Protecting Your Ecommerce Platform from Hackers in 2018

Security

 

2017 saw an increase in cybercrimes in Australia. Back in May, News.com.au reported on the massive ransomware attack across the world, mentioning that at least three private businesses in Australia were hit. While Australia didn’t experience any major attacks, other countries suffered losses. In total, the incident affected around 200,000 people in 150 countries. Countless computer systems were examined in relation to the extortion plot where users would get kicked out unless they sent payment.

2018 brings a clean slate of opportunities for online businesses to strengthen their security systems. Ecommerce platforms are the most at risk, since they involve payments and valuable information. In determining how strong your website’s defense is against hacker threats, consider some of these factors:

Customer data

Identity thefts will not occur if there is nothing to steal. Therefore, you should refrain from saving any customer data that isn’t important to your business. Storing payment card details is against PCI (Payment Card Industry) standards anyway. These details are usually handled by the payment provider. What you can do is use an encrypted checkout tunnel so that your servers won’t save any payment data.

Firewall

For your ecommerce business to have decent security, it should at least be able to withstand common attacks. Business2Community suggests to begin with a firewall, because it weeds out the untrusted networks and controls the website traffic. Firewalls serve as a great first line of defence against the usual hacking threats.

DoS and DDoS Protection

Once in a while, your server may be attacked by malicious queries that intend to keep your website from functioning properly. These Denial of Service or Distributed Denial of Service attacks can keep you out of business for a long time, which is why security measures should be taken to prevent them. DoS and DDoS raids can come from different sources, like applications and traffic flooding.

The best defence is to invest in more bandwidth, since a large amount of space will render it difficult for attackers to flood your site. The downside is that this is also the most expensive solution. However, it’s in your best interests to spend on security. DP Computing previously explained the importance of not being cheap when it comes to security technology, as it serves your business in the long run.

HTTPS

Another DP Computing article advised to pay close attention to the URLs on Google, because hackers would sometimes use phishing scams to acquire sensitive information from customers. These involve links that if accessed, will install malware on your PC that can steal information.

When checking URLs, be wary if the website uses only HTTP. It is more appropriate for ecommerce platforms to use HTTPS, especially on pages where data is created. Unlike in HTTPS, information entered on HTTP is not encrypted. The data is only sent as plain text, making it an easy target for hackers to intercept. Although, remember that not all website pages need to be in HTTPS, or else your website speed will suffer.

Pay attention as well to how your website appears on Google search results, especially if your business is using paid search ads. Ayima noted that Google has improved its algorithm on paid search ads, stating that emphasis is placed on close variants. This means that advertisers will have an easier time of building lists to match user queries. Since paid ads are becoming more rampant now, hackers have taken the opportunity to promote their malicious sites in order to fool thousands of victims. If by any chance, your website’s ad appears shady or seems similar to a malicious ad, take it as a sign to rethink your campaign.

In today’s digital landscape where hackers are getting more creative with their attacks, the importance of cyber security cannot be stressed further. For ecommerce businesses, security investment should be one of the top priorities. Left unchecked, your website could close down at any time, resulting in huge losses in revenue.

 

Traveling With Technology?

Business trips can be stressful at the best of times. Whether you’re off for an overnight visit to a client, a few days for a training session or a longer business conference there are certain things you need to keep in mind:

Be careful with free WiFi
Many hotels have free WiFi along with libraries, cafes, bookstores and other public areas. Unfortunately, that convenience can come at a huge cost. The wireless network you use to check your email while relaxing with a latte could be operated by someone up to no good or even have been taken over by a hacker.

Using a VPN can help as well as only using secure websites (make sure the sites you visit have the little HTTPS lock).

Connect via your cell phone
The wireless networks in hotels are notorious for being slow or insanely expensive. You may find that you can use your mobile as a wireless Internet connection. This means that you connect your laptop to your phone via WiFi or cable and piggy back on its mobile internet connection. Most carriers and phones allow this – but not all. Importantly, if you’re in another country it can also be worthwhile getting a local sim card for your phone rather than paying expensive roaming charges.

Don’t forget power adapters
You’ve seen it before…people asking to borrow your charger and huddling around in groups until their device has enough juice to get them through a few more hours. Remember it is only funny when it happens to other people so make sure that it doesn’t happen to you. Be sure to pack your correct power adapters and cables, along with any plug/voltage converters required to match where you are going. It is also worth carrying your USB charging cables on your person or carry on luggage, as many planes and airport shops now offer a place for you to plug in for a quick boost.

Have plans for being offline
Sometimes you simply can’t get online, which will do you no good when you’re checking into your hotel and all your booking details are tucked safely away in your email acount. You can print out essential travel and business details on paper, but if you have a lot or don’t want to carry them, you can also save them to a document on your phone or computer. Emails can be copied and pasted into a MS Word document, or you can print them to PDF by pressing Print > Save to PDF (or similar). Many apps also have an offline mode that allows you to store the information on your computer, including Evernote and Netflix.

Need a tech checkup before you go away? Call us today at 08 8326 4364 or via email at support@dpcomputing.com.au.

IT vs Productivity – How You Can Win the Battle

Productivity & ITHow much time and productivity did you and your staff lose on computer problems over the last year? Without getting an analyst in to crunch each action and every number, you’ll never know how much money you could have earned in those lost hours. Right now, what you know for sure is that you didn’t go into business to be an IT expert, but suddenly there you are: battling servers, workstations, software, protections and permissions, all on a daily basis…managing all those things you don’t particularly care about, or understand more than you need to. Somehow, you ended up running an IT company plus your regular business.

It didn’t start that way. You got into business because you’re great at what you do. We can help you get back to doing what you’re really passionate about, and free up your time for revenue growth activities. Offload all those niggly It tasks sucking away your day to our Managed Service Provider (MSP) team.

Here are some examples of what we can take care of for you:

Software and security updates: If it seems like an update for something is always popping up, sending your employees away for yet another coffee break while it runs, you’re not far off. While it is great that software providers are continually improving their product, patching holes and reinforcing against threats, keeping up with them all can be incredibly time-consuming. Our MSP can handle all updates and patches keeping your employees focused on their business tasks.

Help desk: We can take care of all those “I don’t know how to”, “I think it’s broken” or “I need another” tech problems that can drive you crazy. You can simply circulate the new protocol – ask DP Computing – and watch how fast these small problems are solved, and your employees are back to work, more productive than ever.

Network management and security: The last thing you want is extended downtime due to a crashed server or a cyber-attack. Our monthly MSP plans works with you to balance security with your business’ necessary tasks and access, leaving you protected and operational. You’ll have staff set-up with the exact permissions they need, robust backup systems in place, and early warning when hardware/software is aging out.

Strategic IT planning: Why blow your IT budget putting out fires, buying incompatible systems or tech you simply don’t need? DP Computing can conduct strategic planning in line with your goals so you’re able to scale what you already have and schedule new expenses in time to meet projections.

The time you spend battling IT problems could be time you spend earning money, growing your business and moving strategically forward. Moving to a monthly managed service plan with DP Computing is easier than you might think. Simply let us know you’re ready to get back to the parts of your business you love and we’ll take the stresss of computing away from you.

Get managed services for your business. Call us at 08 8326 4364 or via email support@dpcomputing.com.au.

Why You Need A Multi Layered Approach To Security

Multi layered security

Firewalls are a well-known security essential, and we are certainly big fans, but did you know a firewall alone is not enough to keep your business safe? It is like building a fence around your house to keep the burglars out: You feel safe, private and secure… but the reality is, anyone with a ladder, enough motivation or ninja skills poses a real threat. That is why despite every networked business having a firewall in place, security breaches are increasing at an alarming rate – further protections are still needed.

Without these additional protections, once the firewall is beaten or bypassed it’s like a fox in a hen house. The bad guys are free to view and download files, make changes, and even take over your systems completely. That’s why computer security works best when it’s multi-layered. When one protection fails, the next layer kicks in to keep your business safe. And then the next, and the next…but that doesn’t mean you need CIA level security that gets in your way.

A few strategic, well-planned measures can provide all the protection your business needs to keep operating without costly downtime. While it’s cool to imagine a system so secure you’ll be opening doors with retinal scanners the reality is infinitely more usable and affordable. In fact, we’ll help you choose the perfect measures that blend invisibly into your existing processes, boosting security without affecting productivity. Take a look at some of our offerings:

Proper firewall device
While not enough by itself, your firewall is still your first line of defence. However, there’s a huge difference between the generic firewall that comes standard with your broadband router and a dedicated hardware firewall appliance. Our technicians will work with you to identify which firewall is suitable for your business.

Corporate Grade Antivirus Software
A free antivirus program might be ok for home use but do you really want a free program with no backup or support protecting your confidential business data and financial information?

Access restrictions
We’ll help you give employees access to only the files they need to do their job. It’s not a matter of trust, but rather one of security. If they were the one to accidentally let the attackers through the firewall, perhaps by clicking an email link, you’re then able to limit the damage. Without this added layer of protection, it’s relatively easy to access any and all files.

Encrypt confidential files
More secure than simply password locking a file, this uses a secret ‘key’ to scramble the files and their contents, so that when anyone else tries to view them all they see is incomprehensible nonsense. Our technicians can setup an encryption system for you so that approved users can use them normally while all files remain secure.

Backups
As nothing is totally 100% secure no matter what features you implement a backup is a necessity. Having your data backup on multiple removable devices (stored both locally and offsite) as well as a cloud based backup is a must.

DP Computing offers security services to make sure all our clients are protected and all their security products are operating at 100% efficiency. Threat analysis, prevention, management and response are all included so your focus can remain on growing your business and we’ll take care of the bad guys.

Give us a call at 08 8326 4364 or via email at david@dpcomputing.com.au about multi-layered protections for your business.

Eleven Best Security Practices To Stop Ransomware

Ransomware and most malware attacks start in two main ways. A booby-trapped email with a malicious attachment or via a compromised website; which then work their way down to your endpoints and servers.To stop these attacks, it is critical that you have a multi layered approach to security.

This starts with a training your employees and patching your devices right through to cloud based malware filters, dedicated hardware firewalls and corporate grade security applications on each device.

The eleven best security practices to apply now are:

  1. Employee training
    Regular training for employees is essential. Employers need to inform their staff on what to look out for and don’t trust the contents of every email they receive.
  2. Patch early, patch often
    The sooner you patch Windows the fewer holes there are for ransomware to exploit.
  3. Backup
    Backup regularly and keep a recent backup copy off-line and off-site. Offline and off-site means ransomware can’t get to it. With recent backups data loss can be minimized.
  4. Implement corporate grade security software
    A free antivirus program might be ok for home use but do you really want a free program protecting your confidential business data and financial information?
  5. Install a firewall or UTM
    You probably don’t just rely on a cheap door lock on the front door of your house so why rely on a basic firewall on the electronic entrance to your business?
  6. Enable cloud based email filtering
    Don’t rely on your local antivirus software detecting and stopping malware within your email application. Block it before it even enters your network by using using a cloud based filter – one that uses multiple filters is even better.
  7. Enable file extensions.
    Enabling extensions makes it much easier to spot file types that wouldn’t commonly be sent to you.
  8. Disable Macros
    Don’t enable macros in document attachments received via email. A lot of infections rely on persuading you to turn macros on, so don’t do it!
  9. Be cautious about unsolicited attachments
    If you aren’t sure – don’t open it. Check with the sender if possible.
  10. Admin Login Rights
    Don’t have more login power than you need. Having administrator rights may bake things easier for administration but they also give malware free ranges on your computer and network. An infection which may be able to be contained to one device could become a network disaster is the malware exploits admin rights.
  11. Keep applications up to date.
    Stay up-to-date with new security features in your business applications
    For example Office 2016 now includes a control called “Block macros from running in Office files from the internet”.

Don’t Become a Victim of Social Engineering

Social EngineeringYou can have the best in computer and network security but if you or one of your staff members inadvertently give out some information all the security can come to nought.

Social engineering is the art of manipulating other people to take certain actions or divulge private information. Some hackers use social engineers techniques and skip the hassle of writing code and go straight for the weakest link in your security defenses – you and your employees. A seemingly innocent phone call or email may be all it takes to gain access to your computer systems, despite having solid software and hardware protections in place.

Here are a few ways on how social engineers work:

Email: Pretending to be a co-worker, supplier or customer who needs a simple piece of information. It could be a money transfer, contact person or some sort of personal details that they pretend they already know, but simply don’t have in front of them. The hacker may also create a sense of urgency or indicate fear that they’ll get in trouble without this information. Your employee is naturally inclined to help and quickly responds with a reply.

Phone: Posing as IT support, government official or even a customer, the hacker can manipulate your employee into changing a password or giving out information. These attacks are hard to identify and the hacker can be very persuasive, even using background sound effects like a crying baby or call-center noise to trigger empathy or trust.

In person: A person in uniform or a repairman can easily get past most people without question. The social engineer can then quickly move into sensitive areas of your business. Once inside, they become invisible and are free to install network listening devices, read a Post-it note listing passwords or gain information and tamper with your business in other ways.

It’s impossible to predict when and where (or how) a social engineer will strike. The above attacks aren’t particularly sophisticated but can be extremely effective. Your staff have been trained to be helpful, but this can also be a weakness.

So what can you do to protect your business? First, recognize that not all of your employees have the same level of interaction with people, the front desk person taking calls and welcoming visitors is at higher risk than the back office or factory worker. We recommend cyber-security training for each level of risk identified and focus on responding to the types of scenarios like those listed above. Social engineering is too dangerous to take lightly.

Talk to us about your cyber security options today. Call us at 08 8326 4364 or at support@dpcomputing.com.au

Keep Your Systems Up to Date

Computer Updates

Updating your computer systems and associated business software is one of your best protections against cyber-attack, but actually running the updates is a task that businesses often overlook. Either they take too long, they pop up at inconvenient times, don’t know when an update is available or simply don’t know what to do. Do you have a plan in place to ensure all your tech is up-to-date or are you flying by the seat of your pants?

Emergency updates are a killer

Most businesses update their software only when the computer technician comes to fix a different problem. The tech runs the update before they leave but as time goes on the systems sit there with ever-widening security gaps… until another breach happens and the techs are called back for another band-aid solution. Emergency only updates in a break/fix model are a great little earner for those techs but not so good for your uptime and system security.

Finding time for maintenance

To keep your business up and running securely, you need someone who lives and breathes IT. They need to know when and how to apply all the patches and how to make sure all your other tech is playing nice (and may be even do it all after-hours to save you downtime). Businesses that have an in-house IT specialist should be set – and they should already have an update plan. But if you don’t have a qualified IT team, outsourcing to an IT specialist is the perfect solution. You get highly skilled technicians remotely applying your network updates at a time that suits you.

What else needs to be checked?

Beyond running security patches, it’s important to keep your business moving forward. Here are a few areas our techs look at as part of our regular service plans:

Hardware health: The last thing you want is days of downtime after a piece of hardware dies. By not staying on top of your hardware health, you are opening yourself up to lost productivity, lost income and unknown delays. Our services can assess and replace components before they break.

Operating system expiry: Keeping an operating system after the manufacturer ceases support can leave your business wide open for attack. It is simply not a good combination and can cause compliance issues in certain industries. Our managed service technicians will advise you of any changes coming up for your OS and suggest the best upgrade for your needs.

Legacy programs: Updates to your software have the potential to disrupt older program that can result n errors, slow performance or even downtime. With technology advancing so fast, we often find additional requirements are required before updates can be installed. Our technicians always make sure to check for compatibility as a whole before running an update.

Staying on top of your maintenance and upgrades can be a huge challenge for small business. Outsourcing to our regular service plans can help more than your budget – call us today at 08 8326 4364 .

How The ‘KRACK’ Wi-Fi Security Issue Affects Us All

WPA2 KrackedThe invention of Wi-Fi or wireless networking has been a dream come true. We can use our laptops and tablets anywhere in the office and our phones are using the main internet connection instead of sucking down data on the 3G / 4G network. It is essentially the backbone of the smart tech boom for home and business alike. Most Wi-Fi networks are password-protected with an encryption called “WPA2” and up until now this has been safe and secure.

Recently, a security flaw called KRACK (The Key Reinstallation AttaCK) was discovered. KRACK allows hackers to break into Wi-Fi networks – even the secured ones and your wireless networks are possibly vulnerable as a result.

How KRACK works?

KRACK doesn’t work via a problem with your device or how it was set up as it is an actual issue with the Wi-Fi technology itself. The attack gets between your device (eg computer, tablet or mobile phone) and the wireless access point (eg modem / router) to reset the encryption key so hackers can view all network traffic in plain text. Since just about everyone relies on Wi-Fi so much, this might mean hackers have a front row seat to your credit card numbers, passwords, confidential files, emails and more.

NOTE: The hacker needs to be in physical range of your Wi-Fi network to exploit this flaw and it doesn’t work remotely like other attacks we’ve seen recently. Given that most Wi-Fi networks extend well past your own home/business walls, this is small comfort, but important to know.

How to protect yourself

Run your updates: Software updates are being released which fix the flaw. Microsoft has already released them for Windows and Apple has one coming in a few weeks. So please take a few minutes to make sure you’re up to date with all your patches on any device that uses Wi-Fi (your smartphones, laptops, tablets, PCs, game consoles, etc). Unfortunately, some devices may be slow to get an update (eg Android phones), or if they’re older, may not get an update to fix the issue at all. If possible, consider using a cabled connection on those older devices or upgrade to one with support. With smart phones consider using data on the 3G / 4G network instead of Wi-Fi.

Be very careful with public Wi-Fi: While your local business center, library or school campus should have expert IT professionals keeping guard over security, it is a very different matter at your local coffee shop. It is unlikely small locations such as this will be on top of security patches. Remember, a hacker exploiting this flaw only needs to be in the same Wi-Fi area as you, so be careful you don’t give them an opportunity to grab your precious data.

Check your browser security: Before sending anything private over the internet, check that you are using a secure HTTPS site. You’ll know these by the little padlock you see next to the URL, and the address specifically begins with HTTPS. Major sites like Facebook, Gmail and financial institutions already use HTTPS.

If you need help updating your devices, or want us to check if you’re safe, give us a call on 08 8326 4364 or via email at support@dpcomputing.com.au.

How to Tell if Your Computer Has a Virus?

How to tell if your computer has a virus?Sometimes computers do crazy things that ring alarm bells and make users think it is a virus. Next thing you know the boss is telling everyone to run scans and demanding people come clean about their browsing habits. Fortunately, not all weird occurrences are viruses related – sometimes your computer is simply overloaded, overheating or in desperate need of a reboot.

Here are some of the tell-tale signs that your computer maybe infected with malware:

Strange Error Messages

Does your computer have messages popping up from nowhere that make no sense, are poorly worded or just plain gibberish. Take note of anti-virus and security warnings too, check that the warning is from YOUR anti-virus software and looks like it should occur. If a message pops up that isn’t quite right then don’t click it – not even to clear or cancel the message. Close the browser or shut down the computer, then run a full virus scan.

Suddenly Deactivated Anti-virus / Malware Protection

The best way past a security guard is to sneak it when they are not around. Certain malware infections are programmed to disable the security systems first, leaving your computer open to infection. If you reboot and your protections are not enabled you may be under attack. Attempt to start the anti-virus manually and if that doesn’t work, backup your data and try and reinstall your security software.

Social Media Messages You Did Not Send

Are your friends replying to messages you never wrote? Your login details may have been hacked and your friends could be tricked into giving up personal information or money. Change your password immediately and advise your contacts of the hack.

Web Browser Acting Strange?

Perhaps your homepage has changed, it is using an odd search engine or opening/redirecting your to unwanted sites. If your browser has gone rogue it is definitely malware which could be trying to steal your personal or financial details. Skip the online banking and email until your scans come up clear and everything is working normally again. Once you are certain your machine is clean, change all your passwords.

Sluggish Performance

If your computer speed has slowed, boot up takes an eternity and even opening programs takes forever, it is a sign that something is wrong. It is not necessarily a virus though. Run your anti-virus scan and if that resolves it, great, if not, your computer may have a hardware issues or your computer needs a tune-up or service.

Constant Computer Activity

You are not using the computer but the hard drive is going nuts, the fans are whirring, and the network lights are flashing like a disco? It is almost like someone IS using the computer! Viruses and malware attacks use your computer resources, sometimes even more than you do. Take note of what is normal, and what is not and seek help if it looks like something is amiss.

If you have a virus that you can’t get rid of or need a service on your computer give us a call at 08 8326 4364 or at support@dpcomputing.com.au.

What You Need to Know About Facebook Privacy

Facebook PrivacyA lot of people use Facebook but finding the balance between privacy and Facebook fun can be challenging. It allows us to connect with friends near and far but also it publicly shares information that just a few years ago, we’d never dream of putting online. With a Facebook search you can look for people based on where they went to school, town they live in, clubs they belong to, who they’re related to… but when is it too much information?

Your birthday is the first piece of info collected by Facebook when you sign up and it is great getting birthday wishes from friends and family when it appears in their news feed. But while your friends are sending you balloons and funny memes, your birthday is now public knowledge. It may seem harmless, but when you call your bank or other institution, what’s the first question they ask to verify your identity? Your birthday! Some companies and organisations even ask questions like ‘which high school did you go to?’ assuming this is knowledge that only you would know. Except… a lot of people have publicly shared it on Facebook. Whoops!

Then there are the stories of people who have lost their jobs after less-than-wholesome pictures or comments have gone public. If you want to protect your reputation, you may not want pictures from last weekend’s private party showing up online. While you can’t control what others do with photos they take of you, you can control whether or not you are tagged in Facebook in them.

Fortunately, there are settings in Facebook that allow you to control who can see what information and what happens when you’re tagged in a photo. Despite what rumours you may have heard or seen floating around, you do have complete control over your Facebook privacy and it is easy to adjust.

How to Check and Adjust Your Facebook Privacy Settings

Here are some settings you can easily change within Facebook to help secure your privacy and see who can see what on your profile. These steps assume you are logged into Facebook via a browser (using an app on your phone or tablet may be different).

See what your account looks like to an outsider

To see what others can see of your profile follow these steps:

  1. From your Facebook homepage, click your name on the blue bar at the top of the page.
  2. Click the three dots next to ‘View Activity Log’.
  3. Now select ‘View as…’

Run a quick privacy checkup

To run a checkup click the question mark in the top right corner of Facebook and choose the ‘privacy checkup’. Facebook then guides you through a few steps showing what your main settings are.

From within this section think about what you really need to share. For example do people need to know the YEAR of your birth or just your birthday? You can hide the year and your friends will still get the notification.

Edit advanced privacy

While the above checkup covers the most obvious information you can delve much deeper via the privacy section. Click the V-shaped drop down to the right of the question mark and go to settings and select privacy.

Adjust timeline and tagging

In the privacy settings (mentioned above), you can control who can tag you, who can see or share the tagged content and what shows up in your news feed.

I hope that explains about privacy and allows you to go in  and change the settings to what you want and not what the Facebook defaults are.

Tightening your Facebook privacy only takes a few minutes, but it can save you a whole lot of trouble in the future. If you need help with this, just give us a call on 08 8326 4364 or via email at support@dpcomputing.com.au.