Information Technology Navigator

Ransomware has rapidly become the single largest cyber threat we face today and if the first half of 2021 was any indication, things are only going to get worse. Colonial Pipeline, Kia Motors, JBS Foods, Kaseya and CNA Financial have been some of the more notable, high-profile attacks this year. In the case of the Colonial Pipeline, the attack impacted over a dozen U.S. states and cost the company $5 million. Colonial Pipeline was able to recover ~$2.3M of the ransom, but that is often not the case. CNA Financial was not as fortunate and needed to pay an estimated $40 million to retrieve the encryption keys for their data. And ransom from the Kaseya attack, which impacted an estimated 800 to 1,500 businesses, is said to be in the range of $70M which would make it the largest ransom ever paid (should Kaseya decide to pay).

Read More

Cloud security is a constant concern for organizations of every size. Stopping malicious actors from accessing your company’s systems and data is a top priority, but is made difficult by the number of different exploit techniques coupled with the sophistication of the attacks. One area of particular concern is legitimately compromised user credentials. For example, if a password I use frequently (maybe even a strong one) is exposed in a breach of an e-commerce company. The malicious actor located in Moscow who obtains this userID (likely an email of mine) and password then does a quick lookup on LinkedIn and finds that I work at Daymark. From here, the exploit is obvious. They now have a legitimate username and password combination and while we do employ multi-factor, there are constant threats to that.

Read More

Properly securing assets is a constant challenge for IT. Staying one step ahead of the bad actors is a never-ending job and with a well-known shortage of IT security professionals, it’s critical that those of us responsible for protecting systems, networks and data are smart about deploying tools that will help remediate or minimize cybersecurity risks. Microsoft built Azure Security Center to help. It aligns Azure resources with Microsoft best practices to mitigate risks associated with security vulnerabilities that could lead to a breach or other security incident.

Microsoft Security Quick Facts

Read More

As COVID forced organizations around the world to send their workforce home, creating the work from home (WFH) phenomenon, IT and security teams rapidly focused on Zero Trust approaches to security to mitigate challenges of enabling secure remote work. Modern workplace employees are getting their work done any way they can these days – using personal devices, sharing data through new services, maxing out home WiFi, and collaborating outside the confines of traditional corporate network security. It has created an IT balancing act between security and WFH productivity.

Read More

Secure access to email and other business productivity tools continues to be a top priority for IT administrators. Microsoft services, such as Azure Active Directory and Office 365, use OpenID Connect for authentication and OAuth 2.0 for authorization. Here’s how that process works: When Outlook connects to Exchange Online, the API requests are authorized using OAuth 2.0 Access Tokens. They are valid for one hour. When the tokens expire, the Outlook client is redirected back to Azure AD to refresh them. This provides an opportunity to re-evaluate policies for user access. If a user has been disabled in the directory or because of a Conditional Access policy, the admin might choose not to refresh the token.

Read More

To say the cybersecurity community is a buzz over the recent news of the highly-sophisticated data breaches at many U.S. government agencies this month due to vulnerabilities in the SolarWinds Orion IT management platform is an understatement. Experts believe that Russian government hackers are behind this global espionage which may have started as early as last spring. The threat actors conducted a supply chain attack on SolarWinds Orion Platform with a backdoor through a FireEye software update. The SolarWinds versions impacted are 2019.4 HF 5, 2020.2 with no hotfix installed, and 2020.2 HF 1. Agencies affected include the Pentagon, the Department of Homeland Security and the Department of the Treasury.

Read More

Azure Sentinel is a cloud native Security Information Event Management (SIEM) and Security Orchestration, Automation and Response (SOAR) solution from Microsoft. It was the topic of discussion at one of our recent Daymark Cloud Clinics where our technical cloud consultants offer complimentary technical training and tips on a wide range of Azure and Office 365 features.

Read More

Mimecast held their 2020 Cyber Resilience Summit remotely this year covering a wide range of topics. You can read our previous blog “Mimecast Cyber Resilience Summit 2020 – Key Takeaways” for those highlights. In addition, Mimecast provided some alarming data on the pandemic threat reality that we are facing.

 

Mimecast collected 100 days of detection data from January 2020 to April 2020. The results below reveal a 36.9% INCREASE in threat detections, where the key focus of threat actors has become high volume Spam and Impersonation. Here’s the breakdown: 

Read More

 

Mimecast held their 2020 Cyber Resilience Summit remotely this year, providing some interesting updates to their suite of cyber security tools.  As a leading Email Security Gateway, Mimecast has expanded their portfolio over the last few years into a more robust and comprehensive framework that they have dubbed “Email Security 3.0”.

 

The Email Security 3.0 Framework can be broken out into three zones of protection:

Zone 1:  Perimeter – This is your traditional email delivery path and is saturated with relentless attacks.  In order to protect against these threats, Mimecast leverages their advanced Targeted Threat Protection including impersonation protection, attachment sandbox, and URL Protection.

Read More

On July 16, 2020, the European Court of Justice (ECJ – the EU’s high court) invalidated the EU-US Privacy Shield Framework as a potential mechanism for meeting the GDPR's cross-border personal data transfer restrictions.

Effective immediately, U.S. companies that process EU “personal data” can no longer rely on registration under the Privacy Shield and must establish an alternative legal basis for any continued EU-US transfers.

Previously, cross-border transfers to the US were permitted under three mechanisms: 1) the Privacy Shield (http://privacyshield.gov), 2) Standard Contractual Clauses (SCC), and 3) Binding Corporate Rules (BCR).

Read More