All Posts By

James Berger

cloud migration

5 Key Questions to Ask Before a Cloud Migration

By | Cloud

As businesses strive to keep pace with the demands of the digital age, many are capitalizing on the efficiency and scalability advantages of cloud computing. While operational speed and efficiency are critical, migrating to the cloud is about determining what is best for the business―not solely about cutting costs.

Every cloud deployment has its own unique risks and limitations. However, these risks can be minimized by following a carefully planned migration strategy that details precisely which workloads are best suited for the cloud; what specific business value your organization hopes to gain from the cloud; and how success will be defined and measured.

Cloud migration is never simple, but with proper planning and the right approach, you can minimize your risk and optimize your return on investment. Following are five important questions you should ask to help ensure you migrate to a cloud environment that best aligns with your business needs.

 

  1. What is your core business reason for migrating to the cloud?

 

The first step to effective cloud planning is to identify your business goals and understand how the cloud will support those goals. Work with your internal team to carefully evaluate your business priorities, internal processes, operational requirements, and long term strategy.

Be sure to clearly define why you are moving to the cloud and consider the resources and infrastructure you need to make that happen. What does your organization truly require from a cloud environment? What shift in strategy do you expect your business to make in the next few years? What new or emerging technologies should you consider in your migration plans?

While the benefits of cloud computing are attractive, be realistic and realize that not all workloads are a good fit for the cloud. Consider your infrastructure constraints and business priorities. Evaluate and prioritize each workload or application since this will help drive core migration decisions, including cost and timing. How will ongoing market pressures and economic uncertainties impact your IT systems and infrastructure needs?

With a better understanding of how applications and workloads are being utilized, accessed, and created, you can more easily determine the ideal cloud architecture and deployment model. In some cases, a hybrid cloud approach may be the best option. This will allow you to optimally balance data and applications between public and private cloud environments while improving your ability to respond to shifts in workload demands, supply chain weaknesses, and changing market dynamics.

Ultimately, your cloud environment should reliably and efficiently meet the performance requirements of your business, including the need for ongoing sustainability, information security, regulatory compliance, as well as operation efficiency and technology optimization.

 

2.      How will you accurately estimate migration costs?

 

While the cloud offers the potential for substantial cost savings, without proper planning, costs can quickly spiral out of control. It’s important to understand the rate structure and how you will be charged for the proposed cloud services you are migrating to.

Be sure to take into account the cost of software licensing, infrastructure upgrades, outside contractors and the cost of initial and ongoing technical support. Keep in mind that costs typically increase as you scale your workloads or user count. These figures need to be as realistic as possible to ensure reliable budget forecasting.

Estimating the cost of a cloud migration project can be difficult even for the most seasoned professional. Be careful not to stretch your resources too thin. Some applications function differently in a cloud environment cloud. On-premises performance metrics―while a suitable reference― aren’t always correct. Therefore, you’ll want to incorporate a backup plan in your budget to support extra resources if required.

Having a clear picture of your project needs and budget requirements upfront will help minimize the chance of surprises and migration delays. Often a safer approach is to focus first on a single cloud migration effort and prepare a budget with room to spare as opposed to trying to execute multiple projects in a rapid fashion and come up short if costs shift higher than expected.

To help minimize the chance of cost overruns and project delays, consider working with an experienced cloud consultant who already has a reliable and proven migration methodology. Utilizing the latest virtual technology platforms combined with a modern approach to cloud planning and deployment will help ensure you get a tailored, ROI-focused solution.

 

 

3.      Do you the resources and expertise needed for an effective migration?

 

From security and troubleshooting to backup and recovery, there are a lot of moving parts when it comes to planning and deployment. To avoid missteps, make sure you have a knowledgeable implementation team in place early in the decision-making process. Expert planning and advice can mean the different between success and failure.

Your in-house IT team may be best positioned to move your internally developed applications and files to the cloud, but may be less equipped to manage other migration tasks such as moving e-mail systems or file shares. As skill gaps are uncovered, asses the cost-benefit advantages of training your team to handle the task. Be sure that critical areas like security and compliance, managing costs, and governance are properly addressed.

When choosing an outside consultant, look for one with an established record of success in your industry, demonstrated skill in your particular type of project, and equipped with the resources and tools needed to ensure the project is a success. Make certain that your service-level agreements have defined timelines for each stage of the project..

Keep in mind that a delay or failure of your cloud migration project can cost you substantially in lost opportunity and competitive positioning. Teaming with the right cloud partner can help ensure that critical elements stay on track, including go-live schedules, project costs, and business-aligned outcomes.

 

4.      How will you manage data security?

 

One major advantage of cloud computing―flexible data access―can become a huge liability if security is not effectively factored into the equation. That’s why security concerns should be addressed early in your cloud migration project.

Building a solid security foundation requires an IT infrastructure and operating culture that not only safeguards data and mitigates risk, but helps make the business more agile, responsive, and transparent. Although there is no way to defend against all threats, new tools and techniques for detecting and malware and securing networks and endpoints can help protect data without hindering  mobility or productivity.

Technology plays a critical role, but equally important is the need to create an informed and educated security culture. Bad actors and cybercriminals s are continuously exploring new ways to penetrate your defenses, which underpins your need to create a solid culture built around knowledge, awareness and responsiveness.

User policies define acceptable and unacceptable behavior and actions.  You’ll want to work with your IT team to outline and enforce practices and policies based on user preferences and business requirements unique to your specific market.

Regulatory compliance is another important consideration. Based on your unique requirements, you might need to store certain types of data particular region or some data may be best suited for on-premises storage.

Strong application controls like encryption and authentication can help safeguard information across networks and on endpoint devices, helping to thwart attackers from transferring or copying critical business data. Your cloud provider should be able to provide documentation that shows a separation of duties for administrative functions, disclosing the level of access that each user has and how those levels are maintained.

 

5.      How will you recover if data is lost or stolen?

 

Data security and business recovery are among the top critical factors to consider in cloud planning decisions, particularly if your business operates in a regulated environment. In the event of a security breach, you need to be able to restore information and recover quickly.

After identifying and prioritizing the data and applications and you’ve defined your recovery time objectives, your business can establish a solid foundation for a cloud-based disaster recovery solution.

At the center of any good disaster recovery plan is a strategic guidebook that defines processes and outlines procedures to be followed in event of a security breach. This guiding document includes potential scenarios with detailed steps and actions to be taken to minimize the business impact of data loss and allow vital business applications and systems and to be restored and recovered quickly.

The primary goal of disaster planning and recovery is to minimize the impact of a security breach or data loss on business operations and performance. With a properly designed cloud-based disaster recovery plan, mission-critical workloads will failover to a recovery site. Once data is restored, systems can failback from the cloud, and applications and workloads can be restored and re-established to their original condition ―while downtime and disruption are minimized.

Although there is no perfect model or ideal configuration backup and recovery, a smart best practice is to make sure you have employed effective failover measures for all connected devices. A frequent entry point of many attackers is through out-of-date firmware on endpoint devices. That’s why it’s imperative to make sure all of your networks and devices are effectively hardened and capable of protecting against today’s increasingly sophisticated cyberattacks.

 

Establishing a Solid Foundation

As with any IT investment, certain risks come with cloud migration. Minimizing those risks and capitalizing on the full potential of cloud requires a strategic, pragmatic approach, evaluating essential infrastructure requirements, risk factors, performance needs, and cost considerations.

VP-Small-Business1 - Bacsit

Building the Framework for a Better IT Experience

By | managed It services

In an era where technology often drives business growth, efficient and reliable IT performance is more critical than ever. To remain competitive, you need an IT service provider that not only understands the technology landscape, but also is focused on helping you solve business challenges, drive efficiency and build lasting value.

Understanding what IT capabilities your business needs to reach its goals is essential. Knowing how to get it done ―the planning, strategy and execution―is equally important. A results-focused, customer-centric approach to IT service requires close collaboration between the client and the IT consultant.

That’s why it’s important to choose an IT provider that not only has superior technical skills, but is also focused on delivering exceptional customer service. Finding the best match for your unique needs will help ensure you get the results you want and can set the stage for a high-productive, long-term relationship. Following are some key customer experience attributes to keep in mind as you evaluate your IT service provider.

 

  • Effective onboarding: Becoming a company that delivers excellent customer service requires many things to be done well. One of those is effective onboarding. Your service provider should take the initiative to set clear expectations from the start. Your goals should be clearly outlined and backed by actionable deliverables. One of the things we do at BACS to help ensure the relationship gets started on the right track is to hold an initial kick-off call. The call is important because it helps ensure everyone is on the same page and sets the tone for the rest of the engagement. It’s an opportunity for us to get to know more about the client, their challenges, their priorities and the dynamics of their team. We make sure the client understands who their main point of contact is going to be, set up a communication schedule, and identify some initial goals going forward.

 

  • Regular feedback: Businesses often have little time to focus on the routine functions of infrastructure management and day-to-day tasks. That’s where your IT provider can deliver superior service value. The best providers are continuously soliciting client feedback and seeking ways to enhance the service experience. One of the things that sets BACS apart is our persistence and commitment to listening to what our clients have to say. We ask questions. We take the temperature of the relationship. Where are your biggest struggles? How can we provide better service? We review our processes and remove any communication barriers. We hear what our clients have to so, but we also brainstorm with our internal team about opportunities, potential roadblocks, and what competitors are doing. Ultimately we use the feedback to improve the client experience and make it an integral part of the improvement process.

 

  • Fast response: Most IT organizations are stuck in reactive mode, continuously putting out fires and rushing to resolve the latest crisis. That’s why fast, efficient response from your IT provider is more critical than ever. Not only should our provider be available 24/7, but they also need to be able to respond quickly to critical issues. Ideally, our provider should have the ability to remotely monitor and manage your IT infrastructure. When action is required, alerts can trigger your IT team or your service provider’s help desk to initiate the appropriate response. Your IT provider should provide a clearly-defined service-level agreement (SLA) that outlines in detail the specific scope of services provided, standard response times and performance expectations. Your service provider’s ticketing system should be easy to use and focus on communication and customer satisfaction. It’s not enough for a system to ease the intake process―it must actually assist the IT team in quickly resolving issues. Ideally, all parties should be able to track issue progress. At BACS, once tickets are received, they are logged and sorted according to type of issue, automatically triggering requests to the appropriate resources or expert. Tickets are automatically tracked from start to finish to help ensure no request gets overlooked and is promptly resolved.

 

  • Exceed expectations: One of the keys to successful customer engagements and higher levels of satisfaction is empathy. Empathy means understanding the client from their perspective rather than viewing the situation as an outsider. At BACS, we work closely with our clients to understand their overarching vision and develop a defined roadmap as part of an ongoing “alignment” cycle. Recurring checks and ongoing follow up help make sure our recommendations are delivering results and are aligned with the client’s business goals. With daily reporting, quarterly reviews, personalized training, and additional support, your team can focus on strategy and growth instead of stressing over routine maintenance tasks.

 

  • Consistent performance:  It’s been said that all things being equal, customers will choose to buy from a friend. Establishing this kind of familiarity with clients requires consistent, personalized service throughout the client engagement. It requires diligence in keeping clients updated on our procedures and informed about ongoing performance and support issues. At BACS, our consultants are well-versed in the importance of integrating IT into your overall business strategy. We help you take full advantage of the opportunities a proactive IT approach enables, whether it’s growing revenue, capturing market share, or enhancing the customer experience. Our expert consultants understand the complexities and challenges of technology deployment and work ensure your solutions align with your priorities and will scale appropriately.

To help ensure your results are aligned with your business goals, our team will work with you to:

  • Develop a strategic IT plan and review it with you regularly to make sure we stay on track.
  • Address any gaps in your IT support needs recommend updates to address fast-changing IT and business performance needs.
  • Review your security practices and note any deficiencies.
  • Advise you on how best to optimize the performance and resiliency of your IT infrastructure
  • Establish an ongoing process that we’ll use to initially get your IT infrastructure and support processes aligned and then keep it aligned over time.

 

Reaping the benefits of superior IT service

It may not sound exciting, but one of the key ingredients to keep customers happy is consistency. It today’s era of rapid change, it’s easy to lose focus on what’s important. That’s where working with a customer-centric IT provider can deliver substantial value. By outsourcing ongoing support tasks to a trusted partner, businesses can focus on more strategic priorities with greater peace of mind knowing that their IT operation is running smoothly and efficiently.

15 Surprising Statistics About Cybersecurity

15 Surprising Statistics About Cybersecurity

By | Security

What can statistics about cybersecurity tell you? They can offer some insight into how effective or ineffective the efforts currently are to improve the cybersecurity outlook. As a cybersecurity executive, cybersecurity statistics can prove to be an excellent means of communicating to upper management that your organization should invest in cybersecurity. 

Presented below are 15 surprising statistics about cybersecurity, grouped in the following categories:

 

Costs

  • The average cost of a data breach in 2020 (so far) is $3.86 million.

In their 2020 Data Breach report, IBM states that the average cost of a security breach is $3.86 million. This is an alarming statistic because the amount presented by IBM is higher than the amounts they provided in previous years because 2020 has not yet ended. There are numerous possibilities about the cause(s) of the increases. However, the bottom line is that the cybersecurity landscape is not improving.

  • The amount spent on cybersecurity budgets in 2019 was $250, 000 for midmarket organization to $1 million spent by large enterprises.

The 2019 The Security Bottom Line report by Cisco reports that companies are investing in cybersecurity, but the costs are not equal. Companies recognize that cybersecurity is an important investment, but the costs to implement it are often too much. In the same Cisco report, 84% of the CISOs survey participants stated that their organization was only able to afford only a portion of what was considered the minimum required to protect their infrastructure.

  • The cost of cybersecurity insurance is projected to cost organizations $28.6 billion by 2026.

 

According to a market outlook provided by Allied Market Research, cybersecurity insurance just about hit the $5 million mark in 2018. As more organizations are adding cyber insurance to mitigate potential losses due to a cyberattack, that number is projected to balloon to almost $30 billion by 2026.  Cybersecurity insurance is becoming more important as the costs of recovering from a data breach increase. This type of insurance also benefits companies by providing their customer base an assurance that in case there is a data breach, they will receive some protection.

 

Threats

  • The most frequent attack to both enterprises and small business is DDos attacks.

The 2019 IT Security Economics report by Kaspersky reports that distributed-denial-of-service DDos attacks are equal-opportunity attackers in the business world. These types of attacks highjack a company’s resources and in most cases requests a ransom to release them. They do not only cause a disruption of business, but are associated with significant costs.

 

  • Cyberattacks of mobile devices increased by 50% in 2019.

 

The technology firm ZDNET reported on this statistic in their report on the increase in mobile malware. This is an important statistic because more IT departments are implementing Bring-Your-Own-Device (BYOD) policies. Any vulnerabilities that are associated with a device that connects to a corporate network pass on to the network and increase the chances the network will succumb to a cyberattack. The report highlights the increased usage of online banking as a key to the increase in mobile malware attacks.

 

  • Malware threats occur most often (94%) via email.

In the early days of technology, malware was most often considered a threat via software. Now that email has become the main method of communication around the world, cybercriminals have changed their tactics. A 2019 report by Verizon outlines the statistics of malware. Despite the numerous ads and training programs that highlight the dangers of clicking on questionable links, people are still falling victim to email malware.

 

Industries

  • 43% of the security breaches of 2019 involved a small business.

As noted in this statistic from the Verizon 2020 Data Breach Investigations Report, the message is clear that cybersecurity is for everyone. Tight budgets and no buy-in from top executives make it difficult to direct funds to cybersecurity, but it should be considered a significant part of your business. The potential impact is not only financial. Your business reputation can also suffer, your business may be disrupted, and your customers or business partners may be impacted. This stat indicates that small business may not be taking

  • Attacks on supply chain providers were up 78% in 2019.

 

A 2019 report by Symantec that states that cybercrime in the banking industry rose in 2019 to $18.3 million. This probably isn’t a surprise to you since the financial and banking industries are markets that are targeted often. What’s surprising is that supply chain providers are not being added to that list. The increase in supply chain cyberattacks is linked to organizations relying more on multiple third-party vendors to distribute their products. The attacks on the supply industry has become some critical that during the Aspen Institute’s Virtual Cyber Summit, a leader of the FBI warned  companies in the United States to about hackers targeting the distribution of the COVID-19 vaccine. 

 

  • From 2016 to 2019, 93% of healthcare organizations have had a data breach.

 

Healthcare is one of the industries that are most targeted for cyber attacks (companies in finance, government, manufacturing, education, and technology are also heavily targeted). According to a report by Black Book Research, a whopping 93% of healthcare organizations experienced a data breach between 2017 and 2019. In addition, the report states that more than 50% of organizations in the healthcare industry have experienced more than five data breaches within the 2016 and 2019 period. The healthcare/medical industry is an attractive target for cyber criminals because it receives and stores a significant amount of personal data. During health crises, such as the COVID-19 global pandemic, the industry is target even more as cyber criminals attempt to gain access to privileged research data.

 

Outlook

  • The average time for financial services companies to detect a network intrusion is 98 days.

 

The technology company ZDNET reports that the majority of organizations don’t detect a data breach until its been around for more than six months. This is a sobering number. Organizations in the financial industry are privy to a significant amount of personal data and are one of the key targets of cyber criminals. Since a data breach of these organizations can impact a large number of people, their reaction time to an intrusion is critical.

 

  • Less than 50% of companies in the world feel they are adequately prepared to mitigate their cybersecurity risk.

The accounting firm PriceWaterhouseCoopers conducted a survey of  3,249 executives in business and technology and learned that 55% of them did not have confidence that their investment in cybersecurity would provide their companies the most benefit. One of the most difficult aspects of cybersecurity risk is determining where to allocate your investment. Without an accurate assessment of an organization’s needs, they will likely not provide their organization with the most protection.

  • 33 billion records will be stolen by cybercriminals in 2023.

 

This projection stems from a report by Juniper Research of 48 leading cybersecurity companies. According to the research, the latest technologies to protect against newer forms of attacks aren’t making it to small businesses that are most vulnerable to cyberattacks. Until small businesses are able to keep up with technologies and the costs associated with mitigating their cybersecurity risks, we’ll likely to continue to see alarming projects like this one.

 

  • 58% CISOs report that they feel employees ignore cybersecurity policies and guidelines.

The 2020 Cyber Threats Report by netwrix includes an important statistic. One of the most sobering statistics is that employees are not doing their part to help organizations stay safe. However, employees may not be receiving sufficient education (see statistic #15). The important factor in education is content and timeliness. Cybersecurity professionals should assess the knowledge that the employees in their organization require and design a training program that fits that assessment.

 

  • Only 5% of folders stored on a corporate network are adequately protected.

 

The 2019 Global Data Risk Report from the Varonis data lab highlights the results of 785 data risk assessments they performed. Protecting all potential entry points is a basic cybersecurity best practice. Project folders that are uncontrolled are easy access for cybercriminals via ransomware or other forms of malware.

 

  1. The average frequency for employee cybersecurity awareness training in the U.S. is once per year.

According to Statista, an Internet statistics database, employees in the U.S. on average receive cybersecurity awareness training on an infrequent basis. This is a startling statistic, considering the growing number of cyberattacks projected in the future. One of the most significant impacts on the outlook of cybersecurity is human behavior. 

 

Conclusion

 

As technology for mitigating cybersecurity risks improve, so do the tactics of cyber criminals. Understanding the cybersecurity landscape can help you remain informed about what your organization should consider when you design your cybersecurity policies.

BACS is a professional team of security experts who can help you understand all aspects of your infrastructure and devise a plan that provides the greatest amount of protection at the most reasonable cost. 

Everything To Know About Managed Service Providers

MSP 101 – Managed Service Provider

By | IT Support, managed It services

Managed service providers are becoming more and more popular. Replacing or supplementing traditional IT teams with an MSP can improve the quality of a company’s IT infrastructure. Companies all over the world are taking advantage of all the benefits that come with working with an MSP.

Still, the concept of a managed service provider may be confusing to interested parties and could keep them from utilizing an MSP. Understanding the basics of what an MSP is will help businesses stay ahead of the curve.

 

What Is An MSP?

In order to better understand managed service providers, a bit of history of how they evolved could be useful. Managed service providers have a history dating back to the 1990s. During the early 90s, many IT companies only provided repair services to various technology pieces. That began to change as the 90s evolved and the industry rapidly evolved.

Internet speed was rapidly improving throughout the 90s until it reached a point where software applications could be deployed from a central location. This enabled the development of software that could manage and control a computer from a remote location. Innovative software solutions could be developed and deployed to a number of customers all at once.

The early 2000s marked the beginning of the managed service provider industry. IT consultancies began to create companies filled with computer engineers that could create comprehensive IT frameworks for other companies. By the 2010s this process had become much more robust to the point where an MSP could manage nearly all of another company’s IT software, strategy, and infrastructure. The rise of the cloud has only accelerated this trend.

MSPs have recently exploded in popularity with the rise of cloud services. The cloud allows services and software to run through the internet, instead of on your local computer network. This enables your business to access software, applications, and data anywhere in the world. The cloud has opened the door to various improvements in company productivity, but there are some potential drawbacks.

Managing this complex cloud environment can be extremely challenging. This is one of the key reasons why companies have turned to managed service providers. MSPs can manage the entire IT infrastructure of a company, including the cloud infrastructure. Many companies use an MSP to help take their company into the cloud environment. Managed service providers can also keep software applications up to date, database maintenance and setup, data analytics, cybersecurity, and more. Even with all of these services, some businesses are still hesitant to utilize a managed service provider.

If you could bring all of your IT infrastructure in house, why would you want to pay someone else to do it? Trusting and relying on another company to manage your IT infrastructure and data can be a scary proposition. Many companies want to do everything themselves, but the benefits of MSPs vastly outweigh the risks.

 

Why Do You Need An MSP?

Managed service providers create a ton of value for companies that they work with. If you have not switched to an MSP then you are likely falling behind your competitors. Here are a few reasons why you need a managed service provider.

 

Take Stress Out Of Your Life

Your expertise is likely not in the area of IT. A managed service provider will make your life much easier. Your business can call your MSP anytime to repair any issue that is affecting your business’s IT infrastructure. Your website and IT infrastructure will have significantly less downtime, so your employees will not have to wait around while repairs are made. Instead of worrying about managing an IT department, you can focus on the bigger picture. Your team will have extra time to focus on projects and keep your customers happy.

 

Cost Savings & Scalability

Many businesses believe that hiring an MSP may be out of their budget, but that is not the case. Managed service providers reduce the costs that businesses are responsible for. Companies will no longer have to worry about paying expensive IT employees or investing in IT infrastructure. MSPs will handle all of those costly endeavors. Additionally, as your business grows you will need to add additional IT infrastructure. A managed service provider can help you scale your business easily. Your business can easily increase server space and install additional applications to improve productivity.

Use Their Experts

Managed service providers are full of IT experts that can improve your IT infrastructure. Your team can use an MSP expert to work on a project that will improve your processes and productivity. Instead of having to hire an expensive consultant, you can work with your MSP to finish the project. This is extremely beneficial from an HR perspective as well. Your HR team does not have to manage additional employees and worry about key team members leaving the company. Your team can simply rely on your MSP experts to help out on any projects.

 

How BACS Can Help

Whether your company has 10 employees or 1,000 employees, BACS can create a customized solution that will meet your unique needs. Your business can take advantage of all the benefits that working with us comes with. From cost savings to less stress, your business will be able to focus on the core competencies that drive revenue.

 

BACS can answer any questions you may have about managed service providers and how we can benefit your organization. Reach out to BACS today to learn more about our services and offerings. Our team can develop a comprehensive, customized plan that will make your life easier and help your business grow.

 

 

 

 

 

 

 

 

 

 

 

 

Cloud computing - cloud manged IT services

Cloud Computing Frequently Asked Questions

By | Cloud

New technologies continue to move the business world forward. Simultaneously, they create a lot of confusion and apprehension among business people and owners who tend to get intimidated by new business concepts.

While cloud computing had been growing in popularity over the last few years, it’s still a reasonably new concept to most people. Perhaps, you have thought about transitioning your company’s software, and computing needs to a cloud environment. If so, it’s very likely that you would have questions about the transition process and how cloud computing works.

To help you move closer to making the right decision about your company’s data needs, it makes sense to offer you a few answers to some common questions about this concept. The following question/answer format should help provide you with the answers you seek.

 

Question:

What does the transition process encompass, and how long will it be before my data servicing is fully operational offsite?

Answer:

The transition process requires some level of participation by company employees. However, hiring an IT professional consultant with related experience could help remove a lot of the burden off of your employees’ shoulders. Your company’s employees could focus on their everyday responsibilities while the IT consultant concentrates on implementing a parallel system with the cloud-computing facility.

As for time requirements, experts claim the entire transition process will usually take 10 to 14 days, depending on business size, the amount of data involved, and the services required.

 

Question:

How will my company’s data access be affected should there be a complete loss of Internet connectivity?

Answer:

The answer to this question is complicated. If you maintain updated synchronized copies of your data in-house, your employees might be able to continue working off of your local server. If not, your company would face one of two possible scenarios.

First, you could be out of luck if your service provider was a single office environment. You would have to wait until they were able to restore access. Under the second scenario, your primary facility’s location might be one of many sites your provider maintains. If that’s the case, it’s doubtful that all of their facilities will experience the same issue simultaneously. If the provider supports substantial redundancy, you might be able to access your cloud-computing environment through an alternative location.

 

Question:

How will a slow Internet connection affect our company’s work productivity?

Answer:

Data connection issues are hit and miss. Some days, the connection speed is adequate, while other days, it might be unbearably slow. The most feasible solution for this type of problem is the simultaneous synchronizing of data between the cloud-computing facility’s data servers and your in-house data server.

Here is how that might work. Most operating systems, Microsoft’s Windows included, offer a feature that can facilitate this kind of synchronization process. Somebody can do work on either server, with the data updated on the opposite server within seconds. Suppose your company is experiencing a slow period of connectivity. In that case, your employees could easily switch to working from the in-house server, knowing the data input will hit the cloud-computing server in short order.

 

Question:

How secure are cloud environments? Will we need to sacrifice some of the protection we have in-House?

Answer:

Of course, your number one concern will focus on security and the protection of your data. You need to understand that there is nothing about your ability to protect data in-house that can’t be replicated in a cloud environment. Your cloud-computing provider probably has access to substantial financial resources they can use to create multiple layers of security.

Another issue worth considering is that your employees are likely to make errors that could compromise the security located around your in-house server. That might include downloading files with viruses or forgetting to use secure passwords. For a cloud-computing provider, their reputation often rests on their ability to keep the client’s data safe. It’s a good bet they have procedures in place to protect against potential errors.

 

Question:

How easy is it to reclaim data should our company go out of business?

Answer:

At the point of implementation, you should receive information about how to proceed in case of an emergency. The information should include detailed instructions on how to recover all of your data without assistance from the facility’s personnel. If you were to encounter any problems, you should also have access to the emergency contact information that would put you directly in touch with someone who could help you proceed.

Ensure you receive copies of the facility’s disaster recovery plans, corporate insurance policy information, specific information about backup procedures, the exact location of your secured data, and any software licensing information you might need.

The bottom line is your provider is your data partner. They should be there to help you under any circumstance, even if your company is going out of business. Never settle on a provider that is unwilling to offer total transparency.

 

Question:

Will there be any special hardware requirements placed on our company?

Answer:

There is lots of good news here. By committing to a cloud-computing solution, you would need to invest less money in your data infrastructure. At most, you would only need one server to use as a backup, plus the workstations and printers you would need for your employees. You would also benefit by not needing to purchase state-of-the-art components because the real thrust of your computing power would be residing with the cloud-computing facility. The money saved could be quite substantial, depending on the size of your company.

 

Question:

Is there adequate protection against disasters, viruses, and errors that could affect our data?

Answer:

Again, cloud computing providers rely on reputation. Through economies of scale, they can provide all clients with a protection level that each client would have trouble providing for themselves.

 

Question:

Will training be available for my employees?

Answer:

Yes, your employees would get ample training related to accessing data and monitoring backup procedures. The training would come in the form of face-to-face live training sessions or through online webinars. Nothing would be permitted to go live until you feel your employees are up to speed and ready to go.

 

Question:

Is this the best data solution for a company with limited financial resources?

Answer:

The short answer is an emphatic yes. Your company would likely experience substantial annual savings in a lot of areas.

 

First, this data option offers the benefit of workforce savings. You would likely need less emphasis on hiring an IT professional because the biggest hardware concerns would fall under the cloud-computing provider’s responsibilities. You would not be responsible for hardware installations, maintenance of updates, and software licensing.

Second, you could save a lot of money on software if you were to choose a generic software system that’s already available on the cloud’s servers. Custom software programs can get quite expensive.

Finally, you could save money in the form of higher productivity among your employees. Instead of worrying about IT issues, they can focus on doing the jobs for which they are getting paid.

 

cloud computing - it services - cloud services

Different Types of Cloud Solutions and How to Decide Which One is Best For You

By | Cloud

Businesses worldwide have started implementing the use of cloud solutions for handling the storage of their technology needs. These solutions allow for off-site servers and hardware that is easy to access via the internet. There’s no doubt that this off-site setup allows for reduced business expenses in housing physical infrastructure and paying staff to manage it.

Considering moving to a cloud solution? You’ve likely been overwhelmed with all the options out there. From public clouds to hybrid clouds, which one is best for you? The truth is that each cloud computing solution offers different benefits for different businesses. We’re going to define each type of solution and explain when it’s best used.

1. Public Clouds

The most popular solution offered is public. The providers of this solution provide infrastructure and services for a large group of customers. This type of solution works best for collaborative projects and software development. Due to the easy scalability and pay-as-you-go structure, public clouds are an excellent option for developers to create and test their applications before switching to a private option.

The major pitfalls of public clouds are that users are under the full control of the solution provider. The solution provider could decide to change its platform at any moment or even shut down its operations. This situation requires consistent monitoring and quick response times from your business regularly. Public networks are also susceptible to more security issues as users don’t have any control over the security measures implemented for the network.

Pros

  • A massive amount of space offers easy scalability
  • Pay as you go structure
  • Quickly managed through a self-service web portal

Cons

  • Under full control of solution provider
  • Must-follow terms and conditions of solution provider
  • Susceptible to significant platform changes and provider shut down at any time
  • Unpatched security issues

 

Recommended For: Public clouds are best for those businesses that are not looking for a high level of data security or for companies that are just starting and have minimal investment funds. Public clouds tend to be preferred by software developers who need the convenience of easily scaling up their space without the massive infrastructure investment at first. Many developers, once finished, will switch from public to private for a more secure application.

2. Private Clouds

Private cloud computing offers a more secure solution for businesses that want their data to be accessible only by authorized users of a single organization. The actual infrastructure can be positioned on-site or accessed via a colocation provider. Since private clouds are under the full control of an organization, there is no threat of sudden changes or shutdowns.

While private clouds can be an ideal option for businesses with strict data collection and storage regulations, they can be very costly. Unlike public clouds, where you can use the massive amount of available space to expand easily, private clouds require more infrastructure and software to expand, making scalability time-consuming and expensive for any organization, big or small.

Pros

  • Can only be accessed by one organization
  • Customizable security and system control
  • No-risk of sudden changes
  • Can be hosted on-site or accessed online

Cons

  • Must pay for software and infrastructure
  • Expensive scalability

Recommended For: Private clouds are highly sought-after by businesses who work in industries with highly-restricted data regulations. These include financial organizations, government agencies, healthcare providers, and schools.

3. Hybrid Clouds

As the name suggests, hybrid clouds are both private and public clouds where businesses can utilize public clouds for some aspects of their business and private clouds for others. The hybrid model allows for seamless interaction between both private and public platforms. There are typically two ways to utilize hybrid clouds.

The first is cloud bursting when private clouds are used as a primary solution to store data and house exclusive business applications in a secure environment. In the cloud bursting model, public clouds are used as a backup resource to ensure exclusive applications’ seamless operation when the user demand increases beyond the private solution’s limits. This solution helps to save the business money as they don’t have to buy more infrastructure and servers to handle high demand times.

The second hybrid model is based on using public clouds for outsourcing non-critical business applications. Those deemed non-critical are applications like basic productivity tools. However, most applications and data storage is housed in private clouds for more secure access. This multi-cloud architecture allows businesses to take advantage of private security for regulatory needs while still enjoying cheaper public computing for basic tasks.

Pros

  • Allows for a cost-effective solution
  • Ensures a business can always meet user demand

Cons

  • Can be more difficult to setup
  • Can make business data more susceptible to threat when user demand is high

 

Recommended For: Businesses who deal with frequent spikes in demand. Some well-known businesses that use this hybrid model include Airbnb, Uber, and Netflix.

 

4. Community Clouds

 

Community clouds are commonly shared among businesses within the same industry. They work essentially as private clouds but shared among a handful of companies. This model allows for a multi-tenant environment that reduces the high cost of infrastructure and software for private clouds. Each community solution is jointly managed by members of the various businesses that utilize it. Community clouds can be housed on-premises, such as in a shared industrial building or at a chosen data center.

 

Pros

  • Much cheaper than a single organization private solution
  • Allows for optimal data security at more affordable costs

Cons

  • Network security depends on effective management of infrastructure
  • Relies heavily on other solution partners staying in operation

 

Recommended For: Common users of community clouds include those in the financial services sector, healthcare organizations, and government agencies.

As you’ve discovered, you need to choose from these four cloud solutions. These include public, private, hybrid, and community clouds. Picking the right one for your business to use comes down to a few main factors.

  1. Price plays a significant role in your ability to choose the ideal solution for your business. You may not have the money in your budget to use any private solution if you’re just getting started.
  2. Security Requirements vary depending on your industry. Some government regulations may require your business to have a private solution for data storage.
  3. User Demand, for some businesses, fluctuates tremendously. Having the available infrastructure to handle high times of demand is a must to keep customers coming back.
  4. Industry Partners can be a great asset to save money on data storage and operation solutions. Those with many industry partners may opt for community clouds instead of footing the large private clouds bill.

Choosing a cloud solution requires diligence and understanding of your business’s various options and the many benefits that those options can provide. By analyzing the factors above, you should be fully capable of selecting the right type of solution for your business.

cybersecurity trends

TECH TALK: 7 Trends You May Have Missed About Cybersecurity

By | Data Protection, Security

At any given point in time, there are numerous trending topics in cybersecurity. Change is one aspect of technology that we can always depend on, and that’s a good thing. We’re able to do more in less time than ever before. Of course, advancements in technology goes together with the cybersecurity landscape. As someone who has a key role in IT, keeping up with changes in technology and cybersecurity should be a routine task. However, there trending topics that are just beginning to emerge that you may not yet be aware of.

Here are seven cybersecurity trends you may have overlooked:

1: Bring Your Own Device (BYOD)

2: Internet of Things (IoT) Devices

3: Fifth Generation (5G) Technology

4: Social Engineering

5: Bitcoin Ransomware

6: Smart Contracts

7: Insider Threat

1: Bring Your own Device (BYOD)

 

BYOD programs that allow employees to use their personal devices to access business assets on the job have been accepted by IT programs for a while now. They can be a bit unwieldy in terms of control, but the benefits to production and costs are difficult to ignore. Unfortunately, the security concerns are increasing. The main concerns with allowing personal devices to access a corporate network is that IT personnel are usually not aware of their connection to the network, there is usually minimal security features, they are easily stolen or misplaced, it is difficult to control how employees use them (they can easily download apps).

History has proven that the concerns listed above are serious. In 2017, the cryptocurrency firm Bithumb experienced a data hack that was traced to an employee’s home PC. That data breach exposed the personal information of 30,000 of the Korean company’s customer base.

If your organization supports a BYOD program, you can mitigate your risk by first developing a policy that outlines the requirements for use in the organization. It is a good idea to add controls to your organization’s Wi-Fi. These are often easily accessible by anyone who knows the password. There should be an acknowledgement before a device can connect to the organization’s corporate network. This could consist of requiring employees to register any device they want to connect to the network and implement security safeguards such as multi-factor authentication. You might also consider implementing a Mobile Device Management System (MDM) that functions like a global positioning system (GPS). These toe a fine line to privacy infringement, but there are MDM systems available that are less invasive.

 

2: Internet of Things (IoT) Devices

 

Wikipedia defines Internet of Things (IoT) as a “network of physical objects—’things’—that are embedded with sensors, software, and other technologies for the purpose of connecting and exchanging data with other devices and systems over the Internet.” While IoT devices include many of the popular smart devices that individuals use on a regular basis (watches, fitness trackers, alarms, biometric scanners), there is a growing use of these by organizations. For example, the healthcare industry uses IoT-connected sensors to improve the services they provide to patients.

The main security concern for IoT devices is the amount of data that is shared among interacting devices. According to a report by KPMG, 84% of IoT adopters have experienced a security breach. The advisory and audit firm offers the following three best practices for securing IoT devices:

  • Asset management – know the devices that connect to the organization’s network and the path they travel once they are outside the organization’s network.
  • Device Security – In addition to granting only authorized users access to business data using IoT devices, make sure these devices are protected by antivirus and encryption software, are kept updated with the lasts security software, and are monitored for suspicious activity.
  • create a vulnerability management program – “identify and fix weaknesses with a device”

 

3: Fifth Generation (5G) Technology

 

The growing use of IoT is stressing our mobile capabilities. The good news is fifth-generation wireless technology has arrived! Just as with its predecessors, this advancement in mobile communication offers faster download speeds, decreased latency, and more network capacity. The transition to 5G is just beginning and is predicted to reach full evolution by 2022.

Many of the cybersecurity risks associated with 5G networking will be addressed through the network’s builders. However, there are more responsibilities of IT departments. The increase in bandwidth that 5G provides also increases network monitoring tasks for IT departments. With data traveling much faster on the network, new strategies for monitoring the traffic will be necessary. 5G also transitions from a network that is based on hardware switching to one that relies on software digital routing. IT departments that are unable to keep up with the 5G advancements can expect an increased threat of distributed denial-of-service (DDoS), man-in-the-middle (MiTM), and botnet attacks.

 

4: Social Engineering

 

According to Verizon’s 2019 Data Breach Investigations Report, social engineering threat actions in data breaches have increased significantly more than any other type of threat in the past seven years. In the past, phishing (pretending to be someone else to persuade an individual to disclose their personal information) has been the most used form of social engineering.

The social engineering threats that are trending now include the following:

  • Smishing – Phishing via phone calls or text messages
  • SIM Swap – Fraudulently switching another individual’s mobile account information to gain access to bank and credit card accounts
  • Harpooning – Phishing by impersonating executives and using information from social sites
  • Pharming – Fraudulently installing malicious code on a PC or server. The code redirects any click to another fraudulent website without the user’s consent.
  • Deepfakes – Editing (using advanced AI technology) a legitimate video or voice clip for the purpose of acquiring personal information.
  • Vishing – impersonation via phone calls or voice message

Hopefully, your organization has already implemented email safeguards to detect and block suspected phishing communications.

Social engineering involves human interaction. The best safeguards are educating employees about the different types of social engineering tactics and how they should be cautious before responding to any type of communication, even if it appears to be from someone reputable. If possible, employees should use an alternate method to verify suspicious communications.

 

5: Bitcoin Ransomware

 

Using malevolent software for the purpose of blocking access to another’s system and requiring payment to unblock it is referred to as ransomware malware, or ransomware for short. This type of attack is often carried out by someone clicking a bad link that installs the ransomware on the system. The sophistication of the ransomware can vary. The most advanced types use encryption to prevent access to systems or files and require a decryption key. The latest form of requested payment for ransomware attacks is bitcoin because it is a digital currency that is quickly exchanged.

Ransomware is a serious problem. This was highlighted with the 2017 WannaCry ransomware attack that involved computer systems all over the world that had not applied a Microsoft software patch. Unfortunately, the trend is continuing. The most significant ransomware attacks as of June 2020 cost the victims more than $100 million to recover from the incidents.

Network and security monitoring software maker NetFort recommends the following five tasks to protect and recover from ransomware attacks:

  • Back up your data regularly
  • Make sure all systems that connect to the network have the most recent security updates
  • Implement anti-intrusion detection systems
  • Monitor network traffic for unusual activity
  • If a system is infected with ransomware, disconnect it from the network immediately and rebuild it

 

6: Smart Contracts

 

Blockchain, the technology that powers bitcoin, is being used in a variety of methods of exchange. Smart contracts are one of those. A smart contract is a daisy chain of encoded actions that are saved within a blockchain and digitally self-executing without the assistance of a third party such as a bank or attorney. Smart contracts are gaining popularity because of their transparency, speed, permanency, and non-editable characteristic. Although smart contracts are inherently secure (the data they contain are encoded), they are comprised of program code that is susceptible to vulnerabilities. The main security concerns with smart contracts are access control and undiscovered bugs in their programming code. One of the most newsworthy incidents occurred in 2017 when the code of a multi-signature wallet was exploited by a user by accident. The incident caused users of the wallet to lose more than $280 million because they were unable to withdraw funds from the digital wallet.

The best way to mitigate your risk with smart contracts is to:

  • Make sure the smart contract is 100% encoded (every record from start to finish). Access via private key should only be distributed to specific users.
  • Don’t lose your private key! Even better, your organization should consider engaging in smart contracts that use multi-access so that there is more than one point of failure.
  • Ensure the underlying code is bug free. This means to test, test, and test some more to make sure there are no vulnerabilities that malicious actors could take advantage of.

 

7: Insider Threat

 

An unfortunate trend that is increasing is that people who have or previously had legitimate access to an organization’s data may intentionally or unintentionally cause destructive actions. Insider threat occurs through multiple methods. An example of the significant damage an insider can cause is the ex-Cisco employee who caused $1.4 million in damages. The criminal left the company in 2018 and shortly thereafter installed malicious code from his old Google Cloud Platform account and subsequently deleted the nearly 500 virtual machines hosted by Cisco WebEx applications. Within two weeks, 16,000 WebEx accounts were deleted. In this case, the ex-employee somehow managed to maintain his access to Cisco’s cloud infrastructure after he left. It is not known how.

The Insider Threat Mitigation Guide  published by the Cybersecurity and Infrastructure Security Agency provides the following tips for establishing an effective inside threat mitigation program:

  • Identify and focus on those critical assets, data, and services that the organization defines as valuable
  • Monitor behavior to detect and identify trusted insiders who breach the organization’s trust
  • Assess threats to determine the individual level of risk of identified persons of concern
  • Manage the entire range of insider threats, including implementing strategies focused on the person of concern, potential victims, and/or parts of the organization vulnerable to or target by an insider threat
  • Engage individual insiders who are potentially on the path to a hostile, negligent, or damaging act to deter, detect, and mitigate

 

Conclusion

 

Is your IT department equipped to address the emerging cybersecurity threats? If you’re unsure, now is the time to determine your level of vulnerability and implement the necessary safeguards to ensure your organization’s assets are fully protected.

If you require assistance with assessing your needs and implementing the “right” IT security solutions for your organization, BACS can help. We are an experienced team of IT service professionals that work closely with clients to assess, develop, and implement security solutions that offer an ideal level of protection.

The Anatomy of Great Cybersecurity

The Anatomy of Great Cybersecurity

By | Data Protection, Security

If security professionals were asked to define the anatomy of great cybersecurity, it would likely be significantly different than a few years ago. IT departments are allocating more resources to improve their cybersecurity outlook. This is due in part to the large number of security breaches that have exposed critical data. The developers of the  Norton anti-virus software report that of the 3,800 publicly disclosed security breaches reported in the first six months of 2019, a record number of 4.1 billion records were exposed (more than a 50% increase over 2018 for the same time period). There is probably a lot more that are not publicly disclosed. While there isn’t a single “right” way to implement a cybersecurity strategy, there are areas of importance in which you should direct your focus.

Here are three key tale-tale signs of effective cybersecurity:

1: Leadership Buy-In

2: A Comprehensive Cybersecurity Framework

3: Security Awareness

Leadership Buy-In

As a security professional, your ideas about the best cybersecurity strategy for the organization are important to leadership (typically includes the board of directors, executive team, and security officers and managers). The weight that an organization places on cybersecurity begins at the top. This is because the top executives usually have the final authority to approve the cybersecurity budget that is appropriate for an organization’s needs. However, it’s not enough that you have the knowledge and a good picture of your organization’s cybersecurity stance. You must also effectively communicate this information to leadership, often for the purpose of persuading them.

Here are ideas to help you communicate your cybersecurity plan to leadership and obtain their buy-in:

  • Focus on providing metrics instead of explaining technical jargon.
  • Outline your recommendations. Make sure you provide multiple effective options that vary in cost. Explain the pros and cons of each option.
  • Explain how increasing the cybersecurity budget fits in with the organization’s goals. Focus on revenue cost savings, ROI, and customer satisfaction.
  • Emphasize any weaknesses that your analysis or an expert’s assessment has uncovered and the potential threats that your organization could become victim to if the weaknesses are not addressed.
  • Highlight security breaches of organizations that are similar to yours and the devastating results. If your organization isn’t one of the top organizations that are threatened most often (financial, healthcare, manufacturing, or government), leadership may not worry about security as much. Do your research and point out an organization that is similar to yours that has experienced a devastating breach. For example, if your organization is a gaming company, you could point out the data breach of mobile gaming producer Zynga that resulted in 218 million records of customers (the largest data hack of 2019).

Once you’ve prepared your list of ideas, make sure you also prepare answers to questions that leadership may have. Think of the pros and cons of the ideas you present to them and any other questions that may come up. It’s also a good idea to communicate with other cybersecurity professionals who have successfully obtained leadership buy-in and how they obtained it.

A Comprehensive Cybersecurity Framework

A cybersecurity plan must address the methods of protecting information assets. Since this involves a variety of components, a comprehensive cybersecurity framework is the best choice. When you are considering your framework, you should focus on how you want to handle potential threats. You want a framework that helps you understand your organization’s needs (assessment and analysis), provides components for implementing and managing risk controls and enables you to continually monitor your progress.

When you are considering the cybersecurity framework to implement in your organization, you should also check if there are any regulations specific to your organization or industry. An example is  the Healthcare Insurance Portability and Accountability Act (HIPAA) that provides security requirements for healthcare organizations.

To implement a comprehensive cybersecurity framework, you will likely combine multiple systems and controls. Here are five notable cybersecurity structures that are available for organizations:

 

National Institute of Standards and Technology (NIST) Cybersecurity Framework

This framework was developed specifically for organizations that manage critical systems in the United States but identifies five elements that any organization can use for managing and mitigating their cybersecurity risks. The five elements include Identify, Protect, Detect, Respond, and Recover. NIST provides the framework as downloadable files from their website. They also provide additional resources.

 

Center for Internet Security (CIS) Controls

These 20 controls are prioritized best practices that CIS has developed to help organizations prevent cyber attacks. The controls are prioritized as basic, foundational, and organizational and are downloadable in their entirety in PDF or Microsoft Excel format. CIS provides information for implementing the 20 controls as well as other cybersecurity resources on their website.

 

Information technology — Security techniques — Information security management systems — Requirements (ISO/IEC 27001)

This compliance specification, which provides requirements for managing information management systems (IMS), was officially adopted into the International Organization for Standardization (ISO) in 2005 and has been modified over the years to address the advancements in cyber threats. Organizations can choose to simply follow the requirements or request an audit to become ISO 27001 certified. Meeting these requirements can help organizations develop a cybersecurity framework. Companies that meet the rigorous requirements can choose to request an audit to become ISO 27001-certified organizations. This is an added benefit that provides proof to leadership, customers, and partners that a company has met a high standard for cybersecurity and is serious about protecting its information assets.

 

Federal Deposit Insurance Corporation (FDIC) Cybersecurity Framework

In 2016, the FDIC announced this framework to provide guidance to banking organizations for mitigating cyber risks that are specific to the industry. According to a report by the Keeper Security firm, of the thousands of IT professionals they surveyed, two-thirds of the financial organizations experienced cyber-attacks. This framework identifies four areas of focus to reduce cybersecurity risks: Corporate Governance of Cybersecurity, Threat Intelligence, Security Awareness Training, and Patch-Management Programs.

The FDIC also lists other cybersecurity resources on their website. In January 2020, the FDIC issued the Joint Statement on Heightened Cybersecurity Risk document to “remind supervised financial institutions of sound cybersecurity risk management principles.” The document outlines six areas of focus: Risk Management, Identity, and Access Management, Network Configuration and System Hardening, Employee Training, Security Tools and Monitoring, and Data Protection.

 

Plan-Do-Check-Act (PCDA) Methodology

Wikipedia defines PCDA as “an iterative four-step management method used in business for the control and continuous improvement of processes and products.” It was part of the ISO 27001 compliance standard for many years and has been incorporated in a variety of other cybersecurity frameworks. Organizations can use this system to improve their security implementation by using four steps: Plan, Do, Check, and Act.

Security Awareness

Security awareness refers to the ability to identify a potential threat and take appropriate action to alleviate it. An effective cybersecurity strategy would be incomplete without a plan for establishing awareness in employees. According to a study by the information security firm Shred-It, employee negligence poses the greatest information security risk to organizations. If employees in the organization do not understand security risks and make bad choices, leadership buy-in, and implementing a comprehensive cybersecurity framework will have a limited effect. Creating an environment characterized by employees having security awareness involves providing employees the information they need to understand the cybersecurity landscape and educating them on the behavior that is best in that landscape.

The following are the ways your organization can increase security awareness:

  • Develop a training program that identifies the types of cybersecurity threats and provides best practices for preventing security issues (recommended behavior when using email, social media, and company assets). The training should be mandatory for all employees and should be repeated and updated on a regular basis.
  • Make security policies (part of your cybersecurity framework) easily accessible by employees. Adding hardcopies to new hire packages is a good idea.
  • Send regular reminder notifications about cybersecurity best practices via email and text messages.
  • Hang up posters and security reminders in common areas of the organization.
  • Incentivize good employee behavior. For example, reward an employee that comes across a potential phishing email and performs the steps outlined in the training manual or security policy.

Next Steps

Developing and implementing an effective cybersecurity strategy can be a daunting task. Not only does it require resources, but it also requires an understanding of your organization’s needs in relation to the current cybersecurity environment. Developing an effective cybersecurity strategy shouldn’t be a singleton task. Engage your security team and other members of the organizations to perform specific tasks. If you decide to reach out to a security firm for assistance, choose one that is experienced in all facets of cybersecurity.

BACS specializes in providing a full spectrum of IT services to companies of all sizes. They can help you assess your security requirements and develop the most effective strategy to mitigate your organization’s security risks.

data protection - IT security services

TECH TALK: 3 Steps to Developing an Effective Cybersecurity Strategy

By | Data Protection, Security

Has the task of developing an effective cybersecurity strategy landed on your To-Do list? As the average worldwide cost of a data breach is estimated as $3.92 million (from The Cost of a Data Breach Report for by Ponemon Institute), it’s an important responsibility for all organizations that manage digital data. A cybersecurity strategy can be defined as a set of policies that outline your organization’s plan for mitigating the cyber risks to its assets. The key then to creating an effective strategy is aligning the plan to the specific needs of your organization. You can scour the Internet for a model to use for your organization’s strategy, but know that for it to be effective, you’re going to have to make it very personal to your organization. How do you do that?

Here are three basic steps:

1: Define Your Threats

2: Inventory Your Assets

3: Outline Your Protection Measures

 

1: Define Your Threats

The first step of developing a successful cybersecurity strategy is to identify the threats to your organization. If you’re not sure what the threats are, consider the general threats to all businesses, threats common to your industry, and the threats that are currently gaining momentum.

  • General Cyber Threats to Your Business

The technology company Cisco acknowledges the following six types of cyberattacks:

Malware

Malware, formally known as malicious software, refers to a group of computer software that cybercriminals design to gain access to a system and cause havoc, usually in the form of damaging or disabling the system. The most common types of malware are adware, ransomware, viruses, worms, and spyware.

Phishing

Cybercriminals use phishing attacks to obtain sensitive data such as social security numbers, credit card numbers, and passwords. This type of attack occurs via email or any other means of digital communication.

Man-in-the-Middle (MitM)

Just as it sounds, a MitM attack occurs when a cybercriminal gets in the middle of an exchange of data between two parties, such as a computer and a server, for the purpose of performing malicious acts.

Denial-of-service

One of the most dangerous types of threats to businesses is a distributed denial-of-service attack. A cybercriminal commits this threat by gaining access to a system, often by exploiting a vulnerability, with the goal is to overload it to the point of blocking people (your employees and/or customers) from accessing the system.

SQL injection

A SQL injection attack refers to malicious SQL code that is created to access and cause havoc to a vulnerable SQL database.

Zero-day exploit

A zero-day exploit is a cyber threat that is designed to exploit a vulnerability that has not yet been discovered and patched by the designer.

DNS tunneling

The domain name system (DNS) protocol is a legitimate method of exchanging data across the Internet. Cybercriminals can manipulate the DNS protocol to create a path or “tunnel” for infiltrating a network and exposing sensitive data.

 

  • Threats to Your Industry

You should also consider cyber threats that are specific to your organization’s industry. The following are common industries and the threats that they often face.

Financial

Organizations that handle financial transactions are big targets for cyber criminals. Insight, a cyber intelligence company, reported findings of  that malware attacks in 2019 were targeted more often in a specific area—financial institutions (25.7 percent). Malware isn’t the only threat to these organizations. According to a report by technology consulting firm Mindsight, the top three cyber threats to the financial industry are web application attacks, DDoS attacks, and backdoors and supply-chain attacks.

Healthcare

Healthcare companies are a common target for cyber criminals because of the large amounts of personal data they manage. The Fact Sheet of the Cybersecurity Act of 2015 lists the following as common threats to healthcare organizations: Ransonware, email phishing attacks, loss or theft of equipment or data, internal, accidental or intentional data loss, and attacks against connected medical devices that may affect patient safety are common threats to these industries.

Government

The IT systems of governmental organizations, federal agencies in particular, are responsible for managing critical infrastructures and are often targeted by cyber criminals. According to the U.S. Government Accountability Office, the Department of Homeland Security received more than 35,000 security incidents reports from federal executive branch civilian agencies in 2017. Of those incidents, the largest number (31%) were from an unidentified source. The remaining incidents were from improper usage (22%), email/phishing (21%), loss or theft of equipment (12%), web-based attack (11%), multiple attack vectors (2%), and attrition, external/removable media, and physical cause made up 1%.

Manufacturing

The infrastructures that are critical to keeping countries moving smoothly require manufacturing operations. Cyber criminals know this and have been increasing their threats on this industry. According to a study by Deloitte and the Manufacturers Alliance for Productivity and Innovation (MAPI) nearly 40% of the surveyed manufacturing companies were affected by cyber incidents in the prior 12 months, and 38% of those impacted indicated cyber breaches resulted in damages of $1 million or less.

The National Institute of Standards and Technology (NIST) identifies the following threats to manufacturing: Identity theft, phishing, spear phishing, spam, and compromised webpages

 

  • Trending Threats

As the world changes, we see old cyber threats improve and new ones emerge. Sometimes, we see threats increase on the radar of cyber intelligence trackers because of specific events. In 2020, for example, the COVID-19 global pandemic was associated with the following three significant cyber attacks, as reported by MonsterCloud:

Corporate ransomware attacks

Large corporations are often the target of ransomware attacks. During the COVID-19 pandemic, cyber criminals have been threatening doxware (extortionware), which is a type of ransomware that involves a cyber criminal threatening to sell or publish sensitive data.

Research and vaccines

As companies are in the midst of developing a vaccine for COVID-19, cybercriminals are increasing their attacks to obtain information to sell to other companies and governments wanting it.

Social engineering (Twitter)

In the summer of 2020, a teenage hacker managed to scam high-profile Twitter users out of more than $100,000. He was arrested, but not before obtaining $100,000 from his victims.

An additional threat that many companies neglect to acknowledge is within their organization. In the article “The Biggest Cybersecurity Threats Are Inside Your Company” , insider threats account for 60% of all threats to an organization.

2: Inventory Your Assets

Once you understand the threats to your organization, you should then understand your assets that could be threatened. The plan you develop will be effective only if you understand the assets you need to protect. The best way to learn this information is to perform an inventory. The National Initiative For Cybersecurity Career and Studies (NICCS) defines an asset as “A person, structure, facility, information, and records, information technology systems and resources, material, process, relationships, or reputation that has value.”

Here are a few examples of common assets within an organization:

  • Data that flows through your organization. This includes personal data (sensitive data about employees, vendors, and third-party companies and the work data the organization obtains or produces.
  • Physical assets or endpoints that employees use connect to your organization’s network.
  • Network that employees connect to.
  • Infrastructure resources such as databases and servers that store your data.
  • Software that employees use in the company (note the identifying information as well as dates).

A simple spreadsheet is a good way to manage the assets, but it shouldn’t be a laundry list of your assets. You should include details that help you determine the critical value of the asset. This includes adding information about its intended use, how it is accessed, by whom is it accessed, and an assessment of its value. You should devise a system for noting those assets that are critical to the business.

3: Outline Your Protection Measures

Once you understand the threats to your organization and the most critical assets you need to protect from those threats, you are ready to specify how your organization plans to protect its assets from cyber threats.

The following are examples of types of cybersecurity protection methods referenced in an effective cybersecurity strategy:

  • Training to develop cybersecurity awareness among all employees.
  • Security policies for every type of asset (examples listed below):
    • Perimeter security such as network security includes firewall and anti-virus protection, and encryption
    • Endpoint security that protects the systems that connect to your network
    • Application security methods such as sandboxing and encryption
    • Password security that requires employees to use strong passwords
    • Email security measures such as multi-factor authentication and email security gateway protection
    • Remote access security measures such as virtual private networks (VPNs) and end-to-end encryption
  • Insurance that protects your organization from liability should you suffer a cyber attack

Next Steps

The information presented above will help you develop your cybersecurity strategy. Keep in mind that your cybersecurity strategy is not a document that you develop and forget about. It should be a dynamic document that you revisit often to ensure it is up to date.

Seeking the assistance of a cybersecurity expert is a good plan of action to ensure that your cybersecurity strategy addresses all the needs of your organization. BACS is an IT services company that partners with organizations to help them solidify effective security strategies that are based on in-depth analysis.

data-backup-and-recovery-business-continuity

Best Practices for Building a High Availability Cloud Architecture

By | Cloud

The critical nature of today’s cloud workloads has made choosing the right cloud architecture more important than ever. To reduce the potential for system failures and hold downtime to a minimum, building your cloud environment on high availability architecture is a smart approach, particularly for critical business applications and workloads.

High availability is a design approach that configures modules, components, and services within a system in a way that helps ensure optimal reliability and performance, even under high workload demands. To ensure your design meets the requirements of a high availability system, its components and supporting infrastructure should be strategically designed and thoroughly tested.

While high availability can provide improved reliability it typically comes at a higher cost. Therefore, you must consider whether the increased resilience and improved reliability is worth the larger investment that goes along with it. Choosing the right design approach can be a tedious process and often involves tradeoffs and careful balancing of competing priorities to achieve the required performance.

Although there are no hard rules of implementing a high availability cloud architecture, there are several best practice measures that can help ensure you reap maximum return on your infrastructure investment.

 

Load balancing:

Modern cloud designs allow for the automated balancing of workloads across multiple servers, networks or clusters. More efficient workload distribution helps optimize resources and increases application availability. When instances of server failure are detected, workloads are automatically redistributed to servers or other resources that continue to operate. Load balancing not only helps improve availability, but it helps provide incremental scalability and supports increased levels of fault tolerance. With network load balancers installed in front of servers or applications, traffic or users will be routed to multiple servers, improving performance by splitting the workload across all available servers.  The load balancer will analyze certain parameters before distributing the load, checking the applications that need to be served, as well as the status of your corporate network. Some load balancers will also check the health of your servers, using specific algorithms to find the best server for a particular workload.

 

Clustering:

Should a system failure occur, clustering can provide instant failover capabilities by summoning resources from additional servers. If the primary server fails, a secondary server takes over. High availability clusters include several nodes that exchange data using shared memory grids. The upshot is that should any node be shut down or disconnected from the network, the remaining cluster will continue operation―as long as one node is fully functioning. Individual nodes can be upgraded as needed and reintegrated while the cluster continues to run. The additional cost of implementing extra hardware to build a cluster can be offset by creating a virtualized cluster that uses the available hardware resources. For best results, deploy clustered servers that both share storage and applications, and can take over for one another if one fails. These cluster servers are aware of each other’s status, often sending updates back and forth to ensure all systems and components are online.

 

Failover:

Failover is a method of operational backup where the functions of a component are assumed by a secondary system or component in the event of a failure or unexpected downtime. In the event of a business disruption, tasks are offloaded automatically to a standby system so the process remains seamless for end-users. Cloud-based environments offer highly reliable failback capabilities. Workload transfers and backup restoration is also faster than traditional disaster recovery methods. After problems at the initial site or primary server are solved, the application and workloads can be transferred back to the original location or primary system. Conventional recovery techniques typically take longer as the migration uses physical servers deployed in a separate location. Depending on the volume of data you are backing up, you might consider migrating your data in a phased approach. While backup and failover processes are often automated in cloud-based systems, you still want to regularly test the operation on specific network sites to ensure critical production data is not impacted or corrupted.

 

Redundancy:

Redundancy helps ensure you can recover critical information at any given time, regardless of the type of event or how the data was lost. Redundancy is achieved through a combination of hardware and/or software with the goal of ensuring continuous operation in the event of a failure or catastrophic event. Should a primary component fail for any reason, the secondary systems are already online and take over seamlessly. Examples of redundant components include multiple cooling or power modules within a server or a secondary network switch ready to take over if the primary switch falters. A cloud environment can provide a level of redundancy that would be cost-prohibitive to create with on-premises infrastructure. This redundancy is achieved through additional hardware and data center infrastructure equipped with multiple fail-safe measures. In the case of geographic redundancy, multiple servers are deployed at geographically distinct sites. By capitalizing on specialized services and economies of scale, cloud solutions can provide much simpler and cost-efficient backup capabilities than on-premises systems.

 

Backup and recovery:

Thanks to its virtualization capabilities, cloud computing takes a wholly different approach to disaster recovery. With infrastructure encapsulated into a single software or virtual server bundle, when a disaster occurs, the virtual server can be easily duplicated or backed up to a separate data center and quickly loaded onto a virtual host. This can substantially cut recovery time compared to traditional (physical hardware) methods where servers are loaded with the application software and operating system and updated to the last configuration before restoring the data. For many businesses, cloud-based disaster recovery offers the only viable solution for helping to ensure business continuity and long-term survival.

 

Business continuity:

Even with the best high availability practices and architecture in place, IT-related emergencies and system failures can strike at any moment. That’s why it’s vital to have a well-designed business continuity plan in place as part of your cloud strategy. Your business continuity and recovery plan should be well-documented and regularly tested regularly to help ensure its viability when confronting unplanned interruptions. In-house training on recovery practices will help improve internal technical skills in designing, deploying, and maintaining high availability architectures while well-defined security policies can help curb incidences of system outages due to security breaches. Additional practices involve defining the roles and responsibilities of support staff. If you must failover to a secondary data center, how will you effectively manage your cloud environment? Will your staff be able to work remotely if the primary office or data center location is compromised? In addition to the hardware and infrastructure, the fundamental business continuity logistics and procedures are an important part of your high availability cloud design.

 

 

Building a Solid Cloud Foundation

Cloud environments have helped make high availability and disaster recovery designs supremely efficient compared to traditional methods. Despite many highly publicized examples of security breaches and system failures, many organizations effectively run critical workloads in the cloud when they are built on the right architecture and employ the appropriate management tools.

While high availability techniques can help improve uptime and aid in recovery, it’s important to maintain and test your systems and processes on a regular basis. It’s better to uncover any issues early on rather than have them emerge during a crisis. Determine what needs to be corrected and continue to test the processes until they are perfected.

While putting together all the pieces in place to achieve a highly available cloud environment can be complex and time-consuming, the effort will pay dividends far beyond the initial investment.