4 Lesser-known benefits of hiring an MSP

You are probably aware of the most common benefits of signing up with an MSP such as

• On-demand IT support: Having an MSP ensures that you get priority IT support when you need it.
• Scalable IT infrastructure: With an MSP by your side, you can scale your staff structure up or down without worrying about the IT aspect of it. Need to add 20 people to your workforce? You focus on the hiring, while your MSP will work out the IT logistics
• Lower IT costs: Overall, having an MSP gives you a lot of cost savings vis-a-vis having an IT team in-house. Even if you have an IT team in-house, you can have them work in tandem with your MSP for the best results. Or, have them focus on research and optimization of your IT environment instead of focusing on mundane tasks like backups or software updates.

But, here are a few more benefits that are often overlooked.

IT analysis

An MSP has the expertise needed to analyze your IT infrastructure and identify problems that impact your workforce’s productivity negatively. Whether you sign up with an MSP or not, you should definitely hire one to analyze your existing IT infrastructure. They will be able to identify possible IT glitches, security lapses and hardware or software problems that can trigger a breakdown of your IT architecture.

Better deals on IT purchases

MSPs often have agreements with software or hardware vendors and will be able to get you a better quote on your IT purchases. Plus, with their knowledge and expertise, they are in a good position to help you choose the hardware or software that will work best for you.

Hassle-free compliance

As a business, you have certain IT rules and regulations to adhere to. An MSP can help you meet these effectively. With an MSP on board, you can focus on running your business without worrying about meeting regulatory requirements.

Staying ahead of the curve

An MSP is an expert at what they do. They are in the industry, working closely with hi-tech companies, analysts and vendors. They are more likely than your internal IT team to be aware of newer technology and tech-related market trends. By making them a part of your business, you benefit from their knowledge and your business stays ahead of the curve from the technological point of view.

Working with an MSP offers numerous benefits to an organization, especially, to an SMB as it allows them to divert their resource investments to more productive assignments.

Dark web monitoring: What you need to know

The dark web is essentially a marketplace for cyber criminals. If your data has been compromised, the dark web is the place where it is traded. It could be sold by miscreants, to miscreants, who can later hack into your system or extort money from you to prevent a data leak and so on.

What can be the implications for your organization if you are on the dark web?

If your data is on the dark web, it puts your business and your customers at risk. For example, as a business, you possess a lot of the Personally Identifiable Information (PII) of your customers, which, if leaked can even shut down your business by

• Attracting lawsuits that require you to shell out large sums of money in the form of fines or settlements
• Causing serious damage to your brand
• Resulting in the loss of customers and new business

What are dark web monitoring services?

One way to mitigate the risks of the dark web is by signing up for dark web monitoring services.

As a part of the dark web monitoring service, a company may keep an eye out for any information you specify or that is related to you that may be present or traded on the dark web. There are various avenues where such information may be made available on the dark web. Examples include

1. Chat forums
2. Blogs
3. Social media platforms
4. Online marketplaces (Dark web’s equivalent of eBay or Craigslist)

Another service offered as a part of dark web monitoring includes vulnerability alerts. On the dark web, there will be entities who will be willing to give away information about vulnerabilities in certain systems/software for a price. A company that offers dark web monitoring will keep an eye out for such information and alert its customers of such threats.

Companies offering dark web monitoring services may also be able to offer you industry insights, trends, and benchmarks that can help you proactively tighten your cybersecurity.

What you can do: Safeguarding your data against the dark web

With dark web monitoring services, you will know if there has been a data breach. Let’s say you come to know your e-commerce website’s user IDs and passwords have been stolen, or your customer’s credit card data has been leaked via your database, you can take the necessary steps to mitigate a possible ransomware attack or data leak before it happens. But, that’s reactive. That’s damage control after the damage has been done. While dark web monitoring services can warn you if your data has been compromised, here are a few things that you can do to keep your data safe in the first place.

Password hygiene

Follow good password hygiene and industry best practices. Establish clear password policies and rules and regulations regarding password sharing. For example, discourage the use of the same passwords for multiple accounts or use of passwords that are too simple or obvious such as user’s name, date of birth/date of joining organization or numbers in sequence, etc, establish policies regarding password update at regular intervals.

Train your staff

Train your staff to identify spam, phishing, and other malware traps. Conduct tests and mock drills and re-train those who don’t pass them. Provide updates when there’s a new threat in cyberspace that may affect you.

BYOD policies

If you allow your employees to bring their own devices to work, establish a clear BYOD framework that will help you manage the risks associated with this setup.

Access permissions and roles

Establish different user roles for your staff and give them role-based data editing, copying or sharing permissions, so that each employee only has as much access to information as they really need.

Being exposed in the dark web can be exhausting, scary and life-threatening to a small or medium-sized business. Teaming up with an MSP who specializes in cybersecurity or offers dark web monitoring services can help keep you safe.

The dark web: An introduction

Have you come across the term, dark web, recently? As a business, you might have heard that you need to keep your data safe from the dark web. So, what is the dark web anyway? Read on to find out…

What is the dark web?

The cybercrime landscape is evolving fast. The “Nigerian” email scams are now old. Cybercriminals are smarter and more organized now–almost functioning like professionals. In fact, there’s a sort of a parallel universe where they all operate in a very corporate-like manner. And that parallel universe is called the Dark Web.

The surface web, the deep web and the dark web

Essentially, the internet can be categorized into 3 parts.

• The surface web, which includes your ‘regular’ websites–the kinds that just show up on web searches. For example, you type, Dog Videos and links to a bunch of dog videos on YouTube shows up. YouTube, in this case, is an example of the surface web.
• The deep web, which shows up in web searches, but requires you to log in to view specific content. For example, your internet banking page or your netflix subscription.
• Then comes the dark web.

The dark web is part of the internet that isn’t visible to search engines and requires the use of an anonymizing browser called Tor to be accessed. The dark web offers anonymity and hence is the hub for all sorts of illicit activities in today’s internet age. Strictly speaking, the dark web typically hosts illicit content. The kind of content that you find in the dark web include

• Credit card details, stolen login credentials for something as serious as internet banking accounts to something as trivial as Uber or Netflix,
• Contact details/communication platform for striking deals with hitmen, drug dealers, weapon dealers, hackers, etc.,
• Marketplace to buy malicious codes to help corrupt or jam IT systems and even RaaS (Ransomeware as a service!)

All of the above and more, for a fee of course. In short, the dark web is like the underworld of the internet. So, how does it concern you and why you need to steer clear of it? Read our next blog post to find out.

5 Important IT checklists that no SMB should miss: Part-2

In our last blog, we discussed 2 of the 5 important IT checklists that every SMB should have. In this post, we cover the other 3, namely, IT training, Data Backup, and BYOD checklists.

IT Training checklist

Your IT staff is not the only one who needs IT training. Everyone in your office does. An IT training checklist serves as a good process document for any new staff or for any staff working on new hardware or software. Following the IT training checklist can help cut down the learning curve, and ensures the hardware/software is leveraged in the best possible way, thus making your staff more efficient. Here’s what your IT training checklist can offer.

1. Rules and regulations regarding software and hardware use
2. Links to user manuals/instruction videos with how-tos for the software and hardware in use
3. Information about whom to contact if there’s a need for troubleshooting
4. Training schedules for each hardware/software, cyberthreats
5. Information about whom to contact if there’s a perceived cybersecurity breach

Your IT staff is not the only one who needs IT training. Everyone in your office does. An IT training checklist serves as a good process document for any new staff or for any staff working on new hardware or software. Here’s what your IT training checklist should contain.

Data backups checklist

There are a number of factors that can affect the accessibility and quality of your data. Data backups are key to ensuring your data is not lost. You should maintain a checklist or a policy document that covers this aspect. Your data backups checklist should cover

• What are the different data sets that need to be backed up
• How often do each of those data sets need to be backed up
• Where (location/device) will the data backup occur
• How will the data backup happen
• Who will be responsible for the data backup

BYOD policy checklist

In the current business environment where companies allow their employees to use their own devices for work purposes, a BYOD (Bring-your-own-device) checklist is a must. This checklist should answer questions like

• Who is allowed to bring their devices to work (employees of some departments that deal with sensitive data like, the HR/accounts may not be allowed to do so)
• What kind of devices are allowed/approved? For example, you can specify a version below which a certain OS may not be allowed, as it may be outdated, exposing your entire network to any security threat that it may be vulnerable to
• Who is responsible for ensuring the security patches and antimalware protection is up-to-date

Having these checklists/policy documents do not ensure your IT infrastructure is always safe and secure, or never suffers a downtime. These checklists merely help in cutting down instances of security breaches or downtime and go a long way in helping you respond positively to any IT crisis that may befall your business. What we have discussed here is just the proverbial ‘tip of the iceberg’. Your checklists have to be comprehensive, in-depth and cover every angle with a clearly defined action plan for any IT contingency. Reaching out to an experienced MSP for assistance will ensure you leave no loose ends.

5 Important IT checklists that no SMB should miss: Part-1

IT checklists are a great way to analyze, understand and take the necessary steps to meet your IT requirements. In this blog, we discuss 2 of the 5 important IT checklists–Hardware/software and Cybersecurity.

When creating a checklist for hardware/software purchase, use, and installation, answer the following questions.

1. How do you determine what hardware/software is needed?
2. What about installation? Who will be doing it? Incorrect installation can end up resulting in loss of time and, in case of faulty hardware installation, it can also mess up the new hardware
3. What is the process for the procurement of new hardware and software? Do you have regular vendors who you approach or do you start looking for a suitable one once the requirement arises
4. Establish a policy for operating systems, because not all hardware/software is compatible with all OS.
5. What about updates, security patches, and upgrades? Who will be responsible for them and how often?
6. Who is responsible for software installation when there’s a new user requirement

Cybersecurity training can help reduce incidences of cybersecurity breach due to a lapse of judgment from your employees. Here’s what your cybersecurity checklist should cover- all security-related aspects of your IT. For example

1. Create and implement a password policy that you want your staff to adhere to. Cover password hygiene, acceptable passwords, password sharing, reuse, password update rules, etc.,
2. When someone quits your organization or no longer works in the profile that they were working in, how is the access issue addressed? Spell out the rules and regulations regarding the removal of a user from the network, changing passwords, limiting access, etc., Along the same lines, also cover new user initiation into the IT network.
3. Include policies for data sharing–which data can be shared, where and by whom, who has access, the level of data access rights, etc.
4. Spell out the plan of action to be taken in the event of a cybersecurity breach. Whom to contact, how to quarantine the affected systems, what steps are to be taken from the legal perspective (disclosure of the breach, data security violation penalties, and so on…) how to prevent such future events, etc.,
5. Your cybersecurity checklist should not only cover the digital aspect of IT security, but also the physical aspect of it. Establish rules and regulations for physical access to data.

Interested in learning more? Watch out for our next blog that offers pointers on IT training, data backup and BYOD checklists.

Know your IT risks

Whether you have your in-house IT team, or have outsourced your IT needs to be taken care of by a Managed Services Provider, you need to know what are the possible risks to your business from the IT perspective. Having an IT risk checklist can help you be better prepared for an IT emergency.

Getting started

In order to assess your IT risks, you need to first know your IT landscape. Answer questions like

• What role is IT going to play in the success of your business
• What areas is IT supporting your business in, currently
• What new roles can you foresee for IT in improving your business efficiency
• Do you have any new technology in mind that you want to implement in the next year
• If you have your in-house IT team, what kind of staff structure do you see in the next year
• If you are planning to expand your in-house IT team, how many team members will you need to bring onboard and what will be the cost associated with this decision
• Would it be more effective and efficient to hire an MSP instead to supplement your in-house IT department
• What is your IT budget for the year

The checklist for your IT risks

The next step would be to create a checklist of your IT risks. At this stage, you should be answering questions like

• What IT risks are most relevant to you? For example, data privacy is a serious concern for a business operating in healthcare, while phishing can be a bigger concern for an accounting firm. Another angle to look into are environmental risks. For example, do you operate in a hurricane-prone area, or someplace prone to wildfires? Make a list of risks most relevant to you and assess the possibility of them happening to you. Such assessments will help you arrive at the key safety measures that you need to take, as a business, to keep your data safe.
• In the worst case scenario, if your IT infrastructure were to fail, how long can you survive before it will be difficult for you to bounce back? Can your business operate without your key IT systems working? If not, how long can you afford to keep it shut?

Whether you have your in-house IT team or rely on an MSP for your IT maintenance, this exercise will help you understand your key IT goals and the possible impediments to them, and help you survive in the event of an IT emergency.

What to consider when investing in cyber insurance

As a business, you are probably aware of the term, cyber insurance. With the cybercrime rates rising consistently, cyber insurance is increasingly becoming a necessity for survival. Here are a few things to consider before you sign up with a cyber insurance service provider.

Risk analysis

First, perform an internal risk analysis. Research to understand what kind of cybercrimes are most rampant in your industry and ensure your insurance policy covers those for sure. Like we discussed before, the most basic of cyber insurance covers data breach and associated costs, but you definitely want more than just that.

What is the scope of your policy

Be clear about the scope of your policy before you sign the dotted line. Remember that cyber insurance functions on the same principles and policies as like any other insurance, which means there will be deductibles, waiting periods and exclusions. Be sure to ask your insurance service provider about them. You don’t want to find out you weren’t covered by insurance until after the attack, at the time of claim. Here are a few things to ask your insurance company in this regard.

1. Does the policy cover you if a breach happens via your sub-contractor or vendor and makes you liable to your clients? If your cyber insurance doesn’t cover those, then make sure your vendors and sub-contractors have cyber insurance to cover you or sign some kind of an indemnity contract with them so you are covered in the event of such incidents.
2. In case of an action byyour employee causing the breach, such as clicking on a fraudulent link or sharing data accidentally to a dubious email ID, will you still be covered?
3. Ask your insurance provider to clearly spell out any deductibles, exclusions and window periods that may exist
4. Check with your insurance provider on what would be your liabilities as the insured. For example, there may be rules regarding anti-virus measures, data safety and security measures, IT training, timely data backups and IT audits, etc., that you may have to follow in order to be eligible to be covered under the insurance in the event of a breach

Before you sign up, do your research thoroughly, get proposals from multiple insurance service providers and opt for a policy that covers your needs the most and the best. Sometimes, service providers may be willing to make additions or modifications to an existing policy to meet your exact requirements, which may work best for you.

Cyber insurance: What’s the cost and what does it cover

Cyber insurance covers a range of elements, the most basic being the legal expenses incurred as a result of falling victim to cybercrime. This includes legal fees, expenses, and even any fines that you may have to pay or financial settlements that have to make with your customers or third parties who have been affected as a result of the incident. Apart from this, depending on the coverage you opt for, your cyber insurance may cover the following.

Notification costs

In the event of a data breach, the business is required to inform all affected parties of the breach. This involves reaching out to them individually and also through the press. Cyber insurance may cover the costs related to this process.

Restoration costs

After a cybercriminal attacks your IT infrastructure, you will have to spend money restoring it. There will be considerable expense in terms of recovering the lost data and repairing or replacing affected IT systems.

Analysis costs

In the event of a data breach, you will have to conduct a forensic analysis to identify the root cause of the breach and figure out how to prevent further occurrences. Cyber insurance may cover the costs of such an investigation.

Downtime costs

When your business operations shut down, even temporarily, due to IT issues, you lose revenue. You could get a cyber insurance policy to cover such downtime costs.

Extortion money

In some cases of data theft like a ransomware attack, cybercriminals usually demand a certain amount of money as ransom or extortion to let you access it again. Considering how rampant ransomware attacks are these days, it may make sense to opt for a policy that covers this angle as well.

How much does cyber insurance typically cost

Depending on the coverage and risk, annual cyber insurance costs range anywhere from $1000 a month to about a million dollars. But, what you need to ask yourself is, how much can it cost you if you ignored cyber insurance? The answer is, it could cost you your business, your customers and your brand reputation. With cybercrimes rising at alarming rates, cyber insurance is not a luxury that only the big players should invest in. It is the need of the hour for any business, irrespective of its industry or size.

Cyber insurance 101

What is cyber insurance

With cybercrime becoming a major threat to businesses across the world, irrespective of their size, cyber insurance is fast becoming a necessity more of a necessity than a choice. However, the concept of cyber insurance is still fairly new and not many SMBs are aware of its benefits. Cyber insurance is an insurance that covers your liability in the event of your business becoming a victim of cybercrime. For example, a data breach puts you at risk of lawsuits, makes you liable to your customers/other parties whose data has been compromised because of/via your organization. Cyber insurance covers the financial aspect of such liabilities, making it easier for you to deal with them.

Why do you need cyber insurance

Many organizations think of cyber insurance as an added cost. They believe they don’t need it for various reasons.

Bigger organizations think their IT security measures are watertight and they won’t fall victim to cybercrime, and they also tend to believe that even if they are affected in a one-off case of cybercrime, they are solid enough to discharge their liabilities and come out of the incident with their brand value intact.

SMBs, on the other hand, think cybercriminals are most likely to target the bigger players and they don’t need cyber insurance. But, in reality, it is the smaller businesses that are at a greater threat–primarily, because

1. They lack the resources to strengthen their IT infrastructure and their staff is less likely to be trained in identifying cyber threats, making them more vulnerable
2. They are less likely to recover from the damage to their financial and brand health as a result of falling victim to cybercrime

The bottom line is, every organization–big or small, needs cyber insurance today. Cyber insurance, however, is not a replacement for cybersecurity. Having cyber insurance doesn’t mean you can be lax about cybersecurity. It is meant as a buffer, to help.your business survive when something slips through the cracks. An MSP can help you tighten your cybersecurity and prevent data breaches and other untoward incidents. Also, being well versed with the IT industry, your MSP can help you understand the IT risks that you need to get covered for. They can also help you pick out the right cyber insurance policies, in some cases, some of them even being insurance advisors or agents.

Website cloning: Don’t fall for that trap!

Have you watched one of those horror movies where the something impersonates the protagonist only to wreak havoc later? Well, website cloning does the same thing–to your business–in real life. Website cloning is one of the most popular methods among scammers to fleece you of your money.

As the name suggests, the cybercriminal first creates a ‘clone’ site of the original one. There can be a clone of any website, though retail shopping sites, travel booking sites and banks are the favorites of cybercriminals. The clone site looks exactly like the original one, barring a very miniscule change in the url.

Next, they will create a trap intended to get unsuspecting victims to visit the clone site. This is usually done via links shared through emails, SMS messages or social media posts asking them to click on a link to the clone site. The message urges the recipient to take an action. For example, a message that presents itself as though it is from the IRS, asking the recipient to pay pending taxes by clicking on a specific link to avoid a fine or business shutdown, or an SMS about a time-bound discount on iPads. Sometimes, they go straight for the target and masquerade as a message from your bank asking you to authenticate your credentials by logging into your banking portal–the only glitch, the banking portal will be a clone.

Staying safe

So, how do you identify a clone website and a dubious message?

• Does the email sound too good to be true? Well, then it probably is. Nike giving away free shoes? Emirates Airlines giving you free tickets to Europe? Apple iPhone X for just $20? All of these scream SCAM!
• Even if the message sounds genuine, such as an email from your bank asking you to authenticate your login credentials, check the email header to see if the sender’s email domain matches your bank’s. For example, if your bank is Bank of America, the sender’s email ID should have that in the domain. Something like [email protected] could be genuine, whereas, [email protected] is suspicious.
• Check the final URL before you enter any information to make sure it is the actual one. Most shopping/banking websites, where payments are made and other personal details are shared are secure (HTTPS)and will have a lock symbol at the beginning of the URL. Also, check the domain. For example, something like- www.customerauthentication.com/bankofamerica is not

Identifying a cloned website is tricky, but it is not something you can afford to ignore.Giving away your personal and financial information to a fraudster can cause a lot of harm to you and your business.

BYOD=Bring your own disaster?

Workplaces today have changed. They extend beyond the working hours, beyond the cubicles. Whether you are commuting to work or even vacationing, chances are you or your employees take a break from the break to reply to those important emails that require ‘immediate action’. Plus, there may even be employees who are not even on the same continent as you. What does all this mean for your business in terms of IT security? Does BYOD translate to bring your own disaster to work? This blog explores the risks of BYOD culture and offers tips on how you can avoid them.

When you adopt a BYOD culture at your business, you are opening the virtual floodgates to all kind of malwares and phishing attacks. Your employee may be storing work-related data on their personal devices and then clicking a malicious link they received on their personal email or (even whatsapp in case of tablets or smartphones) and put your entire network at risk. Secondly, you cannot control how your employees use their personal devices. They may connect to unauthorized networks, download unauthorized software programs, use outdated antivirus programs etc,. Even something as simple and harmless as the free wifi at the mall can spell danger for your data.

What you can do?

First of all, if you have decided to adopt the BYOD culture in your organization, ensure you have a strong BYOD policy in place. It should cover the dos and don’ts and define boundaries and responsibilities related to the BYOD environment.

It also makes sense for you to invest in strong antivirus software and mandate those employees following the BYOD model to install it. You can also conduct device audits to ensure your employee’s personal devices are up-to-date in terms of software, security and firewall requirements to the extent that they are safe to be used for work purpose.

And one of the most important aspects–train your employees on the best practices related to basic data security, access and BYOD environments. This will ensure that they don’t make mistakes that prove costly to you. You can conduct mock drills, tests and certifications and provide the BYOD privilege to only those who clear your tests. You could also use positive and negative reinforcements to ensure everyone takes it seriously.

BYOD is great in terms of the flexibility it lends to both–the employer and the employee, and the trend is here to stay. It is up to businesses to ensure it helps more than it can hurt.

Get smart about smartphones

With flexible working schedules, remote teams and Bring Your Own Device (BYOD) policies in force, it is has become commonplace for employees and business owners alike to use smartphones for work purposes. A quick reply to an email, sharing that sales presentation, glancing over that vendor proposal–all on a smartphone–is something we all do on a daily basis. But with this convenience comes great security risks.

This blog discusses what they are and how you can avoid them.

Mobile devices are lost/stolen more easily

Unlike desktop computers, your smartphones and tablets are easier to steal. O, you may even forget yours at the restroom in the mall or in the subway, and along with it, goes all confidential data.

Phishing: Avoid biting the bait

A smartphone user is more likely to fall for a phishing scam on two accounts–one, with messaging apps like whatsapp, facebook messenger, etc., chances of getting phishing links are higher. The smaller screen size can make it difficult to clearly verify the authenticity of the site being visited.

Free Wi-Fi = free malware

Free wifi makes everyone happy. The smartphone user, the shopkeepers and also malware distributors! Your smartphone literally travels everywhere with you. The mall, the coffee shop, the movies and then to work as well. Just like how humans can catch the flu and make everyone at work sick, your mobile device can get infected with a malware and spread it across your network in the office.

What you can do?

You have antivirus for your computers, why not for your smartphones and tablets? We all know how disastrous a malware attack can be to your data, devices and your brand, in general. Consider installing antivirus software in your mobile devices to safeguard them from such attacks.

How do you prevent misuse of your debit card? With a PIN number, right? You can do the same to your phone by protecting it with a passcode so the miscreant will not be able to use it to access your data. Also, there are apps that let you wipe out all the data from your smartphone remotely in case you lose your device.

Be careful when downloading data and even 3rd party apps on your phone. Double check URLs when browsing online using your phone and don’t click on messages with links that seems malicious. In such cases, remember, if something seems too good to be true, it almost always is. Chances are, you may have not won that million dollar lottery or that all-expenses-paid trip to Europe.

And, spread the word amongst your employees. Their phone has the power to damage your brand! Take care.