them stay safe in the new year. Sometimes it can be difficult to communicate technical information in a way that non-technical people can understand and retain.

Stay Skeptical

Some people, especially older people, assume the best from people they interact with, even in a virtual environment. You should encourage then to never assume that a stranger online is a trustworthy person. Even if the message appears to come from someone they know, they should exercise caution when anything arrives via email, instant messaging apps, or social media. If in doubt, throw it out!

Don’t click that link

A phishing attack typically begins with an unsolicited email or social media message in which the fraudster impersonates a trusted entity and attempts to persuade you to hand over your sensitive data, such as credit card details or login credentials. Be wary of clicking on links or open attachments in emails even if the message appears to be from a known and trusted source.

There is no free lunch

Never Send Money

Romance scams have for years been high on the list of the most common scams against seniors, which may not be surprising in the sense that loneliness is one of the most common issues many seniors face. Never send money to anyone for any reason because it is probably a scam. If it is a loved one needing bail money, call the jail or bail bondsman directly to arrange payment.

When in doubt, Hang up

Infosec Infographic Collection

I did not create these informative images, but I thought you would appreciate them:

Continue reading “Infosec Infographic Collection”

Types of Attacks

Share this:

Like this:

Share this:

Like this:

Share this:

Like this:

Stay Skeptical

Don’t click that link

There is no free lunch

Never Send Money

When in doubt, Hang up

Share this:

Like this:

Share this:

Like this:

Share this:

Like this:

Share this:

Like this:

Share this:

Like this:

Understanding Cybersecurity

Share this:

Like this:

Share this:

Like this:

Share this:

Like this:

Stay Skeptical

Don’t click that link

There is no free lunch

Never Send Money

When in doubt, Hang up

Share this:

Like this:

Share this:

Like this:

Share this:

Like this: