Cybercriminals use many tactics to obtain credentials that they then use to remotely access corporate accounts, cloud services, and gain access to business networks. Phishing is the most common method, which is most commonly conducted via email. Attackers craft emails using a variety of lures to trick the recipient into visiting a malicious website where they are required to enter their credentials that are captured and used by the attackers to remotely access the accounts.
Businesses are now realizing the benefits of implementing an advanced spam filtering solution to block these phishing emails at source and ensure they do not reach inboxes. Advanced antispam and anti-phishing solutions will block virtually all phishing attempts, so if you have yet to implement such a solution or you are relying on Microsoft Office 365 protections, we urge you to get in touch and give SpamTitan a trial.
Phishing is not only performed via email. Rather than using email to deliver the hook, many threat groups use SMS or instant messaging platforms and increasing numbers of phishing campaigns are now being conducted by telephone and these types of phishing attack are harder to block.
Smishing for Credentials
When phishing occurs through SMS messages it is known as Smishing. Rather than an email, an SMS message is sent with a link that users are instructed to click. Instant messaging platforms such as WhatsApp are also used. Many different lures are used, but it is common for security alerts to be sent that warn the recipient about a fraudulent transaction or other security threat that requires them to login to their account.
Recently, Allied Irish Bank (AIB) customers in Ireland were targeted with such as smishing campaign. The SMS message advises the recipient that there has been a suspected fraudulent transaction which they are required to review by clicking a link and logging in. Their credentials are harvested, and they are instructed to provide codes from their card reader or one-time passwords as part of the security check. Doing so will allow the scammers to access the account and make fraudulent transactions. A variation on this theme involves the user being told they have been locked out of their account.
In this campaign the scammers use a URL on the domain secureonlineservicepayeeroi.com, although these domains frequently change. Many campaigns mask the destination URL using URL shortening services, and one recent campaign conducted by an Iranian threat group used a seemingly legitimate google.com URL and several redirects before the user landed on the phishing page. Smishing is also often used in PayPal phishing attacks using messages warning about the closure of an account.
Vishing Attacks on Businesses Spike
In December 2019, the U.S. Federal Bureau of Investigation (FBI) identified a campaign where cybercriminals were conducting phishing over the telephone – termed vishing. Since then, the number of cases of vishing attacks has increased, prompting the FBI and the Cybersecurity and Infrastructure Security Agency to issue a joint alert in the summer about a campaign targeting remote workers. This month, the FBI has issued a further alert following a spike in vishing attacks on businesses.
Cybercriminals often target users with high levels of privileges, but not always. There has been a growing trend for cybercriminals to target all credentials, so all users are at risk. Once one set of credentials is obtained, attempts are made to elevate privileges and reconnaissance is performed to identify targets in the company with the level of permissions they need – I.e. permissions to perform email changes.
The scammers make VoIP calls to employees and convince them to visit a webpage where they need to login. In one attack, an employee of the company was found in the company’s chatroom, and was contacted and convinced to login to their company’s VPN on a fake VPN page. Credentials were obtained and used to perform reconnaissance. Another target was identified that likely had advanced permissions, and that individual was contacted and scammed into revealing their credentials.
How to Block Smishing and Vishing Attacks
Blocking these types of phishing attacks requires a combination of measures. In contrast to email phishing, these threats cannot be easily blocked at source. It is therefore important to cover these threats in security awareness training sessions as well as warning about the risks of email phishing.
A web filtering solution is recommended to block attempts to visit the malicious domains where the phishing pages are hosted. Web filters such as WebTitan can be used to control the websites that employees can access on their corporate-issued phones and mobile devices and will provide protection no matter where an employee accesses the Internet.
It is also important to set up multifactor authentication to prevent any stolen credentials from being used by attackers to remotely access accounts. The FBI also recommends granting network access using the rule of least privilege: ensuring users are only given access to the resources they need to complete their jobs. The FBI also recommends regularly scanning and auditing user access rights given and monitoring for any changes in permissions.
COVID-19 has made 2020 a terrible year for many businesses, bringing unprecedented challenges that many have struggled to overcome. The year was made worse by cybercriminals stepping up their attacks, with ransomware used to pile even more misery during extremely challenging times.
Ransomware is nothing new of course. It has been used since the early 2000s to extort money from individuals and businesses. Ransomware grew in popularity in the mid-2010s when encryption methods were adopted that were tough to crack, and the past couple of years have seen ransomware grow into the biggest cyber threat for businesses, and 2020 has been especially bad.
In Q3, 2020, ransomware attacks increased by 40% according to data from Kroll. Almost 200 million attacks occurred in the quarter, and attacks continued to increase as the year progressed. Not only are more businesses now being attacked, the amount demanded by the attackers has also dramatically increased. A report from Coveware, a firm that assists companies recovering from ransomware attacks, indicates ransom demands doubled in Q4, 2019 and there has been another doubling of demands in 2020. A recent H1 2020 Cyber Insurance Claims Report from Coalition indicates 87% of all cyber-related insurance claims are the result of ransomware attacks.
Ransomware gangs have also adopted a new tactic to increase the likelihood of their ransom demand being paid. In 2019, the Maze ransomware gang started stealing data prior to encrypting files and using double extortion tactics. In addition to paying to recover data, victims had to pay to prevent the public release of their stolen data. Since then, at least 17 ransomware gangs have adopted this tactic and threaten to publish or sell stolen data if the ransom is not paid.
The healthcare industry was hit particularly hard by ransomware in 2020, especially in the latter half of the year. Healthcare systems and hospitals have been battling with the pandemic and during these extremely challenging times they have been targeted by ransomware gangs. There was a major spike in attacks on hospitals in September and the attacks have continued at high levels since.
The pandemic has given ransomware gangs new opportunities to conduct attacks, as more remote workers introduced vulnerabilities that are easy for the gangs to exploit. Vulnerabilities in new VPN and remote access solutions are exploited, emails spreading ransomware have targeted remote workers, and ransomware has been delivered via drive-by downloads masquerading as free online collaboration tools. COVID-19 has also been exploited in lures that deliver ransomware, first offering advice on the new virus, then possible cures, and latterly vaccine related lures.
The large increase in attacks toward the end of 2020 does not bode well for 2021, and there are no signs that ransomware activity will fall in 2021. In fact, the situation may even get worse before it gets better. As long as ransomware attacks continue to be profitable, the attacks will continue. What businesses need to do is make sure they take steps to block attacks, identify them quickly when they do occur, and make sure they have a plan in place to help them recover quickly should disaster strike.
Some of the important steps to take to prevent, detect, and limit the severity of an attack are summarized below:
Prevention
With so many methods of deploying ransomware, there is no single solution that will prevent all attacks. You should therefore consider the following:
Implement an advanced spam filter with best of breed protection against malware and ransomware, that uses signature-based detection to block known ransomware variants and sandboxing to identify new threats.
Ensure patches are applied promptly and software is updated quickly to the latest version.
Train your staff how to recognize email-based threats and provide general security training to eliminate risky behaviors.
Stay up to date on the latest threat intelligence and take proactive steps to address threats.
Use a web filtering solution to block access to risky and malicious websites to prevent downloads of ransomware from the Internet.
Enforce the use of strong passwords to prevent brute force attacks.
If you can detect unauthorized accessing of your systems in real time, you may be able to block an attack before ransomware is deployed. Many threat actors spend time moving laterally to identify as many devices as possible before conducting an attack and they will attempt to find and exfiltrate data, which provides a window to detect and block the attack. You should implement a monitoring system in place that generates alerts when suspicious activity is detected and, ideally, one that can automatically remediate attacks when they are detected. Many attacks occur at the weekend and public holidays when monitoring by IT teams is likely to be reduced so consider the mechanisms you have in place when staffing levels are lower.
Remediation
You may not be able to block an attack, but you can prepare and limit the damage caused. First and foremost, backup your data as you do not want to be at the mercy of the attackers. Ensure a backup is stored in a location that cannot be accessed from the network where the data resides, store a copy of a backup on a non-networked device, and ensure backups are performed regularly and are checked to make sure data can be recovered.
You should also create a disaster recovery plan that can kick into action as soon as an attack occurs to make sure your business can continue to function until the attack is fully mitigated.
A malware delivery campaign has been identified that uses phishing emails, malicious macros, PowerShell, and steganography to deliver a malicious Cobalt Strike script.
The initial phishing emails contain a legacy Word attachment (.doc) with a malicious macro that downloads a PowerShell script from GitHub if allowed to run. That script in turn downloads a PNG image file from the legitimate image sharing service Imgur. The image contains hidden code within its pixels which can be executed with a single command to execute the payload. In this case, a Cobalt Strike script.
Cobalt Strike is a commonly used penetration testing tool. While it is used by security professionals for legitimate security purposes, it is also of value to hackers. The tool allows beacons to be added to compromised devices which can be used to execute PowerShell scripts, create web shells, escalate privileges, and provide remote access to devices. In this campaign, the hiding of the code in the image and the use of legitimate services such as Imgur and GitHub helps the attackers avoid detection.
The hiding of code within image files is known as steganography and has been used for many years as a way of hiding malicious code, typically in PNG files to prevent the code from being detected. With this campaign the deception doesn’t end there. The Cobalt Strike script includes an EICAR string that is intended to fool security solutions and security teams into classing the malicious code as an antivirus payload, except contact is made with the attacker’s command and control server and instructions are received.
This campaign was identified by researcher ArkBird who likened the campaign to one conducted by an APT group known as Muddywater, which emerged around 2017. The threat group, aka Static kitten/Seedworm/Mercury, primarily conducts attacks on Middle eastern countries, commonly Saudi Arabia and Iraq, although the group has been known to conduct attacks on European and US targets. It is unclear whether this group is responsible for the campaign.
Naturally one of the best ways to block these types of attacks is by preventing the malicious email from being delivered to inboxes. A spam filter such as SpamTitan that incorporates a sandbox for analyzing attachments in safety will help to ensure that these messages do not get delivered to inboxes. End user training is also recommended to ensure that employees are made aware that they should never enable macros in Word Documents sent via email.
A web filtering solution is also beneficial. Web filters such as WebTitan can be configured to give IT teams control over the web content that employees can access. Since GitHub is commonly used by IT professionals and other employees for legitimate purposes, an organization-wide block on the site is not recommended. Instead, a selective block can be placed for groups of employees or departments that prevents GitHub and other potentially risky code sharing sites such as PasteBin from being accessed, either deliberately or unintentionally, to provide an extra layer of protection.
The Advanced Persistent Threat (APT) group APT32 – aka OceanLotus – is conducting a malware campaign targeting Apple MacOS users. APT32 is a nation-state hacking group that primarily targets foreign companies operating in Vietnam. The data exfiltrated by the hackers is believed to be used to give Vietnamese companies a competitive advantage, although the exact motives behind the attacks are opaque.
The group is known for using fully featured malware which is often delivered via phishing emails and commercially available tools. The latest malware variant was identified by security researchers at Trend Micro, who tied the malware to APT32 due to code similarities with other malware variants known to have been used by the group. The malware is a MacOS backdoor that allows the group to steal sensitive information such as business documents. The malware also gives the attackers the ability to download and install additional malicious programs on victim computers.
The malware is being delivered via phishing emails that have a zip file attachment which is disguised as a Microsoft Word document. If the recipient is convinced to open the attached file, no Word document will be opened, but the first stage of the payload will execute in the background. The first stage changes access permissions which allows the second stage payload to be executed, which prompts the third stage of the payload that downloads and installs the backdoor on the system. This multi-stage delivery of the backdoor helps the malware to evade security solutions.
Protecting against attacks involves blocking the initial attack vector to prevent the phishing emails from being delivered to end users. End user security awareness training should be provided, and employees conditioned not to open email attachments from unknown senders. It is also recommended to ensure computers are kept fully patched, as this will limit the ability of the group to use its malware to perform malicious actions.
Chinese TA416 APT Group Delivering New Variant of PlugX RAT
The APT group TA416 – aka Mustang Panda/Red Delta – is conducting a campaign to distribute a new variant of its PlugX Remote Access Trojan (RAT). TA416 is a nation state sponsored group with strong links to the Chinese government and has previously conducted attacks on a wide range of targets around the world.
The group is known for using spear phishing emails and social engineering techniques to deliver malware that allows the hackers to gain full control of an infected computer. The attacks are conducted for espionage purposes; however, the malware has an extensive range of capabilities. In addition to stealing data, the malware can copy, move, rename, execute, and delete files, log keystrokes, and perform many other actions.
The new campaign delivers two RAR archives, which act as droppers for its PlugX malware. The theme of the emails in the latest campaign are a supposed new agreement between the Vatican and the Chinese Communist Party.
The campaign was identified by researchers at Proofpoint, who could not pinpoint the exact delivery method; however, TA416 is known to use Google Drive and Dropbox URLs in its phishing emails to deliver malicious payloads. One of the RAR files is a self-extracting archive that extracts four files and executes an Adobelm.exe file, which delivers a Golang version of the PlugX malware. The recent update to the PlugX RAT helps it evade security solutions.
Combating the APT Threat
The tactics used by these and other APT groups to deliver malware are constantly changing, with phishing campaigns regularly tweaked to increase the likelihood of end users performing the desired action and to prevent the campaigns being detected by anti-virus and anti-phishing solutions. The changes to the malware and campaigns are effective and can easily fool end users and bypass technical controls, especially signature-based antivirus solutions.
Advanced AI-based cybersecurity solutions are required to detect and block these threats. These solutions detect known malware variants and can also identify zero-day malware threats and never-before seen phishing campaigns. The solutions work by protecting against the two most common attack vectors – email and the web – and prevent malicious messages from reaching inboxes and block downloads of malicious files from attacker-controlled websites.
Cybercriminals are using an increasing range of tactics, techniques and procedures to fool the unwary into disclosing their credentials or installing malware, which is making it hard for end users to distinguish between genuine and malicious messages.
It is common for cybercriminals to purchase lookalike domains for use in phishing scams and for distributing malware. Oftentimes the domains purchased are very similar to the domains they impersonate, aside from one or two changed letters.
For instance, the letters v v could be used in place of a w for a domain spoofing Wal-Mart – e.g. VVal-Mart. In internationalized domain name (IDN) homograph attacks, aka script spoofing, Greek, Latin, and Cyrillic letters are used in domains instead of standard letters. This can lead to domains being almost indistinguishable from the domains they are spoofing, especially since the web pages hosted on those domains include the logos and color schemes used on the official websites.
FBI Warns of Use of Spoofed FBI Domains
Recently the Federal Bureau of Investigation (FBI) issued a warning following the discovery that many FBI-related domain names have been purchased that closely resemble official FBI websites. While these domains are not believed to have been used for malicious purposes to date, it is probable that the individuals registering these domains were intending to use them in phishing attacks, for distributing malware, or for disinformation campaigns. The domains include fbidefense.com, fbimaryland, fbi-ny, fib.ca, fbi-intel.com, fbi.systems, and fbi.health.
These domains can be used to host phishing kits or exploit kits, but the domains can be used to create official-looking email addresses. An email from one of these domains, that has the FBI in the name, could easily scare someone into taking an action demand in the email, such as disclosing their login credentials or opening a malicious email attachment.
Legitimate Cloud Services Leveraged in Sophisticated Phishing Attacks
There have also been phishing campaigns detected in recent weeks that use legitimate cloud services to mask the malicious nature of the emails. Campaigns have been detected that use links to Google Forms, Google Docs, Dropbox, and cloud services from Amazon and Oracle. Emails are sent that include fake notifications with links to these cloud services; however, once the link is clicked, the user is taken through a series of redirects to a malicious website hosting fake Office 365 login prompts that steal credentials.
Several of these campaigns involved checks to make sure the recipient is a real person, with automated responses directed to official domains to prevent analysis. Phishers are also continuing to use typosquatting – the name given to the use of domains with natural typographical errors – to catch out careless typists.
Sophisticated Campaigns Call for Sophisticated Cybersecurity Defenses
The sophisticated nature of today’s phishing and malware campaigns, together with cybercriminals’ constantly changing tactics, techniques, and procedures, mean it is becoming harder for end users to distinguish between genuine and malicious emails. End user security awareness training is still important, but it has never been more important to have effective technical solutions in place to ensure that these threats are identified and blocked before any harm is caused.
The first line of defense against phishing is an email security gateway solution through which all emails need to pass before they reach inboxes. These solutions need to use a range of advanced mechanisms for identifying malicious and suspicious emails, so should one mechanism fail to identify a malicious email, others are in place to provide protection.
SpamTitan from TitanHQ is one such solution that incorporates many layers of protection to detect and block phishing and malware attacks via email. Checks are performed on the message headers, content is analyzed, and machine learning is incorporated to identify never before seen threats, in addition to blacklisting of known malicious email addresses and domains. To block malware threats, SpamTitan uses dual anti-virus engines to block known threats and sandboxing to identify and block zero-day malware threats. Working seamlessly together, these mechanisms will block 99.97% of malicious messages.
An additional anti-phishing solution that you may not have considered is a web filtering solution. Web filters are important for blocking the web-based component of phishing attacks and preventing individuals from visiting sites used for malware delivery. A web filter can also block redirects to malicious websites that hide behind links to legitimate cloud services.
WebTitan from TitanHQ is a smart, DNS-based web filtering solution that uses automation and advanced analytics to block emerging phishing and other malicious URLs, not just those that have been already used in attacks and have been added to blacklists. Through the use of AI-based technology, WebTitan can provide protection from zero-minute threats.
Advanced cybersecurity defenses do not need to be complicated for end users to use. Both SpamTitan and WebTitan have been developed to be easy to implement, use, and maintain. While they incorporate all the required protections and allow advanced users to drill down and analyze threats, they can also easily be used to protect networks and devices by users with little technical skill. The ease of implementation, use, and maintenance together with the superb threat protection are why the solutions are consistently rated so highly on review sites such as Capterra, GetApp, Software Advice, and on Google Reviews.
To improve your defenses against cybersecurity threats delivered via email and via the web, give the TitanHQ a team a call today and find out more about SpamTitan Email Security and WebTitan DNS filtering.
The first known ransomware attack occurred in 1989, but in the years since this form of malware has not proven popular with cybercriminals. That started to change in 2013 with Cryptolocker and the number of attacks – and ransomware threats as continued to grow ever since.
Today, ransomware is one of the biggest malware threats faced by businesses. Ransomware attacks are no longer relatively small campaigns conducted by ransomware developers. Rather than conduct their own attacks, it is now common for ransomware developers to leave the distribution of the ransomware to a network of affiliates. Under the ransomware-as-a-service model, more attacks can be conducted and more ransoms will be paid as a result. Most ransomware operations now operate under this RaaS model and there is no shortage of affiliates willing to distribute the ransomware for a cut of the profits.
While ransomware was once used simply to encrypt files and prevent them from being accessed by businesses unless a ransom was paid for the keys to decrypt files, the Maze ransomware operators started stealing data in 2019 prior to file encryption to add an extra incentive for victims to pay up. Many other ransomware operations followed suit and either threatened to publish the stolen data or sell it on to other cybercriminals if the ransom is not paid.
Data theft prior to file encryption is fast becoming the norm. Coveware, a company that works with ransomware victims to resolve ransomware attacks (often entering into negotiations with the attackers on behalf of its clients), recently published a report that shows half of all ransomware attacks now involve data theft prior to file encryption. It may be possible to recover encrypted data from backups, but that will not prevent the publication or misuse of stolen data.
This tactic has proven to be effective for the ransomware gangs, but there have been many cases where payment of the ransom has not resulted in the deletion of stolen data. In the United States, several victims in the healthcare industry have paid the ransom demand only to receive a second demand for a payment to prevent stolen data from being released.
According to Coveware, the Sodinokibi ransomware gang is known to issue further demands after the initial payment is made, and it has been a similar case with Netwalker and Mespinoza ransomware. The operators of Conti ransomware provide proof that files are deleted after the ransom is paid, but that proof is faked.
Ransom demands are also increasing. The average ransom demand in Q3, 2020 was $234,000, up 31% from the previous quarter according to the Coveware Quarterly Ransomware Report.
The healthcare industry has been extensively targeted by ransomware gangs and attacks have increased during the COVID-19 pandemic. The healthcare industry is heavily reliant on data and attacks aim to encrypt patient data and steal medical records prior to encryption. If the ransom is not paid, the data has a high value and can be sold on easily.
Recently, a joint warning was issued by the U.S. Department of Homeland Security Cybersecurity and Infrastructure Security Agency (CISA), in conjunction with the FBI and the Department of Health and Human Services, warning of an increased and imminent threat of targeted ransomware attacks on the healthcare and public health sectors. A few days after the alert was issued, 6 healthcare providers were attacked with Ryuk ransomware in a single day.
Ransomware attacks are here to stay for the foreseeable future. They will only start to decline when they are no longer profitable. With attacks at record levels and no guarantee that stolen data will be returned even I the ransom is paid, it is more important than ever for businesses and healthcare organizations to ensure their defenses are hardened against ransomware attacks.
Ransomware can be delivered using a variety of techniques. Vulnerabilities in software and operating systems are commonly exploited to gain access to networks, so vulnerability scanning is important for identifying exploitable vulnerabilities to ensure they are promptly addressed before they can be exploited.
Email remains one of the most common attack vectors, not only for delivering ransomware, but delivering ransomware downloaders. Emotet and TrickBot are two Trojans commonly used to deliver ransomware as a secondary payload, and both are primarily delivered via email, as is BazarLoader, which has been used to deliver ransomware in many recent attacks.
To block this attack vector, an advanced AI-powered spam filter is required – one that is capable of not only detecting known malware threats, but zero-day malware and email attacks that have not been seen before. SpamTitan uses AI and machine learning techniques to identify these email threats at source and prevent them from being delivered to inboxes where employees unwittingly provide the attackers with access to their networks. In addition to dual anti-virus engines, SpamTitan has a sandboxing feature for identifying zero-day malware threats and SPF, DKIM, and DMARC to detect and block email impersonation attacks.
Ransomware, ransomware droppers, and other malware threats are often delivered via the Internet, so cybersecurity measures are needed to block this attack vector. WebTitan similarly uses AI and machine learning techniques to provide protection from websites used to deliver malware threats. The solution uses automation and advanced analytics to search through billions of URLs/IPs and phishing sites that could comprise a company and ensure those threats are blocked.
By implementing layered defenses, it is possible to block the majority of threats, but it is still important to ensure that your data is protected in the event that an attack succeeds. You should make sure that come what may, your data is secured.
A good approach to adopt is the 3-2-1 backup strategy, which involves making three backups, storing the copies on 2 different media (tape, disc, or cloud for instance), and ensuring one copy is stored securely off site. Should an attack succeed, you will not be at the mercy of the attackers and will at least be able to recover your data without paying the ransom.
If you want to improve your defenses against ransomware, give the TitanHQ team a call today for information and advice on the steps you can take to harden your defenses.
Phishers are constantly coming up with new scams that abuse trust. People tend to trust their favorite brands and when email communications are sent by those companies there is a tendency for the emails to be trusted. The same is true when emails are sent from email contacts such as work colleagues and friends. Cybercriminals take advantage of trust to get users to take a specific action, such as clicking on an embedded hyperlink in an email or opening an email attachment.
Many businesses now provide security awareness training to employees and try to teach them to always be vigilant and never to trust emails implicitly, even if they have been sent by known contacts. Just because an email has been sent from a known and trusted email account does not mean the message is genuine. Email accounts are often compromised and used to send phishing emails. The Emotet Trojan hijacks email accounts and uses them to send copies of itself to the victim’s contacts, and several other malware variants do the same. Email addresses are also spoofed. The display name may be correct or believable, but the actual email account used to send the message is anything but.
Another tactic is now being used by at least one cybercriminal group than similarly abuses trust, albeit in a new way. A phishing campaign, which was first detected on September 21, 2020, uses the challenge-response test CAPTCHA to simultaneously make the campaign believable and also to reduce the probability of the scam being detected by email security solutions.
Internet users will be familiar with CAPTCHA, although maybe not by name. The CAPTCHA system is used by many websites as a way to determine if a website visitor is a human or a bot, most commonly on forms.
Google uses CAPTCHA and requires users to pass a pictorial challenge where it is necessary to select all the images in a group that featuring a car, bicycle, bus, or traffic lights. If you pass the challenge you will be allowed to proceed, if you fail you will not. Other versions involve entering in a number or code word that has been heavily disguised in an image.
While these CAPTCHA challenges can be annoying, they are associated with security so if a website has one of these challenges, subconsciously people tend to feel more secure. However, as with a website starting with HTTPS, it does not mean the website is genuine.
In this new phishing campaign, users are likely to feel more secure when credentials are requested since they had to pass a CAPTCHA test, especially considering the page on which the challenge was set up looks just like the genuine login prompt for Office 365. The background is the same, as is the login prompt. The only difference between the genuine login page and the fake version is the URL.
Security teams face a challenge detecting and blocking these phishing pages as email security solutions, despite having AI-based detection mechanisms, are essentially bots and, as such, cannot pass a CAPTCHA challenge.
A second tactic is also used to evade detection. The scammers have set up their campaign so that only a specific set of IP addresses will be presented with the CAPTCHA test on the fraudulent domain. If any IP address outside a specific range attempts to visit the link– the IP range used by the targeted company – a redirection will occur to the genuine Microsoft login page.
While these scams help to ensure that malicious emails are delivered to inboxes, organizations do not need to be totally reliant on their employees recognizing the scams and taking appropriate action (reporting the email to the IT security team).
With a web filtering solution in place, attempts to visit known malicious websites will be blocked. When malicious domains are detected they are automatically added to a web filter’s blacklist, and any attempts to visit malicious domains will be blocked.
WebTitan is a low maintenance security solution that can be set up in about 5 minutes and will protect against the web-based component of phishing attacks and will block malware downloads from malicious websites. WebTitan works in tandem email security solutions to provide greater protection against malware and phishing attacks. The solution can also be used to control the content that employees and guest network users can access over the internet, whether they are on the network or working remotely.
If you have not implemented a web filter or are unhappy with your current solution, give the WebTitan team a call to find out more. A product demonstration can be arranged, you can have a free trial of the solution, and assistance can be provided to help you get the most out of WebTitan during your trial.
The Internet opened up a world of new opportunities for businesses, allowing them to get in touch with customers around the world, explore new markets, find new suppliers, and access a wealth of knowledge. Web filtering solutions allow businesses to control internet access and monitor its use by employees and guest users, but why is web filtering in the workplace necessary, what are the benefits, and what are the risks of not filtering the internet? In this post we will explore the benefits of web filtering in the workplace.
What Exactly is a Web Filter?
You will no doubt be aware of spam filters, which are used to carefully control what emails are delivered to inboxes, blocking threats such as phishing emails and malware. Spam filters may also scan outbound email and apply controls to prevent data loss and malicious emails from being sent externally. A web filter performs a similar function for Internet access.
A web filter sits between your end users and the Internet and applies controls over the websites that can be accessed and the files that can be downloaded. The main function of a web filter is content control to restrict access to NSFW websites and block phishing websites and malware downloads.
Reasons for Web Filtering in the Workplace
There are many different reasons for web content filtering in the workplace. These include:
Blocking access to inappropriate web content
Web filters are often used to prevent employees from accessing NSFW content such as pornography, images of violence, and hate speech, which can lead to the development of a hostile work environment. Businesses such as coffee shops, along with libraries and schools, use web filtering to create a family-friendly online environment and prevent minors from accessing age-inappropriate content.
Blocking online threats
Phishing attacks are now commonplace and there is a significant risk of malware being downloaded from the Internet. A web filter blocks these threats, by first preventing users from accessing known malicious websites and secondly by preventing downloads of malicious files.
Controlling bandwidth use
There will be a limited amount of bandwidth available and sometimes that bandwidth may be squeezed, resulting in considerable latency that affects all Internet users on the network. A web filter can be used to restrict bandwidth use by blocking certain online activities – video streaming for instance – ensuring sufficient bandwidth is available for all.
Improving productivity
The Internet makes slacking off very easy for employees. Business can suffer major productivity losses from employees accessing certain types of websites which serve no purpose in the workplace. A web filter can be used to block access to social media networks, dating websites, gambling and gaming sites, and video streaming services such as YouTube.
Preventing legal issues
Legal issues can arise from uncontrolled Internet use. If an employee or user of a Wi-Fi network engages in illegal activity, the business owner may be liable for their actions. For instance, illegal software, music, and video downloads from P2P file sharing networks. Web filters can also prevent data theft by blocking access to file sharing sites.
Monitoring Internet use
You may want to adopt a permissive approach and only restrict access to illegal content and malicious websites, but a web filter gives you insights into what users are doing online. This can help you to prevent and resolve HR issues and identify insider threats.
How Web Filtering in the Workplace is Achieved?
There are several ways that web filtering in the workplace can be implemented. A physical appliance can be purchased through which all Internet traffic is routed, with controls applied by a system administrator. Cloud-based web filters are now much more popular. With filtering taking place in the cloud, no equipment purchases are required.
DNS-based web filtering sees filtering take place at the DNS lookup stage of a web request, with filtering occurring without content being downloaded. Cloud-based filters that operate at the DNS level also avoid any latency issues, which can be a problem with physical appliances.
Methods of Web Filtering
There are various methods of web filtering in the workplace, with most solutions using a combination of all.
Whitelists and Blacklists
Blacklists are used to block access to specific domains and URLs, either through third-party or user-generated blacklists. Whitelists are used to always allow access to a specific URL or domain, regardless of the content filtering controls put in place.
Category Filtering
Category filtering is the easiest way of exercising content control. A web filtering solution will assign websites into categories based on the content of the website. Using a checkbox in the UI, the system administrator can select which categories of content should be blocked. Commonly blocked categories include pornography, gambling, gaming, dating, social media, news, and webmail.
Content Analysis
Web filters can perform analyses of web content to detect certain keywords and can assign a score to each URL. Thresholds can be set for individual users, departments, or the entire organization and if that threshold is exceeded, the content will not be displayed.
WebTitan Cloud: Workplace Web Filtering Made Simple
WebTitan cloud is a powerful web filtering solution that provides visibility into the online activities of users and allows controls to easily be set to control Internet access and block online threats that could threaten your business. WebTitan Cloud has been developed to be easy to set up and use, with no technical prowess required to use the solution.
Highly granular filtering controls allow precision control over the content that can be accessed, without overblocking and preventing important web content from being accessed. The solution is DNS-based, so no equipment purchases or software downloads are necessary, and there is zero latency.
WebTitan Cloud protects on-site workers on the network, Wi-Fi users, and remote workers no matter where they access the Internet.
There is a transparent pricing policy, no optional extras, the product is extremely competitively priced, and customers benefit from industry-leading customer support.
Managed Service Providers (MSPs) that want to add web filtering to their service stacks benefit from many MSP-friendly features such as multiple hosting options, a brandable white-label version of the product, monthly billing, and pricing that accommodates rapidly changing numbers of seats.
To find out more about the full benefits of WebTitan Cloud, to arrange a product demonstration, give the WebTitan team a call today.
Many companies have adopted a hybrid workforce model, where employees spend some time in the office and some time working from home. This working model works well for the business and gives employees the flexibility they want.
Some businesses have transitioned to a fully remote workforce, but then 2020 arrived and virtually everyone had to do the same. Research from Gartner suggests that during the coronavirus pandemic, 88% of companies made remote working mandatory.
The rapid change to an office-based to remote workforce caused major headaches for IT teams, but it has allowed business to continue to function during incredibly challenging times. There have been productivity issues and technical problems, but business have weathered the storm and have continued to operate. Employees can still stay in touch and collaborate using online using chat platforms, videoconferencing, and the telephone and some businesses have reported an increase in productivity since switching to remote working.
While there are now many different methods of collaborating and maintaining contact, remote working has meant businesses and their employees have been forced to rely on email to a much greater extent. The increased reliance on email means it is now more important than ever to ensure emails can be accessed come what may, even if email servers are down. Should anything happen to the email system, work can grind to a halt.
Many businesses use emails as a store of essential information and much of the data in emails is not stored elsewhere. Figures from IDC indicate around 60% of business-critical data resides in emails and email attachments and that was before the pandemic.
There are many regulations covering business data, including at the federal, state, and industry level. There are set retention times for certain types of data, regardless of where the information is stored. If the information is stored in emails, then that information must be protected and secured against accidental or deliberate deletion until the retention period is over.
Backups of emails can be performed to meet certain regulations, but problems exist when it comes to recovering emails. Finding emails in backups can be an incredibly time-consuming process that can take days or weeks. Even finding the correct backup media can be a major challenge in itself, and then finding emails in a backup – which is not easily searchable – can seem a near impossible task.
The way to ensure privacy, security, and meet compliance requirements and ensure that emails and attachments are never lost is to use an email archiving service. Email archives are created for long term data storage. Email archives can be easily searched, so when emails need to be found and recovered, the process takes seconds or minutes. A tamper-proof record of all emails is retained for compliance purposes and to protect against data loss and ensure business continuity in the event of disaster.
Many businesses have implemented an on-premises email archive, but this is far from ideal in a world where virtually everyone is working remotely. After the pandemic is over, many employees will return to the office, but remote working looks set to stay. The best option is therefore to use an email archiving solution that perfectly suits the remote working or hybrid working model.
Cloud-based email archives centralize disparate email servers and store all emails securely in the cloud where they can be quickly and easily accessed by any authorized individual, from any location. Since many businesses now use cloud-based email, sending emails to a cloud-based archive makes more sense than using on-premises archives. Sending emails to the archive and recovering emails will be far quicker from a cloud service to a cloud service.
If you have an on-premises email archive, transitioning to a cloud-based service can save time and money. There is no need to maintain hardware, perform software updates, and the archive is automatically backed up to guarantee emails can always be recovered and storage space will never be an issue due to the scalability of the cloud.
TitanHQ’s Cloud-Based Email Archiving Solution
TitanHQ offers a cloud-based email archiving solution – ArcTitan Cloud – that is scalable to more than 60,000 users that delivers high performance and reliability. Every email sent and received by a company is automatically sent to the archive. Messages are deduplicated to save on storage space and are compressed in the archive. All emails are indexed and tagged to make searching a quick and easy process. Whenever an email needs to be recovered, a search of 30 million emails takes less than a second.
All emails are encrypted in transit to the archive and at rest and the email archive is automatically backed up. If emails need to be accessed during a mail server outage, they can easily be found in the archive. ArcTitan really is a set and forget solution.
ArcTitan Cloud supports point and click easy search or expert search with sophisticated query language. Searches can be saved, multiple searches can be performed at the same time, and you can search the entire archive, departments, user groups, or individual mailboxes. Permissions can be granted to employees to allow them to access their own archives to ensure they never lose and email and do not need to trouble the IT department when they misplace an email. You can search emails, but also inside all common file formats including Microsoft Word, Excel and PowerPoint, PDF, RTF, ZIP, tar, gz and Open Office documents.
Migrating from an existing cloud archiving service or an on-premises archive to ArcTitan Cloud is a quick and easy process and support will be provided if required. There are no proprietary data formats used, so if you ever want to export your data, that is a quick and easy process too.
Many email archiving services require you to pay for all mailboxes, even when employees leave the company. With ArcTitan, you only pay for the number of active mailboxes and there are no limits on storage space. The solution is easy to implement, use, and maintain, all of which have made the solution incredibly popular with SMBs and MSPs serving the SMB market. On top of that, ArcTitan is one of the most cost-effective arching solutions for businesses.
Figures correct as of July 2020.
For more information on cloud-based email archiving and the ArcTitan solution, give the TitanHQ team a call today.
While the telephone remains a vital tool for business, a great deal of transactions and conversations now take place over email. More than 306 billion emails are now being sent every day and a business with 100 employees will typically send or receive around 4,000 emails a day, many of which will contain important information that is critical to the successful operation of the business.
The loss of emails could prove very costly for businesses, as much of the information stored in emails and email attachments is saved nowhere else. In the event of disaster, such as corrupted PST files, hardware failure, or a destructive cyberattack, email data could well be permanently lost.
Not only could the loss of email hamper the ability of a business to operate, it could potentially result in a significant financial penalty. 24% of organizations have reported receiving a request from a court or regulatory body to produce emails. If emails can’t be produced, the cost of the financial penalties do not even bear thinking about. They could prove catastrophic to a business.
Most businesses backup their emails as part of their disaster recovery plans, but there are problems with backups. Backups cannot be searched, so finding emails can take an extraordinary amount of time. To ensure that emails are never lost and can be found and recovered in a matter of seconds or minutes, most businesses choose to use an email archiving solution.
Here we list 10 of the most important reasons for using an email archiving solution.
10 Reasons Why Businesses Should Archive Emails
Data Loss Prevention
One the most important reasons for using an email archive is for data loss prevention. Emails are sent to the archive for long term, secure storage. If an employee accidentally deletes an important email from their inbox, the message will not be lost as it can easily be recovered from the archive.
Mail Server Performance
The amount of emails now being sent places a strain on email servers and having large volumes of emails stored on the server negatively affects server performance. Storage space can also become an issue. By sending emails to an archive, they can be removed for the mail server which will greatly improve performance.
Litigation and eDiscovery
In the event of a lawsuit, you are likely to be required to produce emails related to the case and you will only have a short period of time in which to respond. Finding emails in PST files and backups can be an extraordinarily time-consuming process, and you may have to search through several years of email data to find all the emails you need. You must also ensure that the messages are original and have not been altered in any way. An email archive makes responding to eDiscovery requests and finding and producing emails a quick and simple process.
IT Department Productivity
The IT department has to spend a considerable amount of time on managing the email system and resolving email storage issues. When employees delete or lose important emails, the IT support desk is expected to respond. Sending emails to an archive eliminates email storage issues and simplifies maintenance. Employees can be allowed to access their own archives and can easily search for emails, saving the IT department a lot of time that can be put to much better use.
Disaster Recovery
In the event of hardware failure, email data can easily be lost. Laptop computers may be lost or stolen, again resulting in the loss of email data. Ransomware and wiper malware attacks could easily wipe out the email system and could potentially result in critical data loss. By sending emails to the archive, in the event of disaster, emails can quickly and easily be recovered.
Regulatory Compliance
If you operate in a highly regulated industry you will need to retain email data for a set period of time, but all businesses must retain certain types of data, much of which is stored in email. An email archive helps with regulatory compliance. Data can be tagged and retention periods can be set, with emails automatically deleted when the legal retention period is over.
Data Access and Right to be Forgotten Requests
The General Data Protection Regulation (GDPR) and other laws give individuals the right to request a copy of the information that a company holds on them. If a request for access to personal data is received, the data must be produced quickly. An email archive allows you to instantly search for email data and quickly respond to right-of-access and right-to-be-forgotten requests.
Internal Audits
There will likely be many occasions when you need to conduct internal audits of email data to find out what employees have been communicating via email. In the event of a customer dispute or an HR issue, you will need to search email data. An email archive makes this quick and easy, and allows you to resolve issues promptly without having to involve the IT department.
Business Continuity
In the event of disaster, you will need to have quick access to email. If an employee suddenly leaves the company, you will need to find all emails related to specific clients. With easy access to email and with the advanced search capability of an email archiving solution, you will be able to ensure business can continue as normal.
Cost Reduction
Searching for lost emails, managing email servers, responding to eDiscovery requests, and producing email data for audits can take an extraordinary amount of time. An email archive will slash the amount of time that needs to be devoted these issues and helps you avoid unnecessary costs. An email archiving solution will more than pay for itself in terms of the costs saved.
ArcTitan – Cloud-Based Email Archiving from TitanHQ
ArcTitan is a powerful, secure, cloud-based email archiving solution from TitanHQ that ensures you will never lose an email. ArcTitan acts as a black box flight recorder for email and gives you total protection against email data loss.
The solution is fully compliant with all industry regulations, email data is protected with end-to-end encryption and is encrypted in the archive, the solution is quick to set up, easy to use, and effortless to manage.
Lightning fast searches can be performed when you need to find emails, with emails sent to the archive automatically at a rate of 200 emails a second with searches of 30 million emails taking less than a second.
There are no limits on storage space, no onsite hardware requirements, and you only pay for the number of active mailboxes. Businesses that use ArcTitan typically save up to 80% of email storage space.
For more information on ArcTitan, details of pricing, or to book a free demo, call the ArcTitan team today!
Exploit kits used to be one of the most common methods of distributing malware, although their use has dwindled to a fraction of the level seen in 2016. That said, there has recently been an uptick in the use of exploit kits and multiple threat actors are conducting campaigns to deliver malware payloads.
An exploit kit is malicious code that incorporates exploits for one or more vulnerabilities. When a visitor arrives on a website hosting an exploit kit, their computer is scanned for vulnerabilities and if one that is being targeted, the exploit is executed and a malicious payload such as a banking Trojan, keylogger, or ransomware is silently downloaded.
Exploit kits are loaded onto websites under the control of the attackers, which can be their own domains or a legitimate site that has been compromised. Traffic is usually sent to the exploit kit through malicious adverts on third-party ad networks (malvertising). These ad networks are used by many websites for adding revenue-generating third party adverts.
According to research conducted by Malwarebytes, a campaign is being conducted using the Fallout exploit kit to deliver the Racoon Stealer, with the EK loaded onto popular adult websites. The campaign was reported to the ad network and the malicious advert was removed, only to be replaced with an advert directing visitors to a site hosting the Rig exploit kit.
Another campaign was identified involving a different threat actor who is known to have targeted various adult ad networks. The malicious adverts were displayed on a wide range of different adult websites, including one of the most popular adult websites that generates more than 1 billion page views a month.
The threat actor had submitted bids for users of Internet Explorer only, as the exploit kit contained an exploit for an unpatched IE vulnerability. The vulnerabilities exploited were CVE-2019-0752 and CVE-2018-15982, the former is an IE vulnerability and the latter is a vulnerability in Adobe Flash Player. In this campaign, Smoke Loader malware was delivered, along with Racoon Stealer and ZLoader.
For an exploit kit to work, a computer must have an unpatched vulnerability, an exploit for which must be included in the EK. Prompt patching is therefore one of the best ways of ensuring that these attacks are not successful. It is also strongly advisable to stop using Internet Explorer and Flash Player. Vulnerabilities in each are frequently targeted.
These campaigns can also easily be blocked by using a web filter. Unless your business operates in the adult entertainment sector, access to adult content on work devices should be blocked. A web filter allows your business to block access to all adult websites, and other categories of web content that employees should not be accessing in the workplace.
A cloud-based web filter such as WebTitan is a low cost solution that can protect against a web-based attacks such as exploit kits and drive-by malware downloads, while also helping businesses to improve productivity by preventing employees from visiting websites that have no work purpose. Web filters can also reduce legal liability by preventing employees from engaging in illegal online activities, such as copyright infringing file downloads.
Once implemented – a process that takes a few minutes – access to certain categories of website can be blocked with the click of a mouse and employees will be prevented from accessing websites known to harbor malware, phishing kits, and other potentially malicious websites.
For further information on WebTitan and protecting your business from web-based threats, give the TitanHQ team a call today.
COVID-19 has created a great many challenges for businesses and has forced them to adapt to a new way of working very quickly. Businesses that had mostly office-based workers have had to change to having virtually everyone working remotely.
Employees working from home are maintaining contact via IM solutions, email, and videoconferencing platforms such as Zoom and Microsoft Teams, but in contrast to office-based work, businesses are now relying on their employees to stay connected and remain productive.
While most businesses have adapted to the new way of working, many business leaders are concerned about how to protect their data and maintain compliance with most of their employees working from home. Employers have had to accept that remote working, to some degree, is now the new normal, so steps must be taken to ensure business and email continuity.
On Tuesday, September 22, 2020, TitanHQ is hosting a webinar to discuss these and other concerns and offer a solution that can help to keep businesses moving forward when employees are working remotely.
During the webinar TitanHQ experts will discuss the following topics:
The Current 2020 Technology Landscape
Security & Compliance in a time of Global Remote Working
Increase in Companies Relying Solely on Office 365
Protecting Business Critical Data
The Importance of Continuity in the Era of Remote Working
Attendees will also be given a live demo of TitanHQ’s cloud email archiving solution, ArcTitan.
Webinar Details
Title: How to Ensure Business Continuity with Email Archiving for your Remote Workforce
Many businesses have created an email archive for compliance purposes and to ensure emails, documents, calendars, and other data in the email system is preserved to meet regulatory obligations and for disaster recovery.
Many businesses only discover after they have been using an email archive that it does not quite live up to expectations, is proving to be expensive, or the archive is no longer performing as well as it should.
Once you have set up an email archive, it does not mean that you are tied to any provider. Migrating your email archive to another provider that offers a service that is more suited to your organization requires a little planning, but it can be a pain free process.
Is it Time to Upgrade your Email Archive?
One of the main reasons for changing an email archive is because legacy archives have become sluggish due to the volume of backed up data. Over time, these legacy archives can become unreliable, searches do not always provide all the results, and in some cases the archiving solution reaches end of life and patches are no longer issued so security becomes an issue.
Storage space can become a problem if you are using aging email archiving appliances or physical servers, and latency can increase, especially if you have transitioned to cloud-based applications such as Office 365. If an email archive is failing to perform, it is time to upgrade to a new archiving solution; one that is more modern, can be searched much more rapidly, and does not pose a security risk to your organization.
Cloud Email Archives Can Solve Your Archiving Problems
With an increasing number of organizations having migrated to Office 365, using a cloud-based email archiving service makes a great deal of sense. Your email data is already in the cloud, so switching to a cloud-based email archive is a logical step. Moving data from the cloud to on-premises infrastructure is likely to involve some degree of latency, whereas archiving from a cloud service to another will avoid these latency problems and see improvements in performance.
You will not need maintain on-premises hardware with a cloud-based archive. The email archiving service provider is responsible for maintaining the hardware, patching, and performing updates. Cloud-based email archives also have scalability. As your email volume grows, your archive automatically scales, and more storage space is made available. You will never run out of storage space with a cloud email archiving service. Your cloud email service provider will just arrange for more servers to be made available.
Cloud email archives can also be accessed from any location, on any device, through either an email client or web browser – something that has become much more important during the COVID-19 pandemic, with many employees now working from home.
Making the change to a new email archiving service provider will likely greatly improve performance and allow faster archiving and searching. That means considerable productivity gains and less headaches for your IT department as the maintenance burden will be eased.
Companies that switch from legacy email archives to cloud archiving services can greatly reduce the cost of email archiving, allowing them to put their resources to much better use. Even switching from one cloud email archiving solution to another can see considerable costs saved.
ArcTitan: Save Costs and Improve the Performance of Your Archive
Regardless of the current email archiving solution you are using, migrating your email archive to ArcTitan is a straightforward and quick process. TitanHQ will guide you through the migration process, providing detailed steps to take to get your archive migrated quickly. Alternatively, we can talk you through the process and even work with your current provider directly to transfer your archive.
If you are upgrading from a legacy email solution to Office 365, you can simply transfer your archived data to ArcTitan, rather than send it to Office 365. Again, full assistance will be provided by our knowledgeable engineers.
Many ArcTitan customers have managed to reduce the load on their mail servers by 80%, significantly improving performance. Maintenance time can be slashed by around 50%, and the cost savings are considerable.
Then there is the speed of the solution. ArcTitan conducts searches at a rate of 30 million emails a second, searches can be combined, multiple searches run at once, and emails and attachments searched in the same search. Searches can also be saved if you conduct them frequently.
Security is assured with email data protected by end-to-end encryption, with passwords hashed and encrypted. Your archive is encrypted and stored securely on Replicated Persistent Storage on AWS S3 and will be automatically backed up. Updates are managed for you and there will never be any patches to apply.
On top of all the features of ArcTitan, many of which are lacking in other email archiving solutions, you are also likely to be pleasantly surprised at the price of the solution (and the margin if you are an MSP looking to add email archiving to your service stack.)
For more information about ArcTitan and migrating your archive, give the TitanHQ team a call today and take the first step toward eliminating your email archiving headaches.
What our Customers Say…
“Fast, scalable, very easy to operate and has all the email archiving features a company needs to have. Safe and the cost was fantastic. A truly superb email archiving tool,” Jesse Gusmao, IT Manager.
Sociedade Hospital Samaritano. Brazil.
“I can tell you our experience has been outstanding. ArcTitan email archive has been the most effective solution we’ve found. Initially, we tested it for ourselves, but given the success we’ve had, we’re now signed up as a reseller and are confidently introducing the product to our small and medium clients.” Lou Liberio, IT Director. Clarion Data Systems, USA
“Exceptionally easy to install and insert into our email infrastructure. The effect and affect of ArcTitan Email Archiving was dramatic. The load on our Exchange server was reduced by 80% immediately.” Mike Pluta, IT Director. NRC Broadcasting, USA
Several thousand email messages can be received by a business every day, and many of those messages contain important documents and sensitive information, which in some cases is saved nowhere else other than the email system or on a user’s local device.
Several regulations require email data to be backed up and stored for a certain time period, with many businesses choosing to store copies of business emails using backups. While backups will allow a business to comply with regulations and ensure messages can be recovered in the event of disaster, backups are not searchable which makes recovery of emails a time-consuming process.
An email archive is a much better solution. Email archives store emails in a tamper-proof repository and, in contrast to backups, prior to being sent for long term storage, emails and attachments are indexed to allow them to be searched on demand. When an email needs to be found, a search can be performed and individual emails can be found and recovered in seconds or minutes, whereas the process of finding and recovering emails from a backup could take days.
In the event of a legal investigation, it is essential for emails to be produced. Businesses must be able to prove the integrity of email data and show an original copy of the messages is provided that has not been altered since being sent or received. If you cannot prove the integrity of email messages, you could get in serious legal trouble. In the event of a cyber-incident, email messages are checked in the investigation process, so it is also essential to maintain message integrity and ensure all emails can quickly be recovered.
Given the number of emails received by businesses every day, the amount of storage space that must be devoted to emails and attachments grows quickly. Businesses are likely to require terabytes of storage space, which can prove costly. A cloud-based archive ensures that there is always sufficient storage space available and rules can be sent to delete emails and attachments securely when they are no longer required to be retained by law. A cloud-based archive can reduce storage use by up to 75% compared to on premise storage and reduce maintenance time by up to 50%, resulting in significant cost savings.
Many businesses use Outlook for email, which stores emails in Personal Storage (PST) files. These files are stored locally on each user’s device and are not tamper-proof. They can also become corrupted, can be targeted in cyberattacks, and are at risk of being accidentally deleted. If these files are not backed up, in the event of data corruption or accidental deletion, they cannot be recovered. Using an email archive ensures that all users’ email data can be recovered, and users’ PST files can be quickly and easily restored. Without an email archive, critical business emails could easily be lost.
If you are required to comply with the E.U. General Data Protection Regulation, you must be able to search for data in email if a request is made by an E.U. citizen to access their data or if they exercise their ‘right to be forgotten.’ If you have an email archive, searches can be performed quickly, and it is easy to satisfy these GDPR requests. The failure to respond to these requests quickly, could easily result in a substantial fine for noncompliance.
Should you ever need to change email systems and migrate to new email servers, all inboxes, messages, and attachments will need to be migrated to the new server. If you do not have the right systems in place, that process can be difficult and time-consuming. Using an email archive makes the process faster and simpler, ensuring seamless migrations with few errors, saving considerable time and effort.
In summary, and email archive will…
Ensure a tamper-proof copy of email data is retained and is always accessible
Allow you to search millions of emails in seconds
Reduce server management costs
eDiscovery requests can be processed quickly
Email data is protected against cyberattacks and can always be recovered in the event of a data destruction event
Email migrations can be performed quickly and easily without data corruption
Reduce storage space by 50% or more and greatly reduce costs
Maintain an audit trail to ensure compliance with regulations such as Sarbanes-Oxley (SOX), PCI-DSS, SEC, DPA, HIPAA, and GDPR
Free up IT support time by allowing employees to access their own email archives
Help with compliance and ensures data can be quickly found and produced in the event of an investigation
ArcTitan: Email Archiving Made Simple
ArcTitan is a powerful email archiving solution from TitanHQ that makes archiving email, performing searches, and recovering email data a quick and simple process.
Key Features of ArcTitan
Scalable, email archiving that grows with your business
Email data stored securely in the cloud on Replicated Persistent Storage on AWS S3
Lightning fast searches – Search 30 million emails a second
Rapid archiving at up to 200 emails a second
Automatic backups of the archive
Email archiving with no impact on network performance
Ensure an exact, tamper-proof copy of all emails is retained
Easy data retrieval for eDiscovery
Protection for email from cyberattacks
Eliminate PSTs and other security risks
Facilitates policy-based access rights and role-based access
Only pay for active users
Slashes the time and cost of eDiscovery other formal searches
Migration tools to ensure the integrity of data during transfer
Seamless integration with Outlook
Supports single sign-on
Save and combine searches
Perform multiple searches simultaneously
Limits IT department involvement in finding lost email – users can access their own archived email
Compliant with regulations such as HIPAA, SOX, GDPR, Federal Rules of Civil Procedure, etc.
If you are not yet archiving your email, are unhappy with your current provider, or are an MSP that is not yet offering email archiving to your clients or is unhappy with the service or margins with your current provider, give the TitanHQ team a call to find out more about ArcTitan.
The COVID-19 pandemic created a massive opportunity for cybercriminals, and they have been exploiting it with vigor, especially in phishing campaigns. Phishing is the use of deception to trick someone into performing an action. Social engineering techniques are used to get people to open malicious email attachments, visit hyperlinks to websites where sensitive information is harvested, or to take other actions such as make donations to fake charities.
In the early stages of the pandemic when little was known about the virus, how it was spread, the risk of infection, and the disease it caused, the public was very much in the dark and craved information. This created the perfect opportunity for cybercriminals for use in phishing and other cyberattacks.
Recently, the United Nations released data collected about phishing attacks involving COVID-19 related themes showing there had been a 350% increase in new phishing websites in the first quarter of the year, many of which were health-related and targeted health systems and hospitals.
Research conducted by Check Point also found a major rise in domain registrations linked to COVID-19. Research showed that phishing attacks increased from around 5,000 a week in February to more than 200,000 per week by late April, many of which were linked to COVID-19.
Early in the year the lack of knowledge about COVID-19 and the SARS-CoV-2 virus suited large-scale phishing campaigns involving millions of messages, with cybercriminals re-purposing their normal campaigns and started using COVID-19 themed websites and lures. Phishing emails offered information about the virus, possible cures, and advice to avoid being infected. When there was a shortage of personal protective equipment, phishing lures were used offering low cost supplies and testing kits.
Now that there is more information about the virus and cases and PPE shortages have largely been addressed, phishing scams related to COVID-19 have evolved. A study conducted by ProPrivacy showed that far from the COVID-19 related phishing attacks disappearing and cybercriminals returning to their old campaigns using fake invoices and alike, these campaigns are still running, but they have become more targeted and sophisticated.
These targeted campaigns offer answers to new questions being raised by the public, such as whether it is safe for children to return to schools. The study, conducted in partnership with VirusTotal and WHOIS XML, identified 1,200 COVID-related domains were still being registered each day and a sample of 600,000 of those domains revealed around 125,000 of them were malicious and were mostly being used for phishing.
We can expect to see another wave of phishing emails and websites set up related to COVID-19 vaccines when they start to come to market. Since the threat has not gone away and is likely to remain for some time to come, it is important to remain on your guard and to be cautious with any emails received, especially those related to COVIID-19.
Businesses also need to take extra care to ensure that their employees and devices are protected. Most businesses will already have a spam filtering solution in place to block phishing emails, but now is a good time to review those controls. If spam and phishing emails are still reaching inboxes, consider an alternative solution or a third-party spam filter if you are using Office 365 and are relying on Exchange Online Protection for spam and phishing protection.
One anti-phishing measure that is less commonly used by businesses is a web filter. A web filter allows businesses to control the websites and webpages that their employees can visit. Web filters, such as WebTitan, block access to websites known to be malicious, such as those known to be used for phishing. Web filters also categorize websites and allow certain categories to be blocked. By carefully controlling the web content that can be accessed by employees, businesses will be much better protected against phishing attacks and other cyber attacks with a web-based component.
It is also strongly recommended to implement 2-factor authentication, which will provide protection in the event of credentials being compromised in a phishing attack.
If you would like more information about web filtering, WebTitan, or improving your spam filter, give the TitanHQ team a call.
Cybercriminals have adopted a new tactic to deliver malware and conduct phishing attacks on unsuspecting internet users. They are hijacking inactive domains and using them to direct visitors to malicious websites in a form of malvertising.
Malvertising is the term given to the use of malicious code in seemingly legitimate adverts, which are often displayed on high-traffic websites. Website owners use third-party ad networks as a way to increase revenue from their websites. Most of these adverts are genuine and will direct users to a legitimate website, but cybercriminals often sneak malicious code into these adverts. Clicking the link will direct the user to a website hosting an exploit kit or phishing form. In some cases, ‘drive-by’ malware downloads occur without any user interaction, simply if the web content loads and the user has a vulnerable device.
The new tactic uses domains that have expired and are no longer active. These websites may still be listed in the search engine results for key search terms. When user conducts a search and clicks the link or uses a link in their bookmarks to a previously visited website, they will arrive at a landing page that explains that the website is no longer active. Oftentimes, that page will include a series of links that will direct the visitor to related websites.
What often happens is these expired domains are put up for sale. They can be attractive for purchasers as there may already be many links to the website, which is preferable to starting a brand-new website from scratch. These expired domains are then auctioned. Researchers at Kaspersky found that cybercriminals have taken advantage of these auction-listed websites and have added links that direct visitors to malicious websites.
When a visitor arrives on the site, instead of being directed to the auction stub, the stub is replaced with a link to a malicious website. The study uncovered around 1,000 domains that had been listed for sale on a popular auction site, which redirected visitors to more than 2,500 unwanted URLs. In the majority of those cases, the URLs were ad-related pages, but 11% of the URLs were malicious and were mostly being used to distribute the Shlayer Trojan via infected documents that the user is prompted to download. The Shlayer Trojan installs adware on the user’s device. Several of the sites hosted malicious code on the site rather than redirecting the visitor to a different website.
These domains were once legitimate websites, but are now being used for malicious purposes, which makes the threat hard to block. In some cases, the sites will display different content based on where the user is located and if they are using a VPN to access the internet. These websites change content frequently, but they are indexed and categorized and if determined to be malicious they are added to real time block lists (RBLs).
A web filtering solution such as WebTitan can provide protection against malvertising and redirects to malicious sites. If an attempt is made to send a user to a known malicious website, rather than being connected the user will be directed to a local block page, negating the threat. WebTitan can also be configured to block downloads of risky file types from these websites.
Many organizations have implemented firewalls to prevent direct attacks by hackers, use antivirus software to block malware, and use an anti-spam solution to block attacks via email, but there is a gap in their security protections and web-based threats are not effectively blocked. WebTitan allows organizations to plug that gap and control the websites that can be accessed by employees.
For further information on WebTitan and filtering the internet, give the TitanHQ team a call. WebTitan is available on a free trial to allow you to evaluate the solution and see for yourself how you can block attempts to visit malicious web content and NSFW sites.
TitanHQ customers that are currently using the ArcTitan email archiving solution for long term email storage will soon benefit from a vastly improved email archiving service. TitanHQ is in the process of migrating customers to new email archiving systems that have been developed to improve performance, reliability, and scalability.
The new ArcTitan email archiving service is being delivered on new infrastructure – A highly available, horizontally scaling Kubernetes cluster that is self-maintaining and self-healing. Within the cluster are multiple components that work in harmony, but independently. This has the advantage of ensuring that in the event of a server outage or if a component goes down, there will be minimal or no downtime. Any time a component goes down, all others will remain available and the component that has gone down will be taken offline and automatically repaired. Other components will not be affected.
The new email archiving systems offer replicated persistent storage through Ceph storage clusters. This provides high performance storage and file systems, with automated data replication and fail over. Amazon S3 is used for long term storage of archived email data, providing reliability, redundancy, and scalability. A Percona XtraDB MySQL cluster is deployed within Kubernetes for handling all database operations. The cluster is self-maintaining, self-healing, and can be scaled with minimal effort and zero downtime. Customers are also provided with a new and improved ArcTitan GUI.
Managing the Migration
TitanHQ is in the process of migrating ArcTitan customers to the new system and the process will be completed with minimal customer effort. First, TitanHQ will create a new account on the new infrastructure. Once the new account has been set up, TitanHQ will be in touch to provide the details and talk you through making a simple change to your connector/mail server to point it to the new server. Once that change has been made, all archived email will be sent to the new archive and the old account will receive no further archived emails. Once TitanHQ has verified mail flow, you will be told that the process has been completed.
TitanHQ will then commence the migration of your archive to the new account. Once that process has been completed, you will be contacted and asked to verify the data migration. Once confirmation has been received, the old archive on the original server will be deleted.
There will be a small delay between sending email to the new account and migrating your historical email data, but customers will not lose access to the old archive. Searches can still be performed on the old archive and you will retain full access to all of your historical email data during the migration.
If you have any questions about the migration or the new ArcTitan email archiving systems, our customer service team will be more than happy to help.
Managed Service Providers are an attractive target for cybercriminals. If a threat actor succeeds in gaining access to an MSP’s network, they can use the same remote management tools that MSPs use to conduct attacks on the MSPs clients.
Many companies are now turning to MSPs for IT support and management services. This is often the most cost-effective solution, especially when companies lack the in-house IT expertise to manage their networks, applications, and security. An MSP will typically provide IT management services for many different companies. A successful cyberattack on the MSP can therefore give a threat actor access to the networks of all the MSPs clients, which makes the attack extremely profitable.
There was a marked increase in cyberattacks on managed service providers in 2019, in particular by ransomware gangs using GandCrab, Sodinokibi BitPaymer and Ryuk ransomware. The MSPs were attacked in a variety of ways, including phishing, brute force attacks on RDP, and exploitation of unpatched vulnerabilities.
Once access has been gained to an MSP’s network, hackers search for remote management tools such as Webroot SecureAnywhere and ConnectWise which the MSP uses to access its clients’ networks to provide IT services. Several 2019 ransomware attacks on MSPs used these tools to access clients’ networks and deploy ransomware. MSPs such as PerCSoft, TrialWorks, BillTrust, MetroList, CloudJumper, and IT by Design were all attacked in 2019 and ransomware was deployed on their and their clients’ networks.
Kyle Hanslovan, CEO at Huntress Labs, told ZDNet in a recent telephone interview that his company had provided support to 63 MSPs that had been attacked in 2019 but believes the total number of attacks was likely to be more than 100. However, the number of MSPs that have been attacked is likely to be substantially higher. It is likely that many cyberattacks on MSPs are not even detected.
The attacks have shown no sign of slowing. Recently the U.S. Secret Service issued a TLP Green alert warning MSPs of an increase in targeted cyberattacks. Compromised MSPs have been used to conduct business email compromise (BEC) attacks to get payments sent to attacker-controlled accounts. Attacks have been conducted on point-of-sale (POS) systems and malware has been deployed that intercepts and exfiltrates credit card data, and there have been many successful ransomware attacks.
In addition to cybercriminals, nation state-sponsored hacking groups have also been conducting cyberattacks on MSPs, notably hacking groups linked to China. The National Cybersecurity and Communications Integration Center (NCCIC) issued an alert about the threat to MSPs from state-sponsored hacking groups in October 2019.
Best Practices for MSPs to Adopt to Improve Their Security Posture
There are several best practices that can be adopted by MSPs to improve security and block these attacks. MSPs may currently be incredibly busy helping their clients deal with IT issues related to the COVID-19 pandemic, but given the increase in targeted cyberattacks on MSPs, time should be spent improving their own security, not just security for their clients.
The U.S Secret Service recommends MSPs keep up to date on patching, especially patches for any remote administration tools they use. ConnectWise issued a security advisory last month and patched a flaw in the ConnectWise Automate solution. The API vulnerability could be exploited remotely by a threat actor to execute commands and/or modifications within an individual Automate instance. Vulnerabilities such as these are actively sought by cybercriminals.
The principle of least privilege should be adopted for access to resources to limit the harm caused in the event of a breach. It is also important to have well-defined security controls that are fully compliant with industry standards.
Annual data audits should be conducted along with regular scans to identify malware that may have been installed on systems. Logging should be enabled, and logs should be regularly checked to identify potentially malicious activity. MSPs should also ensure that their employees receive regular security awareness training to teach cybersecurity best practices and how to identify phishing and BEC scams.
The WannaCry ransomware attacks that started on May 12, 2017 were blocked quickly when a kill switch was identified and activated, but how much money did WannaCry make during the time it was active?
WannaCry was a devastating global cyberattack, the likes of which had been predicted by many cybersecurity professionals but had yet to materialize. WannaCry was the fastest spreading ransomware ever created.
WannaCry combined ransomware with a worm, which allowed it to automatically spread and infect huge numbers of devices on a network. The ransomware exploited a vulnerability in Windows Server Message Block (SMBv1) using an NSA exploit called EternalBlue.
The flaw exploited by EternalBlue had been reported to Microsoft and a patch was issued in March 2017, two months before the attacks started. However, many businesses were slow to apply the patch and were vulnerable to attack. Within a matter of hours, around 200,000 computers had been attacked in 150 countries. It is worth noting here that there are still many computers that have not been patched more than 2 and a half years after the patch was released, in spite of widespread news coverage about the threat of attack and its huge cost. WannaCry is still one of the biggest ransomware threats and accounts for a significant percentage of all successful ransomware attacks in 2019.
WannaCry was blocked by a British security researcher who discovered the ransomware checked a domain name prior to encrypting data, but that domain name had not been registered. He purchased the domain name, thus preventing file encryption.
That said, the speed at which the ransomware spread meant many devices were infected and encrypted. Since businesses were not protected if the ransomware encryption had already started by the time the kill switch was activated, the attackers must have had a huge payday. So how much did WannaCry make?
Protect your customers from web-based threats such as drive-by downloads, exploit kits, and phishing. Book a FREE WebTitan demo. Book Free Demo
By today’s standards, the ransom demand was very small. Just $300 per infected device, which doubled to $600 if the payment was not paid within 3 days. It is actually easy to see how many payments were made, as the transactions are detailed in the blockchain. The recipient remains anonymous, but the payments can be seen.
The three Bitcoin addresses known to have been used in the WannaCry attacks currently show 430 payments have been made and 54.43228033 BTC has been sent to those accounts. The value of BTC is somewhat volatile and was much higher at points between now and the attacks, but at today’s exchange rate that equates to around $386,905. Most of the BTC payments have now been moved out of the accounts so the attackers have managed to cash out. Payments are also still being made to those accounts. The latest payments to one of the addresses were made in December 2019.
$386,905 may not seem like much of a payday considering the number of devices infected and the damage caused by the attack, and it’s not. Further, the attackers will need to convert that total to real money, and a considerable amount will be lost in that process. The payday was tiny considering the scale of the attack. However, the cost of the attack to businesses was colossal.
The National Health Service in the United Kingdom was hit bad and the cleanup operation, and loss of business while that occurred, has been estimated to have cost £92 million. That was just one victim, albeit a major one. The total cost of the 2017 WannaCry ransomware attacks has been estimated to be $4 billion globally; however, even though the kill switch was flicked to block the initial attacks, the threat from Wannacry has not gone away. In 2019, two years after the initial attacks, millions of computers were still at risk as the vulnerability that was exploited had still not been fixed and a new version of WannaCry was released that did not have the kill switch and continues to pose a threat. In 2019 Kaspersky said it was the most detected ransomware threat with the ransomware infecting 164,433 users, accounting for 21 percent of detected ransomware attacks that year and ESET reports that WannaCry was the most commonly detected ransomware threat in Q1, 2020, 3 years after the ransomware first appeared. The ransomware is still being used in attacks on unpatched systems in Thailand, Turkey, and Indonesia.
Next time you delay applying a patch or updating software, consider WannaCry and the potential costs of exploitation of a vulnerability. In all of the above cases – all 200,000+ attacks – applying the patch would have prevented the attack and the huge cost of remediation.
TitanHQ is pleased to announce the UK-based mid-market private equity firm Livingbridge has invested in TitanHQ through its Enterprise 3 fund.
Livingbridge invests in fast growing companies valued up to 200 million. The Enterprise 3 fund is used to invest in companies with an enterprise value of up to £50 million. Livingbridge identified TitanHQ as an ideal company for investment, being uniquely positioned with a well-differentiated product portfolio, operating in an attractive market with strong macro tailwinds, and being a leader in the sector with a proven track record for delivering robust, easy to use, effective, and much loved security solutions.
TitanHQ has been operating for 20 years during which time the company has collected many awards for its email security, web filtering, and email archiving SaaS solutions – SpamTitan, WebTitan, and ArcTitan.
More than 8,500 businesses have chosen TitanHQ as a security partner and the company is hugely popular with managed service providers, with SpamTitan, WebTitan, and ArcTitan offered by more than 2,500 channel partners. SMBs, MSPs, and ISPs in more than 150 countries use TitanHQ solutions, including big name brands such as Pepsi, Virgin, O2, ViaSat, and Datto. The company has registered year on year growth and now has an ARR of more than $15 million.
“We are delighted to be partnering with TitanHQ,” said Livingbridge director, Nick Holder. “There is a tremendous opportunity for Titan HQ to accelerate its growth trajectory over the coming years and we look forward to working closely with the management team to fulfill the company’s potential. Their focus and dedication to the MSP community is completely aligned with our strategy.”
The partnership will help TitanHQ reach its full potential and further cement its position as the leading provider of cloud-based security solutions to MSPs serving the SMB market.
“We are excited to be taking this next step in our growth journey with Livingbridge, a partner that understands the unique strengths of our business, shares our vision for success and has the experience and resources to help us to achieve it,” said TitanHQ CEO, Ronan Kavanagh.
The global COVID-19 pandemic has forced businesses to make massive changes in a short period of time. Many managed service providers have demonstrated resilience and have weathered the storm and have shown that while we are now living in very uncertain times, there are opportunities for growth. Successful MSPs have not only adapted their business to ensure their survival, they have seized the opportunities and are gaining considerable growth momentum and have shown it is possible to thrive in spite of an extremely challenging economy.
At MVP GrowthFest on June 23, 2020 you will be able to find out how successful MSPs are turning adversity into growth and profit and will learn from an all-star line up of Channel experts about the state of the Channel and what you must do to adapt to these challenging times. You will also be provided with guidance on the steps you can take now to ensure success and grow your business and thrive.
MVP GrowthFest is a 3-hour virtual event that will provide valuable insights and advice that can be used immediately to help you grow your business. The event is being headlined by an interview with Earvin “Magic” Johnson Jr., the 3-time NBA MVP Award winner.
Matt Solomon, VP of Business Development at ID Agent, will be conducting the interview and Magic Johnson, who will explain how he succeeded by overcoming obstacles throughout his life, and how tenacity and commitment to the community were key to his success.
MVP GrowthFest will be celebrating the energy that powers growth and the drive to thrive during challenging times and, in addition to the interview, MSPs will hear from 15 Channel all-stars in four powerhouse panels.
TitanHQ is pleased to announce that Sales Director Conor Madden will be leading the panel in the security session titled “Leading with Security through Education.” The key to selling products in your security stack is to educate your clients about the need for cybersecurity. Given the fact that cyber actors have been attacking businesses with increased vigor during the pandemic, positioning your security stack front and central is the logical step.
TitanHQ can offer web and email security solutions that will not only protect you and your clients, they can be efficiently implemented into your security stack and can be easily packaged. Plus, an extremely competitive price point means they are affordable solutions for your clients and generous margins will help you boost your bottom line.
Conor will be joined on the security powerhouse by:
Jon Murchison – CEO, BlackPoint Cyber
Kevin Lancaster – CEO, ID Agent & GM Security, Kaseya
Jessvin Thomas – President & CTO, SKOUT
Attendees will also get to hear from Channel leaders in three further Powerhouse sessions that will provide invaluable advice on how to grow your business and boost profits during these challenging times.
Managing Through Change
Featuring:
Dan Wensley – CEO, Warranty Master
Joe Alapat – CEO & Founder, Liongard
Ryan Walsh – Chief Channel Officer, Pax8
Establishing Trust in the New Normal
Featuring:
Dave Goldie – Vice President of Channel, Cytracom
Ted Roller – Channel Chief, ConnectBooster
Andra Hedden – CMO, Marketopia
Frank DeBenedetto – Founder, AudIT
Leading & Accelerating through the Recovery
Featuring:
Tim Conkle – Founder, The 20
Dennis O’Connell – Vice President, Taylor Business Group
If you have been following the security news, you will have seen that there has been a major increase in COVID-19 themed cyberattacks targeting remote workers. Cybercriminals are exploiting fear about the virus and the somewhat chaotic switch from mostly office-based workers to having virtually the entire workforce working remotely. Understandably given the speed at which businesses have had to adjust, vulnerabilities have been introduced.
The attack surface has increased considerably as a result of largely at-home workforces and cybercriminals have taken advantage. According to research conducted by Darktrace, in the United Kingdom, prior to the COVID-19 lockdown being imposed, around 12% of malicious email traffic was targeting home workers. The volume increased to around 60% after 6 weeks of lockdown, which clearly demonstrates the extent to which remote workers are being targeted.
The types of malicious emails being sent to remote workers have been incredibly diverse. Cybercriminals are using all manner of lures to get remote workers to click links and disclose their credentials or open malicious attachments and trigger malware downloads. Financial fraud has also increased with BEC gangs using the COVID-19 pandemic to fraudulently obtain funds from company accounts.
Early on in the pandemic when information about the virus was thin on the ground, emails were being sent offering important advice about preventing infection along with fake updates on cases. As the pandemic progressed and the effects started to be felt, cybercriminals started sending fake requests for donations to charities to help individuals adversely affected by COVID-19. As governments implemented furlough schemes and set up funds to help the employed and self-employed, campaigns were conducted that linked to websites that claimed to offer grants, allow workers to choose to be furloughed, or apply for financial support.
Attacks have targeted the tools that are being used by remote workers to connect to their offices and communicate with colleagues, with the likes of Zoom, Skype, GoToMeeting, and other corporate messaging systems being spoofed to infect users with malware. File sharing platforms have similarly been spoofed to get employees to disclose their credentials. Darktrace’s data shows there has been a massive increase in spoofing attacks during lockdown, increasing from around one fifth of attacks before lockdown to 60%.
It is not only cybercrime groups that are conducting attacks. State-sponsored hacking groups have similarly been taking advantage of the pandemic to steal sensitive data, including the latest COVID-19 research data on potential cures, vaccines, and treatments to further the response efforts in their own countries.
What is not always clear from the new reports is how the increase in cyberattacks targeting remote workers has translated into actual data breaches. Are these attacks succeeding or are companies managing to thwart the attacks and keep the hackers at bay?
There is a lag between intrusions being detected, breaches being confirmed, and announcements being made but it appears that many of these attacks are succeeding. In April, the International Association of IT Asset Managers issued a warning that while a rise in data breaches was to be expected as a result of the pandemic, the number of incidents was actually far higher than anticipated. It is also clear that ransomware attackers have stepped up their efforts to attack businesses. Even organizations on the frontline in the fight against COVID-19 have not been spared.
Threat actors have taken advantage of the opportunities offered by the pandemic. It is up to businesses to make sure their security measures are sufficient to thwart attacks. Combating cyberattacks on remote workers requires additional security measures to be implemented. One measure that is often overlooked but can greatly improve protection is DNS filtering.
A DNS filter provides protection against the web-based component of cyberattacks and is an important measure to implement to improve defenses against phishing and malware. Even with robust email security defenses in place, some messages will arrive in inboxes. A DNS filter provides an extra layer of protection by preventing users from visiting malicious websites linked in emails.
When a malicious link is clicked, a DNS query is made, and a DNS lookup is performed to find the IP address of the URL. DNS filtering ensures that the IP address is not returned if the URL is malicious. A DNS filter such as WebTitan also allows IT teams to block malware downloads, monitor internet activity, and carefully control the types of websites their remote users can access on corporate devices.
If you have not yet implemented a DNS filtering solution and would like more information on how it can protect against cyberattacks on remote workers, give the TitanHQ team a call today.
Cybersecurity for remote workers has never been so important. At-home employees are being targeted by hackers who see them as low hanging fruit and an easy entry point into corporate networks.
The threat faced by businesses that have rapidly shifted to a largely at-home workforce should not be underestimated. With everyone working in the office, within the protection of the corporate firewall, IT departments could keep hackers at bay. Any employees that were authorized to work from home could be provided with a laptop that had security protections appropriate for the increased level of risk.
Moving the entire workforce from the office to attics, basements, kitchens, and spare rooms in a very short space of time has meant corners have had to be cut. Many SMBs have had to adapt quickly and have not had enough time to provide additional training to their at-home employees. The laptop computers now being used by their employees have had to be provisioned quickly and they lack the protection required for at home working. Some businesses are even allowing personal computers to be used out of necessity. Cybercriminals have been rubbing their hands with glee at the new opportunities and the ease at which they can attack businesses.
Lockdowns are now being lifted and people are being encouraged to go back to work, but further spikes in cases are likely as a result and with social distancing in the office problematic for many businesses, many employees will still need to work from home. To reduce the risk of those employees falling for a phishing scam or inadvertently downloading malware or ransomware, additional cybersecurity measures should be implemented.
You will more than likely have an email security solution to block the most common attack vector, but additional layers of security will greatly improve your security posture, one of the most important of which is a web filtering solution. A web filter stops your employees from visiting malicious websites, such as those used for phishing or malware distribution. When an attempt is made to visit a malicious website – through a link in a phishing email, a web redirect, or general web browsing – rather than being allowed to visit the website, employees will be directed to a local block page that explains the site cannot be accessed as it violates your internet usage policies.
A web filter can also be used to stop employees from using their work laptop for personal use by blocking websites by category, and as a control against shadow IT to prevent unauthorized software downloads.
WebTitan Cloud will allow you to improve cybersecurity for remote workers without requiring any software downloads and can be set up and protecting your office staff and remote workers in a matter of minutes.
Join us for our Webinar on Improving Cybersecurity for Remote Workers
If you are reading this before Thursday May 21, 2020, then you can find out more about how WebTitan Cloud can protect your employees and corporate network from attack by joining us on for our webinar.
Title: Keeping your Remote Workers TWICE as secure with SpamTitan & WebTitan
Date: Thursday, May 21, 2020
Time: 11:00-11:30 CDT
If you missed the webinar, just give us a call and we will be happy to answer any questions you have, explain the benefits of WebTitan Cloud, arrange a product demonstration, and help get you filtering the internet and blocking web-based threats.
TitanHQ is hosting a webinar on Thursday May 21, 2020 and will be explaining how you can double protection for your remote workers and better protect them against phishing, malware, ransomware, and zero-day attacks. The webinar is ideal for current SpamTitan customers, prospective customers, Managed Service Providers and small- to medium-sized enterprises.
During the webinar you’ll find out why it is so important to protect against both the email- and web-based components of cyberattacks and you will discover more about an important layer that you can ad to your security defenses that will allow you to significantly reduce susceptibility to a cyber attack and data breach.
TitanHQ will explain how cybercriminals are exploiting the COVID-19 pandemic and are targeting remote workers. You will also discover more about the features and security layers of WebTitan Security and how this DNS-based web filtering solution allows you to manage user security at multiple locations.
Most cyberattacks have an email and web-based component – Find out how WebTitan serves as a vital layer of security to block phishing attacks, malware and ransomware downloads.
Learn why WebTitan is the leading web security option for the Managed Service Provider who service the SMB and SME market.
Join TitanHQ for the webinar, which will be attended by:
Derek Higgins, Engineering Manger TitanHQ
Eddie Monaghan, Channel Manager TitanHQ
Marc Ludden, Strategic Alliance Manager TitanHQ
Kevin Hall, Senior Systems Engineer at Datapac
Webinar Details
Title: Keeping your Remote Workers TWICE as secure with SpamTitan & WebTitan
The 2019 Novel Coronavirus pandemic has caused major disruption for many businesses, and while it is far from business as usual for many firms, work has been continuing by letting employees work from home but doing so opens a business up to new cybersecurity risks, some of the most important of which we have covered in our COVID-19 cybersecurity checklist.
Under normal circumstances, the risks from allowing workers to spend some of their working week at home can be effectively managed, but having virtually the entire workforce working remotely creates many cybersecurity challenges. Further, threat actors are exploiting the pandemic and are actively targeting remote workers.
COVID-19 Cybersecurity Checklist
To help you address the risks of remote working we have produced a quick reference COVID-19 cybersecurity checklist covering some of the most important aspects of cybersecurity that should be addressed, in light of the recent rise in cyberattacks on remote workers.
VPNs
All remote employees should be using VPNs to access corporate systems, but VPNs can also introduce vulnerabilities. There has been an increase in attacks exploiting unpatched vulnerabilities in VPNs during the pandemic and scans are being performed to find vulnerable VPNs.
VPNs clients must be kept up to date and patches should be applied promptly. There have been several attacks reported recently that have exploited the Pulse Secure vulnerability CVE-2019-11510 to deliver ransomware, even though a patch was released to correct the flaw in April last year. Vulnerabilities in other VPNS have also been targeted.
You should also consider disabling split tunneling for VPN profiles to prevent employees from accessing the internet directly while they are connected to corporate information systems or should ensure all internet traffic is routed through the VPN. You should enable multi-factor authentication for VPNs and create a separate VPN zone in your firewall and apply security policies to protect incoming and outgoing traffic.
Remote Desktop Protocol
Many businesses rely on Remote Desktop Protocol (RDP) to allow their employees to connect remotely, but If you do not use RDP, you should disable port 3389. There has been a growing number of brute force attacks on RDP. A recent Kaspersky report showed brute force attacks on RDP increased. There was a major increase between January and February, with global attacks rising to 93,102,836. In April, attacks had increased to a staggering 326,896,999.
If you use RDP, make sure strong passwords are set, enable multi-factor authentication, and ensure connections are only possible through your VPN – Do not allow RDP connections from outside.
Communication and Collaboration Platforms
You will need to use some form of communication and collaboration platform, such as a videoconferencing solution, to allow workers to easily get in touch with colleagues. There are many choices available, but the security capabilities of each can vary considerably. Some solutions that were considered to be secure, such as Zoom, have been shown to have vulnerabilities, some of which have been exploited in attacks. The U.S. National Security Agency (NSA) has recently issued a useful checklist for selecting appropriate communication tools along with information on how they can be used securely.
Data Encryption
With everyone at home, burglaries may be down, and lockdown have reduced the risk of loss and theft of mobile devices, but encryption is still important. All corporate owned mobile computing devices should have encryption enabled, which is straightforward for Windows devices by enabling BitLocker. You should also encrypt web applications and FTP to ensure any data that is uploaded or downloaded is encrypted.
Ensure Firewalls are Enabled
Your employees will be beyond the protection of the corporate firewall so they should have local firewalls enabled. The easiest and most cost-effective way of applying a local firewall is to use the Windows Defender firewall, which can be configured through your MDM solution or Group Policy.
Email Security
The volume of phishing emails may not have increased by a very large degree during the COVID-19 lockdown, but there have been a large number of phishing related data breaches. Phishers have changed their campaigns and are now extensively using COVID-19 themed campaigns, which are proving to be very effective. People crave information about COVID-19 and are responding to COVID-19 themed phishing emails in large numbers. Many of the emails we have seen have been highly convincing, spoofing authorities such as WHO and the CDC.
You should consider adding an additional layer to your email defenses if you are only using Microsoft’s Exchange Online Protection (EOP). Many phishing emails are bypassing Microsoft’s defenses and are being delivered to inboxes. SpamTitan can be layered on top of Office 365 protections and will greatly improve the detection of phishing emails and zero-day malware and ransomware threats.
Multi-factor authentication for email accounts should be set up. In the event that email credentials are compromised, multi-factor authentication should prevent those credentials from being used to access accounts.
You should also set up a system that allows employees to report any suspicious emails they receive to the security team, to allow action to be taken to remove all similar messages from the email system and to tweak email security controls to block the threats.
DNS Filtering
With email security improved, you should also take steps to block web-based attacks. Malicious websites can be accessed by employees through general web browsing, redirects via malvertising, malicious links on social media networks, and links in phishing emails. A DNS filtering solution such as WebTitan Cloud prevents employees from visiting known malicious websites and will block drive-by malware downloads. WebTitan Cloud will protect employees whether they are on or off the network. If you don’t have web filtering capabilities for remote workers, ensure that internet access is only possible through your VPN to ensure bad packets are filtered out.
Cybersecurity Alerts and Log Checking
You should have systems in place that generate cybersecurity alerts automatically and you should enable security logs and regularly check them for signs of compromise. Monitor the use of PowerShell and red team tools such as Mimikatz and Cobalt Strike. These tools are often used by manual ransomware attackers to move laterally once access to networks is gained.
The COVID-19 pandemic has given cybercriminals a golden opportunity to make money. With the world focused on little else other than the response to the pandemic, and with people craving information about the virus, it is not surprising that standard phishing lures have been abandoned in favor of COVID-19 themed lures.
COVID-19 and coronavirus themed domains have been purchased in the tens of thousands and are being used for phishing, malware distribution, and a variety of scams such as obtaining donations to fake charities. Figures released by the Palo Alto Networks Unit 42 team for the period of February to March show there has been an average daily increase of new COVID-19 related domains of 656%, a 569% increase in the number of malicious COVID-19 domains, and a 788% increase in new high-risk domains.
Several domain registrars have started taking steps to combat coronavirus and COVID-19 related fraud and some, such as Namecheap, are now preventing the registration of new domains related to COVID-19. Domain registrars are flagging these new domains for investigation, but that is a manual review process that takes time. In the meantime, the domains are being set up and used for convincing scams.
One malicious campaign uncovered in the past few days uses COVID-19 themed domains to distribute the banking Trojan Grandoreiro. The websites are used to host videos that promise to provide important information about SARS-CoV-2 and COVID-19. When visitors click on the video, a file download is triggered and the user is required to run the installer to view the video content, but instead installs the banking Trojan. The banking Trojan has previously been delivered via spam email, but the threat group behind the malware have changed tactics in response to the pandemic and have changed to web-based delivery.
There have been many similar campaigns created using malicious COVID-19 domains to deliver a slew of malware variants such as keyloggers, information stealers, cryptocurrency miners, and other Trojans.
Lockdown has left people with a lot of time on their hands and outdoor activities have been swapped for more TV time. It is no surprise that movie piracy sites have seen a huge surge in traffic and malware distributors are taking advantage and are bundling malware with pirated video files and using fake movie torrents to deliver malware.
An investigation by Microsoft identified a campaign that uses a VBScript packaged into ZIP files that claim to be pirated movie files. The campaign was being conducted to deliver a coinminer that runs in the memory, with living-of-the-land binaries also used to download other malicious payloads.
These campaigns often have a phishing component, with emails sent to drive traffic to these malicious websites. An advanced spam filtering solution can help to block the email component of these campaigns, but businesses should also consider an additional layer to their security defenses to block the web-based component of these attacks and prevent their remote employees from visiting malicious COVID-19 domains. That protection can be provided by a DNS filtering solution such as WebTitan Cloud.
WebTitan Cloud filters out malicious websites at the DNS lookup stage of a web access request. When a user attempts to visit a website, instead of the standard DNS lookup to find the IP address of a website, the request is sent through WebTitan. If an attempt is made to visit a malicious domain, the request will be blocked and the user will be directed to a local block page. WebTitan can also be configured to block certain file downloads and filter the internet by category, such as blocking P2P file-sharing and torrents sites to provide additional protection against malware and the installation of shadow IT.
WebTitan Cloud can be quickly set up remotely by sysadmins to protect all workers on and off the network with no clients required, which makes it an ideal solution during the COVID-19 pandemic for protecting remote workers.
For further information on protecting your organization and remote employees from web-based attacks, to register for a free trial of WebTitan, and for details of pricing, give the TitanHQ team a call today.
There has been a massive rise in the number of telecommuting workers as a result of the 2019 Novel Coronavirus pandemic and cybercriminals are taking advantage. Phishing and malware attacks have soared in the past few weeks and home workers are being targeted.
Individuals who regularly worked from home before the COVID-19 crisis will be used to taking precautions when connecting to virtual environments set up by their employers, but huge numbers of employees are now logging in remotely for the very first time and may not be aware of the telecommuting cybersecurity risks. IT and IT security departments have also had to set up the workforce for home working in a hurry, and the sheer number of employees that have been forced into telecommuting means corners have had to be cut which has created opportunities for cybercriminals.
Even if the transition to having the entire workforce telecommuting has been expertly managed, risk will have increased considerably. Cybersecurity is far harder to manage when the entire workforce is outside the protection of the corporate firewall and with most workers telecommuting, the attack surface has grown considerably.
Telecommuting workers are seen as low hanging fruit and cybercriminals are taking advantage of the ease at which attacks can be conducted. Since January there has been a massive increase in phishing attacks, malware attacks, and attacks over the internet targeting remote workers.
NASA Sees “Exponential Increase” in Malware Attacks
On April 6, 2020, NASA sent a memo to all personnel warning of a massive increase in targeted attacks on the agency. NASA explained in the memo that the number of phishing attempts on NASA employees has doubled in the past few days and its systems designed to block employees from accessing malicious websites has gone into overdrive. The number of malicious websites that are now being blocked has also doubled, which strongly suggests employees are clicking on links in phishing emails and are being fooled by these scams. NASA also reports that there has been an “exponential increase in malware attacks on NASA systems.”
Attacks are being conducted by a diverse range of threat actors, from small players to prolific advanced persistent threat (APT) groups and nation-state sponsored hackers. NASA has warned its employees that those attackers are targeting NASA employees’ work and personal devices and that the attacks are likely to continue to increase throughout the Novel Coronavirus pandemic.
NASA is far from alone in experiencing a massive increase in attempted cyberattacks. Businesses of all sizes are now having to deal with unprecedented risks and are struggling to defend their networks from attack. They now have to defend a massively increased attack surface and the number of attacks has skyrocketed.
There are other factors that are making it difficult for employers. Employees crave information about the Novel Coronavirus and COVID-19 and cybercriminals are sending huge numbers of emails offering them just the information they seek. Huge numbers of websites are being set up that purport to offer advice on the Novel Coronavirus and COVID-19. Check Point has reported that more than 16,000 domains related to coronavirus or COVID-19 have been registered since January and those domains are 50% more likely to be malicious than other domains registered in the same period.
How to Protect Telecommuting Workers
There are three main ways that telecommuting workers are being attacked: Email, malicious websites, and the exploitation of vulnerabilities.
To prevent the latter, it is essential for software and operating systems to be kept up to date. This can be a challenge for IT departments at the best of times, but much harder when everyone is working remotely. Despite the difficulty, prompt patching is essential. Vulnerabilities in VPNs are being targeted by cybercriminals and offer an easy way to gain access to corporate networks. Employees should be told to make sure their VPN clients are running the latest software version and businesses should ensure their VPN infrastructure is kept up to date, even if it means some downtime while updates are applied.
TitanHQ Can Help You Strengthen Email and Web Security
Advanced email security defenses are now required to protect against phishing and email-based malware threats. Some of the COVID-19 phishing campaigns that are now being conducted include some of the most sophisticated phishing threats we have ever seen.
You should not rely on one form of email security, such as Microsoft’s Exchange Online Protection for Office 365 accounts. Layered defenses are essential. Office 365 email security can be significantly strengthened by layering SpamTitan on top of Microsoft’s EOP protections. SpamTitan does not replace Office 365 protections, it improves them.
SpamTitan is an advanced email security solution that incorporates powerful, real time updated AI-driven threat intelligence to block spam, phishing, malware, malicious links, and other email threats from incoming mail. SpamTitan sandboxing identifies threats that signature-based detection solutions miss and is effective at identifying and blocking zero-day malware threats.
Each day, the number of malicious websites related to COVID-19 grows. These websites are used to phish for sensitive information such as email and VPN credentials and for drive-by downloads of malware. To protect remote workers and prevent them from accessing these malicious websites, a web filtering solution is required.
WebTitan DNS Security offers protection against web-based threats and prevents employees from accessing known malicious websites. WebTitan DNS Security is seeing massively increased traffic demand for its scanning and web detection features, but the solution is cloud based and has been developed with scalability in mind. WebTitan DNS Security is blocking new threats as soon as they are identified to keep customers and their employees protected. The solution can be easily implemented to protect remote workers but inserting simple code into enterprise devices which points the DNS to WebTitan. That small change will ensure the internet is filtered for all employees, no matter where they are working.
TitanHQ is committed to providing safe and secure email and internet usage for our customers, partners and their users, now more than ever. Contact TitanHQ today for help improving security at your organization.
Blackpoint Cyber announced its Remote Reality LIVE conference, which will occur online April 8th and April 9th 2020.
The conference will focus on managed service providers (MSPs) and how they can stay secure, profitable, and resilient as the world increases remote operations during the COVID-19 pandemic – registration and attendance are free. The two-day conference will include sessions by former leaders of the United States’ government cyber security and intelligence communities as well as cyber security experts and business veterans from the MSP services and technology industry.
Blackpoint Cyber announces its virtual cyber security conference for MSPs – Remote Reality LIVE. Featuring a keynote from the former Acting Director of the CIA and sessions from tech giants Datto, Webroot, Marketopia, and more.
Jon Murchison, Blackpoint’s CEO and founder, and former US government cyber operations expert, explains the conference’s objective: “IT services and infrastructure have become mission critical for organizations to survive in this new economic landscape brought on by COVID-19. MSPs are the key to our success and, especially during these times, a collective national asset to their respective countries. That’s why we are bringing together experienced government and industry leaders to help MSPs navigate the current economic and security environments. We’re excited to provide one of the first online and socially-distanced conferences dedicated to MSPs and cyber security.”
Blackpoint has partnered with leading technology, service, and marketing firms for the conference, including:
Datto: leading global provider of cloud-based software and technology solutions purpose-built for MSPs
Webroot: Cybersecurity Solutions Purpose-Built for MSPs and SMBs
Convergint: Global, Service-based Systems Integrator
Marketopia: Lead Generation and Marketing for Technology Companies
ID Agent: Dark Web and Identity Theft Protection
TitanHQ: Email and DNS Security
Compliancy Group: HIPAA Compliance-as-a-Service
Atlantic Data Forensics: Premier Incident Response and Forensics
ProSource Technology Solutions: Leading Managed Service Provider
Corporate Office Properties Trust (COPT): Premier Real Estate Investment Trust
Michael Morell, former Deputy Director and Acting Director CIA, will present the keynote session on national security implications of the Coronavirus outbreak. While at the CIA, Mr. Morell was President George W. Bush’s daily intelligence briefer during the 9/11 attacks and was awarded the Distinguished Intelligence Medal, the CIA’s second highest honor.
Additional former US government cyber security and intelligence expert speakers include: Bill Priestap, former FBI Assistant Director of Counterintelligence, Chris Inglis, Former Deputy Director of NSA, Dave Sears, retired Commander and Navy SEAL, and Kevin Donegan, former United States Navy Vice Admiral and previous commander of the US Navy’s 5th fleet out of Bahrain. Security and MSP industry leaders will also present informational sessions, such as lead generation in a virtual world, security in the MSP space, cyber security for commercial real estate, the threat landscape of remote workers, and more.
Matt Solomon, VP of Business Development & IT at ID Agent, shares his sentiments on the conference: “ID Agent is very excited to participate in one of the first virtual MSP events since in-person events have been taken off the schedule. MSPs still need education during this period and we are honored to be part of such an esteemed group of vendors.”
In addition to learning how to stay secure and prosper, conference attendees will also be eligible for giveaways and prizes.
IT departments have been forced to address cybersecurity risks with remote workers in a hurry due to the 2019 Novel Coronavirus pandemic that has seen large sections of the workforce forced into working from home.
The International Workplace Group conducted a study in 2019 and found that 50% of employees spend at least half of the week working remotely, and 70% of workers spend at least one day each week working from home. The 2019 Novel Coronavirus pandemic has increased that percentage considerably. Many companies have all but closed down their offices and have told their employees they must work from home.
While this is an important strategy for ensuring the safety of the workforce, there are many cybersecurity risks with remote workers and IT departments will find it much harder to secure their systems, protect confidential data, and quickly respond to security incidents.
One of the biggest problems for IT departments is the speed at which changes had to be made to accommodate a massive increase in remote workers. There has been little time to prepare properly, provide training, and ensure the cybersecurity risks with remote workers are all addressed.
Cybercriminals are Targeting Remote Workers
The massive increase in remote workers due to the 2019 Novel Coronavirus pandemic has given cybercriminals easy targets to attack, and unsurprisingly remote workers are being targeted. Remote workers are seen as low hanging fruit and attacks are far easier than when workers are in the office.
Several phishing campaigns have been detected targeting home workers that attempt to obtain email and VPN credentials. These phishing attacks are likely to increase considerably over the coming weeks and months. Attacks on VPNs have also increased, with cybercriminals exploiting unpatched vulnerabilities to steal credentials and gain access to corporate networks.
Campaigns have been detected spoofing Zoom and other videoconferencing platforms. According to Check Point, there have been 1,700 new Zoom domains registered in 2020 and 25% of those have been registered in the past two weeks. Other videoconferencing and communication platforms are also being targeted.
Addressing Cybersecurity Risks with Remote Workers
The massive increase in the number of employees working from home has increased the attack surface dramatically. Laptops, smartphones, and tablets are remotely connecting to the network, often for the very first time. It is essential that al of those devices are secured and data is appropriately protected.
Any device allowed to connect to the network remotely must have the best security software installed to protect against malware. Devices must be running the latest versions of operating systems and patches need to be applied promptly. Some studies suggest that it takes companies around 3 months on average to patch vulnerabilities. For remote workers, patching needs to be accelerated considerably and, ideally, software and operating systems should be configured to update automatically. Computers used by remote workers must also have firewalls enabled.
Ensure Home Routers are Secured
With many countries in lockdown and people being told not to leave the house, one of the biggest problem areas with remote working has been solved. The use of unsecured pubic Wi-Fi networks. When remote workers connect to unsecured public Wi-Wi networks, it is easy for cybercriminals to intercept sensitive corporate data, steal login credentials, and install malware. The Novel Coronavirus pandemic has seen remote workers abandon coffee shops and public Wi-Fi access points and stay at home; however, home Wi-Fi networks may be just as vulnerable.
Home workers will connect to the internet through consumer-grade routers, which will be far less secure than the office. Home Wi-Fi is often poorly secured and many devices that connect to Wi-Fi will have scant security controls in place. Remote workers must ensure that their home Wi-Fi network is protected with a strong password and that routers have WPA2 enabled.
Ensure Remote Workers Use a VPN and Establish a Secure Connection
It is essential for remote workers to establish a secure connection when accessing work resources and the easiest way to do this is with a virtual private network (VPN). A VPN client should be installed on all devices that you allow to remotely connect to the network.
Several vulnerabilities have been found in VPNs over the past year, and even months after patches have been released by VPN solution providers that patches have yet to be applied. Patching VPNs can be difficult when they are in use 24/7, but prompt patching is essential. There has been an increase in cyberattacks exploiting vulnerabilities in VPNs in recent weeks. In addition to ensuring the latest version of VPN clients are used and VPN solutions are patched quickly, training must be provided to remote workers to ensure they know how to use VPNs.
Ensure Multifactor Authentication Is Enabled
Strong passwords must be set to prevent brute force password guessing attempts from succeeding, but passwords alone do not provide sufficient protection for remote workers. You must ensure that multifactor authentication is enabled for all cloud services and for email accounts. If credentials are compromised in a phishing attack, it will not be possible for the credentials to be used to access accounts and sensitive data without another factor also being provided, such as a one-time code sent to an employee’s cellphone.
Security Awareness Training for Remote Workers
IT staff will be well aware that even the best security defenses can be breached as a result of the actions of employees. Employees are the weakest link in the security chain, but through security awareness training risk can be significantly reduced. Most companies will provide security awareness training to staff as part of the onboarding process, and often refresher training sessions will be provided on an annual basis. Consider increasing training for remote workers and conducting training sessions far more frequently.
The purpose of cybersecurity awareness training is to teach employees the skills they will need to recognize and avoid threats and to change the mindset of workers and create a culture of cybersecurity. Best practices for cybersecurity must be taught to prevent employees from falling prey to cyberattacks when working remotely. Employees need to be made aware of the cybersecurity risks with remote workers, which may not have been covered in training sessions when employees were only working in the office. Training remote staff should now be a priority. It is important to step up training to help remote workers identify phishing emails, spoofing, impersonation attacks, and also to teach remote workers about good IT hygiene.
Protect Against Web-Based Attacks
The dangers that come from the internet should be covered in security awareness training, but not all web-based threats are easy for remote workers to identify. Malicious adverts can be found on all manner of websites that direct users to phishing sites and websites where drive by malware downloads occur. To address cybersecurity risks for remote workers when accessing the internet, a web filtering solution should be deployed.
Cloud-based web filters are the most practical choice as they are easy to deploy, require no software downloads, and do not need to be patched or updated as that is handled by the solution provider. DNS-based filters are the best choice as they will involve no latency, which can be a major issue when bandwidth will be limited in workers’ homes.
WebTitan prevents remote workers from visiting or being redirected to known malicious websites and allows IT teams to control the types of websites that can be accessed on work devices to further reduce risk. Since WebTitan integrates with Active Directory and LDAP, IT teams can monitor the internet activity of all employees and can configure the solution to block malicious file downloads and the downloading unauthorized programs onto work devices.
It is fair to say that more people are now working from home than ever before and the number is growing rapidly due to the coronavirus pandemic. Here we explore some of the key cybersecurity challenges for remote working and suggest ways that CIOs and IT managers can reduce risk, keep their networks secure, and protect their workers.
COVID-19 and Remote Working
Even in the absence of a pandemic, an increasing number of people are working from home for at least part of the week. One study conducted by the International Workplace Group in 2018 suggests 50% of employees spend at least two and a half days a week working from home and 70% spend at least one day a week working from home.
The coronavirus pandemic is rapidly changing that. Governments around the world are recommending people work from home if they possibly can and many want to do so to reduce the risk of contracting COVID-19. With the 2019 Novel Coronavirus pandemic likely to last for several months at the very least, that is unlikely to change any time soon. Businesses will come under increasing pressure to get their employees set up for working at home.
Cybersecurity Challenges for Remote Working
For many businesses, having to set up large number of employees to work from home in such a short space of time will have come as a major shock. Rather than being able to transition gradually, the quarantine measures and social distances demanded in response to the coronavirus pandemic has given businesses and their CIOs and IT teams little time to prepare and address the cybersecurity challenges for remote working.
Some employees will already be working from home some of the time, so they will be familiar with the steps they need to take to access work networks and applications securely from home, but for a great deal of workers this will be their first time. Those workers therefore need to be trained and made aware of the additional risks, they must learn how to access work systems remotely, and the steps they need to take to do so securely.
Measures need to be considered to reduce the harm that can be caused should devices be lost or stolen, as the risk of device theft increases considerably when IT equipment is taken out of the office. Even if workers are not venturing out of the house to coffee shops, home environments may not be as safe and secure as the office.
Cyberslacking is likely to increase considerably when workers are not being directly supervised due to working at home, so loss of productivity is a real issue. Productivity losses due to people working from home is a key business concern that should be addressed. Cyber risks also increase from internet access at home.
The risk of insider threats also increases with more remote workers. Steps should be taken to reduce the potential for fraud and data theft.
It is relatively easy for organizations to effectively manage risk when users are connected to internal networks when working in the office. Doing the same when most of the workforce is working remotely is a different matter entirely. As the attack surface increases, mitigating risks and protecting against cyberthreats becomes a major challenge.
There are also issues with authentication. A known individual may be attempting to connect to the network, but it becomes harder to determine is that person is who they claim to be. Authentication measures need to be stepped up a gear.
Many businesses will be faced with the problem of simply not having enough devices to allow workers to work remotely on company-issued devices, so the decision will need to be taken about whether to allow employees to use their personal devices. Personal devices are unlikely to have the same level of protection as company-owned devices and it is much harder to control what employees do on those devices and to protect against malware that could easily be transferred onto the work network.
There is also a greater risk of shadow IT when workers are home-based. The downloading of applications and use of non-authorized tools increases risk considerably. Vulnerabilities may be introduced that can easily be exploited by cybercriminals.
Then there is the problem of having so many people accessing work networks using VPNs. Systems may not be able to cope with the increased number, which means workers will not be able to connect and work from home. IT departments must ensure there is sufficient bandwidth and licenses for VPN solutions. Those VPNs also need to be updated and patched.
These are just some of the many cybersecurity challenges for home working. The list of security concerns is very long.
Cybercriminals are Taking Advantage of a Huge Opportunity
Cybercriminals are constantly changing tactics to attack businesses and the coronavirus pandemic offers them opportunities on a silver platter. It is unsurprising that they are taking advantage. In January, phishing campaigns were launched taking advantage of fear about coronavirus. Those campaigns have increased significantly as the COVID-19 crisis has deepened. Coronavirus and COVID-19 are being used as phishing lures and to COVID-themed emails are being used to distribute malware. Cyberattacks exploiting vulnerabilities in VPNs are also increasing.
As the COVID-19 crisis worsens and lockdowns are enforced, businesses will be forced to have more workers working from home and cyberattacks are likely to continue to increase. Since shutting down the business temporarily or indefinitely simply isn’t an option for most businesses, addressing the cybersecurity challenges for remote working will soon become critical.
Addressing the Cybersecurity Challenges for Home Working
Addressing the cybersecurity challenges for home workers is likely to be difficult. Listed below are some of the steps that should be taken to prepare.
When creating new accounts for home workers, ensure strong passwords are set and use the principle of least privilege to reduce risk.
Enable two-factor authentication.
Ensure workers can connect through VPNs and there are sufficient licenses and bandwidth.
Make sure VPN software is patched and the latest version is installed. Ensure procedures are in place to keep the software updated.
Consider disabling USB ports to prevent the use of portable storage devices. This will reduce the risk of malware infections and the risk of data theft.
Ensure portable devices are protected with encryption. Use software solutions that lock devices in the event of theft or allow devices to be remotely wiped.
Ensure you set up communications channels to allow remote workers to collaborate, such as teleconferencing, chat facilities, document sharing platforms, and SaaS applications. Make sure employees are aware of what can and cannot be shared via chat apps such as Slack and Google Chat.
Ensure staff are trained on new applications, the use of VPNs, and are aware of the additional risks from remote working. Train remote workers on how to identify phishing and other cybersecurity threats.
Ensure policies and procedures are set up for reporting threats to IT security teams. Instruct employees on the correct course of action if they believe they have fallen for a scam.
Implement a DNS filter to prevent employees from accessing high risk websites on corporate-issued devices and block downloads of risky file types.
Ensure email security controls are implemented to block phishing attacks and detect and quarantine malware threats.
How TitanHQ Can Help Protecting Remote Workers and Their Devices
TitanHQ has developed two cybersecurity solutions that can help businesses protect their remote workers and their networks from email and web-based threats. Being 100% cloud-based, these solutions are just as effective when employees are working remotely as they are for office workers.
SpamTitan Cloud is a powerful email security solution that protects against the full range of email threats. SpamTitan has advanced threat detection capabilities to detect known and zero-day phishing, spear phishing, malware, botnet, and ransomware threats and ensure the threats never reach inboxes. SpamTitan Cloud also scans outbound email to detect spamming and malware distribution, as well as improving protection against insider threats through tags for sensitive data.
WebTitan Cloud is a DNS filtering solution that provides protection from web-based attacks for user working on and off the network. Being cloud based, there is no need to backhaul traffic to the office to apply filtering controls. Since the filter is DNS-based, clean, filtered internet access is provided with no latency. Controls can easily be applied to restrict access to certain types of websites to prevent cyberslacking and block cybersecurity threats and malware downloads.
Both of these solutions are easy to implement, require no local clients, and can be set up to protect your employees in minutes. They are also available on a free trial if you want to evaluate the solutions before committing to a purchase.
For further information on SpamTitan Cloud Email Security and WebTitan Cloud DNS filtering and to discover how these solutions can help to protect your business and remote workers at this extremely challenging time, give the TitanHQ team a call today.
During this unprecedented time of uncertainty, the health and safety of our employees, customers, partners and their families is one of our main focuses and concerns. Team TitanHQ are fully committed to supporting our partners and customers. The benefits from our email and web security products are even more relevant and important now.
Our fantastic team has jumped at the challenge with vigor and we have mobilized our workforce so that it’s business as usual over this unusual phase. We are taking advice from the government on best practice and have a task force in place to manage our progress.
Customers and partners can rest assured that support teams will continue to be available and product teams are working as normal. If you have any questions or concerns about products, or technical support, please contact us in the usual way. The support team has been trained to be aware of special customer concerns during this period and will escalate any question to the appropriate responsible person or department.
We are aware that this is a sensitive time and we will make sure to go the extra mile to make it easier for our customers. All of us at TitanHQ wish you good health and thank you for your continued support.
Many phishing campaigns have been detected that use the novel coronavirus as a lure and now a new ransomware variant called CoronaVirus has been detected and analyzed by MalwareHunterTeam. CoronaVirus ransomware is being distributed through a malicious website masquerading as software called WiseCleaner, a tool that can be used to clean up the registry and remove duplicate files and junk files from computers. WiseCleaner is legitimate software tool, but the website used in this campaign is fake.
It is currently unclear how traffic to the website is being generated. Campaigns such as this typically use malvertising for traffic – Malicious adverts on ad networks that direct users to malicious websites. These adverts are displayed on many legitimate websites that use third party ad networks to generate extra revenue.
If a website visitor tries to download WiseCleaner from the malicious website (The genuine website is wisecleaner.com), a file named WSHSetup.exe will be downloaded. Executing this file will download two malicious payloads: CoronaVirus ransomware and the Kpot Trojan. The Kpot Trojan is an information stealer that steals a variety of credentials, including Skype, Steam, Discord, VPN, email, and FTP passwords from a variety of different applications. The Kpot Trojan steals information such as banking credentials that have been saved in browsers and can also steal cryptowallets. The executable file also attempts to download other files, although currently only two files are downloaded. The intention may well be to download a cocktail of malware.
When CoronaVirus ransomware is downloaded and executed it encrypts a range of different file types. The encrypted files are renamed using the attacker’s email address, but the original file extension is retained. A ransom note is dropped in each folder where files are encrypted.
Interestingly, the ransom demand is very low. The attackers only charge 0.08 BTC – around $50 – for the keys to decrypt files. This suggests the ransomware component of the attack is not the main aim of the campaign which is to distribute the Kpot Trojan and potentially other malware payloads. CoronaVirus ransomware may just be a distraction.
There is currently no known decryptor for CoronaVirus ransomware and it is unclear whether the attackers can – or will – supply valid keys that allow encrypted files to be recovered.
Businesses can protect against attacks such as this by ensuring they backup all of their files regularly and store the backups offline. A web filtering solution should also be implemented to prevent malicious files from being downloaded. Web filters can be configured to prevent attempts by employees to visit malicious websites and also to block downloads of risky file types such as .exe files.
For more information on web filtering and to find out how TitanHQ’s web filtering solution, WebTitan, can help to protect your business from web-based cyberattacks, give the TitanHQ sales team a call today.
There are many ways that ransomware can be downloaded onto business networks, but most commonly, ransomware attacks occur via Remote Desktop Protocol (RDP), drive-by downloads, or email.
RDP Attacks
Scans are performed to discover organizations with open RDP ports, which are then attacked using brute force tactics to guess weak passwords. Cybercriminals also add credentials from historic data breaches to their password lists.
The best way to defense against this method of ransomware delivery is to disable RDP entirely; however, RDP is often required for remote management or remote access to virtual desktops, so this may not be an option. If RDP cannot be disabled, there are steps that should be taken to make it as secure as possible.
Use of strong passwords is important to protect against brute force attempts to guess passwords. You should follow NIST advice on creating complex passwords. Passwords must be unique and not used on any other platform. Two-factor authentication should be implemented to prevent stolen credentials from being used.
You must make sure you are running the latest software versions for servers and clients. RDP connections to listening RDP ports should only be permitted through a secure VPN, and ideally, an RDP gateway should be used. You should also restrict who is permitted to login to remote desktop. Finally, you should use rate limiting to lock users out after a set number of failed attempts to enter the correct password.
Drive-By Ransomware Downloads
Drive-by downloads occur on websites controlled by hackers, either their own sites or insecure sites that have been compromised. Malicious scripts are added to the websites that download ransomware and other malware payloads onto a user’s device when they visit the malicious webpage. This method of attack does not require any user interaction, other than visiting the malicious website. That could occur by clicking a malicious link in an email, via a redirect, or even through general web browsing.
A web filter such as WebTitan is one of the best defenses against drive-by ransomware downloads. WebTitan is a DNS filtering solution that prevents end users from visiting websites known to be malicious. Rather than connecting to the website, the user will be directed to a local block page if they attempt to visit a known malicious website. WebTitan can also be configured to block downloads of risky file types such as executable files.
Email-Based Attacks
Ransomware is also commonly delivered via email. This could be via an embedded hyperlink to a website where a drive-by download occurs or via malicious scripts in file attachments. Protecting against email-based attacks requires a defense in depth approach, as no single solution will provide total protection against all email attacks.
An advanced email security solution such as SpamTitan should be implemented. SpamTitan scans all inbound and outbound emails and uses a variety of techniques, including machine learning, to identify and block potentially malicious emails. SpamTitan incorporates two antivirus engines that detect known malware variants and a sandbox to analyze suspicious files for malicious actions. Sandboxing protects against never-before-seen malware and ransomware variants.
End user training is also important to ensure that in the event of a malicious email reaching an end user’s inbox, it can be recognized as such. A web filtering solution will help to ensure that any attempt to visit a malicious website via a hyperlink in an email or email attachment is blocked before ransomware is downloaded.
Ransomware as a Secondary Payload
Several ransomware operators use commodity malware to deliver their ransomware payloads. The threat actors behind DoppelPaymer ransomware have been using the Dridex banking Trojan to deliver their malicious payload, while the Ryuk ransomware gang uses the TrickBot Trojan.
Even if these commodity malware infections are discovered and removed, the ransomware gangs may still have access to systems. These commodity malware infections are often viewed as relatively trivial and when these malware variants are discovered the attacks are not properly investigated. The Trojans are removed, but the ransomware operators continue to spread laterally before deploying their ransomware payloads.
In the case of TrickBot, once it is downloaded it gets to work harvesting data such as passwords files, cookies, and other sensitive information. Once the attackers have harvested all the data they can, a reverse shell is opened to the Ryuk ransomware operators who perform recon of the network and attempt to gain administrator credentials. They then use PSExec and other Windows tools to deploy ransomware on all devices connected to the network.
That is exactly what happened with the attack on the e-discovery firm, Epiq Global. The initial TrickBot infection occurred in December 2019. Access was provided to the Ryuk operators who deployed the ransomware on February 29, 2020. Prior to the deployment of ransomware, the Ryuk operators compromised computers in all 80 of Epiq’s global offices.
TrickBot and other Trojans are primarily delivered via phishing emails. SpamTitan will help to keep you protected against these Trojans and other ransomware downloaders.
A campaign has been detected that uses alerts about out of date security certificates to fool unsuspecting web users into downloading malware. The warnings have been placed on several legitimate websites that have been compromised by cybercriminals.
When visitors arrive on the compromised websites they are presented with an error message that tells them the digital security certificate has expired and they need to download an updated one. Downloading and running the file results in malware being installed on the user’s device – The Mokes backdoor (aka Smoke Loader) and the Buerak malware downloader.
This tactic of malware distribution is nothing new. Cybercriminals have been using this method for years to fool users into downloading malware under the guide of a browser or Flash update, but this is the first time that expired website security certificate error messages have been used for malware distribution.
The NET::ERR_CERT_OUT_OF_DATE error message is delivered via an iframe that is overlaid over the website using a jquery.js script. The warning matches the size of the original page, so it is all the visitor sees when they land on the website. If they want to be able to view the content, they are told they should update their security certificate to allow the connection to the website to be made. The content of the message is loaded from a third-party web resource, but the URL displayed is of the legitimate website the user has navigated to.
It is not clear how the threat actors compromised the websites. Oftentimes websites are compromised using brute force tactics to guess weak passwords, or exploits are used for vulnerabilities that have not been patched. It is also unclear how people are being sent to the websites. Typically, traffic is sent to the compromised websites through phishing scams or malicious web adverts (malvertising), but visitors could simply navigate to the website through a Google search.
Since the warnings are appearing on legitimate websites, users may think the messages are genuine. One of the compromised websites is the official website of a zoo, another identified by Kaspersky Lab was for a legitimate auto parts dealer. The campaign has been active for at least two months.
Protecting against this method of malware distribution requires a combination of security solutions. Up-to-date anti-virus software is a must to ensure that any files downloaded to business computers are scanned for malware. A web filtering solution such as WebTitan will also provide protection by preventing users from visiting compromised websites that are being used to distribute malware and also blocking downloads of dangerous file types.
Contact TitanHQ today to find out more about web filtering and how you can protect your business from web-based attacks.
Today, February 11, is Safer Internet Day 2020 – A day where safe and positive use of digital technology is promoted around the world. Safer Internet Day started out as part of the EU SafeBorders project in 2004 but has grown into a global event with more than 150 countries participating and promoting safe use of the internet. The aim of Safer Internet Day is to help create a better and safer internet by empowering everyone to use technology responsibly, respectfully, critically, and creatively. This year’s theme is “A better internet: How to look after yourself and others.”
Everyone has a role to play in making the internet a more positive and safer environment, from seeking positive opportunities to create and connect with others, being kind and respectful to others online, and reporting illegal and inappropriate content.
Businesses that provide Wi-Fi access to their customers also have a responsibility to ensure their Wi-Fi hotspot is not abused and cannot be used to access harmful content, especially by minors. The easiest way to do that is by implementing a web filtering solution and today is the perfect day to get started.
The easiest-to-implement and most cost-effective web filtering solution is a DNS filter. A DNS filter allows content to be controlled at the DNS lookup stage of internet access, when the human-friendly domain name of a website is converted to an IP address that a computer uses to find the server hosting the website. This method of web filtering requires no hardware purchases or software downloads. You simply change your DNS record to point to your DNS filtering service provider. You then access a web-based interface and stipulate the categories of content your customers are not permitted to access. Getting started takes just a few minutes. Since all filtering takes place at the DNS level before any content is downloaded, this form of web filtering has almost zero latency, which means internet speeds are unaffected.
With WebTitan Cloud for Wi-Fi you can decide on the content that you don’t want people to access and can use the checkboxes in your user interface to block categories of web content with the click of a mouse. To make the internet family friendly, you can check the adult content checkbox to ensure pornographic material cannot be accessed through your Wi-Fi network. You can also block access to illegal websites to protect your business, such as torrents sites where copyright-infringing downloads of music, software, and films take place. Controls can also be applied to limit access to streaming websites to conserve bandwidth and make sure everyone can enjoy fast internet speeds.
WebTitan has categorized more than 500 million websites into 53 categories, including all of Alexa’s top million websites and web content in 200 languages. You can set internet content controls for different locations, different user groups, and you can manage multiple locations through a single portal.
Blacklists are a useful way to ensure unsuitable or illegal content cannot be accessed. One of the main blacklists is maintained by the Internet Watch Foundation and includes webpages and websites known to host child pornography and child abuse-related content.
Blacklists also protect Wi-Fi users from malicious content, such as phishing websites and sites hosting malware and ransomware, which can help you to protect your users and your company’s reputation.
WebTitan Cloud for Wi-Fi is ideally suited to all businesses that provide Wi-Fi access, such as:
Wireless Wi-Fi ISPs, MSPs and other Wi-Fi service providers
Cafes, coffee shops & restaurants
Retail outlets & shopping malls
Schools & universities
Health systems & hospitals
Hotels
Offices
Libraries
Airports
Rail & bus networks
This Safer Internet Day is the perfect time to implement a DNS filtering solution to make your Wi-Fi (or wired) network much safer for all users.
To find out more about WebTitan Cloud for Wi-Fi, WebTitan Cloud for wired networks, for a product demonstration, or to register for a free trial, contact TitanHQ today.
Spam email may be the most common method of distributing malware and phishing for sensitive information such as Office 365 credentials, but businesses also need to protect against web-based threats.
Malware and ransomware are often unwittingly downloaded from the internet by employees when browsing the internet. Hackers are constantly attacking legitimate websites and uploading malicious content, and malware-lacked files are often hosted on file sharing sites such as Dropbox and Google Drive.
Many owners of high traffic websites use third-party ad networks to bring in much needed extra revenue. Ad blocks are added to websites and the site owners earn money from the number of ad impressions or clicks. Cybercriminals often sneak malicious adverts onto these networks, and they are displayed on many high traffic websites. The malicious adverts link to websites hosting exploit kits that probe for exploitable vulnerabilities in browsers and plugins. If a vulnerability is found, it is exploited to silently download malware.
Phishing emails often have a web-based component. A hyperlink is supplied which links to a website hosting a phishing kit. An email security solution may fail to detect the hyperlink as malicious and will deliver the email. If an employee clicks the link, there may be no protection in place to prevent that site from being accessed and credentials being handed over.
There has also been an increase in malware downloads through social media websites in recent years. Research from Bromium in 2019 showed one in five companies had experienced a malware infection as a result of employees visiting social media websites and 12% of companies suffered a data breach as a result of the malware infection.
Over the summer last year, a multi-year social media campaign dubbed Operation Tripoli was uncovered. The social media malware campaign targeted users in Libya, but Facebook users in other companies were also infected with malware. Malicious code is also inserted into images which are shared on Facebook and Facebook Messenger. That code similarly downloads malware.
Businesses also face other problems from the use of social media sites by employees: A major loss in productivity. According to a Spiceworks survey, 28% of employees at large companies and 45% of employees at medium-sized companies spend four or more hours a week on personal internet usage such as visiting social media sites. The same study also revealed 38% of companies had experienced a security incident as a result of employees’ personal internet usage.
Fortunately, there is a solution that will block internet-based threats and also allow businesses to make significant productivity gains by curbing personal internet usage. Further, the solution is easy to implement, requires little maintenance, and is cost effective. That solution is WebTitan.
WebTitan is a DNS filtering solution ideally suited to SMBs and MSPs that serve the SMB market. WebTitan is a 100% cloud-based web filtering solution, so no software downloads are required and there are no hardware requirements. Simply point your DNS to WebTitan and you will be filtering the internet in minutes. You will block access to known malicious websites, be able to control what types of files can be downloaded from the internet, and you can block access to certain categories of website or filter at the web page level. Highly granular filtering means it is easy to selectively block content. WebTitan allows you to block access to social media sites or just Facebook Messenger if you wish. You can filter at the organization, user group, or individual user level and can set time-based controls.
A full suite of reports allows you to see exactly what types of sites are being accessed, who attempts to violate your policies, and you can also view internet usage in real-time.
WebTitan adds an extra layer to your security defenses that will protect you from the full range of web-based threats. By blocking phishing attacks and malware downloads and allowing you to make significant productivity gains the solution will more than pay for itself.
To find out more about web filtering with WebTitan, give the TitanHQ team a call today.
On January 1, 2020, the California Consumer Privacy Act (CCPA) took effect, giving state residents greater control over the use and sale of their personal data and introduced. In this post we explore the CCPA data security requirements for businesses and the consequences of failing to adequately protect consumer data.
What is the California Consumer Protection Act?
California already had some of the strictest privacy laws in the United States, but CCPA took consumer privacy a step further. CCPA has been likened to the EU’s General Data Protection Regulation (GDPR), as it gives California residents similar rights over the personal data collected and used by companies.
CCPA requires companies to inform California residents about the categories of data that are being collected, at or before the point of collection. There is a right to access all personal information held by a company and find out with whom personal data has been shared. Consumers have a right to opt out and prevent their personal data from being sold and can request that their personal data is deleted. Consumers also have a right to equal services and prices, and cannot be discriminated against, or denied goods or services or levels of services if they opt out of the sale of their personal data.
Who Must Comply with CCPA?
On January 1, 2020, CCPA applies to all companies that do business with California residents, regardless of where the company is based, if one of the following conditions is met:
The company generates revenues of at least $25 million each year; or
The company collects, purchases, sells, or shares the personal data of at least 50,000 people; or
The company generates at least 50% of its revenues from the sale of personal data
CCPA does not apply to insurance institutions, agents, and support organizations, which are covered by different state laws.
CCPA Data Security Requirements
CCPA does not specify what security measures need to be implemented to protect the personal data of California residents; however, businesses do have a duty to implement reasonable security measures based on the level of risk, in accordance with other state laws. Under CCPA, penalties can be applied for a “violation of the duty to implement and maintain reasonable security procedures and practices.”
Since legal action can be taken against companies over a breach of personal data, it is important for companies to ensure appropriate measures are taken to protect data and prevent data breaches.
CCPA does not specify what controls need to be implemented nor what constitutes “reasonable security procedures and practices.” A 2016 Data Breach Report released by the California Attorney General acts as a good guide. It includes a list of 20 controls that the Center for Internet Security says are requirements to protect against known cyberattack vectors. These should therefore serve as guide to the CCPA data security requirements. They are:
How TitanHQ Can Help You Comply with CCPA Data Security Requirements
Email is the most common attack vector used for phishing and malware distribution, so safeguards need to be implemented to keep email systems secure. Phishing attacks often have a web-based component where credentials are harvested, and many malware downloads occur via the internet. Internet controls are therefore also essential to protect against cyberattacks and data breaches. Due to the risk of attack via email and the web, email and browser protections are listed as the first of the foundational Center for Internet Security controls.
This is an area where TitanHQ can help. We have developed two powerful cloud-based security solutions that can help you meet CCPA data protection requirements.
SpamTitan Email Security is a powerful spam filtering solution that keeps inboxes free from email-based threats. SpamTitan incorporates multiple layers of anti-spam and anti-phishing controls, including Sender Policy Framework (SPF), DMARC, SURBL’s, RBL’s Bayesian analysis and more. SpamTitan uses twin antivirus engines to block known malware threats and sandboxing to protect against breaches and data loss from zero-day threats.
WebTitan is a cloud-based DNS filtering solution that protects against the internet component of phishing attacks and stops wired and wireless network users from accessing malicious websites. These solutions will help you meet your email and web security responsibilities and protect your organization from phishing attacks, malware and ransomware downloads. Together they will help you prevent costly data breaches and avoid the resultant CCPA fines.
Penalties for Noncompliance with CCPA
Each intentional violation carries a maximum penalty of $7,500 per record. Unintentional violations carry a penalty of $2,500 per record.
There is also a private cause of action in CCPA. In the event of a data breach, victims of the breach can sue for a CCPA violation. Statutory damages of between $100 and $750 by each California resident affected by the breach. Alternatively claims can be made for actual damages, whichever is greater, along with other relief determined by the courts. Class action lawsuits are also permitted under CCPA. The California Attorney General can also take legal action against the company rather than permitting civil suits to be filed.
TitanHQ and Pax8 have announced a new strategic partnership that will see TitanHQ’s cloud-based email security and DNS filtering solutions incorporated into the Pax8 ecosystem.
Pax8 simplifies the journey into the cloud through billing, provisioning, automation and industry-leading PSA integrations and is proven leader in cloud distribution. Pax8 has achieved position 60 in the 2019 Inc. 5000 list of the fastest growing companies and has been named CRN’s Coolest Cloud Vendor and Best in Show at the NextGen and Xchange conferences for two years in a row.
In order to have products added to the Pax8 marketplace, vendors must have developed exceptional channel friendly solutions. As the leading provider of cloud-based email and web security solutions for managed service providers (MSPs) serving the SMB marketplace, TitanHQ was an ideal fit.
Under the new partnership, Pax8 partners will have easy access to TitanHQ’s leading email security solution, SpamTitan Cloud, and can protect clients from web-based threats with WebTitan Cloud, TitanHQ’s DNS filtering solution.
These cloud-based AI-driven solutions help MSPs secure their own environments and protect their clients from malware, ransomware, botnets, viruses, and phishing and email impersonation attacks and avoid costly data breaches.
Both solutions have been developed with MSPs firmly in mind. The solutions are easy to integrate into an MSP’s security stack through TitanHQ’s APIs, there are multiple hosting options, the solutions can be supplied in white label form, and there are generous margins. Pax8 partners also benefit from a fully transparent pricing policy and industry leading technical support.
TitanHQ’s solutions have much loved by users and are consistently rated highly on business software review platforms, including G2 Crowd, Gartner Peer Insights, and Capterra.
“Our partners are excited about the addition of TitanHQ and the ability to protect their clients’ businesses by blocking malware, phishing, ransomware, and links to malicious websites from emails.” said Ryan Walsh, chief channel officer at Pax8.
You will no doubt have heard of a man in the middle (MiTM) attack. Here we define this attack method, explain how a MiTM attack occurs, and show you how to prevent a man in the middle attack and keep your devices and networks secure.
What is a Man in the Middle Attack?
Man in the middle attacks are commonly cited as a threat, but what exactly is a man in the middle attack? As the name suggests, this is a scenario where a person inserts him or herself between two communicating systems and intercepts conversations or data sent between the two. It is the computer equivalent on eavesdropping on a phone call where neither party is aware that their conversation is not private and confidential.
With a phone call, eavesdropping would allow an attacker to gather a host of sensitive information, which is divulged verbally between both parties. In this scenario, the attacker does not influence the conversation. He/she must wait until a valuable nugget of information is disclosed by either party.
A MiTM attack is concerned with intercepting data transferred between two parties. This could be data sent between a smartphone app and a server, between two parties on a messaging app such as WhatsApp, or an email conversation between two parties. It could also be communication between a user’s browser and a website.
In contrast to the telephone call scenario, which is passive, in a MiTM attack the attacker can influence what is being said. In fact, with a MiTM attack, the two people or systems communicating are not really communicating with each other. Each is communicating with the attacker.
Take email for example. Person A initiates an email conversation with Person B and requests a wire transfer to pay for services rendered. Person A supplies the bank details, and Person B agrees to the wire transfer. Various details are discussed, and the transfer is eventually made. There could be 10 or more messages sent by each party in the conversation. Each message between the two is altered by the attacker, crucially including the bank account details for the transfer. Neither party has been communicating with each other, yet both parties would be convinced they are.
Types of Man in the Middle Attack
The goal of a MiTM is to intercept information, usually for financial gain, but there are different ways that this can be achieved. Generally speaking, there are four main ways that a MiTM attack occurs: Packet sniffing, packet injection, session hijacking, and SSL stripping
Packet sniffing is one of the most common MiTM attack methods and is a type of eavesdropping or wiretapping, except it is not phone conversations that are obtained. It is packets of data sent between the two systems. Packet sniffing is much easier when sensitive data is not encrypted, such when information is disclosed between a browser and a HTTP website, rather than HTTPS where the connection is encrypted.
The above email example is a type of packet injection. Data is intercepted, but additional packets are introduced, or data packets are altered. For instance, malware could be introduced.
Session hijacking is where an attacker hijacks a session, such as a session between a browser and a banking website where the user has logged in. In this example, the attacker is the one in control of the session. SSL stripping is where a HTTPS session, which should be secure as the session is encrypted, is stripped of the encryption, turned from HTTPS to HTTP, and data is identified. This latter example is utilized by web filtering solutions that feature SSL inspection. It allows businesses to check for threats in encrypted traffic.
How to Prevent a Man in the Middle Attack
Fortunately, MiTM attacks can be difficult to perform, so the potential for an attack is limited, but there are skilled hackers who can – and do – perform these attacks and gain access to sensitive data and empty bank accounts. One of the most common examples is a coffee shop scenario where an attacker creates an evil twin hotspot. When a user connects to this evil twin – a Wi-Fi network set up to look like the genuine coffee shop Wi-Fi hotspot – all data sent between their browser and the website is intercepted.
There are several steps you can take to prevent a Man in the Middle Attack.
Never disclose sensitive data when connected to an untrusted public Wi-Fi network. Only ever connect via a VPN, and ideally wait until you are on a trusted Wi-Fi network to access online bank accounts.
Ensure the website is protected by an SSL certificate (starts with HTTPS). Bear in mind that hackers also use SSL certificates, so HTTPS does not mean a website is genuine.
Do not use hyperlinks included in emails, always visit the website directly by typing the correct URL into your browser or finding the correct URL through a Google search.
Do not install unauthorized software, apps from third-party app stores, and do not download and use pirated software.
Businesses should implement a DNS filtering solution to protect their workers and prevent them from visiting malicious websites.
Make sure your networks are secured and have appropriate security tools installed.
Disable insecure SSL/TLS protocols on your website (Only TLS 1.1 and TLS 1.2 should be enabled) and implement HSTS.
At face value, SpamTitan and VadeSecure may appear to be equivalent products. In this post we offer a comparison of SpamTitan and VadeSecure to help managed service providers (MSPs) differentiate between the two solutions.
SpamTitan and VadeSecure
SpamTitan and VadeSecure are two email security solutions that block productivity-draining spam emails, phishing emails, and malspam – spam emails that deliver malware or malware downloaders. These cloud-based solutions assess all incoming emails and determine whether they are genuine communications, unwanted spam, or malicious messages and deal with them accordingly to prevent employees from opening the messages.
TitanHQ is the leading provider of cloud-based email and web security solutions for MSPs that serve the SMB market and has been providing email security for MSPs for more than 2 decades. SpamTitan is TitanHQ’s email security offering, which has been developed for SMBs and MSPs that serve the SMB market.
VadeSecure is a French company that has developed an email security solution for the SMB market. As is the case with SpamTitan, VadeSecure offers protection from email-based threats and provides an important extra layer of security, especially for Office 365 environments. The company is now venturing into the MSP market and has recently raised an additional $79 million in venture capital to help it make inroads into the MSP market. However, at present, the solution is primarily geared toward SMBs rather than MSPs that serve them.
Enhanced Phishing Protection for Office 365 Accounts
Office 365 is the most widely used cloud service by user count and 2019 figures show that Office 365 cloud services are used by 1 in 5 corporate employees, with Office 365 email being the most common. With so many businesses using Office 365 for email, it should come as no surprise that Office 365 email accounts are being heavily targeted by hackers and scammers.
Microsoft does have measures in place to block spam and phishing emails, but the level of protection provided by Exchange Online Protection (EOP) is not sufficient for many businesses. A large percentage of phishing emails manage to sneak past Microsoft’s defenses. According to research from Avanan, 25% of phishing emails are delivered to Office 365 inboxes.
Consequently, additional protection is required, and many businesses choose to implement an anti-phishing solution provided by third parties such as SpamTitan and VadeSecure. MSPs also offer third party solutions to block phishing attacks on Office 365 accounts, not only to better protect their customers, but also to reduce the amount of time they spend mitigating phishing attacks that have not been blocked by EOP.
SpamTitan and VadeSecure have been developed to work on top of Office 365 and add an important extra layer of protection for Office 365 email.
Here we will concentrate on a comparison of SpamTitan and VadeSecure with a specific focus on the features and benefits for MSPs rather than SMBs.
Comparison of SpamTitan and VadeSecure for MSPs Serving the SMB Market
Since VadeSecure has historically focused on the Telco market, the email security solution lacks many features to make MSP’s lives easier and does not provide the level of control, flexibility, or the management tools and reports that MSPs seek. SpamTitan has been developed by MSPs for MSPs, so important features for MSPs have always been offered. We will cover these features below, but initially it is useful to include an infographic that summarizes some of the basic features of SpamTitan and VadeSecure for comparison purposes.
Basic Features of SpamTitan and VadeSecure
SpamTitan Features for MSPs Not Offered by VadeSecure
This comparison of SpamTitan and VadeSecure may seem a little one-sided, and that is because VadeSecure is very much focused on end users rather than MSPs. No doubt the solution will be updated to incorporate more MSP-friendly features over time as the company tries to move into the MSP market, but at present, the features below are provided by SpamTitan but are not offered by VadeSecure.
Configuration Flexibility and Customization Potential
One of the biggest bug bears with VadeSecure is the inability to configure the solution to suit the needs of MSPs. It is not possible to create custom rules for instance, and MSPs must therefore use the Exchange Admin functionality of Office 365.
With SpamTitan, MSPs can create rules based on their own requirements and the needs of each individual client, and those rules can be highly granular and can easily be applied to specific groups, users, and for specific domains. That level of granularity and the ease of customization allows MSPs to fine-tune filtering policies to maximize the detection of threats while minimizing false negatives. MSPs can easily select more permissible or more aggressive policies for each client, but with VadeSecure there is no option for customization for each customer.
True Multi-Tenancy
SpamTitan includes a full multi-tenancy view of all customers, with multiple management roles. This allows MSPs to easily monitor their entire customer base and trial base, assess the health of the deployments, view activity volumes across all customers, and quickly identify issues that require attention. With VadeSecure, there is no possibility of integrating with PSAs and RMMs, and there is no customer-wide view of the entire system.
Highly Granular Reporting
MSPs can tell their clients how important it is to improve their security defenses, but they must also be able to demonstrate that the solutions are proving effective at blocking threats to ensure they can continue to provide those services and receive regular, repeating revenue.
With SpamTitan, MSPs have highly granular reports that give them full visibility into what is happening and a detailed view of system performance. Client reports can easily be generated to show them how effective the solution is and why it is important to keep it in place. Furthermore, this level of reporting – per domain, per group, and at the group domain level – gives MSPs the information they need to identify potential issues and obtain detailed information on spam emails. The solution also has the management capabilities to allow any issues to be quickly identified and corrected to ensure the solution remains effective over time. With VadeSecure, visibility and control options are lacking and there are no options for demonstrating how effective the solution is and to demonstrate that to clients.
High Margins and Significant Revenue Potential
As previously mentioned, the flexibility and scope for customization is a real benefit for MSPs as it allows them to add more value through superior management capabilities. That means MSPs can build solutions that really benefit their clients and it helps them become more of a strategic partner rather than an IT service provider. It is much harder for clients to change a strategic partner than switch IT service providers. VadeSecure lacks this customization which means it is not possible for MSPs to add value to generate reliable, recurring revenue.
Further, with VadeSecure you get one product, but TitanHQ offers a trio of solutions for MSPs to better protect their clients and add more recurring revenue streams. Through the TitanShield for Service Providers program, MSPs also have access to WebTitan DNS filtering and ArcTitan email archiving. This allows MSPs to maximize revenue from each client by cross-selling new services, while also offering a layered security package to protect clients from the full range of email- and web-based threats.
Fully Transparent Pricing
When it comes to pricing, VadeSecure (and many other email security solutions) lack transparency and the pricing model is complex and expensive. Several features are not included as standard with VadeSecure and come at an additional cost. This makes it hard to perform a SpamTitan and VadeSecure pricing comparison.
For instance, with VadeSecure the solution is priced per module, so the Greymail, Spam, and Virus Protection options are not provided as standard and have to be added onto the cost. Based on feedback we have received from MSPs the solution is expensive, which reduces MSP profits and makes the email security solution more difficult to sell to SMBs.
With VadeSecure, the total number of users is not aggregated, which shows a lack of experience of working with MSPs. An MSP with 100 x 10-seat licenses will have that pay at 10 seats each rather than 1,000 seats overall. As such, discounts will be far lower.
With SpamTitan there is just one price which includes all features, including sandboxing, full support, dual anti-virus protection, all security modules, and updates. Furthermore, the price is exceptionally competitive (less than $1 per user). The pricing model was created to incorporate the flexibility for dealing with fluctuating numbers of customers, which often happens when providing managed email services.
Effectiveness at Blocking Threats
Price, usability, and flexibility are all important for MSPs, but features and benefits are the icing on the cake. Email security solutions are used to protect against threats, so the effectiveness of a solution is critical. SpamTitan and VadeSecure are effective at blocking threats and will provide an important additional layer of security for Office 365 users, but feedback we have received from MSPs show there is a clear winner.
VadeSecure includes ‘time-of-click’ protection against embedded hyperlinks, which rewrites URLs and sends them to a scanner. However, MSPs have reported that it can take a long time for phishing emails to be detected, even after threats would be blocked by Chrome. That means that phishing emails are being delivered and there is a window during which a successful attack could occur. This URL click feature only appears to work in OWA or the Outlook client as it is an API integration with Office 365.
SpamTitan includes more advanced detection methods to ensure that malicious URLs are detected and phishing emails are filtered out. SpamTitan includes SURBL filtering and other malicious URL detection mechanisms that complement the default mechanisms in Office 365 such as Recipient Verification Protocols, Sender Policy Frameworks, and Content Filter Agents. This means end users are better protected and there is a much lower probability of a phishing email evading detection.
Dual anti-virus protection is also provided and SpamTitan features a sandbox where suspicious attachments can be safely analyzed for malicious actions. This provides superior protection against malware, ransomware, and zero-day threats that are not detected by the two AV engines.
Any business that processes card payments is a target for cybercriminals, but restaurants in particular are favored by hackers. Over the past few weeks, cybercriminals have stepped up their efforts to attack these businesses and several restaurant chains have had their systems compromised. In all cases, malware has been installed on point-of-sale systems that steals payment card information when diners pay for their meals.
Many of the attacks have hit restaurant chains in the Midwest and East, with credit card data from diners recently having been listed for sale on the underground marketplace, Joker’s Stash. A batch of approximately 4 million credit and debit cards is being offered for sale, which comes from malware attacks at Moe’s, McAlister’s Deli, Krystal, and Schlotzsky’s.
The cyberattack on Krystal was detected in November, with the other three chains, all owned by Focus Brands, attacked in August. In total, the above chains have more than 1,750 restaurants and almost half of those locations, mostly in Alabama, Florida, Georgia and North and South Carolina, were affected.
Catch Hospitality Group also announced in November that it had suffered a cyberattack which had seen malware installed on its point-of-sale system that scraped and exfiltrated payment card data as diners paid for their meals. The data breach affected customers of Catch NYC, Catch Roof, and Catch Steak restaurants. Fortunately, the devices used to process the majority of payments were unaffected. Malware was on the Catch NYC and Catch Roof devices between March 2019 and October 2019, with Catch Steak affected between September 2019 and October 2019.
Church’s Chicken restaurants were also attacked in a separate incident in October. The majority of its 1,000+ restaurants were not affected, but at least 160 restaurants in Alabama, Arkansas, Florida, Georgia, Illinois, Louisiana, Mississippi, Missouri, South Carolina, Tennessee and Texas had malware installed on their POS system.
Other restaurant chains that have been attacked in 2019 include Checker’s Drive-In, Cheddar’s Scratch Kitchen, Huddle House, Applebee’s, Chilli’s, and Earl Enterprises (Buca di Beppo, Chicken Guy, Tequila Taqueria, Mixology, Planet Hollywood). Malware n the systems of Earl Enterprises had been present for almost a year before it was detected.
How to Improve Restaurant Cybersecurity
Restaurants process many thousands of card transactions which makes them an attractive target for hackers. Restaurants often use out-of-date operating systems, have vulnerability-ridden legacy hardware, and their cybersecurity solutions often leave a lot to be desired. Consequently, cyberattacks on restaurants are relatively easy to perform, at least compared to many other types of businesses.
In order to infect the POS system, the attackers will need network access. That is most commonly gained via phishing emails, drive-by malware downloads, or by abusing remote access tools. Direct attacks are also possible using techniques such as SQL injection and weak passwords can be easily guessed using brute force tactics.
The malware that sits on systems and exfiltrates data tends to have a very small footprint and is often stealthy as it needs to be present for long periods of time to collect payment card data. That can make it hard to detect when it has been installed. The key to security is therefore improving defenses to make sure the malware is not installed in the first place, which means preventing the attackers from gaining access to the network.
Listed below are some easy-to-implement steps that will help restaurants improve their security posture and block attacks. The key is defense in depth through layered security.
Use an enterprise-grade firewall –Ensure an enterprise-grade firewall is purchased. A firewall will prevent unauthorized individuals from gaining access to your network resources.
Patch promptly and update all software and firmware – Ensure patches are applied promptly and software and firmware updates are implemented when they are released. That includes all systems and networked devices, not just your POS.
Upgrade hardware – When your hardware is approaching end of life it is time to upgrade. Unsupported hardware (and software) will no longer be updated and vulnerabilities will no longer be fixed.
Lockdown your POS: Use whitelisting or otherwise lock down POS systems to make it harder for malware to operate. Only allow trusted apps to run on your POS systems.
Install powerful antivirus software – Ensure all devices are protected by a powerful anti-virus solution and that it is set to update virus definitions automatically. Regularly scan the network for malware, especially your POS.
Implement an intrusion detection system – These systems monitor the network for unusual activity that could indicate a malware infection, attackers searching the network for the POS system, and unusual traffic that could indicate data exfiltration.
Change all default passwords and set strong passwords – To protect against brute force attacks, ensure strong passwords are set on all systems and all default passwords are changed. Also implement rate limiting to block attempts to access a system or device after a set number of failed password attempts.
Implement a powerful spam filtering solution – A powerful email security solution, such as SpamTitan, is required to prevent spam and malicious emails from being delivered to end users. Even if you have Office 365, you will need a third-party email security solution to block email-based threats.
Restrict Internet access with a DNS filter – A DNS filter such as WebTitan provides protection against drive-by malware downloads and web-based phishing attacks. WebTitan will block all known malicious websites and those with a low trust score. The solution can also be configured to prevent employees from accessing categories of websites where malware downloads are more likely.
Disable Remote Access if Possible – Disable Remote Desktop Protocol and all remote access tools. If remote access tools are required to allow essential maintenance work to be completed, ensure they can only used via a VPN and restrict the people who can use those tools.
Black Friday phishing scam are rife this year. With almost a week to go before the big discounts are offered by online retailers, scammers are stepping up their efforts to defraud consumers.
Spam email campaigns started well ahead of Black Friday this year and the scams have been plentiful and diverse. Black Friday phishing emails are being sent that link to newly created websites that have been set up with the sole purpose of defrauding consumers or spreading malware and ransomware. It may be a great time of year to pick up a bargain, but it is also the time of year to be scammed and be infected with malware.
A wide range of spam emails and scam websites have been detected over the past few weeks, all of which prey on shoppers keen to pick up a bargain. This year has seen the usual collection of almost too-good-to-be-true offers on top brands and the hottest products, free gift cards, money off coupons, and naturally there are plenty of prize draws.
Anyone heading online over the next few days to kick start their holiday shopping spree needs to beware. The scammers are ready and waiting to take advantage. With legitimate offers from retailers, speed is of the essence. There is a limited supply of products available at a discount and shoppers are well aware that they need to act fast to secure a bargain. The scammers are playing the same game and are offering limited time deals to get email recipients to act quickly without thinking, to avoid missing out on an exceptional deal.
This time of year always sees a major uptick in spam and scams, but this year has seen much more sophisticated scams conducted than in previous years. Not only are the scammers insisting on a quick response, several campaigns have been identified that get users to help snag more victims. In order to qualify for special offers or get more deals, the scammers require users to forward messages and share social media posts with their friends and contacts. This tactic is highly effective, as people are more likely to respond to a message or post from a friend.
So how active are the scammers in the run up to Black Friday and Cyber Monday? According to an analysis by Check Point, the number of e-commerce phishing URLs has increased by 233% in November. Those URLs are being sent out in mass spam campaigns to direct people fake e-commerce sites that impersonate big name brands. Those sites are virtual carbon copies of the legitimate sites, with the exception of the URL.
While consumers must be wary of Black Friday phishing scams and potential malware and ransomware downloads, businesses should also be on high alert. With genuine offers coming and going at great speed, employees are likely to be venturing online during working hours to bag a bargain. That could easily result in a costly malware or ransomware infection.
The scams are not limited to the run up to Black Friday. Cyber Monday scams can be expected and as holiday season fast approaches, cybercriminals remain highly active. It’s a time of year when it pays to increase your spam protections, monitor your reports more carefully, and alert your employees to the threats. A warning email to employees about the risks of holiday season phishing scams and malicious websites could well help to prevent a costly data breach or malware infection.
Its also a time of year when a web filtering solution can pay dividends. Web filters prevent employees from visiting websites hosting exploit kits, phishing kits, and other known malicious sites. They can also be configured to block downloads of malicious files. A web filter is an important extra layer to add to your phishing defenses and protect against web-based attacks.
If you have yet to implement a web filter, now is the ideal time. TitanHQ is offering a free trial of WebTitan to let you see just how effective it I at blocking web-based threats. What’s more, you can implement the solution in a matter of minutes and get near instant protection from web-based phishing attacks and holiday season malware infections.
According to research from Channel Futures, security is the fastest growing service for 73% of managed service providers (MSPs). If you have yet to start offering security services to your clients, you are missing out on a steady income stream that could really boost your profits. But where should you start? What services should you be offering? In this post we will be exploring the ideal security stack for MSPs and the essential services that should form the core of your security offering.
Why is Managed Security is so Important?
As an MSP, you should be aware of the importance of security. Companies are being targeted by cybercriminals and data breaches are occurring at an alarming rate. It is no longer a case of whether a business will be attacked, it is a case of when and how often.
Many SMBs do not have sufficiently skilled staff to handle IT and it is far easier, and often more cost effective, to outsource their IT to MSPs. The same is true for security, but even more so due to the difficulty finding sufficiently skilled cybersecurity staff. With so many positions available and a national shortage of cybersecurity staff, cybersecurity professionals can afford to pick and choose there they work. SMBs must ensure they are well protected against cyberattacks, so they look to MSPs to provide security-as-a-service either as a stop gap measure while they try to fill internal positions or so they can forget about security and let an MSP look after that side of the business.
If you are not providing security services to your clients, they will most likely search for another MSP that can protect their business from threats such as malware, ransomware, phishing, botnets, and prevent costly data breaches.
What do SMBs Want?
SMBs may be aware of the need for security, but they may not be so clued up about the solutions they need to protect them from cyber threats. You may need to explain to them exactly what they need and why. What is vital when explaining cybersecurity to SMBs is to emphasize the need for layered security. No single solution will provide protection against all threats and you will need to educate your clients about this.
Layered security is essential for protecting against ever increasing cybersecurity threats. No single solution will provide total protection. You need overlapping layers so that if one layer is bypassed, others are there to block the attack.
You should certainly be initiating conversations with your clients about security. Many SMBs only look for security services after they experience a costly data breach. By being proactive and approaching your clients and offering security services, you will not only have a much greater opportunity for increasing sales quickly, you will help them avoid a costly data breach and will not have to clear up the mess that such a breach causes.
What is the Ideal Security Stack for MSPs?
The best place to start is with a cybersecurity package that includes the core security services that all businesses need to protect them from a broad range of threats. Different packages can be offered based on the level of protection your clients need and their level of risk tolerance. Extra services can always be provided as add-ons.
There are four key security services you should be offering to your clients to give them enterprise-grade protection to secure their networks and protect against the main attack vectors. The ideal security stack for MSPs will differ from company to company, depending on the kind of clients that each MSP has. It may take some time to find the ideal security stack, but a good place to start is with core security services that every business will need.
Core Security Services for MSPs
Firewalls
Email security
DNS filtering
Endpoint security
Firewalls are essential for securing the network perimeter and separating trusted from untrusted networks. They will protect network resources and infrastructure against unauthorized access. It may even be necessary to implement multiple firewalls.
Email security is essential as this is the most common attack vector. Without email security, malware and phishing emails will hit inboxes and employees’ security awareness will be regularly put to the test. The threat of email attacks cannot be understated.
Email security must be explained to clients to ensure they understand its importance and why standard email security such as that provided by Microsoft through Office 365 simply doesn’t cut in anymore. Too many threats bypass Office 365 defenses. A study by Avanan showed that 25% of phishing emails bypass Office 365 security and are delivered to inboxes.
DNS filtering is also a requirement to protect against web-based attacks such as malvertising, drive-by downloads, and exploit kits. Even the best email security solutions will not block all phishing threats. DNS filtering provides an additional layer of security to protect against phishing attacks. While email was once the primary method of delivering malware, now malware is most commonly delivered via web-based attacks. The average business user now encounters three malicious links per day and 80% of malware is downloaded via the internet. Further, with more and more employees spending at least some of the week working remotely, protection is needed for public Wi-Fi hotspots. DNS filtering provides that protection when they are off the network.
Endpoint security solutions add another layer to the security stack. If any of the above solutions fail and malware is downloaded, endpoint security solutions will provide extra protection. This can include basic protection such as antivirus software or more advanced solutions such as intrusion detection systems.
When choosing solutions for your security stack, it is important to make sure they work seamlessly together. This can be difficult if you purchase security solutions from a lot of different vendors.
Additional Services to Add to your Security Stack.
The above security services should form the core of your security offering, but there are many additional services you can easily provide to ensure your clients are better protected. These can be offered as addons or as part of more comprehensive security packages.
Data loss protection
Security helpdesk
Email archiving and backup services
Vulnerability scanning and patch management
Security policy management
Security information and event management (SIEM)
Incident response and remediation
Security awareness training and phishing email simulations
How TitanHQ Can Help
TitanHQ is the global leader in cloud-based email and web security solutions for the MSP that services the SMB market. TitanHQ products are consistently rated highly by MSPs for the level of protection, ease of use, ease of admin, and the level of support provided.
The TitanHQ portfolio of cybersecurity products consists of three core solutions:
SpamTitan Email Security
WebTitan DNS Filtering
ArcTitan Email Archiving
Each of these solutions has a 100% cloud-based architecture and has been developed for MSPs to easily incorporate into their security stacks. TitanHQ offers seamless deployments and easy incorporation into MSP’s management portals via RESTful API.
The above solutions can be supplied with multiple hosting options. You can host with TitanHQ, on your existing infrastructure or in the cloud with AWS, Azure or any other system.
SMBs want to know they are protected, but many don’t care about what solutions are used. This gives you an opportunity to reinforce your brand. This is easily achieved with TitanHQ as the above solutions can be provided in white label form, ready for you to add your own branding. You can even customize the user interface and only include the features that you need to reduce complexity.
Need reports for your clients? No problem. TitanHQ has an extensive range of pre-configured reports that can be scheduled to ease your admin burden, including board-level reports with scope to create your own reports to meet you and your clients’ needs.
Other key features for MSPs include:
Multi-tenant dashboard
Automated policy management
Continuous monitoring
Full visibility of usage
Flexible, affordable, and transparent pricing with monthly billing
Set and forget solutions to ease the admin burden
World-class customer support included with all solutions
AD integration
Generous margins for MSPs
Competitive pricing with monthly billing
Excellent MSP program – TitanShield – with dedicated account managers, assigned sales engineers, scalable pre-sales and technical support, and sales and technical training
TitanHQ has made it as easy as possible for MSPs to start offering security services to their clients. These solutions will also help established security-as-a-service providers ease their management burden and improve their margins.
To find out more about the TitanShield program and for further information on any or all of TitanHQ’s security solutions for MSPs, get in touch with the channel team today. Product demonstrations can be arranged and free 14-day trials are available to allow you to see for yourself why TitanHQ is the leading provider of email and web security solutions for MSPs.
Feedback from TitanShield Program Members
TitanHQ solutions are consistently rated highly by users with the solutions praised for the protection they provide, value for money, and ease of set up and use. The solutions have achieved top marks on independent review sites such as G2 Crowd, Expert Insights, with overwhelmingly positive reviews on Capterra, Spiceworks, Gartner Peer Insights, Software Advice, and Google Reviews.
Here’s what some of our MSP customers are saying about TitanHQ solutions they have implemented to protect their clients and increase their bottom lines.
“By reducing malware-related security incidents, you’re reducing your number one uncontrollable expense: the people on your IT operations team, like your help desk techs.” – MSP, Washington, US
“It’s baked into our fees as well, and our Crypto calls dropped to 0” – MSP, London, UK
“Web filtering is one of the, if not the greatest bang for your buck services. It’s built in anti malware has protected our clients, saving us thousands of hours of repair time I am absolutely certain.” – MSP, New York, US
“I don’t remember the last time one of our customers got Cryptolocker. I bundle it with our offering so that they get it no matter what just to make my life easier on virus removal or data problems.” – MSP, Seattle, US
“a key part of our security stack as we’ve scaled to over 6,000 managed endpoints, while decreasing virus and malware related tickets by 70%.” – MSP, Boston, US
“It has paid for itself many times over by reducing malware calls.” – MSP, Toronto, Canada
The Racoon Stealer is a relatively new form of malware that was first detected in April 2019. The malware is not sophisticated, it does not incorporate any never before seen features, in fact it is pretty unremarkable. The Racoon Stealer can take screenshots, harvest system information, monitor emails, and steal information from browsers, such as passwords, online banking credentials, and credit card numbers.
However, the malware is effective and very popular. In the past six months, the Racoon Stealer has been installed on hundreds of thousands of Windows devices and it is now one of the most talked about malware variants on underground forums.
What makes the Racoon Stealer stand out is a highly aggressive marketing campaign aimed at signing up as many affiliates as possible. Racoon is being marketed as malware-as-a-service on underground forums and affiliates can sign up to use the malware for a flat fee of $200 per month.
The information stealer can be used to steal a range of sensitive information such as passwords, credit card numbers, and cryptocurrencies. Under this distribution model, affiliates do not have to develop their own malware, and little skill is required to start conducting campaigns. The malware developers are also providing bulletproof hosting and are available to give affiliates support 24/7/365, and the package comes with an easy to use backend system.
While the cost is certainly high compared to other malware-as-a-service and ransomware-as-a-service offerings, affiliates are likely to make that back and much more from the information that they can steal. There is no shortage of takers.
How is the Racoon Stealer Being Distributed?
Affiliates are distributing the Racoon Stealer via phishing emails containing Office and PDF files that incorporate code that downloads the Racoon payload. The information stealer has been bundled with software on third-party websites, although a large percentage of the infections come from exploit kits.
The Racoon Stealer has been added to both the Fallout and Rig exploit kits which are loaded onto compromised websites and attacker-owned domains. Traffic is sent to those sites via malicious adverts on third party ad networks (malvertising).
When a user lands on a webpage hosting an exploit kit, their device is probed for vulnerabilities that can be exploited. If a vulnerability is found it is exploited and the Racoon Stealer is silently downloaded.
Once installed, Racoon connects to its C2 server and the resources required to start stealing information are obtained, that information can be sold on darknet marketplaces or used by affiliates to conduct their own attacks.
Given the huge potential for profit, it is no surprise that malware developers are now opting for this business model. The problem is likely to get a lot worse before it gets better and the threat from these malware-as-a-service offerings is significant.
How to Block the Racoon Stealer and Other Web and Email Threats
Fortunately, there are steps that businesses can take to improve their defenses against these MaaS campaigns.
Exploit kits usually incorporate exploits for a small number of known vulnerabilities rather than zero-day vulnerabilities for which no patches have been released. To block these exploit kit attacks, businesses need to apply patches and update software promptly.
It is not always possible for businesses to apply patches promptly as extensive testing may be necessary before the patches can be applied. Some devices may be skipped – accidentally or deliberately due to compatibility issues. Those devices will remain vulnerable to attack.
Patching is important, but it will not stop drive-by malware downloads from the internet that do not involve exploit kits. What is therefore required is a web security solution that can block access to malicious sites and prevent downloads of risky file types.
A DNS filtering solution such as WebTitan provides an additional layer of security to block these web-based threats. Through a combination of blacklists, content control, and scanning websites for malicious content, businesses can protect themselves against web-based attacks. A DNS filter will also prevent employees from visiting websites used for phishing.
Blocking attacks that take place via email requires strong email security defenses. An advanced spam filter such as SpamTitan can prevent malicious emails and attachments from reaching end users’ inboxes. SpamTitan scans all incoming emails for malware using two anti-virus engines but is also effective at blocking zero-day threats. SpamTitan includes a Bitdefender-powered sandbox, where suspicious attachments are subjected to in-depth analysis to identify any potentially malicious actions.
With these two solutions in place, businesses will be well protected from malware threats and phishing attacks and managed service providers can ensure their environment and those of their clients are kept malware free.
To find out more about these two powerful anti-malware solutions and to discover why TitanHQ is the global leader in cloud-based email and web security for the managed service provider serving the SMB market, give the TitanHQ team a call.
The event will be attended by thousands of IT professionals, business owners, and industry leaders who will be discussing the IT industry, recent advances in information technology, and the latest trends affecting MSPs. The conference provides an excellent opportunity for learning, networking, and collaboration and boasts an extensive program of interactive sessions, keynotes, and in-depth training sessions. The event also showcases the latest IT solutions and provides tips and tricks to ensure every ounce of value is squeezed from those tools.
This year’s event promises to be bigger and better than ever before, thanks to an all-star cast of thought leaders and industry professionals who will provide practical advice to help you improve every aspect of your business.
Connect IT Europe covers the entire Kaseya universe and the diverse ecosystem of solutions that serve IT professionals. The conference will help attendees find new revenue streams, increase their profit margins, and simplify IT management through educational presentations, workshops, roundtables, and interactive challenges.
As the leading provider of cloud-based email and web security solutions for MSPs serving the SMB market, TitanHQ is proud to be a Silver sponsor of the event. Attendees will have the opportunity to discover why TitanHQ is the leading provider of cloud-based email and web security solutions for MSPs servicing the SMB marketplace and the features and benefits of SpamTitan email security, WebTitan DNS filtering, and ArcTitan email archiving that make the solutions such a hit with MSPs and IT professionals.
The event will be attended by TitanHQ Strategic Alliance Manager Marc Ludden and Alliances/MSP Partner Manager Eddie Monaghan. Marc and Eddie will be explaining the recently launched TitanShield program for MSPs and how TitanHQ solutions can help MSPs improve efficiency, profitability, and security of their operations and enhance their customers’ security postures.
If you would like further information on TitanHQ products, feel free to reach out to Marc and Eddie ahead of the event:
Eddie Monaghan, MSP Alliance Manager, LinkedIn
Marc Ludden, MSP Alliance Manager, LinkedIn
TitanHQ is proud to be a platinum sponsor of DattCon19, Paris – The leading event for MSPs looking to keep up to date on the latest industry trends, learn best practices, form new and profitable partnerships, and obtain invaluable advice that will help them grow their business and become more successful.
The event gives the TitanHQ team an opportunity to meet with leading MSPs, MSSPs, and ISPs and explain why TitanHQ is the global leader in cloud-based email and web security solutions for the MSP that services the SMB market.
The team will be available to explain the benefits of the TitanShield MSP program and show just how easy it is to integrate TitanHQ products into your service stacks and start rolling out spam filtering, web filtering, and email archiving to your customers… and the best way to sell those services, reduce the time you spend on providing support, and improve the profitability of your business.
The event will be attended by Rocco Donnino, TitanHQ VP of Strategic Partnerships, Marc Ludden, TitanHQ Strategic Alliance Manager, and Eddie Monaghan. Alliances/MSP Partner Manager.
On Tuesday October 22 between 11:15am and 11:35am, Rocco Donnino will be explaining Email & Web Security for the SMB Market. Rocco will talk about the trends TitanHQ are seeing in the email and web security for SMB markets globally, drawing on the experience from working with over 2,200 MSP customers worldwide.
Marc Ludden and Eddie Monaghan will be on hand to meet with MSPs and ISPs to explain the benefits of joining the TitanShield MSP Program and how best to take advantage of TitanHQ’s proven technology and deliver our advanced network security solutions directly to their client base. The pair will be helping MSP partners push TitanHQ products downstream to their customers and grow their businesses.
The event will be attended by more than 1000 MSPs, ITSPs, and industry leaders. Over the three days of the conference, attendees will get to hear from the most successful MSPs and MSSPs and discover what they are doing differently and how they are driving growth.
The sessions, keynotes, and networking opportunities will help you get better at running your business with Datto Solutions and discover how the addition of key products such as SpamTitan email security, WebTitan DNS filtering, and ArcTitan email archiving can improve profitability and add greater value.
The keynotes will be bigger and better than ever before and will be taken by 80 of the best and brightest business tycoons, MSPs, and Datto executives, who will share valuable real-world insights and best practices.
The Peer Forums are more intimate small-group roundtable sessions that provide high-value networking on key topics. These sessions are driven by attendees who will share pain points, success stories, and best practices that have been proven to help MSPs grow their business. This year’s Peer Forums are on the following topics:
Business Strategy
Service Delivery: Driving Efficiency & Automation
Selling Networking as a Managed Service
Women in Tech
French Language Peer Forum: Business Strategy
Service Delivery: Service Desk & Professional Services
M&A: How Do I Acquire or Be Acquired?
Security: Securing Your MSP First
German Language Peer Forum: Business Strategy
Service Delivery: Client Engagement & vCIO
Add to that the networking opportunities and the stunning location and you have an invaluable event that is not to be missed.
DattoCon19 Paris will be taking place on October 21st, 22nd and 23rd at the Palais des congrès de Paris, 2 Place de la Porte Maillot, 75017 Paris, France.
Malvertising is the term given to the abuse of ad networks to serve malicious adverts on legitimate websites that scam visitors by displaying popup ads or direct them to malicious websites hosting phishing forms or exploit code to silently deliver malware. Many website owners place third-party advertising blocks on their websites to increase revenue. While the ad networks have controls in place to prevent abuse, cybercriminals often succeed in bypassing those security measures.
One cybercriminal group has been particularly active over the past year and has been conducting attacks on a massive scale. Researchers at Confiant have been tracking the activity of the group – known as eGobbler – and report that the group delivered fake adverts on 500 million user sessions in Europe and the United States in the past week alone. The campaigns are on a truly massive scale. One of the latest campaigns, conducted between August 1 and September 23 involved around 1.16 billion ad impressions.
Typically, the criminals behind these campaigns target mobile users as the security protections on their devices are nowhere near as robust as on desktop computers; however, this campaign has targeted desktop users on Windows, Linux, and macOS.
Several content delivery networks have been used to serve the malicious adverts, which redirect users to websites that exploit two browser vulnerabilities to deliver their malicious payloads. The first is a bug in the Chrome browser – CVE-2019-5840 – which was patched by Google in June. The second is a zero-day vulnerability in WebKit, the browser engine used by old Chrome versions and the Safari web browser. The bug has already been patched for Safari, but currently Google has not patched Chrome. Since the latest browser engine used by Chrome is based on WebKit, later versions are also affected.
While sandboxing features protect advertising iframes, the zero-day vulnerability has allowed the group to break out of the iframes and display malicious code to visitors and perform redirects.
This cybercriminal group is atypical of most groups that use malvertising to deliver malware. The group is highly skilled and capable of finding bugs in the source code of browsers and conducts campaigns on a massive scale. The group poses a significant threat to internet users although there are steps that can be taken to reduce the likelihood of an attack.
Personal users can harden their defenses by using ad-blockers and ensuring they keep their browsers updated. Businesses similarly need to ensure browsers are updated and block these malicious adverts using a web filtering solution.
In addition to blocking malicious adverts, a web filter can be configured to block the download of malicious files and prevent employees from visiting phishing websites and other malicious websites. A web filter can also be used by businesses to enforce acceptable internet usage policies.
TitanHQ has developed a powerful DNS-based web filtering solution for SMBs and MSPs – WebTitan – that provides protection against malvertising and other types of web-based attacks. The solution is easy to use and can be implemented in just a few minutes. No technical skill is required.
Considering the level of protection provided by WebTitan, you are likely to be surprised at how little the solution costs. To find out more, to arrange a product demonstration, or to set up free trial of the full solution, give the TitanHQ sales team a call.
In Idaho, library content filtering is now mandatory. H.B.194, which was signed into law in April, requires llibraries in Idaho to implement a content filtering system by July 2020 that is capable of preventing minors from accessing objectionable content. Not only does that content filtering system need to prevent library computers from being used to access undesirable content, the content filter must also cover library WiFi networks.
The law change was introduced in to prevent children from accessing pornography on library computers, which various studies have shown can cause considerable harm. Without filters in place, children could access adult content or inadvertently see adult content on other users’ screens. There have been many reports in the media and on internet forums of library patrons catching glimpses of pornography being accessed in plain sight of others.
Some library directors and library boards are unhappy with the law change for two main reasons. The first concerns a potential violation of First Amendments rights. The American Civil Liberties Union has voiced its concerns, stating “Ultimately, blocking software prevents users from accessing a wide range of valuable information, including such topics as art, literature, women’s health, politics, religion and free speech, which is in direct violation of our First Amendment rights.”
The view that filtering means other content will also be blocked is outdated. While the overblocking of internet content was once a concern, modern internet content filters for libraries are much more advanced and allow highly granular control of internet content. Modern filters are also much better at categorizing content than they once were. Further, easy-to-use interfaces reduce the potential for user error setting the content controls.
The filters also prevent malware downloads and block access to phishing forms, which further enhances protection for users and protects library networks from malware and ransomware attacks.
The other main issue is one of cost. While libraries can obtain discounts under the e-rate program if they implement content filters to comply with the the Children’s Internet Protection Act (CIPA), Idaho libraries otherwise have to cover the cost of the filtering controls themselves. No additional money has been made available.
Implementing Library Content Filtering for WiFi Networks is Easy
Little guidance has been provided on how libraries should implement the filters and there is confusion over how the filters can be applied to wired and WiFi networks.
Traditional filters require an appliance to be purchased which is costly. The appliance sits between the user and the internet and all traffic passes through that device and content controls are applied. This is problematic, especially when library devices are supplied for use off-site as all traffic must be hauled back to the appliance and then back to the device, which can result in significant latency (slow internet speeds).
A more cost-effective and trouble-free solution is a DNS-based filter. DNS-based filters apply filtering controls at the DNS level. No appliance needs to be purchased – which means a significant cost saving – and there is no latency. All the filtering takes place on the service provider’s server, not locally on an appliance device.
This system also allows filtering to take place on WiFi networks. Any device that connects to the WiFi network will only be able to access the filtered Internet service. Blocks can also be placed on anonymizer services to prevent filtering controls from being bypassed and DNS filtering can also be used to protect mobile devices, even those used off site.
TitanHQ’s content filtering solution for libraries – WebTitan Cloud and WebTitan Cloud for WiFi – not only incorporate highly granular controls to prevent overblocking of internet content, the solution requires no technical skill to operate, no hardware purchases are required, and no software downloads are necessary. WebTitan Cloud and WebTitan Cloud for WiFi are also low-cost content filtering solutions for libraries. Typical licensing costs are less than $1 per user per month.
If you are struggling to find a content filtering solution for your library, give the TitanHQ team a call. You will be able to have your questions answered about how to implement the solution, you can schedule a product demonstration to see how easy the solution is to operate, and can also take advantage of a free trial to see for yourself how precise the filtering controls are.
Benefits of WebTitan Cloud for Libraries
Create a family-friendly, safe and secure web browsing environment.
Block access to illegal content and pornography without blocking educational material
Block malicious websites and malware downloads
Accurately filter web content through 53 pre-set categories and up to 10 custom categories.
Filter by keyword and keyword score.
Inspect encrypted websites.
Filter content in 200 languages.
Apply time-based filtering controls.
Control bandwidth use.
Filter the Internet across multiple WiFi hotspots.
Manage access points through a single web-based administration panel.
Delegate management of access points.
Schedule and run reports on demand with real time-views of Internet activity and extensive drill down reporting.
Due to the high cost per user, many SMBs and managed service providers (MSPs) are looking for an OpenDNS alternative that provides the same or better protection at a much lower cost. At TitanHQ, we have the solution. We offer an advanced cloud-based web filtering solution that provides excellent protection from online threats with highly granular filtering for precision control over the types of web content that can be accessed by end users.
In this post we will explain why so many SMBs and MSPs have signed up for our OpenDNS alternative, and why WebTitan Cloud is, in general terms, a direct swap out for OpenDNS. However, first we should explain about OpenDNS and Cisco Umbrella as the two names are often used interchangeably.
What is Cisco Umbrella?
OpenDNS is a company that was founded on 2006 and provides domain name system resolution services and provides protection against Internet threats. OpenDNS was acquired by Cisco in August 2015. Under the terms of the $635 million acquisition, the OpenDNS name was retained for its free-to-use home solutions but Cisco re-branded the business and enterprise solutions as Cisco Umbrella. The reason the OpenDNS solution cannot be used by businesses is due to the limits placed on the number of users. Since there is a maximum number of users that can be protected, the business version – Cisco Umbrella – must be used.
The Cisco Umbrella business DNS filtering solutions, which this post covers, are not free services, but paid subscription services. These subscription services are available in three different packages. The most basic package: Cisco Umbrella DNS Security Essentials; the mid-range solution: DNS Security Advantage; and the top level solution: DNS Secure Internet Gateway.
OpenDNS Cost Per User
First, let us consider one of the most important reasons for seeking an OpenDNS alternative: Cost. Cisco’s OpenDNS business DNS filtering service is a popular choice with enterprises, SMBs, and MSPs for good reason. It is an accomplished web filtering solution but that comes at a price. At the time of writing, the OpenDNS cost per user is around $2.20 per month (based on 100 users). While that is a small price to pay for the level of protection that a web filter provides and the potential for productivity increases through careful content control, the cost adds up. For 100 users, that’s $220 per month and $2,640 per year.
WebTitan costs $0.90 per user, per month. That’s just $90 per month and only $1,080 per year. That provides a saving of $1,560 per year based on a 1-year subscription and the cost can be lowered further with a 3-year subscription.
Such a major cost saving makes WebTitan Cloud a very attractive OpenDNS alternative, but price isn’t everything and the lowest cost solutions are not always the best. In this case however, it is possible to save a small fortune without compromising security and control, while improving usability and gaining other important benefits.
A Direct Swap Out for OpenDNS That Will Save a Small Fortune
OpenDNS Cisco Umbrella and WebTitan are best-of-breed DNS-based web filtering solutions that combine advanced protection against malware, phishing, and other web-based threats. They also offer precision control for restricting access to certain types of online material.
Both solutions have been designed with the same core principles and both can be used to block downloads of file types commonly associated with malware and ransomware, such as .exe, .js, .scr, .dll and other executable file types.
To protect against phishing, both solutions support the use of blacklists – Lists of websites and IPs that have previously been identified as malicious or have a low trust score. These phishing web pages are often visited by end users after clicking embedded hyperlinks in emails. Both web filters therefore serve as an important additional layer of protection against phishing.
Both solutions allow filtering controls to be set for different users, at the individual, user group, department, or organization level via category-based filters, which makes it easy to quickly apply and enforce your acceptable Internet usage policies.
Both solutions offer a high level of protection, but for many SMBs and MSPs, the price of WebTitan is the deal clincher. However, there are several other benefits of WebTitan Cloud over OpenDNS.
WebTitan Cloud Advantages over OpenDNS
Some of the key advantages of WebTitan Cloud over OpenDNS are detailed below.
Local Hosting
Certain types of businesses, such as MSPs, will be reluctant to direct users to an external cloud service. To meet the needs of those businesses, TitanHQ offers different hosting options. Typically, WebTitan is hosted within TitanHQ’s own environment, but it is also possible for the solution to be hosted locally to give users greater control and privacy or in a private cloud.
Flexible Pricing
The WebTitan pricing model is perfectly transparent and all features are included in the price, including customer support at no additional cost. TitanHQ can also offer flexible licensing and can negotiate commercial arrangements that suit both parties. Pricing can be based on APs, IPs, or locations. For MSPs there are no monthly minimums, no yearly commitments, and the solution will grow and shrink with customers’ needs. OpenDNS Cisco Umbrella has a complex, multi-tiered pricing system with some of the advanced features only available as an add-on which further increases the cost. Customers also often end up paying for capacity that is not used.
World Class Support
All WebTitan Cloud users benefit from industry leading, world class support, including scalable pre-sales and technical support and sales & technical training. Support is provided for all users at no additional cost. Support is also provided to customers taking advantage of the free trial. Only email support is provided with the lowest tier of OpenDNS Umbrella unless the support package is upgraded at an additional cost. The speed at which support is provided by Cisco is a common complaint among its customers.
Cloud Keys
There will be times when organization-wide or individual filtering controls need to be bypassed. Rather than changing a policy for a particular user and then having to revert back to the original policy, TitanHQ developed bypass codes called cloud keys. These cloud keys can be used to temporarily bypass filtering policies. They can be set to expire after a certain time period or after a certain number of uses.
An Ideal OpenDNS Alternative for Managed Service Providers
The biggest exodus from OpenDNS to WebTitan is MSPs. As mentioned in the previous section, the ability to host WebTitan locally is a major benefit for many MSPs who prefer to host their solutions in their own private clouds.
As an additional benefit, WebTitan Cloud can be supplied in full white-label form and is completely re-brandable. The solution allows customized block pages to be created – these pages are displayed when a user attempts to visit a web page that contravenes company policies. The UI can also be re-branded and customized to include corporate branding. OpenDNS does not offer MSPs a white-label solution and cannot be re-branded.
TitanHQ also ensures WebTitan Cloud fits seamlessly into MSPs service stacks through the use of APIs and RMM integrations. The multi-tenant dashboard allows MSPs to keep clients separated and apply controls on an individual client basis and also to manage client settings in bulk. The APIs make it easy to integrate the solution into existing security and customer management systems.
The low price of our OpenDNS alternative allows MSPs to add web filtering to their existing security packages to better protect their customers while saving themselves a great deal of support time. TitanHQ also offers monthly billing and high margins for MSPs. With WebTitan it really is possible to make 100 points.
Feedback from MSP Clients
"When we decided to trial WebTitan we were happily surprised. Straightaway we dropped Cisco Umbrella and moved to WebTitan and it is impressing us every day. WebTitan easily integrated into Network Needs existing service stack, avoiding any delays in offering the service. There is comprehensive remote management and monitoring via an API. Any MSP will benefit from WebTitan’s many advantages" - Network Needs Technical Director, Ryan Lochhead.
"We looked at Cisco Umbrella last year and ended up going with WebTitan, I've been happy with it so far. It is cloud based, but make sure you install the VM appliance they offer for free to help it sync with your AD to show what user is accessing the content. The cost was a whole lot less than OpenDNS for the same functionality." - Chad1642, MSP, Spiceworks
"Comprehensive protection at a reasonable price. I really love the amount of options you have in protecting your network. There seems to be an almost endless granularity in filtering.
My clients have realized the potential of DNS Filtering services. The reporting has gotten more comprehensive. Our recurring revenue has increased because of this." - Capterra MSP
"The service is very intuitive and easy to use. I'm using it as an MSP provider and the integration with the API is simple, well documented and supported. Makes it much easier to use and offer it to our customers. Offering domain filtering services to my customers, and not having to develop it as a service of our company, made it economically better" - Wasserman MSP, Australia
How Do WebTitan and OpenDNS Compare?
One of the best ways to find out about how the two different solutions compare is to use independent software review sites such as G2 Crowd. The site includes more than 650,000 reviews from verified users. Those users consistently rate WebTitan Cloud higher than alternative web filtering solutions and across the 6 rating areas, WebTitan Cloud achieves higher ratings than OpenDNS Umbrella and is the highest rated solution out of all OpenDNS alternatives reviewed on the platform.
Over the next three months, TitanHQ will be travelling throughout Europe and the United States to meet with managed services providers (MSPs) at some of the biggest trade shows serving the MSP community.
The trade shows and conferences bring together the best MSPs from around the world and gives them the opportunity to learn about new industry trends, best practices, and proven tactics for increasing growth. The shows provide a tremendous opportunity for networking and bring together MSPs and companies offering MSP-focused cybersecurity solutions.
For the past 20 years, TitanHQ has been developing cybersecurity solutions for MSPs and the SMBs marketplace. From humble beginnings, the company has grown into a leading provider of cloud-based email security, web security, and email archiving solutions for MSPs. TitanHQ products have now been adopted by more than 7,500 businesses and 2,000 MSPs around the globe.
TitanHQ products are much loved by MSPs as they have been developed specifically to meet their needs. The solutions are quick and easy to implement and maintain and they save MSPs a considerable amount of support and engineering time by blocking email and web-based cyberattacks at source.
At these MSP events you will be able to find out more about the benefits of cloud-based spam filtering and the importance of adding web filtering to your service stack. The TitanHQ team will be on hand to answer questions about the products and will explain how the solutions can be seamlessly integrated into your client management platforms and how they can make your life easier and improve your bottom line.
Come and Meet the TitanHQ Team at these fall MSP Trade Shows and Conferences
Date
Event
Location
September 17, 2019
Datto Dublin
The Alex Hotel, Dublin, Ireland
September 18, 2019
MSH Summit
155 Bishopsgate, London, UK
October 6-10, 2019
Gitex
Dubai World Trade Centre, Dubai, UAE
October 7-8, 2019
CompTIA EMEA Show
Park Plaza Westminster Bridge,
London, UK
October 16-17, 2019
Canalys Cybersecurity Forum
SOFIA Barcelona, Spain
October 21-23, 2019
DattoCon Paris
Palais des Congrès de Paris, Paris, France
October 30, 2019
MSH Summit North
Hilton Hotel, Manchester, UK
October 30, 2019
IT Nation Evolve (HTG 4)
Hyatt Regency, Orlando, Florida, USA
October 30, 2019
IT Nation Connect
Hyatt Regency, Orlando, Florida, USA
November 5-7, 2019
Kaseya Connect
NH Collection Amsterdam Gran Hotel Krasnapolsky, Amsterdam, Netherlands
If you are planning on attending any of the above events this fall, be sure to come and visit the TitanHQ team to discuss your options and feel free to reach out in advance of the event to arrange a meeting.
Rocco Donnino, Executive Vice President-Strategic Alliances, LinkedIn
Eddie Monaghan, MSP Alliance Manager, LinkedIn
Marc Ludden, MSP Alliance Manager, LinkedIn
If you are unable to attend any of these exciting events, give the team a call for further product information, to book a product demonstration, or to sign up for a free trial of SpamTitan, WebTitan, and ArcTitan.
Exploit kit activity may be at a fraction of the level of 2016 when peak activity was reached, but the threat has not gone away. In fact, the mid-year cybersecurity roundup from Trend Micro shows exploit kit activity is now triple the level of mid-2018. Websites hosting exploit kits still pose a significant threat to businesses.
Exploit kits are toolkits that contain exploits for vulnerabilities in popular software applications, such as Internet Explorer and Adobe Flash Player. When a user lands on a web page that hosts an exploit kit, it will scan the user’s browser for vulnerabilities. If an exploitable flaw is identified, malware is automatically downloaded and executed on the user’s device. In many cases, the downloading of a Trojan, ransomware, or other form of malware is not identified by the user.
Traffic is sent to exploit kits through malvertising – malicious advert – on high traffic websites. User’s can be directed to malicious websites through phishing emails, and it is also common for hackers to hijack high traffic websites and use them to host their exploit kit. That means users could visit a malicious website just through general web browsing.
There are several exploit kits currently in use such as Magnitude, Underminer, Fallout, Green Flash/Sundown, Rig, GrandSoft, and Lord. These exploit kits are pushing cryptocurrency miners and botnet loaders, although ransomware and banking Trojans are the most common payloads.
Many of the exploits used by these toolkits are for old vulnerabilities, but since businesses are often slow to apply patches, they still pose a major threat. Exploit kits such as GrandSoft and Rig are regularly updated and now host exploits for much more recently disclosed vulnerabilities.
One of the most recently identified campaigns has seen the threat actors behind Nemty ransomware team up with the operators of RIG to push their ransomware on businesses still using old, vulnerable versions of Internet Explorer.
A new exploit kit named Lord is being used to infect users with Eris ransomware. In this case, traffic is being directed to the exploit kit through malvertising on the PopCash ad network. The EK primarily uses exploits for flaws in Adobe Flash Player such as CVE-2018-15982.
Protecting against exploit kits is straightforward on paper. Businesses need to ensure that vulnerabilities are identified and patched promptly. If there are no vulnerabilities to exploit, no malware can be downloaded. Unfortunately, in practice things are not quite so simple. Many businesses are slow to patch or fail to apply patches on all devices in use.
Anti-spam software can help to reduce risk by blocking phishing emails containing links to exploit kits, but most of the traffic comes from search engines and malvertising, which anti-spam software will do nothing to block. To improve your defenses against exploit kits, drive-by downloads, and phishing websites, one of the best cybersecurity solutions to deploy is a DNS filtering solution.
A DNS filter allows businesses to carefully control the websites that employees can access when connected to the business’s wired and wireless networks. Controls can be set to block different types of web content such as gambling, gaming, and adult websites but crucially, the DNS filter also blocks all known malicious websites. DNS filters use blacklists of known malicious websites such as those hosting exploit kits or phishing forms. If a web site or web page is included in the blacklist, it will automatically be blocked. Websites are also scanned in real time to identify malicious content.
Since all filtering takes place at the DNS level, access to malicious or undesirable content is blocked without any content being downloaded. Setting up the solution is also quick and easy, as it only requires a change to the DNS record to point it to the service provider. No hardware is required and there is no need to download any software.
If you want to improve your defenses against malware, ransomware, botnets, and phishing and are not yet controlling the web content that your employees can access, contact TitanHQ today and ask about WebTitan. Alternatively, sign up for a free trial of the solution by clicking the image below.
The year 2018 saw a reduction in ransomware attacks on businesses as cybercriminals opted for alternative means to make money. Major ransomware attacks were still occurring, just at a slightly lower rate than in 2017.
Some reports were released that suggested ransomware was no longer such a massive threat as it was in 2016 and 2017, but the number of reported attacks in 2019 have shown that is definitely not the case. Any business that has not implemented defenses to protect against ransomware attacks could well be the next victim and have to pay millions to recover from an attack.
Make no mistake. Ransomware is one of the most dangerous threats faced by businesses. If ransomware is installed on the network, all files, including backups, could be encrypted. That could prove catastrophic, as one small Michigan medical practice discovered.
The two-doctor practice in Battle Creek, MI suffered an attack that resulted in the encryption of all patient data. A ransom demand was issued by the attackers, but as there was no guarantee that files could be recovered after the ransom was paid, the decision was taken not to pay up. The hackers then deleted all the encrypted files. Faced with having to rebuild the practice from scratch, the doctors decided to call it quits and took early retirement.
Ransomware attacks on healthcare providers are now being reported at an alarming rate and government entities, cities, and municipalities are being extensively targeted. The city of Baltimore suffered a major attack in May involving a ransomware variant called RobbinHood. The attack brought down the city’s servers and systems, causing major disruption across the city. A ransom of $6 million was paid for the keys to regain access to the encrypted files.
Two small cities in Florida also suffered major attacks. Lake City was forced to pay a ransom of $460,000 and Riviera Beach paid a ransom of $600,000, while Jackson County in Georgia paid $400,000 after its court system was attacked.
As the year has progressed, the attacks have increased. A report from Malwarebytes indicates there was a 195% increase in ransomware attacks in Q1, 2019. Figures from Kaspersky Lab show ransomware attacks almost doubled in Q2, 2019, with 46% more attacks reported than the corresponding period in 2018.
The increase in attacks means businesses need to be prepared and have the necessary security tools in place to make it difficult for the attacks to succeed.
There is no one cybersecurity solution that can be implemented to eliminate the threat of attack, as hackers are using a variety of methods to gain access to networks and download their malicious payloads. Layered defenses are key to repelling an attack.
Email is the primary method of delivering ransomware. All it takes if for a malicious email to arrive in an inbox and for an employee to be fooled into opening a malicious attachment or clicking on a hyperlink for ransomware to be installed. An advanced email filtering solution such as SpamTitan Cloud is therefore needed to block malicious emails and ensure they do not reach employees’ inboxes.
SpamTItan includes Domain-based Message Authentication, Reporting, and Conformance (DMARC) to block email impersonation attacks and a sandbox where suspicious attachments can be executed in safety and studied for malicious activity. Sandboxing is essential as it allows zero-day ransomware threats to be identified and blocked.
Not all attacks occur via email. Attacks over the Internet are also common. A web filtering solution should therefore be implemented to block these web-based attacks. A web filter will prevent employees from accessing known malicious sites where ransomware is automatically downloaded. With these two technical measures in place, businesses will be well protected from attacks. Along with security awareness training for staff and the adoption of good data backup practices, businesses can mount a strong defense against ransomware attacks.
Taxpayers and tax professionals are being targeted by scammers posing as the Internal Revenue Service (IRS). The goal of this new IRS tax return phishing scam is to deliver information-stealing malware. The malware harvests credentials that are used to gain access to and empty financial accounts.
The campaign uses at least two subject lines for the emails – “Electronic Tax Return Reminder” and “Automatic Income Tax Reminder.” The emails contain a hyperlink that directs the user to a website that closely resembles the IRS.gov website. The emails include a one-time password to use to login in to submit a claim for a tax refund.
When the user logs in to the site, they are told that they need to download a file in order to submit their refund. The file is actually keylogging malware which records keystrokes on an infected computer and sends a range of sensitive information to the attackers.
The IRS warning was issued after several taxpayers and tax professionals reported the phishing emails to the IRS. Efforts are ongoing to disrupt the campaign, but the IRS notes that dozens of compromised websites and malicious URLs are being used by the scammers. The IRS is contacting hosting companies to get the websites shut down, but the number of URLs being used makes this a major challenge. As soon as one URL is shut down, there are others to take its place.
The offer of a tax refund or a threat of legal action over tax issues prompts many people to click without first assessing the content of the message and the legitimacy of the request, which is what the scammers are banking on.
The advice of the IRS is never to click on any link in an unsolicited email claiming to be from the IRS. The IRS does not initiate contact with taxpayers by email, text message or social media channels, and no requests are sent for personal information.
The latest warning comes just a couple of months after the IRS and Security Summit partners issued a reminder that all professional tax preparers are required by law – The FTC Safeguards Rule – to implement a written information security plan to ensure the tax information of their clients is properly protected.
The reminder was issued as it had become clear that many tax professionals were unaware of their obligations to implement a security plan to protect client tax data.
There are several required elements of the information security plan:
Designate an employee or employees to coordinate the information security plan
Conduct a risk analysis to identify risks to the confidentiality of client data
Assess the effectiveness of current safeguards
Implement, monitor, and test the safeguards program
Only use service providers that can maintain appropriate safeguards and oversee the handling of client data
Evaluate and update the security program, as appropriate, in response to changes to business practices and operations
The requirements for the information security plan are flexible. For instance, tax preparers can choose the safeguards to implement based on their own circumstances and the findings of their risk analyses.
Two important safeguards that protect businesses from phishing and malware attacks are a spam filter and a web filter. The spam filter protects the email system by identifying and blocking malicious messages such as phishing emails and malspam (malicious spam email), while a web filter blocks web-based attacks and malware downloads. Both of these solutions are highly effective at blocking phishing and malware attacks yet are cheap to implement.
To find out more about how spam filters and web filters can protect your business and help you meet your legal responsibilities contact TitanHQ today.
A highly convincing Instagram phishing campaign has been identified that uses warnings about attempted fraudulent logins to trick users into visiting a phishing webpage where they are required to confirm their identity by signing in to their account.
The messages include the Instagram logo with a warning that someone attempted to login to the user’s Instagram account. The message is a virtual carbon copy of the genuine 2-factor authentication messages that are sent to users to confirm their identity when a suspicious login attempt is detected.
The messages include a 6-digit code that must be entered when logging into the account, together with an embedded “sign in” hyperlink. The user is told to login to confirm their identity and secure their account.
The messages are well written, although there are some punctuation errors which suggest that the email may not be what it seems. These could easily be overlooked by someone worried that their account has been hacked.
Not only is the message almost identical to Instagram’s 2FA warning, the website to which the user is directed is also a perfect clone of the genuine Instagram login page. The webpage has a valid SSL certificate and starts with HTTPS and displays the green padlock to confirm that the connection between the browser and the web page is secure.
The only sign that the web page is not genuine is the domain name. The scammers have chosen a free .CF – Central African Republic – domain name, which is a clear indication that the web page is a fake. However, the presence of HTTPS and a green padlock could fool many people into providing their login credentials in the mistaken belief they are on a secure website.
Many people mistakenly believe that the presence of HTTPS at the start of a website and a green padlock means the website is genuine and secure. However, the green padlock only means the connection between the browser and the website is secure and any sensitive information provided to the website will be protected against unauthorized access in a man-in-the-middle attack. It does not mean the content on the webpage is genuine.
HTTPS websites are often used for phishing as many people look for the green padlock to confirm that the website is secure. Unfortunately, SSL certificates are often provided for free by hosting companies and checks on site content are not conducted.
This is an important issue for businesses to cover in security awareness training. Employees should be taught the true meaning of the green padlock and told to always check the domain name carefully before disclosing any sensitive information.
Businesses can further improve their defenses against phishing with a web filtering solution such as WebTitan. With WebTitan in place, businesses can carefully control the types of website that their employees can visit on their work computers. WebTitan also prevents users from accessing any website known to be used for phishing, malware distribution, or other malicious purposes. WebTitan also performs checks in real-time to assess the legitimacy of a website. If the checks are failed, the user is presented with a block screen and will not be able to access the site.
For further information on how a web filter can improve your organization’s security posture and better protect the business from phishing attacks, contact the TitanHQ team today.
A new phishing campaign has been detected that uses Google Drive links to avoid detection by Office 365 Exchange Online Protection and ensure messages are delivered to inboxes.
The emails, reported through Cofense Intelligence, impersonated the CEO of the company who was attempting to share an important document. The document had been shared via Google Drive and came with the message, “Important message from – CEO.”
Google Drive allows files and collaboration requests to be easily sent to other individuals. The account holder chooses who to share a file with and the system generates an email alert containing a link to the shared file.
In this case, the name of the CEO was correct, but the email address used was different to the format used by the company. While this is a clear sign that the emails are not what they seem, some employees would likely be fooled by the message.
Importantly, the messages are not detected as malicious by EOP and are delivered to inboxes. A scan of the message would reveal nothing untoward, as the embedded URL is a legitimate shared link to a genuine cloud service operated by Google.
The shared document itself is not malicious, but it does link to another Google Docs document and a phishing URL. Any anti-phishing solution that only assesses the embedded hyperlink in the email to determine whether it is malicious would allow the email to be delivered. Only a deeper inspection would reveal the true nature of the URL.
If the link is visited by an end user, a fake login window is presented. If login credentials are entered, they are captured and stored on the attacker’s server.
This campaign highlights the importance of multi-layered anti-phishing defenses and the risks of relying on EOP to provide protection against phishing attacks.
An advanced spam filtering solution should be implemented on top of Office 365 to provide greater protection from phishing and other email-based attacks. This will ensure more sophisticated phishing attacks are blocked.
If a malicious message is delivered and a link is clicked, the connection to the malicious webpage could be blocked using a web filtering solution.
WebTitan is a DNS-based content filtering solution that serves as an additional layer in organization’s anti-phishing defenses. Should an attempt be made by an employee to visit a malicious website or suspicious domain, the attempt would be blocked before any content is downloaded. WebTitan assesses each website when the DNS query is made. Malicious websites and those that violate an organization’s content control policies are blocked.
To find out more about how a DNS filter can improve your defenses against phishing attacks and malware downloads, contact TitanHQ today.
Malware creators are constantly developing new techniques to circumvent traditional anti-virus defenses and ensure their malicious code can run undetected on a targeted machine.
Zero-day malware variants, those which have never been seen before, are not picked up by signature-based AV solutions. However, the malware will need to communicate with its owner, so the source code will contain URLs and IPs for that purpose. These URLs can be detected when scanning files. If the URLS are detected and they are known to be malicious, the file will be deemed to be malicious and will be quarantined.
To ensure this does not happen, malware developers use a variety of techniques to hide the URLs and IPs in the source code. This is often achieved by converting the IP address into a decimal value, which is stored as XML content. When in decimal format, even a malicious URL would not be detected as such by most antivirus software. When the IP address is needed by the malware, it can be converted back to its original form and then reconverted to digital when no longer required.
Similarly, a URL – or part of a URL – could be encoded in its hexadecimal equivalent. That URL would be unlikely to be detected as malicious yet can be read by a browser. AV software would likely detect the file example.com/maliciousfile.exe as malicious in nature and would block it accordingly. In hexadecimal, that translates to:
That address would not be recognizable as malicious and would likely go undetected during a scan by an AV solution. The use of both obfuscation techniques together is not unusual, to make it even harder for AV solutions to detect malicious URLs and IPs.
While these techniques can be used to fool endpoint AV solutions, connections to those malicious servers can be blocked using a DNS-based content filter such as WebTitan.
It doesn’t matter how the URL or IP address is masked. Before a connection can be made, it is necessary to make a DNS query, and the collection must be permitted by the DNS-based filter. If the URL is malicious, the DNS filter will block the attempt to connect before any content is downloaded.
WebTitan works in conjunction with a real time database of millions of malicious URLS and uses a real-time classification system to assign websites to one of 53 categories. Those categories can be allowed or blocked with the click of a mouse. In addition to blocking access to malicious content, the category-based controls can be used to prevent employees from accessing content that could cause offense or lower productivity.
To find out more about how WebTitan can benefit your organization and improve your security posture, contact the TitanHQ team today.
OneStopIT, one of the leading Managed Service Providers (MSPs) in the UK, has partnered with TitanHQ and will be incorporating TitanHQ cloud-based email and web security solutions into its service stack to better protect its customer base.
Businesses in the UK are increasingly being targeted by cybercriminals. A variety of tactics are used to obtain company funds, sensitive data, and company secrets. Attacks may be diverse, but they typically start with a phishing email and/or visit to a malicious website.
Cyberattacks are now being reported at record levels and business leaders are understandably worried. To better protect their networks and data, many turn to MSPs such as OneStopIT for help protecting their networks and data.
“The proliferation of phishing threats across Office 365 is a real problem for SME’s in the UK and we’re partnering with a key vendor in this space to protect our customers and also give them the OneStopIT premium service they are used to,” said Ally Hollins-Kirk, CEO of OneStopIT.
TitanHQ has developed powerful email and web security solutions for the SMB marketplace that have been developed to be easily delivered via MSPs. SpamTitan is a cloud-based anti-spam and anti-phishing solution that incorporates DMARC authentication and a sandboxing feature to protect against email impersonation, phishing, and email-based malware attacks. WebTitan is a DNS-based web filtering solution for content control and protection from web-based threats. The solution is backed up by a threat intelligence database of 650 million people. TitanHQ’s email archiving service, ArcTitan, allows MSPs to offer a secure, email archiving service to help businesses meet their compliance obligations.
Under the new partnership agreement, OneStopIT will be offering its customers advanced email security and anti-phishing protection, DNS-based web filtering, and an email archiving service powered by TitanHQ technology.
“TitanHQ is pleased to add our advanced threat protection layer for email and web security to the OneStopIT security stack,” said Rocco Donnino, President of Strategic Alliances, TitanHQ. “OneStopIT has excelled in the areas of customer service and security, our partnership further cements this commitment.”
Join the TitanHQ MSP Partner Program
TitanHQ has gained extensive experience from working with managed service providers for more than two decades. During that time, the company has listened to the needs of MSPs and has incorporated all of the features MSPs could reasonably expect from cybersecurity solutions to meet the needs of even their most demanding clients. All TitanHQ solutions were created from the group up with MSPs in mind, with the solutions easy to implement and requiring little management. The aim has always been to allow MSPs to increase revenue for as little effort as possible, while ensuring their clients are protected from from the full range of cyber threats.
To better meet the needs of MSPs, TitanHQ developed the TitanSHIELD Program for MSPs. MSPs joining the TitanSHIELD MSP program receive one-to-one training with our sales engineers and have a dedicated account manager, assigned sales engineer support, access to the Global Partner Program Hotline, access to the Partner Knowledge Base, 24/7 priority technical support, online technical training and FAQs, access to the Partner Technical Knowledge Base, and full access to an extensive range of marketing materials and sales tools.
TitanHQ now has more than 1,500 MSP and ISP clients worldwide who are protecting their clients from email and web-based attacks, while helping them to meet their compliance obligations through the ArcTitan email archiving solution. If you would like to join the TitanSHIELD program, give the TitanHQ MSP team a call today.
We have performed a 2019 email archiving price comparison to help you choose the best value email archiving solution for your business.
An email archive is a depository for all emails that are no longer required but cannot be deleted for legal and compliance reasons. The email archive contains an exact copy of every message sent or received across all corporate mailboxes. Those messages are moved out of the mailbox to the archive to free up space and ensure that important emails can not be accidentally deleted and are always recoverable.
In contrast to a backup, an email archive is searchable. Emails can be found and retrieved quickly and easily on demand. An email archive is therefore a useful email repository that can be used on a daily basis to store emails, freeing up space on your mail server to improve performance.
There are many reasons for creating an email archive, but one of the most important is for eDiscovery. Court orders for email communications may be received and emails must be produced as part of the eDiscovery process. Since an email archive is searchable, recovering messages from the archive takes minutes. Finding and recovering emails from backups can take days, if they can be recovered at all.
The failure to produce emails on demand for eDiscovery can result in significant fines. In the case Coleman Holdings v. Morgan Stanley, a Florida Circuit Court awarded $15 million in damages for the failure to comply with email discovery obligations. In Zubulake v. USB Warburg, $29 million in damages were awarded to the plaintiff as the defendant was unable to locate and produce important emails.
State and federal laws in the United States are not the only reason for implementing an email archive. Since the EU’s General Data Protection Regulation (GDPR) came into effect on May 25, 2018, all businesses that collect or process the personal data of EU citizens must implement safeguards to protect personal data. An email archive meets that requirement by storing an encrypted copy of email data, protecting against data loss and unauthorized access.
GDPR also gave EU citizens new rights, such as the right to be forgotten. If that right is exercised, all data relating to that individual must be deleted. That includes personal data in emails. With an email archive, locating those emails is quick and easy. The failure to respect GDPR rights and process requests in a timely fashion can result in a financial penalty of up to €20 million, or 4% of global annual turnover, whichever is greater.
2019 Email Archiving Price Comparison Grid
TitanHQ has created an email archiving price comparison grid to help you find the most cost-effective email archiving solution. The grid below has been compiled using pricing information based on 100 users.
As you can see, TitanHQ’s email archiving solution, ArcTitan, is extremely competitively priced and costs less than $3 per person per year.
Email is now the main method of communication for businesses. Each day, a typical business will receive thousands of emails. Those messages need to be retained for several years to meet state and federal laws and certain industry regulations.
There are two options available to businesses to meet data retention laws for email. Businesses can backup all email data or create an email archive. While businesses will be familiar with the former, there is considerable confusion about the latter.
In this post we will explore some of the common myths of email archiving and will explain the important differences between email backups and email archives.
One of the commonest misconceptions about email archiving is an archive is not necessary because data backups are already performed. Backups are essential as they ensure data can be recovered in the event of disaster. Backups allow a business to create a restore point so that in the event of a catastrophe, systems can be restored to their state at a specific moment in time – The date and time that the backup was created.
An email archive is different. An email archive is used for long term storage of emails. Emails are archived with metadata and can be searched and recovered quickly. Backups are not searchable, so finding and recovering specific emails or conversation threads can be incredibly time consuming.
An archive makes legal discovery, investigating complaints, and providing evidence for compliance audits simple. With an email archive, single messages, threads, and conversations can be quickly and easily recovered.
Another common myth about email archiving is it is only a requirement for businesses in certain industries such as finance and healthcare. While email archiving is essential for meeting regulatory requirements in certain industries, it does not mean that email archiving is just for highly regulated industries.
The U.S. Federal Rules of Civil Procedure require emails to be producible in the event of legal action. If emails cannot be produced, the company could be liable for the destruction of evidence and face stiff financial penalties.
Another common myth is email archives increase risk. Many companies choose a short email retention period, such as 90 days, and require all complaints to be submitted in the same time frame. After 90 days, emails are deleted as they are no longer required. That, however, is a dangerous strategy.
Deleting emails from the email server only deletes local copies. It is probable that emails will have been retained on the recipient’s server. Short retention periods also make the process of eDiscovery more time consuming, expensive, and difficult.
The other risk is that of exposure of sensitive information. Many companies believe that it is more secure to create email archives on on-premises hardware. Security is naturally a concern, but cloud-based email archives are just as secure, if not more secure than on-premises archives. Cloud based archives are automatically backed up to prevent data loss in the unlikely event of hardware failure.
Cloud-based archives also have considerable advantages. They are scalable, so when more storage space is required it is available immediately. With on-premises archives, businesses are limited by their IT hardware and software. Purchasing additional hardware can be expensive and resources must be devoted to managing and maintaining that hardware. Businesses typically save up to 50% of maintenance time by using a cloud-based email archive. Cloud-based archiving is therefore more cost effective and does not involve sacrificing security.
With an email archiving solution, businesses can meet their regulatory obligations, will be able to respond quickly to eDiscovery requests, and will have easy and fast access to any email message or attachment, even if that message was received several years previously. With an email archive, all critical email data is safely and securely saved and stored and can be recovered quickly on demand.
ArcTitan: Email Archiving for SMBs and MSPs
If you are not currently archiving your emails or you are unhappy with your current email arching solution provider, TitanHQ can offer a solution. ArcTitan is a powerful, secure, easy to use, and lightning-fast cloud-based email archiving solution for MSPs and SMBs that is compliant with all email retention regulations.
Key Features of ArcTitan
Scalable, email archiving that grows with your business
Email data is stored securely in the cloud on Replicated Persistent Storage on AWS S3
Lightning fast searches – Search 30 million emails a second
Rapid archiving at up to 200 emails a second
ArcTitan automatically backs up the archive
No impact on network performance
Ensures an exact, tamper-proof copy of all emails is retained
Easy data retrieval for eDiscovery
Protection for email from cyberattacks
Eliminate PSTs and other security risks
Facilitates policy-based access rights and role-based access
Performs multiple searches simultaneously
Save and combine searches
Search email messages and attachments simultaneously
Slashes the time and cost of eDiscovery other formal searches
Migration tools ensure the integrity of data during transfer
Seamless integration with Outlook
Supports single sign-on
Users can be given permission to access their own archived emails
Only pay for active users
Compliant with regulations such as HIPAA, SOX, GDPR, Federal Rules of Civil Procedure, etc.
White-label version of ArcTitan is available for MSPs and resellers
Ransomware attacks have been increasing since late December 2018 and attacks have been reported with increasing frequency as 2019 has progressed. Ransomware may have fallen out of favor with cybercriminals in 2018, but it is once again a firm favorite as it was in 2016 and 2017.
In recent months there has been an extensive ransomware campaign targeting local government offices, cities, and municipalities. These attacks have caused massive disruption, and many have resulted in ransoms being paid.
In the past few days alone, three ransomware attacks have been reported that have seen more than $1,200,000 in ransoms paid. Riviera Beach in Florida paid a ransom of $600,000 for the keys to unlock its encrypted files and Lake City in Florida paid around $460,000. Most recently, La Porte County in Indiana paid a ransom demand of $130,000.
These are just three of many. According to the United States Conference of Mayors, in the past 6 years, more than 170 city, county, or state government systems have been taken out of action as a result of ransomware attacks and there have been 22 attacks so far in 2019.
Cybercriminals will continue to conduct attacks as long as it is profitable to do so. When ransoms are paid, it simply encourages further attacks. The United States Conference of Mayors has decided to take a stand. The organization represents more than 1,400 majors across the United States and has vowed that in the event of attack, ransom demands will not be paid.
That is a necessary step to take to de-incentivize attacks but it could potentially be very costly. In 2018, the City of Atlanta was attacked with ransomware and refused to pay the $50,000 ransom demand. The city has ended up spending tens of millions of dollars on recovery.
The high cost of recovery without paying the ransom could prove too much for small cities, which is why several have been advised by their insurers to pay the ransoms.
In such cases, help is required from the federal government. The majors have urged Congress to pass the State Cyber Resiliency Act, which would give state and local governments the support needed to help them implement their cyber resiliency plans
What is also needed is greater investment in cybersecurity defenses. Attacks are being conducted because there are security holes that can be easily exploited. Until those holes are plugged, the attacks will continue.
TitanHQ can help plug those holes and thwart ransomware attacks by blocking the main attack vectors. SpamTitan is a powerful email security solution that blocks email-threats at source and keeps inboxes threat free. WebTitan protects users while online and blocks malicious websites and malware downloads. With both of these powerful, but low-cost solutions in place, you will be well protected against ransomware attacks.
There has been a spate of ransomware attacks on cities, municipalities, mayor’s offices, and local government facilities in recent weeks.
The latest attack was on La Porte County in Indiana. The attack started on July 6, 2019, but prompt action by the IT department allowed the ransomware to be contained. That rapid response meant only 7% of the laptops used by the county were affected. However, two domain controllers were also affected and that rendered the network unavailable.
Experts were brought in to try to restore files from backups and bring the network back online, but those attempts failed as the backup servers had also been infected with the ransomware. La Porte County was left with no alternative other than to pay the ransom demand. The Bitcoin ransom equated to around $130,000, $100,000 of which was covered by an insurance policy.
This attack involved Ryuk ransomware – The same ransomware variant that was used in the attack on Lake City in Florida on June 10, 2019. For Lake City, Ryuk ransomware was delivered by the Trickbot Trojan, which was in turn deployed by the Emotet Trojan. Lake City paid approximately $500,000 to the attackers to obtain the keys to unlock the encryption. Riviera Beach in Florida was also attacked and paid a ransom of around $600,000.
These are just three cases out of several recent attacks. Those three attacks alone have resulted in more than $1,200,000 being paid to cybercriminals. That sends a very clear message to other cybercriminals that these attacks can be extremely profitable. That is the reason the FBI advice is never to pay.
2018 saw a decline in ransomware attacks as cybercriminals pursued other strategies for attacking businesses, but ransomware is now certainly back in favor and is being used in an increasing number of attacks.
Something that several of the targets in the recent ransomware campaigns have in common is they are relatively small cities that have limited resources to devote to cybersecurity. They have hardware and software that has reached end of life and, due to limited funds, security gaps have started to appear.
Riviera Beach, for instance, is a city of 35,000 people with limited resources. It had recently undergone a period of turmoil in management, had suffered scandals, and during the upheaval its cybersecurity contract had been allowed to lapse. That left the door wide open to attack.
These attacks have proven incredibly costly, yet they could have been prevented with a very small spend on a select number of security solutions. The attacks on Rivera Beach and Lake City could have been prevented with an advanced email security solution such as SpamTitan. The ransomware was installed in both of these attacks as a result of employees opening malware-infected email attachments.
SpamTitan incorporates dual anti-virus engines to detect malicious software and a Bitdefender-powered sandbox for deep analysis of suspicious email attachments. SpamTitan incorporates DMARC email authentication to counter email impersonation attacks and a host of other anti-spam and anti-phishing controls.
SpamTitan can be deployed as a gateway solution on existing hardware or as a cloud-based solution, and can be easily layered on top of Office 365 to improve protection against phishing and ransomware attacks.
Further, the cost of protection against ransomware and phishing attacks is likely to be much lower than you think. For more information, contact TitanHQ today.
There has been a spate of ransomware attacks on cities and government agencies in recent months and the healthcare industry sees more than its fair share of attacks, but they are not the only industries being targeted.
Schools, colleges, and universities are prime targets for hackers and ransomware attacks are common. One recent attack stands out due to its scale and the massive ransom demand that was issued. The attackers demanded $2 million (170 BTC) for the keys to unlock the encryption.
Monroe College in New York City was attacked at 6:45am on Wednesday, July 10, 2019. The ransomware quickly spread throughout the network, shutting down the computer systems at its campuses in Manhattan, New Rochelle and St. Lucia and taking down the college website.
The college has switched to pen and paper and is finding workarounds to ensure students taking online courses receive their assignments. No mention has been made about whether files will be recovered from backups or if the ransom will need to be paid.
This is one of many recent ransomware attacks in the United States. Ransomware may have fallen out of favor with cybercriminals in 2018, but it now appears to be back in vogue and attacks are rising sharply. So too have the ransom demands.
$2 million is particularly high, but there have been several recent attacks involving ransom demands for hundreds of thousands of dollars. In several cases, the ransom has been paid.
Riviera Beach City in Florida was attacked and was forced to pay a $600,000 ransom to regain access to its files and bring its computer systems back online. Lake City in Florida also paid a sizeable ransom – $500,000. Jackson County was also attacked and paid a $400,000 ransom.
There have been several cases where ransoms have not been paid. The City of Atlanta was attacked and around $51,000 in Bitcoin was demanded. Atlanta refused to pay. Its cleanup bill has already reached $3 million. With such high costs it is clear to see why many choose to pay up.
In all of the above cases, the cost of implementing cybersecurity solutions to protect against the main attack vectors would have cost a tiny fraction of the cost of the ransom payment or the mitigation costs after an attack.
For less than $2 per employee, you can ensure that the email network is secured and you are well protected against web-based attacks. To find out more, call TitanHQ today.
Sodinokibi and Buran ransomware are being pushed via the RIG exploit kit and now another exploit kit has joined the ranks, although its payload is currently banking Trojans.
Exploit kits are utility programs on websites that conduct automated attacks on visitors. When a visitor lands on a page hosting the exploit kit, the user’s browser and browser-based applications are probed to determine whether vulnerabilities exist.
Exploit kits contain exploits for several vulnerabilities, only one of which is required to silently download and execute a malicious payload on a visitor’s device. Traffic to these malicious pages is generated through malvertising/malicious redirects. The exploit kit code is also commonly added to compromised high-traffic websites.
Exploit kits were once the malware delivery mechanism of choice, but they fell out following a law enforcement crackdown. The threat from exploit kits has never disappeared, but activity has been at a much-reduced level. In recent months however, exploit activity has been at an elevated level.
The new exploit kit is called Spelevo and its purpose is to deliver two banking Trojans – Dridex and IceD – via a business to business website. The exploit kit was discovered by a security researcher named Kafeine in March 2019.
The exploit kit currently hosts multiple exploits for Adobe Flash and one for Internet Explorer. A user visiting a web page hosting the Spelevo exploit kit would unlikely tell that anything untoward was occurring. A tab would be opened to the gate and the browser would appear to go through a series of redirects before landing on Google.com. The entire process from the user landing on a page hosting the exploit kit, to a vulnerably being identified, exploited, and the user redirected to Google.com takes just a few seconds.
The exploit kit could be hosted on an attacker-owned domain, but it is easy to add the exploit kit to any website. All that is required is the addition of four lines of code once a website has been compromised.
Exploit kits are an efficient, automated way of delivering a malware payload, but they are reliant on users that have not patched their browsers and plugins. If browsers and plugins are kept up to date, there are no vulnerabilities to exploit.
The Spelevo exploit kit appears to be used in a campaign targeting businesses. IT teams often struggle to keep on top of patching and have poor visibility into the devices that connect to the network. As a result, it is easy for devices to be missed and remain unpatched. If one device is compromised, an attacker can use a variety of tools to spread laterally and infect other devices and servers.
The primary defense against exploit kits is patching, but additional protections are required. To protect against attacks while patching takes place, to prevent attacks from succeeding using zero-day exploits, and to stop users from visiting websites hosting exploit kits, a web filter is required.
WebTitan is a DNS filter that provides real-time, automated threat detection and blocking and protects against exploit kits and web-based phishing attacks. The WebTitan database contains three million malicious URLs that are blocked to protect end users. More than 300,000 malware and ransomware websites are blocked every day.
If you want to improve protection against web-based threats, exercise control over the content that your employees can access, and gain visibility into what your employees are doing online, WebTitan Cloud is the answer and it can be set up in minutes.
As one ransomware-as-a-service operation shuts down, another is vying to take its place. Sodinokibi ransomware attacks are increasing and affiliates are trying to carve out their own niche in the ransomware-as-a-service operation.
Developing ransomware and staying one step ahead of security researchers is important, but what made the GandCrab operation so successful were the affiliates conducting the campaigns that generated the ransom payments. The GandCrab developers have now shut down their operation and that has left many affiliates looking for an alternative ransomware variant to push.
Sodinokibi ransomware could well fill the gap. Like GandCrab, the developers are offering their creation under the ransomware-as-a-service model. They already have a network of affiliates conducting campaigns, and attacks are on the increase.
As is the case with most ransomware-as-a-service operations, spam email is one of the most common methods of ransomware delivery. One Sodinokibi ransomware campaign has been detected that uses spoofed Booking.com notifications to lure recipients into opening a Word document and enabling macros. Doing so triggers the download and execution of the Sodinokibi payload.
Download websites are also being targeted. Access is gained the websites and legitimate software installers are replaced with ransomware installers. Managed Service Providers (MSPs) have also been targeted. The MSP attacks have exploited vulnerabilities in RDP to gain access to MSP management consoles.
Two cases have been reported where an MSP was compromised and malicious software was pushed to its clients through the client management console. In one case, the Webroot Management Console and the Kaseya VSA console in the other.
Recently, another attack method has been detected. Sodinokibi ransomware is being distributed through the RIG exploit kit. Malvertising campaigns are directing traffic to domains hosting RIG, which is loaded with exploits for several vulnerabilities.
With so many affiliates pushing Sodinokibi ransomware and the wide range of tactics being used, no single cybersecurity solution will provide full protection against attacks. The key to preventing attacks is defense in depth.
TitanHQ can help SMBs and MSPs secure the email and web channels and block the main attack vectors. Along with security awareness training and good cybersecurity best practices, it is possible to mount a formidable defense against ransomware, malware, and phishing attacks.
The excitement is building as DattoCon19 draws ever closer. Starting on June 17, 2019 in San Diego and running for three days, DattoCon19 is an unmissable event for managed service providers (MSPs).
At the conference, attendees benefit from practical advice and best practices to grow their businesses, increase sales, and boost monthly recurring revenue (MRR). A huge range of vendors will be on hand to offer information on exciting products and attendees will have the opportunity to learn strategies to increase business impact growth, boost profitability, and broaden their service stacks.
Sessions will be taken by industry experts and leading MSPs who will share tips and tricks to take back home and apply at the office. On average, attendees at DattoCon achieve 41% sales growth year-over-year as a result of attending the conference.
TitanHQ is sponsoring DattoCon19 and is excited about having the opportunity to meet new MSPs and help them grow their businesses. As a Datto Select Vendor, TitanHQ offers MSPs three cloud-based solutions that can be easily integrated into existing MSPs service stacks: Anti-phishing and anti-spam protection, DNS-based web filtering, and email archiving. All three solutions are available through the TitanShield program for MSPs.
MSPs can meet the TitanHQ team at booth 23 at DattoCon19 to find out more about the TitanShield program and the exciting opportunities for MSPs that work with TitanHQ. TitanHQ will be on hand to help MSPs that support Office 365 to improve protection against phishing attacks and malware. MSPs can also find out more about the TitanHQ threat intelligence that protects Datto DNA and D200 boxes, and how TitanHQ’s DNS filter is a direct swap out for Cisco Umbrella and the cost advantages of doing so.
TitanHQ Executive Vice President-Strategic Alliances, Rocco Donnino, is one of the panel members for the Datto Select Avendors event on Monday. The event brings together experts from different fields to help come up with solutions for some of the major problems faced by MSPs in today’s marketplace.
TitanHQ at DattoCon19
TitanHQ will be at booth 23
Special Show Pricing available
Daily TitanHQ vintage Irish whiskey raffle
TitanHQ and BVOIP are sponsoring a GasLamp District Takeover Party on Monday 6/17 and Wed, 6/19.
DattoCon19 will be taking place in San Diego, California on June 17-19, 2019. If you are not yet registered for the event you can do so here
The leading review website, G2, has published its 2019 Best Software Companies in EMEA list. This is the first time that the company has produced the list, which ranks the best software companies doing business in EMEA based on the feedback provided by users of those products.
G2 is one of the most well-respected business software review websites. Software solutions may appear to tick all the right boxes, but in practice the solutions can be time consuming and difficult to use and fail to live up to expectations. Since the G2 reviews are from registered users of the products, businesses can not only rely on the reviews but can also use them to make smarter buying decisions.
To compile the list, G2 compiled the reviews of over 66,000 users in the software category. More than 900 companies were represented, but only those that performed best in the reviews have made the cut in their respective categories.
TitanHQ has been awarded top spot in the list of the best software companies of 2019 in EMEA.
TitanHQ has developed powerful cybersecurity solutions to meet the needs of businesses and MSPs, but the solutions have also been developed to be easy to use. The solutions are versatile, flexible,and scalable, and can be managed via an intuitive web-based management console with a full reporting suite. A full range of APIs are supplied to allow the solutions to be integrated into existing management software and industry-leading customer support ensures that help is always available to resolve any customer issues.
“TitanHQ is delighted to have been included in the 2019 Best Software Companies in EMEA list. The inclusion shows the value our customers place on the uncompromised security and real-time threat detection we provide,” said Ronan Kavanagh, CEO, TitanHQ. “The overwhelmingly positive feedback from on G2 Crowd is indicative of our commitment to ensuring the highest levels of customer success.”
“With 750,000+ user reviews, 80,000+ products and 1,600+ tech and service categories on G2, TitanHQ’s recognition on the prestigious Best Software Companies in EMEA list is an exceptional achievement: One that can only be earned through the endorsement of its users,” said CEO Godard Abel.
TitanHQ has announced a new partnership with the French Value Added Distributor (VAD) Exer that will see the company’s award-winning cloud-based spam filtering, DNS filtering, and email archiving solutions offered to Exer partners throughout France.
Exer is a leading VAD in France. The company currently works with more than 600 value added resellers (VARs) and integrators in France and specializes in network security, enterprise mobile infrastructure, Wi-Fi, and a range of cybersecurity and managed services. The new collaboration will increase the choice of solutions available to French VARs and will help them improve security for their clients and meet their compliance requirements.
For more than two decades, TitanHQ has been developing innovative cybersecurity solutions for SMBs and MSPs to protect against the ever-growing range of cyberthreats. Starting off by offering anti-spam solutions, the company’s product portfolio has been expanded to include DNS filtering and email archiving.
The solutions have now been adopted by more than 7,500 businesses and are offered by over 1,500 MSPs around the globe. SpamTitan now blocks more than 7 billion spam emails each month, WebTitan blocks more than 60 million malicious websites every month, and ArcTitan is used to securely archive and store more than 10 million emails a month.
Over the past few years, TitanHQ has enjoyed excellent growth and has expanded its global footprint considerably. One of the company’s aims in 2019 is to increase its client base in France. The partnership with Exer was therefore a no brainer.
“Our advanced threat protection for email and web security was designed to keep businesses productive and information secure. We are pleased to be offering the Exer partner community choice, enhanced functionality and greater overall value,” explained TitanHQ Executive VP, Rocco Donnino.
Exer was keen to expand its range of cybersecurity solutions to better protect its clients from an ever-increasing range of web-based and email-based threats. The volume of cyberattacks now being conducted means cybersecurity has never been so important.
“Collaboration with TitanHQ is an opportunity to represent a brand internationally recognized on 3 key technologies: Web Content Filtering, Anti-Spam, and Email Archiving. We are eager to propose these security solutions to ours VARs,” explained Exer CEO, Michel Grunspan. “Our regional presence and our expertise will be our strength for asserting the presence of TitanHQ in the French market”
French VARs can find out more about TitanHQ’s email security, web security, and email archiving solutions at Exer’s Tour De France events over the next few months. The events start in Lille on May 23, 2019 at Hameau de la Becque and will be taking place at various cities throughout France over the following months.
TitanHQ, the leading provider of cloud security solutions for SMBs, has announced a new partner program has been launched to support Managed Service Providers (MSPs), Managed Security Service Providers (MSSPs), Cloud Distributors, Wi-Fi Providers, OEM Partners and Technology Alliance Partners..
TitanHQ started its journey in 1999. Initially, the company provided anti-spam solutions to local businesses in Ireland. Over the next two decades, the company expanded its range of products to include DNS filtering and email archiving solutions and is now a leading global player of cloud-based cybersecurity solutions.
While TitanHQ initially focused on meeting the needs of the SMB market, its products have been developed to meet the needs of MSPs. For instance, TitanHQ solutions are available with a range of hosting options, including the ability to host the solution within the MSPs own environment, and they can be provided in white-label form ready to take MSP’s branding.
TitanHQ’s cloud-based solutions have been developed to be easy to implement, use, and manage and are already a firm favorite with MSPs.
To make TitanHQ cloud security solutions even more attractive for MSPs, the existing partner program has been significantly enhanced and relaunched as TitanShield.
The TItanShield Partner Program makes it even easier to offer TitanHQ cloud security products to clients. Partners benefit from access to engineers, a highly capable support team that understands the needs of MSPs, and a dedicated account manager.
Partners have access to APIs to allow them to easily sell, onboard, manage and deliver advanced network security solutions directly to their client base from within their own user interfaces. In addition, partners receive free access to sales and technical resources, deal registration and lead generation resources, and benefit from flexible, volume-based monthly pricing models and profitable margins.
Under the new, enhanced partner program, customers are separated into their specific areas of expertise to ensure that each can be provided with focused information for the markets and customers they serve.
“Our program takes a unique and strategic approach for our partners and can be customized to fit all business models,” said Rocco Donnino, Executive VP of Strategic Alliances at TitanHQ.
If you want to become a highly valued member of the TitanHQ TitanShield Partner Program, enrollment is now open. Call TitanHQ today or email partners@titanhq.com for further information.
In our previous post we explained why managed service providers (MSPs) should be offering a web filtering service to their customers and the benefits that can be gained by customers and MSPs alike. In this post we explain what makes WebTitan Cloud the go-to web filtering solution for MSPs and why so many MSPs have chosen TitanHQ as their web filtering partner.
Why WebTitan Cloud is the Best Web Filter for MSPs
One problem MSPs face before they can start offering a web content filtering appliance to their clients is how to incorporate the solution into their service stacks and their existing cloud offerings. While there are many providers of web filtering services, not all solutions have been developed with MSPs in mind. TitanHQ differs in that respect.
TitanHQ’s web filtering solution, WebTitan Cloud, has been developed specifically to meet the needs of MSPs and make it as easy as possible for the solution to be added to their existing cloud offerings. WebTitan Cloud seamlessly integrates within existing workflows regardless of whether MSPs self-host, use AWS, Azure, or other cloud platforms.
Why WebTitan is Perfect for MSP’s
Save on customer support time, hours and cost. No more costly ransomware call outs.
Gives your clients excellent protection against malware, ransomware, and phishing attacks.
Real time LIVE updating of malware and malicious threats with an active database of 650 million users driving the AI driven protection.
Easy filtering at multiple levels with the capability to recognize users in many different ways.
Protection from web threats for office and remote users.
Reporting with full AD integration – Easy to show your customers the volume of malicious attacks you have prevented.
Great for improving revenue – Generate regular monthly revenue for very little effort.
Easy client account administration via a central control panel.
Multiple hosting options: Deployed in our cloud, a private cloud, or in your data center.
Intuitive controls with low management overhead.
API driven for advanced back-end integration in your own systems, including billing and reporting.
Flexible pricing to suit your business, including monthly billing.
Multi-tenant solution with advanced customer management features.
Highly scalable with no latency.
Highly customizable – can be provided as a white label ready for your logos and color scheme.
Leading alternative to OpenDNS Cisco Umbrella at a fraction of the price.
Industry-leading technical support and customer service.
No punitive terms, measures, or sharp practices and a fully transparent pricing policy with no hidden costs.
How Does WebTitan Cloud Integrate into MSPs Management Systems?
To make integration as easy as possible, TitanHQ uses RESTful API, which allows fast and risk-free integration into MSPs management systems. WebTitan Cloud uses the OAuth 1.0 protocol for authentication and has a full set of keys and secrets in the WebTitan Cloud user interface (UI). Once an MSP has signed up, no further registration or authentication is necessary. The API client provides the appropriate oauth_signature to authorize requests to protected resources.
Overly complex user interfaces are a problem with many cloud-based solutions. With WebTitan Cloud, the UI is made as clean and easy to use as possible. MSPs can remove all elements from the UI that are not required to keep the UI clean and simple. WebTitan Cloud can also be integrated into MSP cloud interfaces to create a better user experience and greater consistency for customers.
Having information at your fingertips is important when customers send in requests or when reports are required on web use and blocking. WebTitan Cloud allows MSPs to create and integrate a full suite of high-level system and customer reports into their own management consoles.
Onboarding new customers is also a quick and simple process, which can be integrated into current MSP on-boarding processes. New customer accounts can easily be created (or deleted) from within an MSP’s own UI, in addition to performing updates and listing all current customer accounts.
MSPs can connect to WebTitan Cloud to manage their customers settings, including locations, whitelists, and blacklists. Customers that would prefer to manage their own settings can perform a limited number of operations themselves using APIs. Since WebTitan Cloud is available in a full white label, customers who do access their own settings can be given a UI with MSP branding rather than TitanHQ’s to maintain consistency and help reinforce the MSPs brand.
TitanHQ also operates an extremely competitive pricing strategy with generous margins for MSPs and aligned monthly billing cycles through the TitanShield MSP Program.
If you have yet to start offering web filtering to your clients as part of your service stack or if you are unhappy with your current provider’s product, contact TitanHQ today and as about becoming a member of the TitanShield MSP Program. Product demonstrations can also be scheduled on request.
Feedback from MSP Clients
“WebTitan is an outstanding tool for most reliable content filtering. The monitoring feature of this specific product is quite unique that totally monitors all the process of online working and also secures all the data. Additionally, its set-up is superb easy and it can be done in just few minutes that save my time and energy as well.” – Kristie H. Account Manager
“WebTitan is fairly easy to setup. It is available as a cloud based solution or on prem. You can get as simple or as complicated with your filtering as you like, it will handle most situations with ease. It has provided us with a stable web filtering platform that has worked well for us for many years.” – Derek A. Network Manager
“WebTitan is outstanding software that helps me a lot in minimizing viruses. The thing I like most about WebTitan is that it is extremely easy to use and configure. I like its clear interface. It lets us block malicious content and spam easily. It is no doubt an amazing product helping us a lot in kicking out harmful bad stuff.” – Randy Q. Software Engineer
“By reducing malware-related security incidents, you’re reducing your number one uncontrollable expense: the people on your IT operations team, like your help desk techs.” – MSP, Washington, US
“a key part of our security stack as we’ve scaled to over 6,000 managed endpoints, while decreasing virus and malware related tickets by 70%.” – MSP, Boston, US
“It has paid for itself many times over by reducing malware calls.” – MSP, Toronto, Canada
A web filtering service allows Managed Service Providers (MSPs) to better protect their clients from accidental malware downloads and phishing attacks while improving their bottom lines. Further, by preventing phishing attacks and malware infections, they can reduce the amount of time they spend fighting fires. For busy MSPs, the latter will be especially beneficial.
Why is Web Filtering Important?
There are several reasons why MSP clients will benefit from a web filtering service. First and foremost, a web filter will help to prevent their customers’ employees from visiting phishing websites and malicious URLs. Most phishing attacks start with a phishing email, so a powerful spam filtering solution is essential. While commercial spam filters such as SpamTitan will block more than 99% of spam and phishing emails, additional protections are required to protect against the 1% that bypass spam defenses.
Naturally end user security awareness training will help in this regard, but as the 2018 Verizon Data Breach Investigations Report shows, 30% of delivered phishing messages are opened by end users and 12% of those users also click on malicious links in the messages.
A web filter is an additional layer of anti-phishing and anti-malware defenses that kicks in when malicious links are clicked and when end users attempt to visit other malicious sites while browsing the Internet. With a web filter in place, when an employee attempts to access a malicious web page, that attempt will be blocked before any content is downloaded. Instead of displaying the web page, a block page will be displayed.
Web filters also allow companies to carefully control the types of content their employees can access. This allows them to enforce acceptable internet usage policies with ease. Employers can prevent their employees from accessing NSFW content such as pornography, illegal content and, if tighter controls are required to improve productivity, other categories of web content such as dating sites, social media networks, gambling sites, and gaming sites.
With a web filter in place, security and productivity can both be quickly improved and the gains in both of those areas is likely to more than pay for the cost of the web filtering package provided by their MSP.
Cloud Based Web Filtering Solutions for MSPs
Convincing customers to implement a web filtering solution should be straightforward given the number of phishing attacks that are now being conducted and the cost of mitigating phishing attacks and malware infections. The cost of web filtering is tiny by comparison.
For MSPs, cloud-based filtering solutions are the natural choice. They can be implemented in minutes once a customer request has been received, no hardware is required, there is no software to install, and patching is handled by the service provider. All that is required from the MSP is a brief set up and configuration for each customer and ongoing management and reporting.
However, not all cloud-based web filtering solutions make set up, management and reporting simple. WebTitan Cloud differs in this respect. Not only does the solution offer excellent protection, the solution has been developed specifically with MSPs in mind. The ease of integration into MSP’s back-end systems and management has made WebTitan Cloud the go-to web filtering solution for MSPs.
In our next post we will explain how WebTitan Cloud differs from other web filtering solutions, why it is the easiest solution for MSPs to integrate into their existing cloud offerings, and how TitanHQ makes getting started, provisioning new customers, and managing customer accounts a quick and easy process requiring the minimal management overhead.
TitanHQ has released WebTitan Cloud version 4.12. The new version of the award-winning 100% cloud-based web filtering solution incorporates new features at tweaks to improve the user experience and make the solution an even more attractive option for managed service providers (MSPs).
One of the most exciting new features that will benefit businesses and MSPs alike is the ability to implement location-based filtering controls, naturally accompanied by granular, location-based reports.
It was already possible to implement organization-wide filtering controls and set different policies for departments, user groups, roles, and individuals in an organization. The new feature increases the flexibility of the solution with location-based controls. The new feature will be of great benefit to businesses operating across multiple locations, where content control requirements may need to be different for satellite offices. MSPs will be able to offer location-based controls to clients and better manage web filtering for customers with a presence in multiple countries. The location controls can be applied to control content whether users are on or off the network.
As with user and role-based content controls, when a user attempts to access a web page that contravenes the policy that they have been assigned, the content will be blocked and no web page content will be downloaded – in contrast to many appliance-based web filtering solutions. The user will be presented with a customizable block screen that can incorporate the company or MSP’s branding.
There will be occasions when an individual or group needs to bypass policy controls. With WebTitan, this can easily be achieved using cloud keys rather than making changes to policies. The cloud key can be used to bypass the block pages and access content that would normally be blocked by location, company, or other policies.
To make management as easy as possible, all policies and locations are managed through a single user interface. MSPs can manage all locations and customer accounts through a single pane of glass, which improves visibility into all customers’ accounts and locations.
Also of interest to MSPs will be WebTitan’s enhanced search functionality. While it was possible to run reports to obtain information about a specific customer and their traffic, a search filter has now been added to the history page. This allows administrators to search by location name with autocomplete. When a customer account is selected, admins can get second-by-second information about all traffic within that location without having to run a location report.
MSPs already have a multi-tenant, highly scalable, brandable, and easy to use web filtering solution with multiple hosting options that can be offered to customers at an attractive price point, which is why the solution has proven so popular with the MSP market. It is hoped that the new additional features will make the solution even more useful for MSPs to allow them to better serve their SMB clients while making web filtering for SMBs even more straightforward.
For many people, Game of Thrones Season 8 is the TV highlight of the past 12 months, but not all fans of the series are keen to pay for the channel to watch the latest installments of this hugely popular series.
Some fans are turning to P2P file sharing sites to download the latest episodes, but hackers are ready and waiting. Many illegal video files of Game of Thrones episodes have been embedded with malware, most commonly adware and Trojans.
Research from Kaspersky Lab revealed Trojans to be the most common form of malware to be embedded in rogue video files. A third of all fake TV show downloads that have been impregnated with malware include a Trojan.
When one of these infected files is opened after it has been downloaded, the Trojan is launched and silently runs in the background on the infected device.
Many of the Trojans embedded into video files are brand new. These zero-day malware variants are not detected by traditional AV solutions as their signatures are not present in malware definition lists. That means malware infections are likely to go undetected. When signatures are updated, the malware may continue to run until a full system scan is completed. Either way, during the time that the malware is active it could be collecting a range of sensitive data including usernames and passwords.
Malware can also be installed that gives the attacker access to an infected device and the ability to run commands, change programs, download further malware variants, and add the infected device to a botnet.
File sharing websites offer an easy way of distributing malware. Users of the platforms voluntarily download the files onto their computers. However, only a small percentage of internet users visit P2P file sharing sites. Hackers therefore have turned to other methods to get users to execute their infected video files.
Prior to the release date of Game of Thrones Season 8, offers of free access to the TV show were being distributed via email. Campaigns were also detected offering episodes in advance of the release date to tempt GOT fans into installing malicious software or visiting malicious websites.
It is no surprise that fake Game of Thrones video files have been embedded with malware, given the huge popularity of the show. However, Game of Thrones fans are not the only people targeted using this tactic of malware distribution. In the past few months, malware has been detected in fake videos files claiming to be the latest episodes of the Walking Dead, Suits, and the Vikings to name but a few.
Some people feel the risk of a malware infection from downloading pirated video files to be low, or they do not even consider the risks. That is bad news for businesses. When employees ignore the risks and download illegal files at work, they risk infecting their network with malware.
The easiest solution to prevent illegal downloads at work and the visiting of other malicious websites is to use a web filtering solution. A web filter – WebTitan for instance – can be configured to prevent users from accessing file sharing and torrents websites. WebTitan uses a continuous stream of ActiveWeb URLs from over 550 million end users, which provides important threat intelligence to TitanHQ’s machine learning technology. This allows new, malicious URLs to be identified, and users are then prevented from visiting those malicious URLs.
Blocking email attacks is simple with SpamTitan. SpamTitan blocks 99.97% of spam emails to prevent malicious messages from reaching end users, including messages offering free access to Game of Thrones and other TV shows. In addition to dual AV engines to protect against known malware, SpamTitan also now has a sandboxing feature. Suspicious attachments can be safely executed and analyzed in the sandbox to identify potentially malicious actions. The sandboxing feature provides superior protection against zero-day malware which AV software does not block.
With both of these solutions in place, businesses will be well protected against malware, ransomware, botnets, viruses, and phishing attacks.
Each solution is available with a range of different deployment options to suit the needs of all businesses. For a product demonstration and further information, contact the TitanHQ team today.
G2 Crowd, a peer-to-peer review platform trusted by millions of businesses, has named SpamTitan the leading email security gateway solution in its Spring G2 Crowd Grid Report for Email Security Gateways.
TitanHQ’s SpamTitan email security gateway solution was named the leader in the category of secure email gateway performance
SpamTitan was assessed along with other popular email security solutions from big name companies such as Cisco, Barracuda, Proofpoint, Mimecast, and SolarWinds, but took top spot thanks to consistently high ratings for all key metrics assessed for the report.
The G2 Crowd platform allows businesses to find out important information about software solutions that is not often included in the product spiel offered by software providers: What the solutions are actually like to use and whether they match up to expectations. The platform is trusted by businesses thanks to its honest reviews from genuine customers. The company was formed in 2012 and now attracts more than 1.5 million visitors a month to its website.
For the report, each product was assessed based on market presence and four areas of customer satisfaction: Quality of support, ease of use, meets requirements, and ease of administration. SpamTitan scored highly in all four categories, outperforming all other solutions for customer satisfaction and market presence.
SpamTitan ranked highest for meeting requirements and quality of support, achieving a score of 94% in both categories. The average for all 10 email security gateways was 88% and 84% respectively. SpamTitan achieved a score of 92% for ease of use and 90% for ease of administration. The average for all products in these areas was 82% and 83% respectively.
It was clear from the report that TitanHQ customers were extremely happy with the products and service provided by TitanHQ. The user reviews praised SpamTitan for many aspects of the product, two examples of which have been listed below.
“SpamTitan has some of the best filtering we’ve seen compared to other products, it does an excellent job when configured right of capturing a high volume of spam. It’s relatively simple to get around and set it up, and runs in a very lightweight VMware appliance.”
“The degree of customization and logging is amazing. You can account for everything going in or out of your organization and set filtering rules to match any scenario. Performance of the web UI and functions like searching and reporting are lightning quick.
G2 Crowd also released a Spring G2 Crowd Grid Report for Secure Web Gateways and TitanHQ’s WebTitan solution was rated a high performer, achieving a customer satisfaction score of 94% against an average of 87% across all 10 solutions under assessment.
If you are unhappy with your current email or web security gateway product or you have yet to implement one of these important cybersecurity solutions, contact TitanHQ today to arrange a product demonstration. The full versions of both solutions are available on a free trial to allow you to see for yourself how effective they are and how easy they are to use.
If you have any questions about either product, contact the TitanHQ today to have your questions answered.
Supply chain attacks allow cybercriminals to attack businesses through weak links in the supply network. Smaller companies are attacked, which gives hackers access to larger and better secured businesses: Businesses that would be harder to attack directly.
This attack method was used to spread NotPetya malware in Ukraine. A software supply company was breached which allowed the malware to be spread to the software supplier’s clients. The massive data breach at Target in 2014 was made possible by first attacking an HVAC system provider. The attack allowed hackers to install malware on the Target’s POS system and obtain the credit card numbers of millions of its customers. According to Symantec, supply chain attacks doubled in 2018.
There are many different types of supply chain attacks, but all serve a similar purpose. By attacking one company it is then possible to attack a bigger fish, or in the case of attacks on cloud service providers and managed service providers, a single attack will give a hacker access to the networks of all MSP clients.
Large businesses often have the budgets to hire their own IT and security staff and can implement robust defenses to prevent attacks. Smaller businesses often struggle to recruit security professionals as they are in high demand. With the shortage of skilled cybersecurity staff and an inability to pay the large salaries that skilled cybersecurity professionals demand, SMBs often turn to MSPs to provide those services.
In order to be able to provide those services, managed service providers are given remote access to their client’s networks. Many of the tasks that need to be performed by MSPs require administrative privileges. Managed service providers also hold login credentials to their clients’ routers and cloud accounts. All of those credentials are extremely valuable to hackers.
Given the typical number of clients each MSP has, a successful attack on an MSP could prove very profitable for a hacker. It is therefore no surprise that there has been an increase in cyberattacks on MSPs and CSPs.
While MSPs are usually good at securing their clients’ networks and ensuring they are well protected, they also need to ensure their own house is in order. Patches must be applied promptly, vulnerabilities must be addressed, and security solutions must be put in place to protect MSPs systems.
MSP staff should be security aware, but when they are busy resolving their clients’ problems, mistakes can easily be made such as responding to a well-crafted spear phishing email. All it takes is for one MSP employee to respond to such an email for a hacker to gain a foothold in the network.
Naturally, security awareness training should be provided to all MSP employees and security solutions need to be deployed to protect against email and web-based attacks. This is an area where TitanHQ can help.
TitanHQ Cybersecurity Solutions for MSPs
TitanHQ’s offers a suite of cybersecurity solutions for managed service providers that have been developed from the ground up with MSPs in mind. TitanHQ has an in depth understanding of what MSPs need, having been working closely with them for more than two decades. TitanHQ solutions provide everything MSPs could reasonably ask for to meet the demands of their clients.
Our multi-tenanted solutions are full of features to help MSPs save time and money. The solutions work on any operating system, client accounts can be up and running within 20 minutes, and fully automated updates minimize the management overhead while ensuring maximum protection from threats. Furthermore, all TitanHQ solutions are available in white label format ready to receive an MSPs logos and there is a choice of hosting options, including the option of hosting the solution within an MSPs own infrastructure.
SpamTitan is an easy to implement and easy to manage cloud-based spam filtering solution that provides excellent protection against the full range of email threats. Email attachments are scanned using dual antivirus engines that block 100% of known malware threats. Suspicious attachments that pass the AV scans are sent to a Bitdefender-powered sandbox where they are subjected to an in-depth, sophisticated analysis to identify previously unknown malware threats and malicious scripts. SpamTitan also uses a defense-in-depth approach to protect against phishing threats, including machine learning predictive techniques to identify zero-day phishing threats. SpamTitan scans inbound and outbound emails and includes a data loss prevention feature to prevent attempts to use email accounts to send sensitive data outside the organization.
TitanHQ has developed WebTitan to provide protection against web-based threats. WebTitan is a DNS-based web filtering solution that prevents employees and guest network users from visiting malicious websites used for phishing and malware distribution. Stopping malicious requests at the DNS layer, which is better than waiting for the payload to be delivered onto the machine and then removed. By stopping it at the DNS layer you’re reducing not only malware infections, but containing machines already infected by preventing them from communicating out to their C&C servers. SpamTitan and WebTitan are fed threat intelligence in real time from an active database of 650 million users, which provides zero-minute protection against cyber threats.
Benefits of TitanHQ Cybersecurity Solutions for MSPs
Easy client account administration via a central control panel
One control panel to manage all clients
Intuitive controls with low management overhead
Eliminates the need for site visits, with no local support required
No end user software installations needed
Incorporate new clients in minutes
Competitive usage-based pricing with monthly billing
Three hosting options: Our servers, a private cloud, or within an MSP’s infrastructure
Generous margins for MSPs
Industry-leading technical support and customer service
Solutions available in a white label version ready to take MSP logos
If you want to improve your defenses against cyber threats and better protect your clients, contact TitanHQ today for further information about SpamTitan Email Security and WebTitan Web Security.
The TitanHQ MSP Program – TitanSHIELD
The TitanSHIELD MSP Program allows MSPs to take advantage of TitanHQ’s proven technology so that they can sell, implement and deliver our advanced network security solutions directly to their client base. Benefits include partner support, a dedicated account manager, assigned sales engineer support, access to the Global Partner Program Hotline, access to the Partner Knowledge Base, 24/7 priority technical support, online technical training and FAQs, access to the Partner Technical Knowledge Base, and full access to an extensive range of marketing materials and sales tools.
Contact the MSP team at TitanHQ today for more information and to apply to join more than 1,500 MSP members of the TitanSHIELD program.
Traditional email security solutions are effective at keeping inboxes free from spam email, but many fall short when it comes to blocking phishing and spear phishing attacks. Cybercriminals are conducting ever more sophisticated campaigns that manage to bypass traditional email security defenses by impersonating legitimate companies and spoofing their domains.
In addition to phishing attacks that attempt to obtain sensitive information, email is often used to spread malware, ransomware and botnets. Traditional anti-virus solutions are effective at blocking known malware threats, but signature-based AV solutions are not effective at blocking never-before-seen malware variants.
Today, new malware variants are being released at record pace. To block these zero-day malware attacks, an advanced email security solution is required which does not rely on signatures to identify malicious file attachments.
SpamTitan was already a powerful email security solution for SMBs and MSPs serving the SMB market and was capable of blocking sophisticated phishing emails and new malware threats. However, new features have now been added that improve detection rates further still and provide superior protection against zero-day malware and phishing attacks that spoof legitimate domains.
TitanHQ has updated SpamTitan to include a DMARC email authentication feature which is capable of detecting and blocking spoofed emails to better protect users from sophisticated phishing attacks.
To better protect against malware, ransomware, botnets, and zero-day attacks, TitanHQ has incorporated a new Bitdefender-powered sandboxing feature into SpamTitan. Email attachments that pass standard checks are safely detonated in the sandbox and are analyzed for malicious activity. The sandboxing feature provides an additional layer of security and greatly enhances protection against malicious attachments. This feature also helps to ensure that more legitimate emails and attachments are delivered to end users.
To explain how these new features work and the benefits to users, TitanHQ is running a webinar. In the webinar, TitanHQ will cover the new features in detail and will explain how SpamTitan can protect against the full range of email-based threats.
Webinar Information:
Date: Thursday, April 4, 2019
Time: 12pm, EST
The webinar will last 30 minutes and advance registration is necessary.
A new report has confirmed the need for robust, multi-layered cybersecurity protections for SMBs to prevent successful cyberattacks. SMBs are increasingly being targeted by cybercriminals as security is often weak and attacks are easy to pull off.
While large corporations are an attractive target for cybercriminals, large corporations tend to have mature cybersecurity programs and they are usually very well protected. A successful attack could prove extremely profitable but breaking through the cybersecurity defenses of large corporations is difficult and attacks can be extremely time consuming and labor intensive.
Cybercriminals often choose the path of least resistance, even though the potential for profit may not be so high. Cyberattacks on SMBs are much easier and hackers are concentrating their efforts on SMB targets. This was clearly demonstrated in the latest cybersecurity report from Beazley Breach Response (BBR) Services.
BBR Services analyzed all of the data breaches that it investigated in 2018. 9% of the successful attacks involved ransomware and 71% of those ransomware attacks were on SMBs. The healthcare industry suffered the highest number of ransomware attacks, and accounted for one third of successful attacks. Companies in the professional and financial services sectors accounted for 12% of ransomware attacks each, followed by the retail industry with 8% of attacks.
The costs of those ransomware attacks can be considerable. If companies are unable to recover data from backups, a sizable ransom must be paid to recover encrypted data. In 2018, the average ransom demand was $116,400 and the median ransom demand was $10,310. One client was issued a ransom demand of $8.5 million. The highest ransom demand paid was $935,000.
Massive demands for payment for the keys to unlock encrypted files may not be the norm, but even at the lower end of the spectrum SMBs may struggle to find the money to pay. The ransom demand is also likely to be considerably higher than the cost of cybersecurity protections for SMBs to prevent ransomware attacks.
One of the main ways that hackers gain access to the networks of SMBs is by exploiting flaws in Remote Desktop Protocol. SMBs that leave RDP ports open are at a much higher risk of being attacked. RDP is required by many SMBs because they outsource IT to managed service providers, which need to use RDP to access their systems. In such cases it is essential for default RDP ports to be changed and for very strong passwords to be implemented to reduce the risk of brute force attacks succeeding.
There was also an increase in sextortion scams in 2018. These scams attempt to extort money by threatening to expose victims’ use of adult websites. While these scams usually contain empty threats, they are often successful. In addition to attempting to extort money, the scams are used to install malware or ransomware. Email attachments are sent which claim to contain videos of the victim accessing adult websites, which the scammers claim to have been recorded using the computer’s webcam. When the files are opened to be checked, malware or ransomware is installed.
2018 also saw a 133% increase in Business Email Compromise attacks. These attacks spoof the email address of a senior executive to make the emails and requests seem more plausible. These scams are usually conducted to obtain sensitive information or to get employees to make fraudulent wire transfers. BEC attacks accounted for 24% of all breaches investigated by BBR Services in 2018.
One of the most important cybersecurity protections for SMBs to implement to prevent these attacks is an advanced email filtering solution – One that is capable of detecting spoofed emails. SpamTitan, TitanHQ’s cloud-based spam filtering solution, has recently been updated to include DMARC authentication to detect email impersonation attacks such as BEC scams. The solution also now includes a new sandboxing feature that allows potentially malicious attachments to be analyzed in detail in the sandbox where no harm can be caused. This helps to identify more malicious attachments and better protect SMBs from zero-day malware and other malicious files.
TitanHQ’s powerful cybersecurity protections for SMBs can greatly improve email security and block a wide range of web-based attacks. For further information on effective cybersecurity protections for SMBs to deploy to improve security posture and block costly attacks, contact TitanHQ today.
TitanHQ has announced its award-winning anti-spam solution, SpamTitan, has been updated and now has two powerful new features to better protect users from phishing, spear phishing, malware, ransomware, botnets, and APT threats.
SpamTitan has long been the go-to solution for SMBs to improve email security and the solution is popular with managed service providers serving the SMB market. SpamTitan is quick and easy to install, simple to use, and provides excellent protection against a wide range of email threats.
As email threats have become more sophisticated and zero-day attacks and new malware variants have skyrocketed, new features are needed to keep end users protected.
To maintain pace and better protect SpamTitan users, two important new features have now been rolled out with the latest release of SpamTitan: Sandboxing and DMARC authentication.
Sandboxing Feature Added to SpamTitan Product Suite
Blocking known threats is one thing, but detecting and blocking brand new threats that evade AV solutions is another matter, yet businesses need protection from these zero-day threats as well. SpamTitan already incorporates a range of mechanisms to detect these new threats but the latest feature takes protection to the next level.
SpamTitan now incorporates a new next-gen sandboxing feature. The Bitfedender-powered sandbox is a virtual environment that is totally separate from other systems. When an email is sent to a SpamTitan user, the message will be subjected to a range of checks to determine whether it is genuine, benign, and should be delivered or if it is malicious and needs to be rejected. If the message contains a suspicious attachment that is not picked up as a threat from those checks, it is sent to the sandbox.
The SpamTitan sandbox service has been designed to appear as a normal endpoint. Malicious files are opened or executed in the sandbox and any malicious code is run as it would on a standard machine. Its actions are logged and subjected to an in-depth analysis, including its self-protection mechanisms and attempts to evade detection. All actions are then assessed by advanced machine learning algorithms and the results of the analysis are then checked against a wide range of online repositories.
Opening potentially malicious files on an endpoint is dangerous, but in the isolated sandbox all risks are eliminated. Once the analysis is complete, which takes just a few minutes, if the file is determined to be benign it will be released and can be delivered to the end user. If it is malicious, the sandbox solution will automatically report the file to Bitdefender’s cloud threat intelligence service. That threat will then be blocked for all SpamTitan users, so the file will not need to be analyzed again.
This new feature greatly increases detection of elusive threats, provides end users with even greater protection, and it also helps to ensure that more genuine messages are delivered.
Businesses that want sandboxing technology usually need to purchase a separate solution. With SpamTitan, advanced emulation-based malware analysis is provided free of charge.
DMARC Email Authentication Now Included in SpamTitan
Email impersonation attacks are a major threat. They abuse trust in a known contact, company, or government organization to fool end users into taking a specific action – disclosing sensitive information, installing malware, or visiting a phishing webpage, for instance.
While SpamTitan already incorporates several mechanisms to identify email impersonation attacks, DMARC authentication has now been added to block even more threats. DMARC is a powerful tool for identifying the true sender of an email to determine if that individual is authorized to use a particular domain.
Detailed checks of the email header are performed and the sender is checked against DMARC records. If the checks are passed, the message can be delivered. If DMARC authentication fails, the message is rejected.
The new anti-spoofing feature protects SMBs and MSPs against data loss, date breaches, zero-day threats, and highly sophisticated email threats, while the sandboxing feature protects against malware, advanced persistent threats (APTs), malicious URLs, and offers insight into new threats to help mitigate risks.
Both of these features have been made available to current and new TitanHQ customers at no extra charge.
The poor state of cybersecurity in K-12 schools is making it too easy for criminals to conduct cyberattacks. As recent cybersecurity reports show, attacks are coming thick and fast. Action is needed to shore up security and keep cybercriminals at bay.
Cyberattacks on K-12 Schools Have Been Increasing Since 2018
Education has long been one of industries most commonly targeted by cybercriminals and there has been a marked increase in attacks since 2018, when several major cyberattacks on K12 schools resulted in data theft and huge financial losses.
The 2018 State of K-12 Cybersecurity report from the K12 Cybersecurity Resource Center revealed 122 cyberattacks on K-12 schools were reported in 2018. 119 public K-12 education agencies in 38 states reported attacks. 60% of those cyberattacks resulted in the personal data of students being compromised.
North Dakota schools were hit particularly hard. In February 2018, one third of schools in the state experienced malware attacks. In many cases, the malware infections were the result of staff and students clicking on links in emails, visiting malicious websites, or opening malware-laced email attachments.
The 2019 State of Malware report from Malwarebytes reveals that in 2018, education was the number one industry targeted with Trojans and was second for ransomware attacks. Business email compromise scams are also common and many K12 school districts suffered W-2 phishing attacks and were fooled into sending scammers copies of employees’ tax information.
There have also been several successful email scams that have resulted in staff being fooled into making fraudulent transfers of school funds to criminals’ accounts. A school district in Texas was scammed out of $2 million in construction funds as a result of a phishing attack that fooled a staff member into making payments to fraudulent accounts. The high number of these types of scams prompted the FBI to issue a warning to schools in September 2018 about phishing scams that attempt to steal employees’ credentials.
K-12 schools are an attractive target for cybercriminals because attacks are relatively easy and the potential rewards are high. Student information sells for big bucks on the black market. Personal information along with Social Security numbers can be used for identity theft. It typically takes longer for identity theft to be detected with minors. If student data are stolen, thieves can rack up huge debts in students’ names over the course of several years before fraud is detected.
The State of Cybersecurity in K-12 Schools
Even though the risk of cyberattacks is high, many school leaders fail to appreciate the seriousness of the problem and how even simple changes to improve cybersecurity in K-12 schools can prevent most cyberattacks.
A Consortium for School Networking/Education Week Research Center survey in late 2017 showed that only 48% of school leaders considered the threat from phishing to be significant or very significant, with the numbers falling to under 30% for malware and ransomware attacks. Only 15% of K-12 schools have implemented a cybersecurity plan, just 29% have purchased cybersecurity products and services, and 31% had not provided end-user training.
The high value of student data, the opportunity to conduct multiple types of fraud, and poor cybersecurity defenses is a winning combination for cybercriminals. Unfortunately, there is no single solution that can be implemented to improve cybersecurity and prevent costly cyberattacks and data breaches. What is needed is an effective cybersecurity plan, policies and procedures, training, and technology.
How to Improve Cybersecurity in K-12 Schools
School budgets are usually stretched so it can be difficult to find the funds to improve cybersecurity in K-12 schools. It is therefore important to choose cybersecurity solutions wisely and select products that provide protection against the most common methods used by cybercriminals to attack schools.
Many of the attacks start with a single phishing email. It is therefore critical for K12 schools to improve email security, and for that, an advanced spam filtering solution is essential. SpamTitan blocks more than 99.9% of spam and phishing emails and is an ideal, low-cost, easy-to-implement spam filtering solution for K12 schools.
A school internet filtering software solution is also an important cybersecurity measure. In addition to blocking students’ access to obscene content, as required for CIPA compliance, web filters can prevent users from visiting phishing websites and will block ransomware and malware downloads. The cost of a web filter can be partially offset by discounts obtained through the E-Rate program.
End user training is also important. K12 schools need to include cybersecurity awareness training as part of their staff development program. Rather than providing a one-off or annual training session, training needs to be conducted regularly to keep staff up to speed on the latest threats.
Doing nothing to improve cybersecurity in K-12 schools is now simply not an option. If costly cyberattacks are to be avoided, is not improved, cybersecurity in K-12 schools must be improved.
If you want to find out more about email and web security and just how affordable these solutions can be for schools, contact the TitanHQ team today.
Businesses that want to start content filtering have a choice: A DNS filter or appliance, but which is best? In this post we explain the benefits of DNS filtering over on-premise solutions.
Traditionally, businesses that wanted to restrict Internet access and block web-based threats would purchase a physical appliance through which all internet traffic would flow. The appliance would be installed on-premise and controls would be applied to cover anyone connected to the network. The appliance would prevent employees and guest users from accessing certain types of web content, block malicious traffic, and ensure malware is not downloaded onto endpoints.
Today, businesses have a choice. They can purchase a physical appliance or they can install a virtual appliance. A virtual appliance performs the same functions as a physical appliance, but it is software-based solution that is installed on existing hardware. This means it is not necessary to purchase any hardware and businesses can save money. In this article we will treat physical and virtual appliances as one.
Another alternative is a DNS filter. A DNS filter requires no hardware purchases or software downloads. The filter works at the DNS level and all filtering takes place in the cloud.
Both types of content filtering solutions allow businesses to prevent users from accessing malicious websites when connected to the network and restrict the types of content that can be accessed.
DNS Filter or Appliance?
If you are unsure whether to opt for a DNS filter or appliance, consider the following benefits of DNS filtering over appliances.
No costly appliance to purchase and quick and easy filtering
Appliances can be costly and they need to be ordered, delivered, and installed. That means the IT team will need to be on site to complete the install. The hardware will also need to be maintained. With a DNS filter deployment is quick and easy. Simply point the DNS to the service provider and you can be up and running in minutes.
Avoid scalability issues
An appliance can be used for a limited number of users. If the business grows or if more devices need to connect the internet, it may be necessary to upgrade the appliance or buy multiple appliances. Similarly, if the number of users falls, you will be left with an expensive appliance that is surplus to requirements. With a DNS filter, you just pay for the number of users and can scale up and down as necessary.
Appliances require content to be downloaded
With an appliance the filtering takes place on the appliance itself, which means any malicious content must be accessed and downloaded before it is blocked. A connection must be made to a malicious site before any filtering takes place, however briefly. Further, since content is downloaded, that has an impact on bandwidth. With a DNS filter, the filtering takes place at the DNS level before a connection to a site is established which means threats are eliminated before any malicious code reaches the perimeter. A DNS filter can also block command and control center callbacks and data exfiltration attempts and protects all ports and protocols, not just port 53.
DNS filters inspect SSL traffic using the service providers resources
Most websites are now SSL enabled, which means web traffic must be decrypted, inspected, then re-encrypted. That requires a lot of processing power which can have a negative impact on end users. During heavy usage, slow downs are inevitable and CPU usage can be intensive. With a cloud-based DNS filter, the service provider performs the processing and, regardless of traffic volume, the user experience is the same.
DNS Filters make it easy to filter at multiple locations
If you buy an appliance, protecting remote workers and satellite offices is a problem. You need to backhaul traffic to the location where the appliance is located, so regional offices and remote workers will have slower internet speeds. With a DNS filter, it is possible to filter in multiple locations and to protect remote workers no matter where they are located, without the need to backhaul traffic. That means no latency.
DNS filters allow managed service providers to offer filtering to their clients
A DNS filter makes it easy for managed service providers to add content filtering to their service stacks. There is no need for an appliance to be sent to a client and installed by MSP staff. A cloud-based DNS filter is a turnkey solution that can easily be set up and managed remotely. All clients can be managed through a single pane of glass, making monitoring and management simple with little time investment required.
In short, for the majority of businesses considering a DNS filter or appliance, a DNS filter wins hands down. It is quick, easy, simple, efficient, and is the most cost-effective way of content filtering and blocking web-based threats.
Further, you can try DNS filtering before committing to a purchase. With TitanHQ’s WebTitan Cloud, you can have a two-week trial of the full product to evaluate it in your own environment.
FAQs
Can you explain DNS filtering vs web filtering?
Web filtering is a general term used to describe the filtering out of undesirable web content. Web filtering often involves blocking specific URLs and websites that are included in a blacklist, such as web pages that are known to be malicious or contain illegal content. A DNS filter is a type of web filter that works at the DNS lookup stage of a web request. DNS-based filters perform filtering without downloading any content so there is zero latency. Most also support URL filtering.
Why do I need a DNS filter?
A DNS filter is an essential cybersecurity tool that businesses use to block malware downloads from the Internet, to prevent employees from visiting phishing websites, and to carefully control the types of content employees can access on company-managed networks. A DNS filter will block threats that would otherwise lead to unauthorized network access.
Can a DNS filter be bypassed?
It is possible to bypass a DNS filter by using a VPN or anonymizer service. With WebTitan it is possible to block access to anonymizer services through the admin control panel. You could also bypass a DNS filter by changing the DNS settings, so it is recommended that these settings are locked down.
What are the main benefits of a DNS filter?
A DNS filter blocks access to malicious websites and will prevent malware downloads. By blocking access to certain types of web content – social media and dating websites for example – employers can improve productivity. DNS filters can also be used to prevent employees from accessing illegal content to reduce legal risk.
Is WebTitan a good OpenDNS Umbrella alternative?
Many businesses are now looking for an OpenDNS Umbrella alternative. Common complaints are the quality of customer support and the response times, Umbrella is overly complicated, and the solution is one of the most expensive web filters available. WebTitan is an ideal OpenDNS Umbrella alternative for most businesses. It provides excellent protection, is easy to use, is far less expensive, and users benefit from industry-leading customer support.
The threat of malware downloads from visiting adult websites has long been thought to be a major risk; however, not all studies on the subject have demonstrated that the risk is any higher than visiting other types of websites. The owners of adult websites, as legitimate business owners, have a vested interest in keeping their sites malware free.
However, new research from Kaspersky suggests the threat of malware downloads from visiting adult websites is real, and adult-themed phishing attacks increased in 2018.
Is There a High Risk of Malware Downloads from Visiting Adult Websites?
According to its latest report, there is a real risk of malware downloads from visiting adult websites. Naturally for consumers who visits adult websites, the risk is theirs to take. For businesses however, risks taken by employees can prove incredibly costly.
One of the major stories to be covered in the media on this theme in 2018 involved a government employee with a prolific thirst for such content. He was discovered to have accessed more than 9,000 adult websites and had inadvertently downloaded malware onto his work computer and the network. After visiting so many sites, that is perhaps understandable, but there have been many such malware downloads from far less prolific surfing of adult sites.
Kaspersky Lab’s research indicates that most malware downloads from malicious websites involves malware disguised as videos. Oftentimes, users are required to download a supposedly benign but malicious file in order to access the video.
Cybercriminals are also using black-hat techniques to poison the search results and get malicious sites appearing high up in the listings. The top 20% of porn-related search terms accounted for 80% of malware disguised as porn. Kaspersky’s tracking indicated 87,227 users had downloaded malware-disguised as porn and 8% of those did so via their work network.
The use of these porn tags is also common to get users to download non-malware threats such as adware and downloaders, although the latter are often capable of downloading much more malicious files. While the number of these attacks decreased by 36% year-over-year, attacking people searching for adult content is still common.
The most common threats associated with adult content were Trojan downloaders (45%) and Trojans (20%), followed by adware (9%) and worms (8%).
Adult-Themed Phishing Attacks Increased by 1,000% in Q4, 2018
While it was previously uncommon for phishing scams to use porn as a lure, that changed in 2018. It is still common for cybercriminals to use impersonate or create fake hookup sites to lure people into divulging credentials but there was also a 1,000% increase in phishing attacks using websites that masquerade as porn websites. Most commonly these were spoofed versions of the top 10 adult sites on the web. The rise in these types of phishing scams could be indicative of a trend that will grow in 2019.
The research shows that malware downloads from visiting adult websites is still a risk and the threat from adult-themed phishing attacks has grown at an alarming rate. Businesses should take note and take steps to limit risk.
The easiest way to do that is with a DNS web filter – A solution that allows businesses to carefully control the web content that can be accessed on work devices and via their wireless networks. With a DNS web filtering solution in place, businesses can block access to adult websites, commonly spoofed hookup and dating sites, and web-based phishing threats.
Not only will a DNS web filter provide protection against phishing, ransomware, and malware downloads, by blocking access to these adult sites, legal liability can be reduced and staff issues can be avoided.
If you have yet to start filtering the internet and preventing your users from accessing adult websites, other NSFW web content, and sites that are a drain on productivity, TitanHQ can help.
For a very low cost, businesses can protect all users of their wired and wireless networks and block a wide range of web-based threats. MSPs can also start providing filtered internet service to better protect their clients.
For further information, contact TitanHQ today and ask about WebTitan Cloud and WebTitan Cloud for WiFi – TitanHQ’s award winning web filtering solution for businesses.
TitanHQ has launched a busy campaign of MSP roadshows and conferences with two Valentine’s Day events in London and Tampa, Florida.
Over the coming five months, the TitanHQ team will be attending 15 events in Ireland, the Netherlands, the UK, and the USA, and will be meeting with managed service providers (MSPs), Wi-Fi providers, ISPs, and technology partners to introduce and explain about TitanHQ’s award-winning suite of email security, web filtering, and email archiving solutions.
The 2019 roadshow campaign started in London where Alliance Manager Eddie Monaghan met with current and prospective MSP partners at the IT Nation Q1 EMEA Meeting. Eddie will be at the event all week and will be discussing TitanHQ’s MSP solutions and finding out more about what is happening in the MSP world. TitanHQ has learned a great deal since joining the IT Nation community two years ago and has really enjoyed the experience thus far.
TitanHQ Alliance Manager, Eddie Monaghan
On the other side of the Atlantic, Alliance Manager Patrick Regan has been meeting with MSPs from Florida and beyond at the TitanHQ-sponsored Datto Roadshow in Tampa. Since joining the Datto community as a strategic partner, TitanHQ has worked closely with Datto MSP partners helping them to integrate email security, DNS filtering, and email archiving into their product offerings and providing tips and tricks to help them to get the most out of the products.
TitanHQ has been increasing its technology partners over the past year and is now working closely with industry giants Comcast, BitDefender, Microsoft, Kaseya, and ViaSat and is a proud member of IT Nation (HTG Peer Groups), Datto Roadshows, COMPTIA, and ASCII.
From humble beginnings as an indigenous Irish company providing anti-spam appliances to the local market, over the following 20 years TitanHQ has developed an innovative range of cloud-based solutions and has matured into a global provider of network security solutions for enterprises, SMBs, and MSPs. TitanHQs award-winning cybersecurity solutions are now offered by a network of more than 1,500 MSP partners and have been adopted by several thousand businesses in 200 countries around the globe.
The TitanHQ product suite has been developed to meet the exacting needs of MSP partners and are delivered via the TitanShield Program. The products help MSPs to protect themselves and their clients, while saving valuable time and effort by blocking threats at source before they can cause any harm.
TitanHQ’s spam filtering solution – SpamTitan – and web filtering solution – WebTitan – help MSPs keep their clients protected from malware, ransomware, viruses, botnets, phishing attacks and other email and web-based threats.
The cloud-based solutions are easy for MSPs to slip into their service stacks to build a high-margin security practice offering clients world-class network security services.
If you are already a TitanHQ TitanShield partner or want to find out more about the MSP program and TitanHQ products, be sure to attend one of the upcoming events and come and meet the TitanHQ team.
We look forward to meeting you at one of the upcoming roadshow events in 2019.
Web filtering at multiple locations can be a headache but it is a necessity. Human error can easily result in an email account breach, malware download, or ransomware attack. Every employee is a potential security risk, so it is important for controls to be implemented to reduce the risk of mistakes leading to a costly security incident.
One of the main ways that data breaches occur is through phishing. The web pages used in phishing attacks host phishing kits that collect login credentials and send them to the scammers. The web pages usually contain identical copies of the login boxes used by the likes of Microsoft Office 365, Google, and Facebook. The web pages are incredibly realistic and can be difficult for employees to identify as malicious.
Hyperlinks in emails also direct employees to websites containing exploit kits which probe for vulnerabilities and silently download malware. A user could visit a website for a couple of seconds, yet still trigger a malware download. Even general web surfing can see users redirected to malicious websites.
The solution is to implement a web filter. A web content filter allows businesses to control the web content that users can visit, and it also blocks access to malicious web sites.
Web Filtering at Multiple Locations
While a web filter is easy to implement on premises, protecting mobile workers and multiple offices can be more of a challenge. Traditionally, web filters were physical appliances through which all Internet traffic flowed. Rules were applied to the appliance to control what sites can be visited by employees.
One of the main disadvantages when web filtering multiple locations, is a separate appliance needs to be used at each location. Not only is this costly, installing and maintaining the appliance requires technicians to be available on site. For many businesses running multiple offices, IT is managed remotely. IT staff are not available at each site. An appliance-based filter at each site is far from ideal.
An alternative is to backhaul Internet traffic to the corporate office, but this has a major impact on Internet speed. The latency issued can cause major problems for remote offices so this option is also not ideal.
The best solution is a cloud-based DNS web filter. A DNS web filter can be applied, configured and maintained remotely without the need for site visits or on-site support staff. No hardware is required and no software needs to be downloaded. All that is required is for a change be made to internal DNS servers or DNS settings.
Not only does this approach eliminate the need for any costly hardware purchases, with a cloud-based DNS filter there is no latency. The DNS-filter can be applied for all locations and managed through a single web-based interface. Controls can also be applied for different locations via an AD/LDAP client.
A cloud-based DNS filter is ideal for web filtering multiple locations, but what about protecting employees on the move? When employees travel for business, their mobile devices similarly need to be protected. A DNS filter can protect those employees online no matter where they access the Internet without the need to backhaul traffic.
Cloud-based DNS web filters are also the ideal solution for managed service providers (MSPs) who want to offer web filtering to their clients. The filters are highly scalable, and they offer multitenant management for MSPs and allow all clients settings to be configured and managed through a single pane of glass. Separate polices can be applied for each clients and reports can be easily generated. There is no need for any site visits, no need for patching, and web filtering can be offered no matter where the client is based.
WebTitan Cloud – Web Filtering Multiple Locations Made Simple
TitanHQ is a leading provider of DNS-based web filtering for businesses. WebTitan Cloud is an enterprise-class DNS-based web filtering solution that makes web filtering multiple locations effortless. The solution takes minutes to implement and requires no training to use. All web filtering controls can be applied remotely via an intuitive user interface.
If you run a business in multiple geographical locations, want to protect remote workers, or if you are a managed service provider that wants to add web filtering to your service stack, contact TitanHQ for further information on WebTitan Cloud.
A phishing campaign has been detected that uses Google Translate to make phishing web pages appear legitimate when visited through mobile browsers. The novel tactic makes it harder for end users to see that the website they have been directed to is not an official website.
The phishing attack starts with an email that indicates the user’s password has been used to access their Google account from an unfamiliar device. Many users will be familiar with these messages. They are generated when a user logs into their own account using a different device or from an unfamiliar location. The messages are also triggered when a user attempts to login to their account using a VPN that has previously not been used to access the account.
In this campaign, the standard Google Security Alert has been copied exactly and includes the Google logo, standard formatting, and text that users will be familiar with. The message tells the user to click on a link – A button below the warning message – to visit their account to review the activity and take action to secure their account.
If the user is on a desktop or laptop, they will be directed to a standard phishing page which has a copy of the Google login window. It should be apparent that the user is not on the legitimate Google site as the URL clearly nothing to do with Google although end users do not always check the URLs carefully, especially when there is an urgent reason for visiting a website such as a security alert.
If the user has opened the email on a mobile device and clicks the hyperlink button, the URL displayed in the browser will be different and they are much ore likely to be fooled. The phishing webpage uses Google Translate to display a URL containing a random string of characters, but crucially, the visible part of the URL displayed in the browser starts with translate.googleusercontent.com/translate_
The URL does contain the web page which the user is on, which is a page on mediacity.co.in that clearly has nothing to do with Google, but it is detailed much later in the URL so will not be displayed to the user unless they click the address bar to check the web page. Many users will not do that since the visible part of the URL appears to be a genuine Google page.
The Google login portal that is served is an old version, but it is likely to fool many users. If Google credentials are entered in the login box, JavaScript on the web page generates an email containing the user’s login credentials and sends them to the scammer. The user is then redirected to a further phishing web page where their Facebook login credentials are requested. This login box is a clone of the login box used by Facebook on the mobile login portal and is similarly an old version. If login credentials are entered, they are sent to the scammer via email as well. The user is then directed to a Facebook page set up by the attacker.
While the phishing campaign is unlikely to work on desktops or laptops, many mobile users will likely be fooled by the scam and will provide their Google credentials. They may not fall for the Facebook login request, as being redirected to Facebook from Google is odd, but by that time the attacker will have full access to the user’s Google account. Google accounts can contain a wealth of sensitive data and can be used for further phishing attacks on the user’s contacts.
Security awareness training will help to prevent employees from falling for phishing scams such as this. By conditioning employees to always check the sender of a message before taking any action, and to always take the time to carefully check the full URL of a website before disclosing any sensitive information, scams like this can be easily identified. Even with security awareness training, employees make mistakes. To improve protection against phishing attacks, businesses should deploy an advanced spam filter to prevent malicious messages from being delivered to corporate inboxes. A web filter is also strongly recommended. A cloud-based web filter can prevent users from accessing phishing web pages, even when they are not onsite and are using mobile devices remotely.
For further information on spam filtering and web filtering for businesses, contact the TitanHQ team today and ask about SpamTitan and WebTitan: TitanHQ’s leading spam filtering and web filtering solutions for businesses.
Anatova ransomware is a new cryptoransomware variant that appears to have been released on January 1, 2019. It is stealthy, can infect network shares, has already been used in attacks in many countries around the world. It could well prove to become a major ransomware threat in 2019.
Ransomware has somewhat fallen out of favor with cybercriminals as cryptocurrency mining malware offers greater potential for profit. The development of new ransomware variants has slowed, but new variants are still emerging and the threat from ransomware is not going away any time soon. Ransomware attacks are still profitable for cybercriminals and as long as that remains the case the attacks will continue.
Anatova ransomware was identified and named by security researchers at McAfee. The name was taken from the name on the ransomware note. The previously unknown ransomware variant has been used in at least 10 countries, with over 100 Anatova ransomware attacks identified in the United States, more than 65 in Belgium, and over 40 in France and Germany.
Not only does the ransomware variant employ a range of techniques to avoid detection, infection can cause major damage and widespread file encryption. Further, the modular design allows the developers to easily add new functionality in the future.
Most of the strings in Anatova ransomware have been encrypted and different keys are required to decrypt them. Those keys have been embedded in the executable. 90% of calls are dynamic and use non-suspicious Windows APIs and standard C-programming language.
Once downloaded and executed, the ransomware performs a check of the name of the logged in user against a list of encrypted names and will exit if there is a match. Names that prompt an exit include tester, lab, malware, and analyst. These names are commonly used on virtual machines and sandboxes. A check will also be performed to determine the country in which the device is located. The ransomware will exit if the device is in any CIS country, Egypt, Syria, Morocco, Iraq, or India.
Anatova ransomware scans for files smaller than 1MB and checks for network shares, although care is taken not to disrupt the operating system during this process and raise a flag before files are encrypted. Once files have been identified, the encryption routine starts. The ransomware uses its own key, so each victim requires a separate key to unlock the encryption.
Once the encryption process has run, the ransom note is dropped on the desktop, the memory is cleaned, and volume shadow copies are overwritten 10 times to ensure files cannot be recovered from local backup files.
The ransom demand is relatively high – Around $700 (10 DASH) per infected machine. Since multiple devices can be infected with a single installation, the total ransom demand could well be considerable.
What is not 100% certain is how the ransomware is being distributed. McAfee detected one sample on a P2P file sharing network which masquerades as a free software program complete with game/application icon to encourage users to download and run the installer. Other attack vectors may also be used. Based on the current distribution vector, a web filter will offer protection against attacks if P2P file sharing/torrents sites are blocked.
The researchers believe Anatova ransomware has been created by highly skilled malware authors who are currently distributing a prototype of the ransomware. More widespread attacks are to be expected once this testing phase has been completed.
Hackers are taking advantage of poor Wi-Fi security to attack small businesses. This post covers simple steps to take to improve Wi-Fi security to block cyberattacks.
Small businesses can implement a robust firewall to protect against cyberattacks, but the Wi-Fi router is often a weak point. A Wi-Fi router providers wireless coverage for your business and it is a likely attack vector if security is lax. By attacking wireless routers, hackers can bypass your firewall.
Fortunately, there are simple steps you can take to improve Wi-Fi security and block attacks. Seven simple steps to take to improve Wi-Fi security have been listed below.
Simple Steps for Small Businesses to Take to Improve Wi-Fi Security
Some of the steps below are obvious security measures, but there have been many instances when small businesses have overlooked these simple protections, only for them to be exploited by hackers.
Change Router Admin Credentials
Changing default credentials is one of the easiest but most important steps to take to improve Wi-Fi security. Because it is so simple, no business should be guilty of this security faux pas, but many are, even large businesses. In November, a school system discovered that its WAN provider had not changed the passwords on routers that had been in use for years. This is not the login for Wi-Fi, but the password for the router itself. These default administrator passwords can be found with a simple Internet search.
Disable Remote Administration on Your Router
Many wireless routers allow users to access and change router settings from outside the network. For the majority of businesses, remote administration is not necessary so it should be disabled. While this setting can be convenient, there are other more secure ways to access router settings remotely such as using a VPN. Allowing remote administration makes it far too easy for hackers to access your router.
Monitor Your DNS Settings
In January 2019, the U.S. Department of Homeland Security issued an emergency directive to all government agencies instructing them to perform an urgent audit of their DNS records after it was discovered that a threat group was targeting government agencies and changing their DNS records. By hijacking the DNS, all employees could be directed to malicious websites – clones of legitimate sites. Businesses that do not have an internal DNS server often use their wireless routers for this. Businesses should regularly monitor their DNS settings to ensure that no changes have been made.
Limit the Range of Your Wi-Fi Signal
You will want to make sure that everyone on the premises can access your Wi-Fi network, but it is important that no one outside your offices can do so too. If your Wi-Fi signal is too strong, it could be accessed by someone outside your offices and out of sight – In a car parked in your lot for instance. An overly strong Wi-Fi signal makes it easy for an attacker to conduct brute force attacks without being seen.
Keep Firmware Updated
New router firmware will be periodically released by the manufacturer and, as with all other software updates, they should be applied as soon as possible. Firmware updates are issued to improve security and functionality. They address known vulnerabilities for which exploits exist. Some routers will be set to update automatically, others may require a manual update through the web-based interface. Be sure to check the manufacturers web page, as your router may no longer be supported, which means it is time for an upgrade.
Make Use of Your Guest Network
One of the most important security measures is to segment your network and this is especially important for Wi-Fi. You should not allow any untrusted device to connect to your network, such as those used by visitors. You should have a separate SSID for your employees and guests. This will keep guests away from your primary network.
Ensure Your Wi-Fi Network is Encrypted
You should ensure that your Wi-Fi network is encrypted with WPA as an absolute minimum. Without encryption your network will be open and hackers will be able to intercept wireless traffic. Currently the encryption standard is WPA2, although this will change to WPA3 in 2019. If you are planning on replacing your Wi-Fi router, make sure the new model supports WPA3. If your router only supports WEP it is time to upgrade.
Hackers are increasingly targeting small businesses. These 10 cybersecurity tips for small businesses can be implemented to improve security, prevent successful cyberattacks, and avoid costly data breaches.
Many small business owners misguidedly think that their company is too small to be a target for hackers but cyberattacks on small businesses are common and they are increasing. A successful attack on a Fortune 500 company is likely to be far more profitable for the hacker, but also much harder. Small businesses are relatively easy targets and attacks can be highly profitable.
Small business owners cannot afford to take cybersecurity lightly. A successful cyberattack could prove catastrophic. With this in mind, we have compiled 10 cybersecurity tips for small businesses that can easily be implemented to improve security. We hope you find these small business cybersecurity tips useful for improving your security posture.
Top Cybersecurity Tips for Small Businesses
Implement a Robust Firewall
A firewall is a cybersecurity solution that sits between a small business network and the outside world and prevents unauthorized individuals from gaining access to the network and stored data. Not all firewalls are created equal. Extra investment in a next generation firewall is money well spent. Don’t forget to also protect remote workers. Ensure that they are also protected by a firewall.
Create and Enforce Password Policies
You should implement password policies that require all users to set strong, secure passwords. A strong, unique password should be used for all systems. Passwords should include capitals, lower-case letters, a number, and a special character, and should be at least 10 digits long. Teach employees how to create secure passwords and enforce your password policies. Consider using a password manager so passwords do not need to be remembered. Consult NIST for the latest password guidance.
Security Awareness Training
Make sure you provide the workforce with regular security awareness training. This is the only way that you can create a culture of cybersecurity. Be sure to cover the security basics, safe Internet use, how to handle sensitive data, creation of passwords, and mobile device security. You should provide training to help employees avoid phishing attacks and consider phishing simulation exercises to test the effectiveness of your training program.
Multi-Factor Authentication
Multi-factor authentication involves the use of a password and at least one other method of authentication. If login credentials are compromised, an additional factor is required to gain access to an account or the network such as an SMS message to a user’s smartphone.
Backups
It is essential to have a good backup policy. In the event of disaster, such as a ransomware attack, you need to be able to recover critical data. Backups must also be tested to make sure files can be recovered. Don’t wait until disaster strikes to test whether data can be recovered. A good strategy is the 3-2-1 approach. Three backup copies, on two different types of media, with one copy stored securely offsite.
Software and Firmware Updates
Vulnerabilities are regularly found in computer software. Patches are released to correct those vulnerabilities, including those that are being actively exploited. Make sure patches are applied promptly, software is kept 100% up to date, and the most up to date firmware has been installed. Implement automatic updates where possible and create a schedule for updates if they need to be performed manually.
Network Segmentation
It is a standard best practice to segment networks and split them into subnetworks. Not only will this improve security it can also improve performance. By preventing access between segments, if one part of the network is compromised, an attacker will not have access to all systems and data. Also make sure you limit access to sensitive data and restrict the use of admin credentials. Apply the rule of least privilege. Do not give employees access to data, networks, and software that they do not need for day to day work duties.
Implement a Spam Filter
Arguably the biggest cyber threat that small businesses face is phishing. A single phishing email could allow an attacker to bypass your perimeter defenses and obtain login credentials or install malware. An advanced spam filter will allow you to improve productivity by blocking non-malicious spam emails and prevent phishing emails from being delivered to inboxes.
Secure Wi-Fi Networks
If you have a wireless network in your workplace it needs to be protected. Ensure that it is secured, data are encrypted, and that it is hidden and does not broadcast its SSID. Use WPA2 for encryption (or WPA3 if possible). Change default passwords and ensure your wireless router cannot be accessed from outside the network.
Consider Implementing a Web Filter
A web filter provides protection against web-based attacks by preventing employees from visiting phishing websites and sites that host malware.
A DNS-based web filter can protect wired and wireless networks and even remote workers. It will block malware downloads and prevent users from accessing dangerous websites and those that serve no work purpose thus improving productivity.
Email archiving for small businesses is now more important than ever. Not only do state and federal laws and industry regulations require data to be retained for long periods, the EU’s General Data Protection Regulation (GDPR) has introduced new requirements for businesses covering email retention. These requirements for email are best met by using an email archiving solution, although many small businesses are still relying on email backups for long term email storage.
Are Email Backups and Email Archives the Same?
In basic terms, an email backup and an email archive serve a similar purpose. They both allow emails to be stored so they can be recovered if needed. However, there are important differences between an email backup and an email archive, which have become even more important since the introduction of the GDPR.
Emails may need to be recovered for a variety of reasons: An important email is lost, a mailbox has been corrupted, emails need to be reproduced for an audit, for legal discovery, or if a customer exercises their right to be forgotten under the GDPR.
Backups are useful, but they are far from ideal for most of the above reasons. Backups allow email data to be restored in the event of loss if a mailbox has been corrupted – Due to a ransomware attack or a hardware failure for instance. In such cases, email backups allow the email system to be quickly restored to the point when the backup was made.
A backup is simply a copy of email data and allows data to be restored to a specific moment in time – the last known point before a data corruption event occurred. A backup is ideal as a short-term solution to protect against data loss. Each time a backup is made, it typically replaces a previous copy. This means that it is possible for emails to be lost. If an email is deleted or corrupted, and a new backup is made that overwrites the last copy, deleted and corrupted emails may be lost forever. Restoring backups may require the entire mailbox to be restored, even when only a few emails need to be recovered, which is hardly ideal.
How Does an Email Archive Differ from an Email Backup?
With an email archive, emails are moved from the mail system into the archive for long term storage. In addition to emails, tasks, email attachments, and calendars can be archived. Many companies choose to implement an archive not for disaster recovery, as backups are still used for that purpose, but to decreases the workload of an email server, improve performance, and eliminate the need for mailbox limits and PST files.
One of the most important differences between a backup and an email archive is an archive is searchable, which makes it a quick and easy process to find a specific email or set of email messages if they ever need to be recovered. They could be emails sent to or from a specific person, emails that contain an individual’s personal data, or emails relating to a specific person or event.
Backups allows emails to be retained and restored, but backups are not searchable. If an email is lost or needs to be recovered, finding messages can be a very time-consuming process.
In the event of legal action against a company, as part of the eDiscovery process, an organization will have to produce emails related to the case. A limited amount of time is provided to respond, so it is essential that information can be found quickly and efficiently. The same is true for compliance audits, GDPR requests, and when complaints are received from customers.
In contrast to a backup, emails that are archived cannot be lost as no data is overwritten. Archives are also tamper-proof and an audit trail is maintained, ensuring legal compliance. Failure to retain data, missing deadlines for producing data, and accidental deletion of email data can result in major financial penalties. Those fines can prove catastrophic for small businesses. Email archiving for small businesses ensures that these issues never arise.
With an email archive, emails are instantly encrypted to prevent data from being intercepted or accessed by unauthorized individuals and, with cloud-based archives, there is no limit on storage space. Users can continue to use their mail clients or browsers and can easily access archived emails. Email archives are easy to use, manage, maintain, and it is quick and easy process to recover emails on demand.
In short, email archiving for small businesses:
Adds legal safeguards
Ensures protection against data loss
Maintains an audit trail for legal compliance
Ensures emails can be quickly found and recovered
Eliminates the need for mailbox quotas and PST files
Improves efficiency and productivity
Allows long term storage of emails to meet regulatory requirements
TitanHQ has developed ArcTitan to meet the needs of small- to medium-sized businesses and managed service providers (MSPs). ArcTitan is a lightning-fast email archiving solution for small businesses that archives emails at a rate of 200 messages a second and can search 30 million emails a second.
ArcTitan is a very competitively priced secure email archiving solution that is easy to set up and use and will allow businesses to meet their legal responsibilities with respect to email retention. The solution works with all major email clients and integrates seamlessly with Office 365.
If you have any questions about email archiving for small businesses, if you want to set up an email archive, or would like information on the best solution to meet the needs for your business, contact the TitanHQ team today.
The news headlines frequently warn businesses of the need to improve cybersecurity protections to thwart hackers, but not all threats come from outside the company. There are various types of insider threats that need to be managed and mitigated, yet these are all too often overlooked or insufficient controls are put in place to reduce the risk of a deliberate or accidental breach.
What are Insider Threats?
An insider threat is one that comes from within the company, typically an employee who accidentally or deliberately takes an action that causes harm or loss to the company.
Hackers attack companies to gain access to their networks to spy on companies, obtain secrets, steal data or sabotage systems. Breaking through perimeter defenses can be time consuming and difficult but if an insider wants to steal data or sabotage a system, it is far easier as they already have network access.
Not all insider threats involve intentional malicious actions by employees. An employee can also act in a way that negatively affects their company without intending to cause any harm.
This could be intentionally violating company policies in a non-malicious manner. An example would be the installation of software to save the employee time or to allow them to work more efficiently. Installing unauthorized software carries a risk of a malware or spyware infection. An employee could violate company policies which could lead to an accidental data breach. Then there is human error, such as sending an email containing sensitive information to the wrong person. Such actions could prove costly.
Businesses need to protect against all insider threats if they are to avoid costly data breaches. A great many data breaches result from too little focus on cybersecurity defenses to block the threat from within.
Malicious Acts by Employees
Anyone that has access to sensitive company data could potentially abuse their access rights to view or steal data. There is no particular profile of a malicious insider. Everyone could decide one day to steal information or sabotage systems, but you can protect against malicious insiders and manage the risk.
Cover insider threats in security awareness training and encourage employees to be vigilant and report suspicious activity. Provide them with an easy way to report their concerns.
Implement tools that monitor for anomalous behavior
Implement controls to prevent the use of portable storage devices such as thumb drives
Implement tools that prevent employees from downloading and running certain files types – Executable files for instance.
Apply the rule of least privilege – Don’t let employees access data/systems that they do not need to access to complete their day to day work duties
Accidents Will Happen…
The insider threats that can be the hardest to defend against are mistakes by employees. These types of insider threats include responding to a phishing email and disclosing login credentials, sending sensitive data to the wrong email recipient, accidentally visiting malicious websites, and inadvertently downloading malware. These threats need to be managed and mitigated through policies and procedures, training, and software solutions.
…But You Can Minimize Risk!
Phishing is arguably the biggest threat. Hackers know all too well that people make mistakes and can easily be fooled. Priority number one should be blocking phishing emails and making sure they are not delivered. For that you need an advanced spam filter. The more phishing emails that are blocked, the lower the risk of a click.
Security awareness training is also essential. When a phishing email lands in an inbox, employees need to have the skills to recognize it as such. Provide training and make the training interesting to engage employees. Interactive training courses can help in that respect. Make sure you test your employees’ knowledge afterwards with phishing email simulations. They will let you know who has taken the training on board and who needs further training.
Training needs to cover all security threats, not just phishing. Teach employees security best practices, including checking badges before allowing someone into the building, password security, keeping credentials private, and safe use of WiFi.
Another important technical control to implement is a web filter. A web filter allows businesses to control what employees can do online. They block access to phishing websites, block drive-by malware downloads, and prevent employees from visiting questionable websites that carry a high risk of malware infections or malvertising redirects: Adult sites and torrents/P2P file sharing sites for instance. Some web filters will also keep employees safe and secure when working remotely.
The important thing for businesses is not to leave things to chance or to assume they are too small to worry about insider threats and data breaches. Every business is at risk, regardless of size.
For further information on software solutions that can protect against data security threats give the TitanHQ team a call.
A new form of MongoLock ransomware is actively being used in a global campaign. A 0.1 BTC ransom is demanded, although file recovery may not be possible. The ransomware immediately deletes files and formats backup drives and a recoverable copy may not be retained by the attackers.
MongoLock ransomware was first detected in January 2017. A major campaign involving the ransomware was detected in September 2018 with the latest attacks having been ongoing since December 2018. The attackers are gaining access to unprotected or poorly protected MongoDB databases and are deleting data and replacing the databases with a new database. Inside the database is a file called readme that contains the ransom demand.
The attackers claim to have exported the database before encrypting it. Victims are required to make a 0.1 BTC payment to a supplied Bitcoin wallet or contact the attackers via email. Many victims have chosen to pay the ransom; however, there is no guarantee that data can be recovered. It is unclear whether the attackers are making a copy of the database or are simply deleting it.
The attacks are automated and scripts are used to delete the database and create the ransomware note, but the scripts are not always effective. Even if it is the intention of the attackers to obtain a copy of the database, that may not always happen.
The latest version of MongoLock ransomware also conducts a scan of local drives and deletes important data, including files saved to the Desktop, My Documents folder, Recent files, favorites, and any backup files that can be located. The drives are then formatted. This makes payment of the ransom all the more likely. Users are advised they have just 24 hours to make payment before the database is permanently deleted.
The file deletion routine is executed after the files have been uploaded to the attackers’ C2 server, so they can potentially be recovered if the ransom payment is made. However, if the computer is taken offline, file deletion continues but no copy of the file will be obtained by the attackers.
These attacks are primarily conducted on exposed MongoDB databases, which can easily be found using the Shodan search engine. Any businesses that uses MongoDB should ensure that the databases are properly secured, and that authentication is required to gain access. It is also important to ensure the databases cannot be accessed remotely over the Internet.
It is also essential to adopt a good backup strategy. The 3.2.1 approach is recommended. Make three backups, stored on two separate devices, with one copy stored securely off site on a non-networked device.
A malvertising campaign has been detected that delivers two forms of malware: The new, previously unknown Vidar information stealer and subsequently, the latest version of GandCrab ransomware.
The packaging of multiple malware variants is nothing new of course, but it has become increasingly common for ransomware to be paired with information stealers. RAA ransomware has been paired with the Pony stealer, njRAT and Lime ransomware were used together, and Reveton ransomware is used in conjunction with password stealers.
These double-whammy attacks help threat actors increase profits. Not everyone pays a ransom, so infecting them with an information stealer can make all infections profitable. In many cases, information can be obtained and sold on or misused and a ransom payment can also be obtained.
The latest campaign uses the Vidar information stealer to steal sensitive information from a victim’s device. The Vidar information stealer is used to obtain system information, documents, browser histories, cookies, and coins from cryptocurrency wallets. Vidar can also obtain data from 2FA software, intercept text messages, take screenshots, and steal passwords and credit/debit card information stored in browsers. The information is then packaged into a zip file and sent back to the attackers’ C2 server.
The Vidar information stealer is customizable and allows threat actors to specify the types of data they are interested in. It can be purchased on darknet sites for around $700 and is supplied with an easy to use interface that allows the attacker to keep track of victims, identify those of most interest, find out the types of data extracted, and send further commands.
Vidar also acts as a malware dropper and has been used to deliver GandCrab ransomware v5.04 – The latest version of the ransomware for which no free decryptor exists.
While many ransomware variants are delivered via spam email or are installed after access to systems is gained using brute force tactics on RDP, this campaign delivers the malicious payload through malvertising that directs traffic to a websites hosting the Fallout or GrandSoft exploit kits. Those EKs exploits unpatched vulnerabilities in Internet Explorer and Flash Player. The campaign targets users of P2P file sharing sites and streaming sites that attract large amounts of traffic.
Infection with the Vidar information stealer may go undetected. New malware variants such as this may be installed before AV software malware signatures are updated, by which time highly sensitive information may have been stolen, sold on, and misused. If GandCrab ransomware executes, files will be permanently encrypted unless a ransom is paid or files can be recovered from backups.
Businesses can protect against attacks such as these by ensuring that all operating systems and software are promptly patched. Drive-by downloads will not occur if the exploits for vulnerabilities used by the exploit kit are not present.
An additional, important protection is a web filter. Web filters prevent users from visiting websites known to host exploit kits and also sites that commonly host malicious adverts – torrents sites for instance. By carefully controlling the sites that employees can access, businesses can add an extra layer of protection while avoiding legal liability from illegal file downloads and improving productivity by blocking access to non-work-related websites.
For further information on web filters for businesses and MSPs, contact the TitanHQ team today.
The U.S. government has issued a warning following a spate of MSP cyberattacks by nation-state sponsored hackers.
Homeland Security Warns of Targeted MSP Cyberattacks
Managed service providers (MSPs), cloud service providers (CSPs), and managed security service providers (MSSPs) have been warned about an increase in malicious cyber activity and targeted attacks on IT service providers. Nation-state sponsored hackers are targeting IT service providers in an attempt to gain access to their networks, and ultimately, those of their clients.
It is not difficult to see why MSPs, CSPs, and MSSPs are such an attractive target. These IT service providers usually have administrator access to their clients’ networks or certainly elevated privileges that could allow an attacker to gain access to servers, security appliances, and databases of multiple clients.
The threat of attack is theoretical. There has been an increase in MSP cyberattacks in recent months, so much so that the U.S. Department of Homeland Security (DHS) has issued a warning to all IT service providers specifically due to an increase in attacks on IT service providers by Chinese government-backed hackers.
The DHS Cybersecurity and Infrastructure Security Agency (CISA) has issued cybersecurity guidance for IT service providers on steps that need to be taken to improve security, detect attacks quickly, and prevent threat actors from gaining access to their clients’ networks. Since companies that use IT service providers have also been warned of the risk of attack through their IT companies, MSPs, MSSPs and CSPs are likely to be contacted by clients wanting reassurances.
IT service providers should therefore be proactive and n ensure that CISA guidance is being followed to better protect themselves and their clients.
Feds Launch Campaign to Raise Awareness of Cyber Risks
CISA is not the only government agency to issue a warning in the past few days. The Trump administration has launched a new campaign to raise awareness of cyber risks in all industry sectors. The “Know the Risk, Raise your Shield campaign is being spearheaded by the National Counterintelligence and Security Center (NCSC) at the Office of the Director of National Intelligence. The campaign has been launched in response to increased cyberattacks from state sponsored hackers in Russia, China, Iran, and North Korea and independent hackers.
The aim of the campaign is to ensure that cybersecurity best practices are being followed to make it much harder for the attackers to succeed. The NCSC is aware that improved cybersecurity comes at a cost, but explains that investment in cybersecurity defenses is money very well spent and reminds businesses that an ounce of security equates to a pound of protection.
How Can Businesses and MSPs Improve Their Defenses?
With MSP cyberattacks on the increase it is essential that defenses are improved. While there are many ways that MSPs and businesses can be attacked, one of easiest ways is phishing. Phishing targets a weak link in security defenses: Employees. If a phishing email is delivered to an inbox and an employee responds, credentials will be obtained by the attacker that gives them a foothold to launch further attacks on other employees and MSP clients.
It is therefore important to improve awareness of the risks and train employees how to recognize email threats and how to react. It is also important to ensure that technical spam defenses are implemented to make sure phishing threats are blocked on the server and are not delivered to end users’ inboxes or local spam folders. SpamTitan is an ideal solution for MSPs to implement to block these phishing attacks on their employees and their clients.
SpamTitan is an easy to implement and easy to manage spam filtering solution that provides excellent protection against the full range of email threats. Email attachments are scanned using dual antivirus engines ensuring 100% of known malware threats are blocked. Suspicious attachments that pass the AV scans are sent to a Bitdefender-powered sandbox where they are subjected to an in-depth, sophisticated analysis to identify previously unknown malware threats and malicious scripts. The solution is automatically updated and is fed real-time threat intelligence gathered from an active database of 650 million users. SpamTitan also uses a defense-in-depth approach to protect against phishing threats, including machine learning predictive techniques to identify zero-day phishing threats. SpamTitan scans inbound and outbound emails and includes a data loss prevention feature to prevent attempts to use email accounts to send sensitive data outside the organization.
A web filter should also be implemented to prevent end users from visiting malicious websites where malware is downloaded and to block the web-based component of phishing attacks. A DNS-based web filter blocks attempts to access malicious sites during the DNS lookup process, with zero latency. TitanHQ has developed WebTitan to provide protection against web-based threats. WebTitan stops malicious requests at the DNS layer, which is better than waiting for the payload to be delivered onto the machine and then removed. By stopping it at the DNS layer you’re reducing not only malware infections, but containing machines already infected by preventing them from communicating out to their C&C servers.
Benefits of TitanHQ Cybersecurity Solutions for MSPs
Easy client account administration via a central control panel
One control panel to manage all clients
Intuitive controls with low management overhead
Eliminates the need for site visits, with no local support required
No end user software installations needed
Incorporate new clients in minutes
Competitive usage-based pricing with monthly billing
Three hosting options: Our servers, a private cloud, or within an MSP’s infrastructure
Generous margins for MSPs
Industry-leading technical support and customer service
Solutions available in a white label version ready to take MSP logos
For further information on spam filtering and web filtering for businesses and MSPs, speak to the TitanHQ team today.
Other important steps to take to improve security include:
Use of strong password policies
Applying the principle of least privilege
Ensuring network and host-based monitoring systems are implemented and logs are regularly checked for signs of malicious activity
Performing regular vulnerability scans to identify security weaknesses before they are exploited.
New figures released by anti-virus firms McAfee and Symantec have shown the extent to which hackers are using cryptocurrency mining malware in attacks on consumers and businesses.
Cryptocurrency mining malware hijacks system resources and uses the processing power of infected computers to mine cryptocurrencies – Validating transactions so they can be added to the blockchain public ledger. This is achieved by solving difficult computational problems. The first person to solve the problem is rewarded with a small payment.
For cryptocurrency mining to be profitable, a lot of processing power is required. Using one computer for mining cryptocurrency will generate a few cents to a few dollars a day; however, hackers who infect thousands of computers and use them for cryptocurrency mining can generate significant profits for little work.
The use of cryptocurrency mining malware has increased considerably since Q4, 2017 when the value of Bitcoin and other cryptocurrencies started to soar. The popularity of cryptocurrency mining malware has continued to grow steadily in 2018. Figures from McAfee suggest cryptocurrency mining malware has grown by 4,000% in 2018.
McAfee identified 500,000 new coin mining malware in the final quarter of 2017. In the final quarter of 2018, the figure had increased to 4 million. Figures from Symantec similarly show the scale of the problem. In July 2018, Symantec blocked 5 million cryptojacking events. In December, the firm blocked 8 million.
There are many different ways of infecting end users. Hackers are exploiting unpatched vulnerabilities to silently download the malware. They package coin mining malware with legitimate software, such as the open-source media player Kodi, and upload the software to unofficial repositories.
One of the easiest and most common ways of installing the malware is through email. Spam emails are sent containing a hyperlink which directs users to a website where the malware is silently downloaded. Links are similarly distributed through messaging platforms such as Slack, Discord, and Telegram. One campaign using these messaging platforms included links to a site that offered software that claimed to fix coin mining malware infections. Running the fake software installer executed code on the computer which silently downloaded the malware payload.
Unlike ransomware, which causes immediate disruption, the presence of cryptocurrency mining malware may not be noticed for some time. Computers infected with coin mining malware will slow down considerably. There will be increased energy usage, batteries on portable devices will be quickly drained, and some devices may overheat. Permanent damage to computers is a possibility.
The slowdown of computers can have a major impact for businesses and can result in a significant drop in productivity if large numbers of devices are infected. Businesses that have transitioned to cloud computing that are charged for CPU usage can see their cloud bills soar.
Anti-virus software can detect known coin mining malware, but new malware variants will be unlikely to be detected. With so many new malware variants now being released, AV software alone will not be effective. It is therefore important to block the malware at source. Spam filters, such as SpamTitan, will help to prevent malicious emails from reaching end users’ inboxes. Web filters, such as WebTitan, prevent users from accessing infected websites, unofficial software repositories, and websites with coin-mining code installed that uses CPU power through browser sessions.
A new variant of capitalinstall malware is being used in targeted attacks on a variety of organizations, in particular those in the healthcare and retail industries.
The main purpose of capitalinstall malware is to install an adware package named Linkury that is used to hijack browser sessions on Windows devices. When Linkury adware has been installed, web search results can be altered to display results which would otherwise not be displayed. An infected machine will display unwanted adverts but could also download unwanted programs, some of which may pose a security risk.
Capitalinstall malware has been linked to various malicious websites, although the adware package is actually being hosted on Azure blog storage which is often trusted by organizations and is often whitelisted.
The malware is installed via an executable file that has been packaged inside an ISO file, with the ISO file hosted on websites that offer keys to unlock popular software such as Adobe Creative Cloud.
Upon running the file, a crack for the software claims to be installing and the user is directed to a website where they are urged to install other programs and browser add-ons, such as cryptocurrency miners, with various enticing reasons provided for installing those programs.
This method of distributing unwanted and potentially harmful software is likely to grow in popularity as it offers a way of bypassing security solutions by taking advantage of inherent trust in cloud storage providers.
A web filtering solution can offer protection against downloads of unwanted programs by preventing end users from visiting potentially malicious websites. WebTitan scans and assesses web pages in real time and prevents users from accessing malicious websites and other sites that violate corporate Internet usage policies. With WebTitan in place, users can be prevented from visiting websites that are used for distributing potentially unwanted programs (PUPs) and malware.
In addition to technical controls, it is important to cover the risks of installing unauthorized software in security awareness training, especially the use of software license cracks. These executable files commonly have spyware, adware, and other forms of malware packaged into the installers.
Managed Service Providers can spend a significant amount of time dealing with phishing attacks and other security breaches. While MSPs provide an invaluable service and help their clients deal with cyberattacks, by providing security services, MSPs can not only protect their clients and prevent attacks, but also save themselves a considerable amount of time and improve their bottom lines.
The Devastating Consequences of an SMB Cyberattack
Successful cyberattacks on businesses can be catastrophic. The average cost of a data breach has now risen to $3.86 million, according to the Ponemon Institute. Such a high cost means many SMBs struggle to stay in business following a major breach.
A data breach can cause a significant drop in share price. While many businesses see share prices return to near pre-breach levels around 6 months after a major breach, many SMBs do not survive that long. Figures from the National Cyber Security Alliance show that up to 60% of SMBs permanently close their doors within 6 months of suffering a data breach.
Not only do businesses have to cover the cost of remediating a breach, they can lose market share which can be difficult to recover. Customers can also be very unforgiving. If customers’ personal information is exposed as a result of a data breach, the loss of business can be considerable. The damage caused to the reputation of a business by a cyberattack can take a very long time to repair.
Many SMBs believe they are too small to be worth hacking, yet the National Cyber Security Alliance’s figures show that is far from the case. 70% of cyberattacks target small businesses, and while not all of those attempts are successful, nearly 50% of SMBs around the globe report that they have experienced at least one successful cyberattack.
Cybersecurity Solutions for MSPs
MSPs that start offering cybersecurity to their clients can prevent the majority of these cyberattacks, providing the right solutions are chosen. Businesses will naturally need a robust firewall to prevent direct attacks, but many attackers are able to bypass this perimeter control by targeting the weakest link in security: Employees.
Cybercriminals are able to bypass perimeter controls by sending phishing emails to employees. Two recent examples have clearly demonstrated this. The San Diego School District discovered a hacker had gained access to its network and a database of 500,000 staff and student records with phishing emails. 50 email accounts were compromised in that attack. Cape Cod Community College also experienced a phishing attack targeting the finance department, the end result of which was fraudulent transfers being made to criminal-controlled bank accounts totaling more than $800,000. End user training could have made all the difference, as could an advanced spam filtering solution – both of which could easily be provided by MSPs.
Why Web Filtering Should be Part of Your Security Stack
Email security is an area often lacking at SMBs, even though email is the most common attack vector. Web-based attacks are also common, and this is an area where many SMBs are particularly vulnerable. This is another area where MSPs can help improve security.
Web filtering is often overlooked as traditionally this has been a security control that is difficult for MSPs to implement. Appliance-based filters require hardware purchases and site visits. Standard web filters require content to be downloaded before access is blocked and that they can cause major latency problems. DNS filtering solves these problems. Since filtering takes place at the DNS level, controls are applied before any content is downloaded and latency issued are avoided and web-based threats are blocked at source. Since there is no need for hardware to be purchased, it is cost effective for most businesses to implement. There are also no software downloads and deploying the solution is a quick and easy Process. Everything can be set up remotely in a matter of minutes and clients can be protected from malware attacks, phishing, and ransomware downloads while also controlling content and blocking illegal and unacceptable web activity.
WebTitan: MSP-Friendly Web Filtering to Protect Wired and Wireless Networks
In contrast to many DNS-based web filtering solutions, WebTitan has been developed to meet the needs of MSPs. One of the main problems with most DNS-based web filters for MSPs is the inability to add MSP branding. It is abundantly clear it is a third-party solution.
WebTitan can be totally rebranded, allowing MSPs to add their own logos and reinforce their brand image. WebTitan can be hosted on TitanHQ’s servers or within an MSPs own environment. WebTitan also has a well-established channel program and offers special pricing packages specifically for MSPs with generous margins and monthly billing. No other web filtering solution is as MSP friendly.
Other key features of WebTitan include:
Highly granular filtering controls: Filter by category, content, and keyword
Supports whitelists and blacklists
Intuitive control panel requiring no user training
Highly scalable solution with virtually no upper limit on number of clients or users
Embedded malware filter supported by dual AV engines
Extensive reporting suite and ability to brand and schedule client reports
Real time view of web activity
No latency
Remote management and monitoring via APIs and easy integration into billing and auto-provisioning systems
Flexible polices for different environments and users
Protection for wired and WiFi networks
Ability to provision new clients in minutes
Full product available on a free trial
Industry leading customer support
For further information on TitanHQ’s cybersecurity solutions for MSPs including WebTitan Cloud, WebTitan Cloud for WiFi, and the TitanHQ spam filter, SpamTitan Cloud, contact the MSP Program Team today.
Local authorities and private sector bus companies are now adding Wi-Fi services to their bus fleets, but without appropriate Wi-Fi security for busses, bus fleet operators can run into problems.
There is no doubt that Wi-Fi is a big hit with passengers, especially for long distance travel. Business commuters can connect to email and their work network without having to use their own data and all passengers can enjoy a variety of digital entertainment, such as Internet-based games, online crosswords, YouTube videos, or all manner of Internet based applications, all without eating into their monthly data allowance.
In locations where people have a choice of different transport, the provision of a reliable Wi-Fi network can be a big attraction that can win more business.
Wi-Fi Security for Busses
There are some considerations when providing Wi-Fi on busses. Wi-Fi security for busses is important to ensure that the Wi-Fi network cannot be used for malicious purposes. Over the summer, it was clearly demonstrated how this can easily happen. A hacker was able to hack into the Wi-Fi network on planes and view the Internet activity of passengers, as well as gain access to other important devices on airplanes – All from the ground.
Appropriate Wi-Fi security for busses should be implemented to protect the privacy of passengers, but also to ensure they can use the Wi-Fi network safely. Bus companies should be taking steps to protect passengers from harmful content, such as sites hosting malware and phishing websites.
Content Control for Busses
A third-party Wi-Fi network offers anonymity and some users take advantage and access types of content that they would not access on their home networks. Bus fleet operators have a responsibility to block illegal activity on their Wi-Fi networks.
If a passenger accesses adult content on the Wi-Fi network of a bus, there is a risk that other passengers will catch a glimpse of the screen and children could be exposed to obscene content. It is the responsibility of bus fleet operators to implement content controls to prevent passengers from accessing inappropriate content.
Controlling Bandwidth Use on Busses
There is also the issue of bandwidth. Ensuring all users have decent bandwidth and can connect to the network and enjoy reasonable Internet speeds comes at a cost. If several passengers are using applications or visiting websites that require a considerable amount of bandwidth, that will naturally have an impact on other users of the Wi-Fi network. Limiting what users can do while connected to Wi-Fi networks can save bandwidth and costs. Preventing, or restricting, high bandwidth applications such as video streaming, online games such as Fortnite, and large file downloads can help to conserve bandwidth.
DNS-Level Content Filtering
All of the above issues can be easily solved with a single, cost effective solution – A web content filter. A web filter allows network administrators to carefully control what users can do online. It offers both content control and Wi-Fi security for busses by blocking access to illegal content, preventing malware downloads, and offering protection from phishing. Categories of web content can be blocked to create a family-friendly Wi-Fi network and control bandwidth use.
Traditional web filters require an appliance through which Internet traffic is routed. This is a costly way of adding Wi-Fi security for busses. A DNS-level filter on the other hand is a low cost, flexible solution that serves the same purpose. When a user connects to the Wi-Fi network, the DNS process sends domain names to the name server and the name server returns the IP address associated with the application server. When content is filtered at the DNS level, no software needs to be downloaded and no appliances need to be purchased.
Not only do DNS-level filters offer excellent Wi-Fi security for busses, they also save on bandwidth as content is not downloaded before the decision is taken to block the content.
WebTitan Cloud for Wi-Fi – Content Filtering and Wi-Fi Security for Busses
WebTitan Cloud for Wi-Fi is an ideal web filtering solution for bus fleets. Since it is DNS-based it is easy to implement, highly scalable, and is cost-effective to set up and run. WebTitan Cloud for Wi-Fi can protect entire bus fleets, in multiple cities, and licenses can be easily scaled up and down to meet bus operators’ needs.
Some of the key features of WebTitan Cloud for Wi-Fi are detailed below:
No hardware purchases or software downloads required
No patching or software updates required
Protects multiple Wi-Fi routers from a single, web-based administration control panel
Protects against malware with dual anti-virus engines
Protects users from phishing and other malicious websites
Allows network administrators to protect the Wi-Fi network from unauthorized users
Highly granular controls allow precise content control without overblocking content
Block content by category with a single click
No latency – Internet speeds are unaffected
Supports static and dynamic IPs
Supports whitelists and blacklists
No restriction on bandwidth, number of devices, or the number of hotspots
Full suite of reports gives network administrators full visibility into their Wi-Fi networks and user activity
If you are looking to improve Wi-Fi security for busses and want to implement content controls to keep your Wi-Fi networks family-friendly, contact TitanHQ today for further information on WebTitan Cloud for Wi-Fi.
Many businesses now offer their customers free access to their Wi-Fi networks, but if guest Wi-Fi best practices are not followed, opening up Wi-Fi networks to guest users is not without risk. You may have provided security awareness training to your employees, but guest users are unlikely to be as careful while connected to your network. Customers and guests may accidentally download malware or visit malicious websites, or even engage in illegal activities due to the anonymity offered by someone else’s Wi-Fi network.
If guest Wi-Fi best practices are not followed, there will be people that take advantage of your lax security. They could launch an attack on your business network, explore your network assets, change router settings, or even gain access to confidential data.
If you run a hotel, restaurant, shop, or another business that provides Wi-Fi access to customers, it is important to create a safe browsing environment for all Wi-Fi users and take steps to secure your access points and control the activities that users can engage in while connected.
Guest Wi-Fi Best Practices for Hotspot Providers
Create A Separate Wi-Fi Network for Guests and Employees
You will no doubt have a Wi-Fi network that is used by your employees. It is important that this is totally separate from the one used by guests and customers. Guest users should access a totally separate network. Ideally, there should be a network firewall that separates guest users from employees. If you use enterprise switches, create a separate VLAN for access points that broadcast the guest wireless SSID. Also make sure you use a software firewall to block traffic from the guest network from your company’s servers and computers. Also make sure guest users can only access the Internet while connected.
Naming Your SSID
An SSID is the name you give to your Wi-Fi network that identifies it as belonging to your business. Care should be taken when choosing a name. Your choice should depend on the nature of your business and who the Wi-Fi network serves. If you run a coffee shop, for instance, you should make it clear which is your Wi-Fi network and prominently display that information. That will make it harder for rogue hotspots to be created to fool customers into connecting to an evil twin – A hotspot set up and controlled by a hacker to fool customers into connecting in the belief it is your hotspot.
Encrypt your Wireless Signals
Unsecured Wi-Fi networks may be easier to set up and use, but they also allow anyone within range to connect, even if they are not in your establishment. To connect, it should be necessary for a password to be entered. You should also encrypt your wireless network to make it harder for hackers to intercept users’ data. Secure your wireless network with WPA2 encryption or, even better, WPA3 if it is supported by your access point.
Create a Safe Browsing Experience and Control the Internet Content That Can be Accessed
You should develop and implement a guest Wi-Fi access policy covering what is and is not permitted on your Wi-Fi network. You should also enforce that policy with technical controls. A cloud-based web filter is ideal for this.
It is easy to deploy and configure and will allow you to carefully control the content that can be accessed while connected. You should block access to known malicious sites and illegal web content through blacklists. Category based filters are useful for blocking access to inappropriate content such as pornography and restricting bandwidth-heavy activities that can slow down Internet speeds for all users. By filtering content, not only will you keep your Wi-Fi users protected, you will also reduce legal liability and ensure that your Wi-Fi network is family friendly.
Adopt these guest Wi-Fi best practices to improve safety and security, keep your customers protected, and make it harder for cybercriminals to attack your network or your guest users.
It’s the time of year when the poor password practices of users are highlighted. This month has seen the list of the worst passwords of 2018 published and a list of 2018’s worst password offenders.
The Worst Passwords of 2018
So, what were the worst passwords of 2018? SplashData has recently published a list of the worst passwords of 2018 which shows little has changed since last year. End users are still making very poor password choices.
To compile the list, SplashData analyzed passwords that had been revealed through data dumps of passwords obtained in data breaches. More than 5 million exposed passwords were sorted to find out not only the weakest passwords used, but just how common they were. The list of the top 100 worst passwords of 2018 was published, although we have only listed the top 25 worst passwords of 2018:
Unsurprisingly, there has been no change in the top two passwords this year. 123456 and password have held number 1 and 2 spots for the past five years. Donald is a new addition but would not keep a user’s account secure for long, even if their name isn’t Donald. 654321 is also new this year but offers little more protection than 123456.
Other new entries include qwerty123 and password1 – Clear attempts to get around the requirement of including numbers and letters in a password.
How common are the worst passwords of 2018? According to SplashData, 3% of users have used 123456 and 10% of people have used at least one password in the list of the top 25 worst passwords of 2018!
Poor Password Practices and the Worst Password Offenders of 2018
DashLane has published its list of the worst password offenders of the year. In addition to the list containing users who have made very poor password choices by selecting some of the worst passwords of 2018, the report highlights some of the terrible password practices that many individuals are guilty of. Poor password practices that render their passwords absolutely useless.
This year has seen many major password failures, several of which came from the White House, where security is critical. Topping the list was a password faux pas by a visitor to the oval office – Kanye West. Not only was ‘Ye’ guilty of using one of the worst possible passwords on his phone ‘000000’, he also unlocked his phone in full view of an office full of reporters who were filming his meeting with President Trump. Ye’s poor password was broadcast to the nation (and around the world). This incident highlights the issue of ‘shoulder surfing.’ Looking over someone’s shoulder at their screen to see passwords being entered. Something that can easily happen in public places.
Another White House password failure concerned a staffer who committed the cardinal password sin of writing down a username and password to make it easier to remember. It is something that many employees do, but most do not write it on White House stationary and then leave the document at a bus stop.
Password security should be exemplary at the White House, but even more so at the Pentagon. Even staff at the Pentagon are guilty of poor password hygiene, as was discovered by Government Accountability Office (GAO) auditors. GAO auditors discovered default passwords were used for software associated with weapons systems. Default passwords are publicly available online which renders them totally useless. GAO auditors were also able to guess admin passwords with full privileges in only 9 seconds.
These are just three examples of terrible password practices. While they are shocking given the individuals concerned, they are sadly all too common.
Password Best Practices to Keep Accounts Secure
A password prevents other individuals from gaining access to an account and the sensitive information contained therein. Choose a strong password or passphrase and it will help to make sure that personal (or business) information remains confidential. Choose a weak password and an account can easily get hacked. Choose an exceptionally weak password and you may as well have no password at all.
To ensure passwords are effective, make sure you adopt the password best practices detailed below:
Make sure you set a password – Never leave any account open
Always change default passwords – They are just placeholders and are next to useless
Never reuse old passwords
Use a unique password for all accounts – Never use the same password for multiple accounts
Do not use names, dictionary words, or strings of consecutive numbers or letters
Ensure passwords are longer than 8 characters and contain at least one number, lowercase letter, uppercase letter, and a symbol – Long passphrases that are known only to you are ideal
Use a random mix of characters for passwords and use a password manager so you don’t have to remember them. Just make sure you set a very strong password for your password manager master password.
Set up multi-factor authentication on all of your accounts
Never write down a password
Never share passwords with others, no matter how much you trust them
Password Best Practices for Businesses
Verizon’s 2018 Data Breach Investigations Report revealed 81% of hacking-related data breaches were due to weak passwords or stolen credentials. It is therefore critical that businesses adopt password best practices and ensure users practice good password hygiene. Businesses need to:
Train end users on good password hygiene and password best practices
Enforce the use of strong passwords: Blacklist dictionary words, previously exposed passwords, previously used passwords, and commonly used weak passwords
Set the minimum password length to 8 characters (or more) and avoid setting a maximum length to encourage the use of passphrases.
Follow the password advice published by the National Institute of Standards and Technology (NIST)
Don’t enforce password changes too often. End users will just reuse old passwords or make very minor changes to past passwords.
Implement multi-factor authentication
Encrypt all stored passwords
Consider the use of other authentication methods – Fingerprint scanners, facial recognition software, voice prints, or iris scans
Educational institutions are being targeted by cybercriminals for all manner of nefarious purposes: To obtain the personal information of staff and students for identity theft and tax fraud, to steal university funds, and to steal university research.
University research theft is an easy income stream for hackers. Research papers can command high prices on the black market and are highly sought after by nation state governments and businesses.
This fall, the UK’s Daily Telegraph revealed Iranian hackers were selling research papers that had been stolen from top British Universities including Oxford and Cambridge. Several Farsi websites were identified advertising free access to university research papers, including an offer of university research theft to order. Provide the details and, for a price, the research be found and sent through an encrypted channel.
There were papers for sale on highly sensitive subjects such as nuclear research and cybersecurity defenses. Even less sensitive subjects are valuable to foreign businesses. The research could help them gain a competitive advantage at the expense of universities. In the case of Iran, universities are being used to gain access to Western research that would otherwise be off limits due to current sanctions.
It is not just British universities that are being targeted. The hackers are infiltrating university research databases the world over, and it is not just Iranian hackers that have tapped into this income stream. University research theft is a growing problem.
How Are University Databases Breached?
One of the main ways access to research databases is gained is through phishing – A simple method of attack that requires no programming know-how and no malicious software. All that is required is a little time and the ability to create a website.
Phishing emails are sent to staff and students that request a visit a webpage where they are required to enter their credentials to academic databases. If the credentials are disclosed, the phishers have the same access rights as the user. The phishers then download papers or advertise and wait for requests to roll in. They then just search the database, download the papers, and provide them to their customers.
Various social engineering techniques are used to entice users to click the links. Requests are sent instructing the user that they need to reset their password, for instance. The web pages they are directed to are exact copies of the sites used by the universities. Apart from the URL, the websites appear perfectly genuine.
Unfortunately, once credentials have been obtained it can be difficult for universities to discover there has been a breach since genuine login credentials are used to access the research databases.
How to Prevent University Research Theft
No single cybersecurity solution will protect universities from all phishing attacks. The key to mounting an effective defense against phishing is layered phishing defenses.
The primary cybersecurity solution to implement is an advanced spam filter to ensure as many phishing emails as possible are blocked and messages containing malicious attachments do not reach inboxes. SpamTitan for instance, blocks more than 99.9% of spam and phishing messages and 100% of known malware. Even advanced spam filtering solutions will not block all phishing emails, so additional controls are required to deal with the <0.1% of phishing emails that are delivered.
While a web filter can be used to block access to categories of web content such as pornography, it will also block access to known malicious websites: Websites used for phishing and those that host malware.
End user security awareness training is also essential. End users are the last line of defense and will remain a weak link unless training is provided to teach them how to identify malicious emails. Staff and students should be conditioned to report threats to their security teams to ensure action can be taken and to alert first responders when the university is under attack.
Multi-factor authentication should also be implemented. If credentials are stolen and used to access a database, email account, computer, or server, from an unfamiliar device or location, a further form of authentication is required before access is granted.
Universities should have security monitoring capabilities. Logs of access attempts and should generated and network and user activity should be monitored for potential compromises.
For further information on anti-phishing defenses and cybersecurity solutions that can help prevent university research theft, contact the TitanHQ team today.
There has been much debate over the use of web filters for libraries. On one side are those that believe that as places of learning, there should be no restrictions placed on the types of information that can be accessed through libraries. Libraries house books that are sexually explicit, racist, or contain material some may find distasteful or offensive, but banning those books would be inappropriate.
That same thinking has been applied to the Internet, access to which is often provided in libraries. The application of a web filter to block certain types of content is viewed as unacceptable by some people, even if as a result of a lack of technical controls library computers are used to access hardcore pornography. The American Library Association does not advocate the use of web filters for libraries, instead suggesting acceptable usage policies and educational programs are more appropriate.
The other camp considers the use of web filters in libraries to be a necessity to ensure libraries can be used by children and adults without others subjecting them to obscene and potentially harmful web content. Acceptable usage policies only discourage users from accessing pornography. Policies do not prevent such activities.
New Hampshire Library Considers Using Web Filtering Technology to Block Porn
The use of public library computers for viewing offensive sexual content is common. There have been many cases of library patrons discovering other users accessing adult content on computers in full sight of other users, as was recently the case at the Lebanon Public Library in New Hampshire.
A complaint was made to Lebanon Public Library about two children (of middle school age) who are alleged to have used the library computers to access pornography. Jim Vanier, youth center coordinator for the Carter Community Building Association, overheard the children discussing pornography at the computers, although they denied accessing adult content.
Vanier’s complaint prompted the Library Board of Trustees to form a task force to investigate current internet usage policies and the task force will consider whether a web filter is appropriate for the library.
While web filters for libraries are available to prevent obscene videos and images from being accessed, relatively few libraries have started implementing even the most basic content controls. The Children’s Internet Protection Act requires the use of web filters in libraries and schools, but only as a condition to obtain e-rate discounts and federal grants. In order to qualify for funds, obscene images, child pornography, and other information deemed harmful to minors must be blocked.
The municipal libraries in Lebanon have taken steps to curb Internet misuse and have introduced policies that prohibit computers from being used for any disruptive or inappropriate behavior, including the viewing of images of a pornographic nature. However, policies alone are insufficient to prevent all cases of inappropriate Internet use.
The reason why many libraries choose not to apply filters is often because web filters for libraries are not perfect, and as a result, they could filter out unintended content.
Accuracy of Content Blocking by Web Filters for Libraries
While there have been issues with web content filters for libraries overblocking content in the past, there have been major advances in web filtering technology over the past 10 years. Web filters can now more accurately assess and categorize content.
WebTitan Cloud, for instance, has highly granular controls and allows libraries to carefully control the content that can be accessed without overblocking.
While there is potential for user error when setting policies, WebTitan Cloud solves this issue by having an easy to use user interface that requires no technical skill to use. This helps to eliminate user error that often leads to overblocking of web content.
With WebTitan Cloud, libraries can easily filter out pornography, child pornography, and other obscene and harmful content to comply with CIPA and meet parents’ expectations without restricting access to valuable, educational websites.
WebTitan Cloud also blocks access to websites that host malware to prevent malicious software from being downloaded onto library computers, as well as blocking a wide range of Internet threats such as phishing.
WebTitan Cloud – An Accurate and Easy to Use Web Filter for Libraries
WebTitan Cloud is an ideal web filter for libraries. It is 100% cloud-based so not costly hardware purchases are required. It is easy to implement, simple to use, and allows Internet content to be carefully controlled without blocking access to valuable educational material.
Some of the key features in TitanHQ’s web filters for libraries have been detailed below:
WebTitan Cloud Features
Highly granular controls to allow precise filtering of Internet content
Unmatched combination of coverage, accuracy, and flexibility
Real-time classification of more than 500 million websites and 6 billion web pages in 200 languages
100% coverage of the Alexa 1 million most visited websites
Easy to use interface requiring no technical skill
100% cloud-based filtering – No hardware purchases or software downloads required
Supports Safe Search and YouTube for Schools
Supports whitelists and blacklists for creating exceptions to allow/block content outside general policy controls
Category-based filtering allows blocking through 53 pre-defined website categories and 10 customizable categories
HTTP/HTTPS filtering
Customizable block pages
Supports time-controlled cloud keys to allow certain users to bypass filtering controls – for research purposes for instance
Provides full visibility into network usage
Full reporting suite including real-time Internet activity
For further information on TitanHQ’s web filter for libraries, to arrange a product demonstration, and to register for a free trial to evaluate WebTitan Cloud in your own environment, contact the TitanHQ team today.
Are you looking for a Cisco OpenDNS alternative that is both easier to use and much more cost effective? On Wednesday December 5, 2018, you can discover how you can save money on web filtering without cutting any corners on protection.
A web filter is now an essential cybersecurity solution to protect against web-based threats such as phishing, viruses, malware, ransomware, and botnets. A web filter also allows businesses to carefully control the online activities of employees by restricting access to NSFW web content such as pornography and curb productivity-draining Internet use.
In addition to offering threat protection and content control on wired networks, a DNS-based web filter offers protection for BYOD and company owned devices regardless where they connect to the Internet. Multiple locations can be protected through a central web-based console.
A DNS-based web filter is cost effective to implement as no hardware purchases are required and no software needs to be installed. A DNS-based filter is also easy to maintenance and requires no software updates or patches.
With DNS-based filters, content control and online threat protection is simple; but what about cost? Many businesses have looked at Cisco OpenDNS to meet their web filtering requirements but are put off due to the high cost. Fortunately, there is a more cost-effective way of filtering the Internet.
TitanHQ and Celestix are hosting a webinar on a WebTitan-powered Cisco OpenDNS alternative, Celestix WebFilter Cloud.
Celestix will be joined by by TitanHQ EVP of Strategic Alliances, Rocco Donnino, and Senior Sales Engineer, Derek Higgins, who will explain how Celestix WebFilter Cloud works, why it is an ideal Cisco OpenDNS alternative, and how you can have total protection against web-based threats at a fraction of the cost of running OpenDNS.
The webinar will be taking place on Wednesday December 5, 2018 at 10:00 AM US Pacific Time
