TechTidBit - Tips and advice for small business computing - Tech Experts™ - Monroe Michigan

Brought to you by Tech Experts™

Mobile Malware Has Increased 500% – What Should You Do?

Cybersecurity researchers uncovered an alarming mobile statistic. During the first few months of 2022, mobile malware attacks surged by 500%.

For years, mobile phones have become more powerful. They now do many of the same functions as a computer.

Yet, people tend to secure their computers better than they do their smartphones.

This is a behavior that needs to change. Over 60% of digital fraud now occurs through mobile devices. That makes them highly risky if proper safeguards aren’t followed.

Use Mobile Anti-malware

Yes, your mobile phone needs anti-virus/anti-malware too! Malware can and does infect smartphones and tablets. Ensure that you have a reliable mobile anti-malware app installed.

Don’t download apps from unknown sources
Only download mobile apps from trusted sources. Do not download outside a main app store. Trusted app stores include places like:

• Apple App Store
• Google Play
• The Microsoft Store
• Amazon Appstore

Don’t assume email is safe
Many people prefer checking email on their phone rather than PC because it’s so handy. But they have a false sense of security about the safety of emails when viewed on a mobile device.

It’s difficult to hover over a link without clicking when on a smartphone. If you see something questionable and want to check the link, open the email on your PC where you can do that.

Beware of SMS phishing (aka “smishing”)
In March of 2022, text spam outpaced robocalls. Unwanted text messages rose by 30%, ten percent higher than robocalls. Many of those spam texts are smishing.

Be on the lookout for text messages that don’t quite make sense. For example, getting a shipping notification when you haven’t ordered anything.

Remove old apps you no longer use
Go through your device and remove old applications that you are no longer using. There is no reason to keep them around, potentially leaving your device at risk.

Keep your device updated
Speaking of updates, you also need to keep your device’s operating system updated. Are you using the current version of Android or iOS?

Not installing updates can mean your phone has vulnerabilities. These vulnerabilities allow hackers to
breach your data.

Use a VPN when on public Wi-Fi
Public Wi-Fi is dangerous. Most people understand that, but many connect to it out of necessity. Reduce your risk by using a VPN app.

Use mobile security solutions to prevent a data breach
Don’t wait until your phone is infected with malware to secure it properly. It’s only a matter of time before you are the next victim.

8 Tech Checks To Make Before You Travel

Our technology inevitably comes with us when we travel. Most of us won’t even travel to the end of the block without our smartphones. When you go on a trip, not having your technology there when you need it can ruin your day.

Travel smarter and more securely by doing several checks before you go. Use our handy tech travel checklist. It can save you from suffering from lost devices, missing chargers, or a data breach.

Check your apps
Have you ever sat at an airport gate wondering why it looked so empty? You then found out that your gate had changed, and you had no idea. You go rushing to the other end of the concourse, hoping you’re not too late.

How did everyone else know about the gate change? They most likely had the app for the airline and received a notification.

Before you leave for a trip, make sure to download any apps you may need. It’s better to download them when you’re at home on your own Wi-Fi. If you wait until you’re at the airport, reception may be an issue.

Some of the apps you may want to grab or update before your trip are:
• Airline app
• Train app
• Hotel app
• Theme park app
• Camping ground app
• Weather app
• City tourism app

Check your cords & adapters
People leave behind countless chargers and adapters every day. They litter airports, restaurants, and train stations around the world.

Make sure to bring a backup charger for your laptop, tablet, or phone. Otherwise, you may find yourself paying a premium for a new charger in a gift shop. Your device could also go black if you lose its charger and can’t quickly get a new one.

Check your power
A great way to ensure you have the power you need is to buy a small charging battery. You can find these in most major retailers or online. They are small “blocks” that hold a charge and can power up a cell phone in a pinch.

Having this extra backup also helps you avoid potential juice-jacking ports. These are fake or compromised public USB charging ports. Hackers use them to steal your data when you plug in.

Check your mobile plan
If you’re traveling out of the country, you’ll want to check your mobile plan. If you don’t have the ability to call internationally, then you may not be able to text or call home.

Carriers can add an international capability to your plan, but ask about pricing. It can get expensive if you’re on long calls or using mobile data.

An alternative is to set up a VoIP app you can use with your office, friends, or family while you’re traveling. These enable both calls and SMS, but you do need an internet connection.

Check or add a VPN
Free Wi-Fi may be a welcome site when you’re on the road, but it can also be dangerous. You don’t know who else is using that Wi-Fi. A hacker hanging out on the connection can easily steal your data if you’re not protected.

It’s better to use either your mobile carrier connection or a virtual private network (VPN) app. VPN plans are inexpensive and will keep your data encrypted, even if you’re on public Wi-Fi.

Check your backup
Unfortunately, mishaps occur when traveling. You may leave your phone behind on a boat, have your luggage lost, or get your device stolen while in a crowded area. Ten percent of all laptop thefts happen in airports.

Don’t lose all your data with the device! Back up your devices to the cloud or local storage before you travel. This ensures that you won’t lose the valuable information on your device. You also won’t need to think twice about enacting a remote “wipe my device” command if necessary.

Check your device security
Make your devices as secure as possible before you hit the road. When we’re traveling, our minds are occupied by other things. So, you may not think to check your antivirus or avoid suspicious phishing links.

Protect your devices before you go using:
• Antivirus/anti-malware
• DNS filtering
• Screen lock with passcode
• Sharing features turned off
• VPN application
• Find-My-Device feature turned on

Check your double checks
What do we mean by checking your double-checks? Use the buddy system as a backup. When the family is getting off a plane, each should check with the other that they have all their devices.

If you’re traveling alone, have a friend or family member check up by text. Did you grab your charger? Is your VPN turned on? Those little reminders can go a long way toward avoiding digital travel nightmares.

Improve the security of your devices now
Don’t leave your devices unprotected. This could mean a breach of your banking app or personal data. Contact us for device security solutions to reduce your risk.

Article used with permission from The Technology Press.

Don’t Waste Money On The Wrong Tech

Have you ever felt like you’ve wasted money on technology that you thought would change your world?

The right tech can be truly transformative. You can grow your business more quickly, help employees be more productive and your systems run more smoothly.

That allows you to focus on strategy and to stop sweating the small stuff.

But the wrong choices can be more trouble than they’re worth. That leaves you to foot the bill for a solution that solves nothing or, worse, creates problems of its own.

Here’s our best advice for making the right tech choices in your business.
Don’t fixate on digital transformation for its own sake. Focus on what you want to achieve and choose the tech that helps you to get there.

Be open to the idea of process change if the tech can create efficiencies. But your tech should support you – not force you to work the way it wants you to.

Define your objectives and seek expert advice before making a big change. That software might look like the answer to everything, but is it well established?

Is it reliable? Is there good support, and are there regular updates? Could an alternative do the same thing for a smaller investment?

Focus on your data. Big corporations have a deep understanding of their data and work hard to define how success will be measured. Think about how you’re able to access your data, how you can protect it, and what it can tell you about your choices.

Enter the cloud. Cloud solutions can help you keep your data better protected and are often more scalable so that they can grow with you.

Ask for help. You can’t be an expert in everything, so if there’s something you don’t understand, or if you can’t decide what’s best for you, ask an expert.

If you’re thinking about change and want to make the right tech decisions for your business, we’re here to support you all the way. Just get in touch.

Are You Still Using That Same Old Password?

We talk a lot about strong passwords. It’s kind of our job. But they’re really important if you want to protect your online accounts and keep your data safe.

So why are we hearing that ‘123456’ is still the most common password? Researchers found it used more than 100,000 times in a recent study.

‘Admin’ is another popular choice, found 17,000 times, followed by the highly creative ‘root’ and ‘guest’. Often these are pre-set default passwords which you’re supposed to change when you first login – but too many people don’t bother.

Names – personal names, celebrities, even football teams – are also common, as are profanities. One swearword cropped up 300,000 times in the study (we’ll let you guess which word it was).

But popular choices make for weak passwords. A brute force attack involves throwing thousands of passwords at a system.

So if you’re using any of these examples, it wouldn’t take long for an attacker to gain access to your account.

A good solution is to use a password manager. This will create long, strong, random passwords that are impossible to guess. It also stores them securely and auto fills them, saving you time.

An even safer solution is Passkeys. These could take over from passwords entirely – Apple and Microsoft are already rolling them out across their apps and accounts. Passkeys consist of two ‘keys’: One on your device and one within the application.

When they connect and recognize each other as the right fit, you gain access to your account… all without clicking a button.

The best part is that you never have to remember a password. It’s all done within your device and the application, so it’s unlikely that a cyber criminal will ever be able to get their hands on your log in credentials. And there are 123456 reasons why that’s a good thing.

Need help to find the right password manager? Get in touch.

What Are The Top Cybersecurity Attack Trends For 2023?

Thomas Fox is president of Tech Experts, southeast Michigan’s leading small business computer support company.

As the world becomes increasingly reliant on technology, cyber attacks have become a major concern for individuals and organizations alike. In 2023, it is likely that we will see a continuation of current trends, as well as the emergence of new threats. Here are some things to look out for:

Ransomware attacks

Ransomware attacks involve hackers encrypting a victim’s data and demanding a ransom in exchange for the decryption key. These attacks can be extremely disruptive, as they can prevent businesses from accessing important data and systems.

It is likely that we will see an increase in the number of ransomware attacks, as well as more sophisticated and targeted attacks.

[Read more…] about What Are The Top Cybersecurity Attack Trends For 2023?

What’s Changing In The Cybersecurity Insurance Market?

Cybersecurity insurance is still a pretty new concept for many SMBs. It was initially introduced in the 1990s to provide coverage for large enterprises. It covered things like data processing errors and online media.

Since that time, the policies for this type of liability coverage have changed. Today’s cyber insurance policies cover the typical costs of a data breach including remediating a malware infection or compromised account. Cybersecurity insurance policies will cover the costs for things like:

  • Recovering compromised data
  • Repairing computer systems
  • Notifying customers about a data breach
  • Providing personal identity monitoring
  • IT forensics to investigate the breach
  • Legal expenses
  • Ransomware payments

The increase in online danger and rising costs of a breach have led to changes in this type of insurance.

No one is safe. Even small businesses find they are targets. They often have more to lose than larger enterprises as well.

The cybersecurity insurance industry is ever evolving. Businesses need to keep up with these trends to ensure they can stay protected.

Demand is going up

The average cost of a data breach is currently $4.35 million (global average). In the U.S., it’s more than double that, at $9.44 million. As these costs continue to balloon, so does the demand for cybersecurity insurance.

Companies of all types are realizing that cyber insurance is critical. It’s as important as their business liability insurance.

With demand increasing, look for more availability of cybersecurity insurance.

Premiums are increasing

With the increase in cyberattacks has come an increase in insurance payouts. Insurance companies are increasing premiums to keep up. In 2021, cyber insurance premiums rose by a staggering 74%. Insurance carriers aren’t willing to lose money on cybersecurity policies.

Certain coverages are being dropped

Certain types of coverage are getting more difficult to find. For example, some insurance carriers are dropping coverage for “nationstate” attacks. These are attacks that come from a government.

Many governments have ties to known hacking groups. So, a ransomware attack that hits consumers and businesses can very well be in this category.

In 2021, 21% of nation-state attacks targeted consumers, and 79% targeted enterprises. So, if you see that an insurance policy excludes these types of attacks, be very wary.

Another type of attack payout that is being dropped from some policies is ransomware.

Insurance carriers are tired of unsecured clients relying on them to pay the ransom. So many are excluding ransomware payouts from policies. This puts a bigger burden on organizations.

It’s harder to qualify

Just because you want cybersecurity insurance doesn’t mean you’ll qualify for it. Qualifications are becoming stiffer. Insurance carriers aren’t willing to take chances. Especially on companies with poor cyber hygiene.

Some of the factors that insurance carriers look at include:

  • Network security
  • Use of things like multi-factor authentication
  • BYOD and device security policies
  • Advanced threat protection
  • Automated security processes
  • Backup and recovery strategy
  • Administrative access to systems
  • Anti-phishing tactics
  • Employee security training

Business Email Compromise (BEC) And Phishing Are Dangerous For Small Businesses

Business email compromise (BEC) and phishing are two of the most common and damaging cyber threats facing businesses today. BEC involves the fraudulent use of email to impersonate a legitimate business or individual in order to gain access to sensitive information or financial resources.

Phishing, on the other hand, is a type of cybercrime that involves the use of fraudulent emails or websites to trick individuals into revealing sensitive information, such as login credentials or financial information.

BEC attacks often target employees with access to sensitive financial information or those who have the authority to make wire transfers or other financial transactions.

The attackers use sophisticated social engineering tactics to trick the employee into revealing login credentials or other sensitive information, or to convince them to make a financial transaction on behalf of the company. In some cases, the attackers may even impersonate a high-level executive or vendor in order to gain the trust and cooperation of the employee.

One of the most common tactics used in BEC attacks is the “man-in-the-middle” attack, where the attacker intercepts legitimate emails and alters them to redirect payments or other financial transactions to their own account.

Other tactics include the use of fake invoices, purchase orders, or other financial documents to trick employees into making payments to the attacker.

Phishing attacks, on the other hand, generally aim to trick individuals into revealing sensitive information or clicking on malicious links. These attacks often take the form of fake emails purporting to be from legitimate organizations, such as banks or government agencies, and may contain links to fake login pages or download malicious software onto the victim’s computer.

To protect against BEC and phishing attacks, it’s important for businesses to implement strong security measures and to educate their employees on how to spot and avoid these threats. Some best practices for protecting against BEC and phishing attacks include:

  • Implementing strong email security measures, such as spam filters and email authentication protocols, to help identify and block fraudulent emails.
  • Training employees on how to spot and avoid phishing and BEC attacks, including teaching them to be wary of unsolicited emails and to verify the authenticity of any emails requesting sensitive information or financial transactions.
  • Establishing strong passwords and using two-factor authentication to protect login credentials and other sensitive information.
  • Setting up monitoring systems to detect and alert on unusual or suspicious activity, such as unexpected wire transfers or login attempts.
  • Regularly updating software and security protocols to ensure that the latest security measures are in place.

In addition to these measures, it’s important for businesses to have a plan in place for responding to a BEC or phishing attack. This should include:

  • Establishing a clear chain of command for reporting and responding to suspicious activity.
  • Designating a team to investigate and respond to potential attacks.
  • Having a process in place for assessing and mitigating the damage caused by an attack.
  • Reviewing and updating security protocols on an ongoing basis to ensure that they are effective in protecting against these threats.

Overall, BEC and phishing attacks are a serious threat to businesses of all sizes. By implementing strong security measures and educating employees on how to identify and avoid these threats, businesses can protect themselves and their customers from these damaging cyber attacks.

Why Should Your Business Consider VoIP?

Voice over Internet Protocol (VoIP) phone service is a popular choice for small businesses because it offers a range of benefits that can help improve communication and increase productivity.

In this article, we’ll take a look at some of the key advantages of using VoIP phone service for small businesses.

One of the biggest benefits of VoIP phone service is cost savings. Traditional phone systems often require expensive hardware and installation fees, as well as monthly charges for long distance calls.

VoIP phone service, on the other hand, uses the internet to make and receive calls, which means there are no additional charges for long distance calls. This can be a major cost saver for small businesses with employees or clients in different locations.

In addition to cost savings, VoIP phone service also offers flexibility and convenience. With VoIP, you can make and receive calls from any location with an internet connection, which means you can stay connected even when you’re on the go.

This can be especially useful for small businesses with remote workers or those that need to stay connected while traveling.

VoIP phone service also offers a range of advanced features that can help improve communication and increase productivity. For example, many VoIP providers offer call forwarding, which allows you to automatically redirect incoming calls to another phone or voicemail. This can be particularly useful for small businesses that may not have dedicated receptionists or that need to manage calls outside of normal business hours.

Another useful feature of VoIP phone service is the ability to use virtual numbers. This allows small businesses to have a local presence in different areas, even if they don’t have a physical location there. This can be particularly useful for businesses that want to target customers in different regions or that want to make it easier for customers to reach them.

VoIP phone service also offers the ability to integrate with other business tools and applications. For example, many VoIP providers offer integration with customer relationship management (CRM) systems, which can help small businesses keep track of customer interactions and improve their overall customer experience. Other integrations, such as the ability to send text messages or make conference calls, can also help small businesses stay connected and collaborate more effectively.

Finally, VoIP phone service is generally easy to set up and use. Most providers offer simple plug-and-play devices that can be easily connected to an internet router, and many offer online portals that allow users to easily manage their accounts and make changes to their settings. This can be particularly useful for small businesses that may not have IT staff or that want to minimize the time and effort required to manage their phone systems.

In conclusion, VoIP phone service offers a range of benefits for small businesses, including cost savings, flexibility, advanced features, and ease of use. By switching to VoIP, small businesses can improve their communication and increase productivity, while also enjoying the convenience and cost savings that come with using internet-based technology.

2022: The Year Of Malware, Hacks And Phishing

Thomas Fox is president of Tech Experts, southeast Michigan’s leading small business computer support company.

Much of our time this year has been spent working with our clients, making sure they’re ready to fend off newly emerging cyber threats or malware strains.

So to look back at the year, we thought we’d round up what many experts agree has been the nastiest malware of 2022.

At the top of the list is Emotet. Chances are you haven’t heard of it by that name, but it’s a trojan that’s spread by spam email. It usually looks like a genuine email with familiar branding, but it tries to persuade the recipient to click a malicious link (using language like ‘your invoice’ or ‘payment details.’

It may also look like it’s from a parcel company. This malware goes through your contact list and sends itself to family, friends, colleagues, and clients. Then it looks less like spam, because it’s come from your email account.

In second position is LockBit. This is ransomware that’s designed to block access to your files and systems when cyber criminals encrypt them.

They ask you to pay a ransom for the decryption key (which they often still don’t hand over, even when you’ve paid). If you don’t have a solid backup strategy, it is highly likely you’ll experience data loss.

This is a targeted attack that spreads itself once it’s infiltrated one device on a network. In fact, it can ‘live’ for weeks inside a network before the attack is launched.

In third place is Conti, another form of ransomware, and in fourth position is Qbot, a trojan designed to steal banking information and passwords.

It may all sound scary, but there’s plenty you can do to give your business greater protection from these threats:

  • Keep your entire network and all devices updated
  • Don’t download suspicious attachments or click links unless you’re certain they’re genuine
  • Practice strong password hygiene, including multi-factor authentication, password managers, biometrics, and passkeys where available
  • Give your people access to only the systems and files they need. Remove ex-employees from your network immediately
  • Create and regularly check back-ups
  • Educate your people regularly

We can help with all of this – just get in touch!

Overcoming Barriers for “Bring Your Own Device (BYOD)” Success In Your Business

Mobile devices make up about 60% of the endpoints in a company network. They also handle about 80% of the workload.

But they’re often neglected when it comes to strong cybersecurity measures. This is especially true with employee-owned mobile devices.

Purchasing phones and wireless plans for staff is often out of reach financially. It can also be a pain for employees to carry around two different devices.

This has made BYOD the preferred way to go by about 83% of companies. Here are some tips to overcome the security and challenges of BYOD.

Define your BYOD policy

If there are no defined rules for BYOD then you can’t expect the process to be secure.

Employees may leave business data unprotected. Or they may connect to public Wi-Fi and then enter their business email password, exposing it.

If you allow employees to access business data from personal devices, you need a policy. This policy protects the company from unnecessary risk.

Keep your policy “evergreen”

As soon as a policy gets outdated, it becomes less relevant to employees. Thus, they may tend to ignore it. Make sure to update your BYOD policy regularly.

Use VoIP apps for business calls

Customers having employees’ personal numbers is a problem for everyone. Employees may leave the company and no longer answer those calls. The customer may not realize why.

You can avoid the issue by using a business VoIP phone system. These services have mobile apps that employees can use. VoIP mobile apps allow employees to make and receive calls through a business number.

Create restrictions on saved company data

No matter what the type of device, you should maintain control of business data. It’s a good idea to restrict the types of data that staff can store on personal devices. You should also ensure that it’s backed up from those devices.

Require device updates

When employee devices are not updated or patched, they invite a data breach. Any endpoint connected to your network can enable a breach. This includes those owned by employees.

An endpoint device manager can push through automated updates. It also allows you to protect business data without intruding on employee privacy.

Include BYOD in your offboarding process

If an employee leaves your company, you need to clean their digital trail. Is the employee still receiving work email on their phone? Do they have access to company data? Are any saved company passwords on their device?

Make sure you check all this during offboarding.