KTC Consulting Inc.

Keylogger 101 We have all heard of hacking, virus, ransomwares, etc. as they keep coming up in the news every now and then. But, have you heard of keyloggers? In this blog post, we discuss keyloggers and how they can be used to gain unauthorized access to your system, online accounts, network and data. As the name suggests, a keylogger logs keys--it captures the keystrokes you make. In fact, use of keyloggers is not illegal. Keyloggers are perfectly legal and are often used by companies to keep tabs on their employees' IT activities during work and closer home, parents use keyloggers to monitor their children’s computer activities for safety and security purposes. But, as with all tools, even keyloggers can be misused and cause a lot of damage if leveraged by a cybercriminal. By logging keystrokes, the keylogger captures passwords and other confidential information. Imagine someone having access to all your usernames and passwords. Your bank accounts, your shopping accounts, your o...

Social media security Social media is a great tool for SMBs to get the word out about their products and services, build their brand, and connect with prospective customers. It also offers paid marketing avenues as well, such as PPCs, marketplaces, etc., But are your social media accounts secure? Typically what happens in a business account on social media is that multiple people may have access to the account. Access could stretch across different departments such as marketing, sales, PR, HR or it could be multiple people from a single team with access rights--usually marketing. If you outsource your social media management to marketing agencies, their staff also end up having access to your social media accounts. All of these situations make your social media accounts very vulnerable. Here are a few tips to keep your social media accounts secure. Always be aware of who has access to your social media accounts. This may seem obvious, but you may be surprised to know that many SMBs are...

Three things to consider when investing in new software When running a business, you will often find yourself in need of new software tools to enhance the productivity, efficiency, effectiveness and even the security of your various business processes. These software programs range across a wide spectrum of tools including accounting, finance, IT, e-commerce, marketing, sales and many more. In this blog post, we discuss the key elements you should consider before investing in software tools for your business. Whose software is it, anyway ? Learn more about the company that owns the software. Find out how long they have been in the business. Are they dealing in similar software programs across different industries, or is this their only product? Get more information about their company size and business model. How do they sell? What kind of after-sales support do they offer in terms of training, troubleshooting and product updates? You need to have answers to all these questions. This i...

Insider threats: Not as uncommon as you think When we speak of cybercrime and data theft, we typically think of seasoned cybercriminals. But you’d be surprised to know that the cause of businesses becoming victims of cybercrime is most often their own employees--sometimes on purpose, sometimes inadvertently. Remember Bob from accounting who was let go? Or the new intern who worked for 3 days and never showed up? Yep! They could engage in cybercrime activities to ‘get back at you’. Many businesses have been victims of cyberattacks brought on by disgruntled employees, both current and ex. No matter who attacks you virtually, whether it is a seasoned cybercriminal or an employee who is simply upset with the kind of coffee your office coffee machine makes, becoming a victim of cybercrime causes you a lot of damage. For starters it erodes the trust your customers have in your brand, it affects your brand negatively. If your data is held ransom, you have no choice, but to pay up the demanded...

Gaining a competitive edge during the pandemic The COVID-19 pandemic has been tough on everyone. The lockdowns, the need to follow social distancing--though indispensable--have been tough on individuals and also resulted in a lot of revenue loss to businesses. For SMBs though, this time has been particularly difficult, with a general downturn in the economy and the job losses, which has been affecting people’s ability to make purchases. In the middle of all these challenges, SMBs are grappling with yet another issue--the need to keep their business running, even remotely in some cases. A lot of businesses had a tough time adapting to the work-from-home setup. Since this sudden transition to the work-from-home model was largely unplanned, a lot of them became victims of cybercrime and many more are being targeted even as you read this. If you're one of those businesses that implemented the WFH model overnight, then it’s time you paid attention to the cybersecurity angle of it. Here ...

Best practices for remote desktop access Remote desktop access is an essential in these days when businesses are expected to be responsive to their clients almost 24/7. Moreover, there has been a surge in the remote desktop access practice with coronavirus pandemic. But, did you know that remote desktop access, while almost indispensable now, can threaten your network security? In this post, we discuss a few best practices that you should engage in for safe remote desktop access. Have your basics in place Make sure your security basics are covered. Your systems should be secured with the latest Firewalls, anti-malware software and up-to-date with all security patches and software upgrades. Another item on this list is passwords. Make sure you are following good password hygiene such as no password sharing, setting secure passwords, not repeating passwords, etc., Train your employees Train your employees who will be accessing your network via remote desktop connections to identify cyber...

Five reasons to invest in a password management system ASAP Password management tools are software programs that put up enough security and safety mechanisms in place to ensure there’s no password breach. Your employees can use the program to generate random, high-security passwords as per the industry best practices. They don’t have to worry about remembering them either, because these tools have built-in mechanisms to store the passwords securely and retrieve them automatically when needed. All passwords are encrypted and stored privately, so no one, other than the authorized user has access to their passwords. It takes care of timely password update reminders and password reset, so you don’t have to worry about them. Password management tools make it easy for you to enforce role-based access permissions. For example, a data entry executive may be able to enter data into the sheet only once, and may need authentication from the manager to edit the data, or only someone at the manager...

Eight common password mistakes to avoid Research points out that more 80% of data breaches happen due to password hacking, meaning that poor password hygiene is responsible for a majority of cybercrimes that follow data breaches. To make sense of this statistic better, let’s first look at what constitutes poor password hygiene. Using simple passwords Often passwords that are easy-to-remember are easy-to-hack. Do you use passwords such as password, password1234, delta123, etc.,? If yes, then you should be changing them at the earliest to something less obvious. Repeating passwords across platforms As another solution for remembering passwords, people tend to use one, single password universally. This dilutes the password even if it is a strong one. Plus, there’s always the risk of the password being hacked at one place and putting the data stored at all other places also at risk. Unauthorized password sharing Unauthorized password sharing for the sake of getting things done faster is a ...

How to manage cookies effectively so they are not a threat to your data Avoid third-party cookies: Third-party cookies are primarily used for online advertising and retargeting, so you won’t miss anything significant by avoiding these cookies. So, whenever you see a cookie alert on any site, first, check if it is for third-party cookies and if yes, it’s best to ‘Not accept cookies’. As a business, don’t allow third-party cookies on your site. Secure sites: Make sure the sites you visit are secure (HTTPS) and have a valid SSL(Secure Socket Layer) certificate. The SSL certificate ensures that any data that’s exchanged is encrypted, meaning even if the hackers get access to the cookies, the information will be garbled eliminating any data leakage. As a business, make sure your site is secure and has a valid SSL certificate. Anti-malware software and security patches: Install antimalware software programs on your computers and make sure they are up-to-date. Install security plug-ins and...

Understand your Cookie to manage it better! There are 3 kinds of cookies, each having different functions. One of them is session cookies. If it weren’t for session cookies, you wouldn’t be able to do any online shopping, banking, social media posting or any other activity that requires you to be logged in/identified. These session cookies are temporary cookies and they disappear once you log out of the website, thereby ending your session. It is the session cookies that enable the website to identify you and your actions and react accordingly. Without them, every click you make on the site, will be treated as a new one, unrelated to the previous action. For example, you logged into your bank account to transfer money to a friend. If you click on “Money Transfer”, without a session cookie, the bank’s website won’t recognize you from your log-in and you just won’t be able to proceed further. You will be stuck in an endless loop of log-ins. The second kind of cookies are called persisten...

Everyone loves cookies--even cybercriminals When you visit a site, probably for the first time or from a new device or browser, you will see an alert that mentions the site uses Cookies to offer you a more personalized experience and asks you if you are okay with it. Let’s admit it. A lot of us don’t even bother to read what the notification says before we click “Accept” and move on with our browsing. Cookies are tiny information packets that store data related to your interaction and behavior on websites. It is like walking into your favorite local diner and having them serve up the “usual” instantly. Cookies, track your digital footprint on a website and allow the site to offer you a more personalized browsing experience. For example, let’s say you visited Amazon.com and looked at some cameras, perhaps you put one into your cart as well, but never checked out, or added one to your wishlist on the site. The next time the camera is on a sale, Amazon app sends you a notification about t...

Don’t let hurricanes blow your data away! “Life is not about sheltering yourselves from the rain, it is about learning to dance in the storm”, goes a popular saying. But, if you are a small business, you first need to shelter your assets from the rain, before you can afford to dance in the storm without a care in the world. Hurricanes, tornadoes and thunderstorms can catch you off-guard resulting in losses worth thousands of dollars. Your inventory may be damaged, your place of business may be flooded and your critical business data lost. While most small businesses do take timely steps to ensure their inventory and place of business are protected from natural disasters, a lot of them tend to overlook the risk such natural disasters pose to their IT infrastructure and data. To many, it doesn’t seem to be that big an issue--and invariably, this is where they go wrong. Data loss due to natural calamity or any other reason can cause significant damage to a business, resulting in extreme c...

Cyber hygiene: The key to your business’s good cyber health We all know that basic hygiene is a must to lead a healthy life. Did you know that the same rule applies to IT as well? There’s something known as cyber hygiene that plays a key role in keeping your business healthy from the IT perspective. So, how do you ensure your business doesn’t fail when it comes to cyber hygiene? Here are a few tips. Follow industry benchmarks and standards Remember that if an IT practice has gained industry-wide recognition and adoption, it is because it certainly offers some benefits. Protocols like the HTTPS implementation, SSL security certificates, CIS Benchmark, etc., are examples of industry standards that you must follow to maintain good cyber hygiene. Following these standards enhance your cybersecurity quotient and also play a positive role in helping you win your customer’s trust. Stronger IT administration The role of an IT administrator is very critical in any organization. IT administratio...

Free Internet Access? Don’t fall for this one One of the popular internet scams that has been doing the rounds since 2017 is the one about “Free Internet”. This scam seems to resurface and somehow manages to claim quite a few unsuspecting victims. Here’s how they catch you. Ads are created on Google, Facebook, popular search engines and social media platforms advertising free internet hours. The ads look professional and show up on general searches and on social media when surfing. This offers a sense of validity. Once you click on the ad, you will be taken to their website, where you will be asked to perform an action, such as Filling out a form with your Personally Identifiable Information (PII) Sharing your credit card information, and though you will be promised that your card won’t be charged, you may end up signing up for something or subscribing to a service for which your card will be charged later. Sharing a few e...

Strengthening your cybersecurity policies Formulating strong IT policies and laying down the best practices for your staff to follow is one of the best ways to prevent your business from becoming a victim of cybercrime. In this blog, we explore the various areas your IT policy should ideally cover. Passwords: Your IT policy should cover Rules regarding password setting Password best practices The implications of password sharing Corrective actions that will be taken in the event the password policy is not followed Personal devices Rules regarding the usage of personal devices at work or for work purposes. Answer questions like Are all employees allowed to use personal devices for work or do you want to limit it to those handling lesser sensitive data, or to those at higher in the corporate hierarchy as you assume they will need to be available 24/7? Regardless, you should spell out the regulations that they must follow. For example, requiring a weekly o...

3 steps you can take to protect your data in the Cloud Moving to the Cloud offers tremendous benefits for SMBs that range from lower IT costs to any-time access to data and certainly more reliability in terms of uptime. But, data in the Cloud is also vulnerable to security threats just like the data stored on physical servers. This blog discusses 3 things you can do to protect your data in the Cloud Secure access: The first step would be to secure access to your data in the Cloud. So, how do you go about it? Safeguard your login credentials-your User IDs and passwords-from prying eye. Set strong password policies that are practiced across the board and educate your employees about good password hygiene. Also, do you have employees using their own devices to access their work-related applications and documents? Do you have staff working from home? Then, you also need to formulate strong BYOD (Bring-your-own-device) policies, so these devices don’t end up as the entry point to cybercrim...

Things to consider before switching to the Cloud More and more businesses are switching to the Cloud to store their data and rightly so. The Cloud offers numerous benefits over the traditional, physical on site server. For example, Anytime, anywhere access to your data: Information in the Cloud can be accessed from anywhere using an internet connection, unlike in the case of traditional servers, where you need a physical connection to the servers Significant cost savings: You cut hardware costs, because the Cloud follows a ‘pay-as-you-use’ approach to data storage SaaS compatibility and support: The Cloud allows the use of Software-as-a-Service since the software can be hosted in the Cloud Scalability: The Cloud lets you scale up and down as your business needs change 24/7 monitoring, support, and greater access reliability: When your data is in the Cloud, the Cloud service provider is responsible for keeping it safe and ensuring it is securely accessible at al...

DNS Cache poisoning: What every SMB must know In one of the most common poisoning attacks, the attacker poisons the DNS Cache with the aim of leading visitors to a fake website. In a DNS cache poisoning case, the attacker gains control of the DNS server and then manipulates cache data such that anyone typing the URL of the actual website is redirected to the fake one. This could be a phishing site where the attacker would have carefully laid out a trap to capture the unsuspecting victim’s personal data or secure information. For example, the visitor thinks they are logging into their bank’s website online, but are actually on the attacker’s phishing site, where they enter the login credentials. Protecting yourself against DNS poison attacks Here are some ways to protect yourself and your customers from becoming victims of DNS poison attacks.     As discussed before, one of the most common poisoning attacks is the DNS attacks. Cybercriminals try to corrupt your DNS server using thei...

Why do you need a top-down approach to IT security? For any organization, its employees are its biggest assets. But, what happens when your biggest assets turn out to be your greatest threats or liabilities? That is how cybercrime can change the game. In a recent study, it came to light that employee actions account for about 70% of the data breaches that happen. This blog focuses on the first step you need to take as an organization to better prepare your employees to identify and mitigate cyber threats--adopting a top-down approach to IT security. Being a victim of cyber-attack can prove disastrous for your business as it has the following repercussions. Affects your brand image negatively: Business disruption due to downtime or having your important business data including customer and vendor details stolen reflects poorly on your brand. It can cause you to lose customers: Your customers may take their business elsewhere as they may not feel safe sharing their PII with you...

Poison Attacks: A quick overview Smart technology is everywhere. Not just in our offices, but even in our day-to-day lives with tools like Google Home and Alexa becoming a commonplace. With technology becoming smarter every minute, the risks are increasing by the minute as well. Cybercriminals are finding new ways to corrupt our IT networks to disrupt our businesses, hold our data hostage and even clear our personal bank accounts. Some of the more overt, commonly known acts of cybercrime include hacking, phishing, and ransomware attacks. This blog discusses a lesser-known cybercrime--Poison attacks. What are Poison attacks Poison attacks are attacks on the ability of the system to make smart decisions. Think about this. How do systems make intelligent decisions? Based on the training or data they receive. This data is used to hone the artificial intelligence of the system to help make smart decisions. Poison attacks mess the very base--the training data set. Poison attacks basically sk...