One day 2 weeks ago a group of friends was enjoying a night out in the West End. They were looking forward to a quality meal and a Saturday night show – but it didn’t quite go according to plan.
Whilst waiting on a tube platform one of the friend’s wives had her pockets picked and her iPhone was stolen. Using her husband’s phone they registered the phone as stolen with Apple and continued on to the show. Thankfully they were able to put the theft behind them and have a great night in London.
Later that night a message pinged on her partner’s phone from “Apple”.
“You’re iPhone 12 Pro was found at 00:35 GMT. View location here” it said, along with a link. He clicked the link and up popped Apple’s “Find my” iCloud screen and asked for his wife’s PIN.
When the PIN was entered, up popped a map with a location – although it was a location in Australia.
Confused, worn out and little drunk from the night’s revelry they both decided to go to bed and approach things with a clearer head in the morning.
Sunday came and they both woke feeling more than a little concerned that Apple had managed to get the number for his Samsung phone to send the “Found iPhone” message to.
He opened the text again to click on the link but it no longer worked. Thinking back he remembered that he thought the map he had seen during the night looked a little odd. It was of a lower resolution than expected and lacked the ability to scroll around or to shrink or enlarge.
The penny dropped. They’d been scammed.
Thankfully, with bank accounts secured by bio-metrics, the bank accounts were secure and a quick check on shopping apps showed nothing had been bought, yet. Passwords were changed just to make sure.
A phone call to their service provider helped put their minds at rest. The PIN was required by the thief so that they could simply wipe the phone and sell it on.
Although nothing more than a phone was lost, the stress my friends went through, allied to the hassle of getting hold of a replacement phone and setting it up was bad enough.
So, be warned. If you have an iPhone stolen be wary of messages popping up on phones belonging to people in your contact list announcing that the phone has been found.
Have a great Christmas, a happy new year and stay Cyber Secure.
I look forward to communicating with you in the new year. If you need any help, please, just ask. You can reach me by phone – 01793 23
Andy Poulton here, your Chief SEO officer and the person who frequently writes about the need to be aware of scams arriving by email and the need to keep your passwords complex and not duplicated.
Well, guess what? I just fell for a Phishing email. And it serves to indicate that you can’t let your guard down for a single minute – because that’s what I did.
Background to the scam
I have a couple of domain names of my own and a number of clients who’s websites and domain names are hosted by One.com. I knew 2 domains were up for renewable in October 2023, I’d had reminders and even received invoices for the renewal but had yet to pay the bills.
It was the last full week of the month and I needed to get around to it. So, on Wednesday 25th I was working on a project, mentally creating a to-Do list and thinking about other tasks that needed completing too – so I think all of my mental capacity was in use.
Then, this dropped in my inbox. Yes, looking at it in hindsight shows how flawed it is but, with minimal spare mental capacity I just thought “heck, lets just get it done and dusted” and without paying any attention to anything in the email, quite the opposite of the advice I regularly hand out, I clicked the “Pay your invoice” link.
I landed on a familiar looking page and paid no attention to anything bar the credit/debit card details boxes. I filled them in with genuine information and clicked “Submit”
The page cleared and I was left staring at the “buffering” spinny wheel of death for much longer than I should have been. (Probably no more than 20 seconds) and it was at this stage that my intelligence finally kicked in.
I went back and read the email. Of course it wasn’t from One.Com
I took a fresh look at the payment page, realised the error (stupidity) of my ways and panicked.
My vision saw my card details being sent to a lovely bunch of scammers who, with the Fullz (pretty much everything they needed) were rubbing their hands in glee that another fool had fallen for their tricks and were opening up the online stores, ready to go on a spending spree.
I opened my business banking app, saw that nothing had yet been taken and phoned my bank from within the App. My call was answered quickly and I was put through to the Fraud Department. I explained how stupid I had been, asked for my card to be cancelled, and requested a replacement. Which arrived just 2 days later.
I then conducted 2 complete virus and malware scans of my PC using 2 different anti-virus applications just to make sure that nothing nasty had been downloaded.
I also checked my account at least twice a day (and I still am – just in case). It seems I have had a lucky escape. Nothing has been spent on my account.
So, this is a warning. No matter how much pressure you may be under, please check carefully, every time you respond to an email demand for payment.
Be careful out there.
And if you need help with your Digital Marketing, SEO, Email Marketing, Social media etc don’t hesitate to get in touch. I won’t spam you and I certainly won’t share your details with spammers and the like.
I offer a free consultancy session or you can just drop me an email or give me a call on 01793 238020 or 07966 547146.
There’s increasing talk in the media, and in advertising, of VPNs as an apparent cure to all your security woes and as a potential money saver. But what is a VPN and do you actually need one?
What is a VPN and how does it Work?
The acronym VPN stands for Virtual Private Network. Virtual in that it’s not, in the strictest sense, real, your VPN only exists for the duration of your use, Private because your connection is encrypted which prevents bad actors form listening in and Network because your VPN builds a private network between your device and an endpoint. It’s often likened to building your own tunnel from you to the endpoint with the data being very secure as it travels through your own tunnel.
Do you remember in some old films when the detectives would say “we can’t track this person, they’ve bounced their call, internet connection etc, off at least 9 different servers across the world”? Well, they could have been using a VPN.
Back in the days when I was employed as a consultant, my employer used a VPN so that we could securely connect to the office network when working remotely. And that’s what a VPN does, it allows a more secure connection across the internet.
Your VPN provider has a number of endpoints that they provide, around the world and when you connect to one, your data is encrypted before it leaves your device and pops out on to the internet at one of these points-of-presence with everything in-between making it’s way through your own, encrypted, secure, tunnel.
Imagine you pop in to your local coffee shop and hop on their free wi-fi to check your emails, perhaps do a little shopping and check your bank account. All your data flows through your coffee shop’s wi-fi router (Local Network in the graphic above) and out on to the internet (Public Network). However, it’s very easy for someone with a malicious intent to set up their own connection to the cafe’s WiFi and pretend to be the free WiFi service. If you connect to this all your data goes through their system (and it could just be their laptop) which allows them to pick up your connection, analyse your traffic and steal your data. This is called a man-in-the-middle attack and is pretty common and very easy to pull off.
If you use a VPN it doesn’t matter about the man-in-the-middle because your data zips right past that, secure in it’s own encrypted, tunnel, on the way to the endpoint – which is where it gets decrypted and sent on it’s way to your chosen website.
Why Should I use a VPN?
There are a number of reasons why you might choose to use a VPN.
The first is SECURITY
As noted just now, it’s not overly difficult to intercept web traffic, some of which will contain personal data and security related info – user names, passwords, banking data etc and a VPN can overcome most of the risks associated with the interception of privacy related data, keeping you safe from identity fraud and theft.
The second is SAVING MONEY
Your VPN provider will have endpoints in a number of different countries and if you select one of those countries then the internet will think that’s where you are – because that’s where your internet connection and data look as though it’s originating.
This means that you might find subscriptions (Netflix, YouTube, Spotify etc) are less expensive in other countries, that flights and holidays may cost less if booked from somewhere other than the UK and so on.
For example,
It’ll take a little bit of research but here are a couple of examples.
Spotify Premium costs just $1.58/month in India (the cheapest) but $18.39/month in Denmark (the most expensive).
YouTube Premium is similarly priced, costing just $1.56/month in India but $15.95 in Switzerland.
Not all VPNs provide access to the least expensive countries but there are many good deals to be had, although you do need a VPN that is able to bypass Geo-Blocks, the technology that subscription providers use to catch VPN users and stop them getting the best deals.
The third is HIDING YOUR LOCATION
When conducting an SEO review I have to appear as a random, anonymous, user when researching client sites. Unfortunately, due to the way that Google works, if I just use my regular browser, Google knows it’s me – even if I choose “Incognito” mode. This means that Google presents search results based on known likes, browser and search history and a wide range of other metrics – which is pretty useless.
So, I use a Browser that rejects cookies, stores no history and has a built in VPN. This ensures that I see results that are unfiltered, for the most accurate results. The Browser that I use for this is the Epic Privacy Browser and it’s free to download and use
I also have international clients and conducting a web search in the UK will show me results biased towards the UK. Again, by setting my VPN endpoint in the country I want to research it looks as though I am connected to that country and so I get to see search results from that country.
Some UK services, BBC iPlayer for example, block you from accessing shows and films when you are outside of the UK because they don’t have the necessary Copyright licenses to broadcast shows to the rest of the world. When on holiday abroad this could limit your access to entertainment. Using a VPN will help bypass this restriction.
Privacy
Many service providers on the internet use details from your internet connection to tailor services to you and target ads at you. A VPN will prevent them from attributing your browsing history to your PC/Phone although if you are logged in to Google, Facebook etc this becomes null and void.
A good VPN will also scan files as you download them, provide Ad Free results and ensure that there’s no data tracking or storing when you are searching.
So which VPN should I choose
As with all things technology related, the real answer is “it depends”. If you just want to anonymise your web browsing then browsers such as Brave (no VPN but blocks trackers and a lot of Ads) or Epic (the one with the inbuilt VPN – although it only has EndPoints in 8 countries) will be sufficient for your needs.
Probably the most well known VPN is provided by Nord and they regularly run a range of special offers. Their normal price is £94.35PA for a 2 year contract although this does enable you to use their VPN on up to 6 different devices. However, at the time of writing this is reduced to £33.65PA or just £2.49/month and you get an additional 3 months free (prices are exc. VAT)
Another leading VPN is SurfShark. Their “Unlimited VPN” package is currently just £1.74/month for the first 26 months and can be used on an unlimited number of devices
TunnelBear logo
My current VPN of choice is TunnelBear but for no other reason than when I signed up I got a lot of bandwidth for very little money. It has some limitations but none that I have found impact on my use
Google 1 VPN Logo
If you have a 2TB plan (or greater) storage plan with Google then you can use their free “1” VPN on phones (Android and iOS). However, it does mean that you are trusting Google not to look at your data as it passes through their servers. You also can’t control your EndPoint so it’s no good if you want to browser from different countries
VPN Drawbacks
Beware of “Free” VPNs because nothing’s ever free. A free VPN may come with ads and it might also sell your data on to unidentified third parties.
Free VPNs also may limit the Bandwidth they provide which will limit the downloads and streaming you can do.
Free VPNs may also limit your Speed which also makes them useless for streaming and downloads will take quite a while longer than you are probably used to.
And finally, if you have any VPN related questions then I probably know enough to be able to answer your question or point you in the direction of someone who can.
If you need assistance with your SEO, Email Marketing, Social media or any other type of online marketing activities then I can definitely help you so you really should get in touch – even if it’s just for a free consult. You can call me on 01793 238020 or 07966 547146, email andy@enterprise-oms.co.uk or book a slot using my calendar and we’ll take it from there
In my previous post I wrote about the key Cyber Security threats that individuals and businesses of all sizes face. If you’ve not read it you can catch up here.
This time around I am going to review some of the key protective measures that you can take. Measures that will make your business harder to defraud, harder to hack and less likely to fall victim to Cyber Crime.
Let’s start with your website. Hackers around the world are queuing up to take over your website or to simply to bring it too it’s knees to stop it working so they can demand money to restore it to good working order. This latter approach is a Distributed Denial of Service attack – aka DDoS. (My previous blog describes a DDoS so I won’t replicate the description here, for brevity).
How do you stop a DDoS attack from bringing your website down
DDoS attacks are happening all around the world, right now, as you can see from this Cyber Attack screenshot
From https://www.digitalattackmap.com
There are two approaches. You can choose a web host that has the necessary provisions in place to ensure that they have the connectivity and technology to make sure that DDoS attacks can’t prevent their web servers from running. They will use a variety of technology, including sophisticated firewalls, traffic filtering and DDoS defence systems. Not all web hosts offer such a high security level so you’ll have to shop around.
A better option, in my opinion, is to use a Content Delivery Network (CDN). A CDN uses many servers located around the globe. This means that if a single server location is targeted regular visitors are simply directed to the next nearest server, totally mitigating the threat. Another big benefit of CDNs is that they also mean that if your website targets different countries then visitors from those countries will connect to your web server that is closest to them – which ensures that your website is always delivered at the fastest possible speed – which benefits both the visitor and your SEO because no-one, not least Google, likes a slow website. Top CDNS are Cloudflare, Amazon Cloudfront and Microsoft Azure
Passwords
I know, I know, I am always banging on about Passwords but passwords are gateways in to PCs, Phones, Networks, your web host and so much more.
So, your gateway passwords needs to be really secure if you want to keep the hackers out – and you really do want to keep them out. You might think that there’d be no interest in your website but hackers are targeting every single website they can find. The UK’s National Cyber Security Centre recommend using a password comprising of 3 random words and a unique password for every site you access. I recently made a short video about this very topic
Firewalls
A Firewall provides an impenetrable, unhackable barrier (provided it’s properly configured) between the internet and your computer or computer network.
Yes, Windows has a Firewall and it’s certainly better than having no firewall at all but, in reality, it’s about as much use as a chocolate fireguard. It’s just too easy to misconfigure, especially if you have a small network and have fiddled with the settings as you try to share files and folders from one PC to another.It might deter the casual hacker but won’t stop a determined one.
There are software firewalls that are provided by the same companies that sell anti-virus software. These are better than the Windows firewall but similar issues remain. Each device on your network has to have one installed and kept up to date.
A far better solution is to use a firewall appliance. A little box that goes between you, your internet router and the internet.
And talking about your router, the device that was supplied to you by your broadband provider. The router does include a Firewall but it’s a tad rudimentary, at best, and if you have’t set a secure password it will still be using the password and user name that it shipped with. This could be as daft as having “admin” as both the user name and password which makes as easy to access from the internet as it does from inside your home/home office or office.
And all somebody has to do is Google the make of router that’s used by broadband company X and the default user names and passwords are readily available. Targeted at those who might have lost their user manual but available to all.
These types of firewall are about as much use as a wall made of paper if you are running a business. It’s much better to invest in a dedicated firewall appliance.
The most popular are provided by Watchguard, SonicWall, Cisco and these prevent computers and networks from a wide range of Cyber attacks.
My set up looks like this. My office provider uses a Watchguard firewall in their comms room. I have a D-Link firewall in my office AND use the Windows firewall on my computers
VPN
Imagine the scenario. You are in your favourite coffee shop and need to jump on their free Wi-Fi. You spot the password on a tent card on your table and fire up your laptop/Chromebook/tablet/phone and search for the Wi-Fi. There it is, right at the top “FreeCoffeeShopWiFi”. You click, you enter the password and you’re away.
You log in to your office email account, then your private email. Then a quick check of your bank account confirms that you have enough to buy that latest thing you’ve been after.
Later that day you check your emails. There’s an unexpected one from your favourite shopping site confirming a change of password – not something you remember doing – so you check your bank account. It’s empty, drained of everything while you were finishing your coffee.
What’s happened? When you logged in to the coffee shop WIFI you weren’t logging in to the legitimate account. Somebody had set up a clone inside the coffee shop, which you found and logged in to. The person behind the clone was “sniffing” all of the traffic going through their portable WiFi hotspot that they’d set up and were merrily pulling off websites, user names and passwords and happily started to spend other people’s money, including yours. This is known as a man-in-the-middle attack.
Could you have prevented it? EASILY.
Just get yourself a VPN, they’re inexpensive but provide a very secure way to access the internet. Simply put, a VPN creates a secure, encrypted, private tunnel between your device (phone/tablet/laptop etc) and the destination website, (bank, email account, online shopping site etc). It doesn’t matter whether you are on a genuine account or a cloned account, your tunnel can’t be broken in to, your data is secure.
Another use of VPNs is when you work remotely and needs to access office files, remotely. A VPN will secure the data that moves between your office and your device and keep everything safe.
You might also use your VPN at home, just in case your neighbour is on your WiFi and “sniffing” your data.
And, finally, if you want to appear to be in a different country – let’s say you are on holiday abroad and want to watch BBC iPlayer content that is only available in the UK – you can use a VPN to give you a “point of presence” in the UK. Your VPN makes it look as though you are in the UK when in reality, it’s just the end of your VPN connection.
If you subscribe to a Google business service then you have free access to a Google VPN on your phones and tablets. If you don’t want to use that then some of the best are provided by ExpressVPN, TunnelBear and StrongVPN.
I use TunnelBear but am not an affiliate so if you sign up, there’s no benefit to me just added security for you
Not clicking
Phishing, SMSmishing and SpearPhishing emails are mainly designed to make you click on a link to visit a genuine looking but fake website where your log-in information can be harvested.
I’m going to be blunt – DON’T CLICK. If you think the email may be genuine you can either contact the sender (by phone or with a fresh email – not a “reply”) and ask them for clarification. If it’s a link to a website then enter the domain name yourself in your web browser, don’t click on the link in your email, don’t “copy” the link but DO hover over the link in your email program (it will have been designed to look legitimate) but hovering your cursor over it will show you where the click will actually go. It might look similar to the pukka site but won’t be. If the proper URL is company.com the fake address could look like company.com.fakesite.eu or company123987.com, for example.
Even if you believe the link to be valid, don’t click on it but either enter a URL you KNOW in your browser or search for the company. 99% of the time you’ll see that that your email is a fake, an attempt to extort you.
Fake News and Fake Reviews
Although you can’t prevent third parties from posting Fake News and Fake Reviews about your company, you can be on the lookout for the posts so you can take remedial action. Use tools such as Google Alerts and Drumup.io which can conduct keyword searches for your brand and alert you by email when something turns up that uses your brand or company name. Then you can see where the article has been posted and review it. If it’s obviously fake news you should post a reply AND contact the host of the review platform and advise them of this
Hacking
What can you do to prevent your devices and networks from being hacked?
You can use a Firewall to provide a secure “wall” between your network and the outside world. You can make sure that you have changed the default user-name and password and use a hard to crack password – something like the three random words recommended by the National Cyber Security Agency.
You should use biometric access controls, fingerprint or facial recognition on your phones, tablets and computing devices. You should be wary of emails and their attachments.
Ensure that your anti-virus programs are up to date and that Windows is allowed to keep itself up to date too.
You should consider encrypting your data, so if it is stolen then it won’t be of any value, or use, to anyone and you also need to be regularly backing up your computers and servers. AND don’t forget to regularly check that you can restore your backed up data. There’s nothing like finding out that your backups are corrupt, or discovering that you’ve not been backing up what you thought was being backed up, when you lose data. It’s too late then.
And finally, train your staff and keep their training up to date so they know how to identify potential threats and to whom they should share their concerns with.
Insider Threats
Office staff having a meeting
Insider threats are the most insidious. By definition, it’s people who you trust. So what can you do?
You should control what they have access to. Nobody outside the Accounts department (with the exception of some board members) needs to have access to financial systems, and files. Nobody outside of Sales needs to have access to details of ALL clients at all stages of the sales process. Give a lot of thought to who can see, and access, what.
Work hard to know your staff. Talk to them. Understand what makes them tick, their personal situation, without being creepily intrusive. Join conversations “around the water cooler”. Have an “open door” policy so that your people know they can bring their concerns to you.
You should also have a very clear policy on BYOD (Bring Your Own Device) where people are permitted to use their personal phones, tablets and laptops and can connect them to the company networks and Wi-Fi. Yes, it’s a great way to save money by allowing people to use their own equipment but it opens up a whole host of risks.
What are they taking home with them to “work” on?
What websites do they visit during work time whilst connected to the company network?
What security protection are they using on their private devices?
What Social Media platforms are they on whilst in company time and on the company network
What policies are in place to manage their use of external memory devices (such as USB sticks and external hard drives)
What files and folders can they access
Ultimately, you might decide that the risk is not worth the saving and simply provide all the equipment and tools that your people need to be able to do their job.
USB Memory
As discussed in my previous Post, “Top Cyber Security Threats to YOUR Business“, USB storage devices can be an absolute nightmare. You must have a policy in place that covers how they are used. How/whether your employees can use their own, what the policy is in relation to found devices. How you will manage lost devices that might have company information on them and an overall policy with regards to USB ports.
I know of many companies that have simply banned the use of unauthorised USB connections (remember, connecting a phone or tablet to charge it means that device can also be used as USB storage to remove data or introduce a virus).
I even know of one business owner who used superglue to ensure that absolutely nothing could be plugged in to the majority of computers and servers in his business. Even I agree that that was an extreme solution but I get his point.
Ransomware
Ransomware normally arrives either as an attachment on an email or via a link contained in an email so, good email security and data hygiene will minimise the risk from this threat
Viruses, Trojans and other Malware
Again, most viruses and trojans infiltrate a business via attachments on Emails and links in emails. The attachments might look like PDFs, Word or Excel documents or pictures but they won’t be. They will either have embedded macros (Word, Excel etc) or mask their true type. Something that looks like picture.jpg might actually be picture.jpg.exe – a file that will be run when clicked rather than a nice picture that will open when clicked.
And rogue USB devices remain an ever present threat.
Avoiding a lot of these threats comes down to good email security and data hygiene although this will be reliant on good training, regular updates and reminders.
You might have a decent anti-virus application running on all devices (including phones and tablets) but it’s a constant war. The cyber criminals are always on the lookout for ways to circumvent security software so you still need to be alert to the threats.
And Ditch Microsoft Windows
Yes, I know. It sounds almost like heresy, but Microsoft does have a bit of a reputation for insecurity. Yes, it’s better than it was but, as the most popular operating system, it’s also the most popular target for hackers. It even has it’s own day of the week – Patch Tuesday, when all manner of updates are released, including security fixes. Apple Macs are better. However, as sales increase so does the hackers interests and it’s not as secure as some would like you to think.
So is there a solution?
Yes, it’s called Linux. It’s been around more than 30 years, is properly free and very secure.
But don’t you have to be a bit of a geek to install, and use a Linux machine?
Nope, not these days. For most, it’s as easy as installing Windows AND it even looks, and works, a lot like Windows because that’s what we’re all used to. I run a Linux machine in the office and it’s uses Linux Mint – which is probably one of the easiest to come to terms with. And you can learn more about Mint, download it and learn how to install it here. Another popular Linux distribution is from Ubuntu and you can run Ubuntu from a USB stick if you want to give it a try without installing – oh and you can also create dual-boot scenarios where you can keep Windows, install Linux and simply choose which one you want to run when you boot your PC.
I am not a cyber security expert although I’ve done my fair bit, especially when working in IT support, and I do my best to stay up to date so feel free to send any questions you might have to andy@enterprise-oms.co.uk or give me a call on 01793 238020 or 07966 547146,Tweet me @AndyPoulton or contact me on LinkedIn and if I can’t help, I know some real cyber security experts that I can put you in touch with.
Thanks for reading and if you need help with your #SEO or any other element of of your digital marketing, please don’t hesitate to get in touch.
We are living through troubled times. Covid seemed to be under control, we were learning to live with it and we were starting to look forward to a quieter 2022.
And then Putin invaded Ukraine!
As a result of sanctions imposed on Russia by the West I have no doubt that the professional Russian Cyber Criminals have ramped up their activities. Not only to attack Ukraine but to attack western institutions for having the temerity to support Ukraine and actively punish Russia via sanctions.
I thought that my next two posts should focus on possible cyber security threats that this will pose. Why two posts? Simple – length and volume of information make it easier to take in of it’s split in two.
The first post, this one, will look at the threats we face as individuals and businesses when we use our computers and the internet. The second will took at ways that we can protect ourselves, and our businesses.
Although 100% security may be prohibitively expensive for SMEs most of us can do more to secure our data and reduce the risk from infiltration, theft, misuse and other malfeasances.
So, without further ado, let’s take a look at the top Cyber Threats that can be used against us, right now.
Distributed Denial of Service – DDoS
A DDoS attack is designed to bring a website, or internet connected system, to a standstill. Simply put, the Cyber Criminals will have gained access to a Botnet ( a network of internet connected devices that they have control over without the computer owners knowledge). They then issue commands to the Botnet to visit a given web address. When thousands of computers try to access a website the website grinds to a halt.
It’s analogous to closing a busy motorway and diverting all of the traffic on to a single lane, country, road. Very soon the road will be so full of traffic that everything grinds to a halt.
When the target website, or service, comes to a stop the hackers approach the website owners and demand a ransom payment, threatening to continue making the website unreachable until the ransom is paid. The busier the site the more it costs for it to be unavailable and the faster the owners are likely to pay.
As an example of this, in the last couple of years a major, online, bookies website was targeted. It was brought to a grinding halt for about 10 minutes. The criminals then contacted the company and identified themselves as the cause of the website failure. They demanded a ransom and threatened to bring the website to a halt over a significant betting weekend (Cheltenham Gold Cup weekend to be precise). For obvious reasons, it’s unknown whether the betting website paid up, or not.
Fake News
Fake news is insidious. Whenever something controversial happens there will always be people posting fake news, and reporting fake news, with the aim of either reducing the apparent severity of reported activity or distracting the news consumer, encouraging them to take their eye off the real story and try to get them to look elsewhere.
Fake news is difficult to ignore, by intentional design, and creeps in to every area of the media.
At a business level, it could be a competitor who posts positive fake news about themselves, to make them appear better than they are, or someone posting negative stories about your business hoping that they can reap the rewards.
Fake Reviews
Like Fake News, Fake reviews go two ways. Competitors, or people with a grudge, publish negative reviews on places like TrustPilot and Google reviews. Not only does this impact the public’s perception of your business but it can have a negative effect on your SEO, especially when it comes to Google Local, where part of Google’s decision making process is the quality of your reviews in comparison to your competitors.
The other way is for your competition to post fake, high quality reviews of their business to boost their business at the detriment of yours.
Hacking
Frequently imagined to be conducted by aggrieved teenagers hacking/cracking websites from the depths of their bedrooms, hacking has evolved in to a massive industry. It’s escalated in to an activity that’s carried out at all levels, all the way up to state sponsored hacking where individuals & organisations are paid by, sponsored by, or simply work for, a county or an organisation.
At the state level they look to attack the infrastructure of a foreign country using the internet as their weapon. The goal being to take services off line, for example. Imagine an attack on a country’s power supply network that could just switching the electricity off.
At the business level, hackers look to break into individual computers, servers or networks. This would provide access to confidential information and intellectual property.
Imagine that you invented something that stood to give you an incredible competitive advantage and make your company a lot of money. Hackers could break in, steal the data and sell it on. It’s believed, for example, that the Chinese government had access to the secrets of US military giants for years. This enabled them to modernise the Chinese military far faster than if they had to do all their own research and development.
Hacking could also be used to plant false information on servers. Imagine a knock on your door, by the police, with a warrant for pirated material (or worse). They take control of your network – banning your people from it and bringing work to a halt – whilst they conduct their examinations to find said material. Whether they find anything, or not, you’ll be prevented from working for days, weeks, months, possibly years while they conduct their examinations. And if there’s whisper of wrongdoing to the media, whether ultimately proven or not, justified or not, your reputation could take a massive hit, from which it might prove impossible to recover from.
Insider threats
Insider threats are probably the most insidious because they are carried out by people you trust, your employees or partners. As well as stealing from you, someone inside your organisation could also conduct a cybercrime against you. It might be as simple as deliberately installing a virus from a USB stick (for accidental virus installation see “USB Sticks and other forms of removable/portable storage“) or opening up your firewall to external intrusion (see Hacking).
Without proper tools and tracking in place you’ll probably never find out where the problem came from, which could lead to repetition once you fix the problem for the first time
Malware
Malware is a generic “cover all” term for malicious software. It has been reported that Malware affects 32% of global computer systems. The goal of malware is to infect your computer system with malicious software with the aim of slowing down, or stopping, your computers and network.
As with a lot of other attacks, businesses that are affected by malware are likely to be approached by the perpetrators who will demand payment to stop the attack.
Phishing
Phishing is an attempt by an unknown third party to persuade to you voluntarily hand over essential log-in credentials for critical web sites (think of your banking info as a single example).
It starts, typically, with a genuine looking email that lands in your inbox, purporting to come from a trusted source. The email will contain a scary message encouraging you to log into your bank account, for example, because failure to do so would see you being “locked out of your account due to a security risk”.
To make it easier, the email also includes a “Click here” link. You click, you arrive at a page that looks like your bank, enter your user ID and password but you can’t log in.
And you can’t log in because it’s not your bank. If smart, the Phishing site (because that’s where you are) will automatically forward you to your actual bank page where you’ll try to log-in again, convinced you made a typo first time around, and this time, you get in to your account.
In the meantime you will have confirmed to the Phishers that you have an account with the bank they targeted AND gifted them your user ID and password. Even though most banks now require an additional form of authentication, getting the first two parts of the authentication chain is a great place to start.
Ransomware
Ransomware is the generic term that covers a wide range of attacks on computer systems with the aim of preventing their effective and proper use. The expected resolution is the payment of a ransom to make the attack stop. The only problem with this is that the criminals are passing on the details of companies (and individuals) who paid up on the premise that they paid once, so will probably pay again.
SMishing (SMS Phishing)
A SMish attack is an attack that starts on a mobile phone. The Cyber Criminals send you an SMS message that will encourage you to click on a link in the message. The link will take you to a website that has been set up to collect critical ID information. This might be bank account details in “payment” to “release” a parcel that’s been held up at the couriers, for example.
Spear Phishing
A Spear Phishing attack is like a Phishing attack but more focused. The criminals won’t be targeting random individuals but will have done their research and will target named individuals within an organisation.
The targeted person (let’s say they are a manager in accounts) will be sent an email, purporting to come from an internal department, asking for an expedited payment to XYZ company for ABD services/supplies/components etc. The payment is made – only it’s not for services etc it simply goes straight in to a bank account operated by criminals.
Trojans
A Trojan attack, named after the Trojan Horse of Greek mythology is where a criminal distributes a piece of software that looks legitimate but harbours a nasty surprise. You’ll typically find Trojan Horse software on the internet, hiding behind hacked websites. You might search for something specific, picture editing software, for example, and come across a website giving away something that seems to do everything you need – for nothing.
You click, after all it doesn’t cost anything so where’s the danger. These’s no demand for bank or credit-card details and it doesn’t cost anything so you click to download. After all, where’s the risk?
You download the software, navigate to your downloads folder and click to install. You screen might go blank for a very short time but soon comes back. There’s no evidence of anything being installed, or anything else happening, so you assume the download is broken. Do you download it again or try something else? Most people will look for something else but the damage has already been done.
In the background, unbeknownst to you, the malicious software has installed itself, and hidden itself so there’s no record of it’s installation. If clever, it might even have disabled your antivirus protection too.
Your computer might now be added to a Botnet to be used in DDoS attacks or might be capturing every keystroke you make – including credit card and banking details, and surreptitiously send them back to the criminal who distributed the software,
USB Memory Sticks and other forms of removable/portable storage
Occasionally, when out and about, perhaps enjoying a coffee in your favourite coffee shop, you might come across a USB memory stick or memory card that someone has “forgotten”. You might ask at the counter whether they know who left it behind but they probably won’t have a clue so you take it back to the office, or your home.
Gleefully, you insert this new trophy into your computer, perhaps to see how large it is, perhaps to see whether you can determine the identity of the owner in the hope that you can return it to them. Or you might simply want to be nosey and see what’s on there.
Whatever your reason, it’s too late. The software that was set to autorun when inserted in to a computer has installed itself on your PC and is now running maliciously, in the background. Either letting an unknown third party take control of your computers and network or sending all your keystrokes back to some criminal.
Virus
Computer viruses are the most common form of cyber security threats out there. They land on your computer as an email attachment that you have been encouraged to click on (perhaps an innocent looking document for example) or pushed down on to your computer when you visit an infected website. As with other threats, you won’t necessarily know you have been infected until they do their dastardly deed. The smarter viruses can circumvent some of the best anti-virus systems and can remain hidden whilst they conduct their criminal actions. Stealing data, monitoring keystrokes and feeding them back to a cyber criminal, for example.
What should you do
Part two of this email will go in to preventative and detective measures in more detail. However, for now, the guidance is simple. Trust no one. Any email that arrives that has a hyperlink or an attachment, no matter who it comers from, should be considered suspect. Don’t click the link or the attachment unless you trust the source, were expecting it or have validated it in a different way.
Don’t plug-in “found” USB drives and memory cards, don’t visit websites on a whim and make sure you keep your anti-virus software up to date, allow Windows (if you are a Windows user) to install Windows updates and please , please, please make sure your firewall is up and running.
And finally, the pitch.
If you need help with your Cyber Security I can help and can even point you in the direction of a really excellent Cyber Security company if you need more in-depth help and support.
Get in touch – even if it’s just for a free consult. You can call me on 01793 238020 or 07966 547146, email andy@enterprise-oms.co.uk or book a slot using my calendar and we’ll take it from there
…yes you can and you must be. But serious about what? About your passwords, that’s what. Like many others, I’ve been banging on about passwords for years and years and years. From a company that would put a new laptop on a desk for the user with the password on a post-it note attached to the lid to companies that shared passwords by email to people using easily guessable passwords the whole issue of password security is not going away.
And it’s causing major problems and financial loss.
In 2019, 80% of all data breaches which resulted in financial loss, were the result of compromised passwords whilst IBM have stated that the average cost of a data breach to businesses in 2020 was $3.86m so you can see stealing passwords (and other information) is big business.
But this post is not about the physical stupidities like leaving passwords lying around it’s about the passwords you and I use that are part and parcel of our day-to-day web access.
Every year a company called NordPass* evaluates the latest password data across 50 countries. They get this by examining a database of 4TB of data, all of these passwords have been nicked, stolen, and hacked. These security breaches are the result of hacking, phishing and other “nocturnal” cyber activities.
Passwords, credit card numbers, bank account details, usernames, dates of birth and other details are made available for sale on the Dark Web and this is where NordPass gets their seed data.
The Most Common Passwords 2021
And it seems that in 2021 little has changed. The most common passwords they found were
123456 (used a staggering 103 million times)
123456789 (46m uses)
12345 (33m uses)
qwerty (22m uses)
password (21m)
12345678 (15m)
111111 (13m)
123123 (10m)
1234567890 (10m)
1234567 (9m)
All of the above would be cracked in under one second. That’s how secure these passwords are
Apparently a “stunning” number like to use their own name – “Charlie” being the 9th most popular password in the UK whilst popular music acts and sports also have their own claim to fame. “Onedirection” being popular, along with “Liverpool” whilst in Canada “hockey” was the top sports related password and “dolphin” was number one amongst animal related passwords.
NordPass have mapped the data too and, according to their data 187,219,153 passwords have “leaked” from the UK, that’s an average of 2.785 passwords per capita.
How should you formulate your passwords?
Passwords should be 16 characters or more – a M1xture! of UPPER case, lower case, numbers and characters and should NOT be used for more than one account. They should not use ANY personal information, no address details, no phone numbers, no pets names in fact nothing that can be gleaned from social media and day to day interactions
Challenge to remember? You bet. Difficult to crack? Most certainly. According to How Secure is my Password 45Erp!VBN?1869y& will take 41 trillion years to crack.
I have over 250 passwords that I use so I have to use a Password Manager to store them. I use LastPass but many others are available, including NordPass’ own, and some are free. I suggest, though , that you use one that can synchronise across all of your devices, PCs, Macs, tablets, phones etc so that you always have your passwords with. A good Password Manager will not only store your passwords very securely but should also create secure passwords for you.
Go ahead and test your passwords using their secure tool.
I might not be a cyber security expert – but I know quite a bit and know some very good ones so if you need some help with your cyber security, your SEO or any other element of your online marketing activities then why not kick things off with a free consultancy session, drop me an email or just give me a call on 01793 238020 or 07966 547146.
In the meantime, be safe out here. The World Wide Web can be a dangerous place
*NordPass have a vested interest in password security – they sell a Password Manager
October is National Cyber Month. What is National Cyber Security Month?
Threats of Cyber Crime from Cyber Criminals continue to increase and we all need to be increasingly alert and focussed on the threats, the impact they could have on our lives AND the things we can do to minimise the risk to ourselves and our businesses.
National Cyber Security Month 2021 has the overarching theme “Do your part. #BeCyberSmart” and looks to empower individuals and businesses to own their role in protecting their part of cyberspace.
If we all do our part then we will all benefit from a safer place to live and be in a safer place to do business. Not only that but we’ll also be denying the cybercriminals the space they need to extort, employ fraud and generate the money they lust after.
How can we contribute?
We can all look to implement stronger/better security practices such as not clicking links in emails, not opening emails from people we don’t know or even opening emails we weren’t expecting. We can install security software on our phones, our tablets and our computers. We can use stronger passwords, and make sure we use unique passwords for EVERY application.
Each week, National Cyber Security Month will have a different focus, starting with Week 1 – Be Cyber Smart
Week 1, Starting October 4 – Be Cyber Smart
Our lives are increasingly intertwined with the internet and the World Wide Web. Pretty much all personal and business information is stored on internet connected platforms.
From banking to social media, from email to SMS, from phone and video calling to watching TV and listening to music and beyond.
The internet simplifies some areas of our lives and makes it more complex in others but the one, overarching common factor, is the need for a strong level of security to keep our data safe.
That’s why Week 1 of National Cyber Security Week focuses on the best security practices and “cyber hygiene” to keep our data safe, owning our role in Cyber Security and starting with the basics. That includes using unique, strong, passwords and making sure that we use multi-factor authentication (2FA) where it’s available, preferably avoiding SMS (text Message) authentication where possible.
Week 2, Starting October 11 – Fight the Phish – Trust No One
Phishing attacks, where emails and text messages are sent containing web links encouraging you to click the link, visit a website set up by cyber criminals and enter your user names and passwords are still on the increase. Why are they on the increase? Because they work. People see an email that purports to come from their bank, HMRC, DVLA, Post Office, BT etc. and are given a warning claiming that the recipient needs to do something NOW or they will be locked out of their account, will be arrested, won’t have an order delivered …. or one of many other ruses. You click the link and either have malicious software sent to your computer without your knowledge and approval or give away user names and passwords to cyber criminals, enabling them to access your personal accounts and to steal from you.
The X-Files mantra of “Trust No one” applies here. Any email that contains a request for such information should always be approached with caution and, if you have even a small inkling of concern, then simply open your web browser and visit the website of the sender to check out the veracity of the email.
Week 3, Starting October 18 – Explore, Experience, Share
Week three focuses on the National Initiative for Cyber Security Education (NICE), inspiring and promoting the exploration of careers in the cybersecurity sector. Whether you are a student or a veteran or seeking a career change, this week is all about the exciting, ever changing, field of cyber security, a rapidly growing business sector with something for everyone
Week 4, Starting October 25 – Cybersecurity First
The last week of National Cybersecurity Month looks at making security a priority. Actually taking a Cyber Security First approach to designing and building new products, developing new software, creating new Apps.
Make Cyber Security Training a key part of onboarding when taking on new employees (and, at the other end, making sure that technology rights are revoked when people leave organisations).
Ensure that your employees are equipped with the cyber secure tools that they need for their jobs. If you practice a BYOD (Bring Your Own Device) policy, allowing employees to use their own phones, tablets and computers then you need to ensure that the cyber security deployed is as strong as that on equipment that you provide.
Before buying new kit, or signing up to a new service, do your research, check the security. Is it secure enough? Can it be made more secure? Can it be remotely wiped? Who has control? All of these questions, properly answered, will ramp up your cyber security defences and help keep the cyber crims at bay
When you set up new equipment, that new phone, tablet or laptop, I know it’s exciting but please invoke the Cyber Security first, don’t leave it until last – it might be too late. Make sure default passwords are replaced with something secure and lock down those privacy settings.
Cyber Security MUST NOT be an afterthought. If it is, you could find yourself paying the price
And if you need some help, you can always ask me. I might not know the answer but I know people in the Cyber Security industry that I can put you in touch with. Email andy@enterprise-oms.co.uk, phone/message me 07966 547146, call 01793 238020 or message me on Social Media and we’ll get it sorted.
15 years ago Bill Gates, yes that Bill Gates, predicted the death of the password, presuming that a much more secure alternative method of securing data be adopted, But it hasn’t and passwords are still the default method of securing access to data and systems.
And, with the rapid rise of Cloud Services, Smartphones, tablets and much greater use of the world wide web passwords are seen as an easily-implemented, low-cost security method that users have become familiar, and comfortable with.
However, with the sound advice of using a different password at every instance that requires a password has lead to “password overload”, more so when the instruction is to make then increasingly complex to reduce the chance of password theft or accounts being hacked. This has lead to a small range of different strategies to remembering passwords. From writing them down in a “little black book”, saving them on a spreadsheet or using a password Manager [with over 300 passwords, the latter is my choice]
However, a lot of people develop a strategy that is simply based on incrementation. HardPassword1, HardPassword2 etc. The danger being that in a data breach, once your strategy is uncovered it’s just a matter of time before hackers gain access to a range of your accounts.
Recent advice from the UK’s National Cyber Security Centre (NCSC, based in London and part of the UK’s Cyber Security HQ at GCHQ) has suggested making passwords up simply from three random words. Their advice is to be creative and use words that are memorable to you – but not words that can be easily associated with you, such as
Your children’s names
Favourite Sports team
Current partners’ name
Names of other family members
Pet’s name
Place of Birth
Favourite Holiday
Etc
So, that makes it harder to think of 3 random words but I’ve got an idea. And it’s based on geography. Before you run away thinking I’m going to suggest capital cities, rivers or mountain ranges stay with me. I suggest using some places that are close to your heart, but randomised -by using the navigation app/website What Three Words.
What Three Words is able to define a precise location, down to a 3 metre square. Simply visit the What Three Words website, or install their free app on your phone and navigate to your favourite place. Here’s one of mine (not used for any of my passwords so I’m giving nothing away)
St Catherine’s By The Sea in Map View and Google Earth View
Whether you use the Map View or Google Earth type view, you’ll see the map is overlaid by little squares.
Now, just click on a square and it will be identified by three unique words, so you could click on the entrance to the church, for example, or even a grave stone in the grave yard and What Three Words will give you a code that is unique to that square.
I’ve clicked on the church door and the unique code is remarking however stubble. You could make it harder by adding hyphens, or a different symbol and perhaps capitalising Remarking-However&Stubble for example.
Now all you have to do is either remember your password or use a decent Password Manager -and there are many to choose from, and I’ve written about them in the past.
And PLEASE, if this applies to to you – STOP USING PASSWORD or 12345678 and use one of the above instead
If you need any help, please, just ask. You can reach me by phone – 01793 238020 – email – andy@enterprise-oms.co.uk or just hunt me down on Social Media.
Cybercrime is everywhere these days, in 2020 cybercrime cost UK businesses an estimated £21Bn* with an estimated 40% of UK businesses being subjected to to some kind of cybercrime in the previous 12 months. So, how can you minimise the risk to YOUR business?
There’s lots of advice on passwords, I regularly write about them, and other security measures that you can take but did you know that even a trip to your favourite coffee shop could end up being far more expensive than the price you pay for your Triple Grande Decaf Soy Latte Macchiato and blueberry muffin.
Imagine the scene, you’re between meetings and decide to drop into your favourite coffee shop for a cup of coffee, a cake and to tap into their Wi-Fi to read your emails, refresh your knowledge in time for your next meeting or simply to surf the web.
Spoof Wi-Fi Hotspot When you sit down and try to log-on to the Wi-Fi there’s frequently a selection of hot-spots to choose from. How do you know which is the free service provided by the venue and which is a spoof.
It’s very easy to set up a Wi-Fi hot-spot using a mobile phone, Mi-Fi type of device or laptop and allow other users to connect through this free connection. This means that all of the traffic can then be intercepted by the person providing the spoof account, what sort of important information is passed from your laptop through this connection? It could be your details to access your online banking, the log-in to your company network or the necessary information required to access your corporate email account.
Time for a comfort break
Then the urge hits, you look around and see that everybody seems respectable enough so you head off to the toilet thinking that your laptop is safe on the table. After all, nobody would nick in sight of all those customers, staff and CCTV cameras would they?
You’d be wrong. Laptop tracking service provider, Prey, found that areas offering free Wi-Fi were the second most common target for opportunistic laptop thefts, the only riskier place being left in a visible place in your car.
If stolen, it’s not only the inconvenience of replacing the laptop, reinstalling your applications and copying back your data [you do back-up your data don’t you?] it’s the additional costs that aren’t covered by your insurance.
The Ponemon Institute, a US cyber crime consultancy, put the real cost of the loss of a laptop and it’s data at nearly £31,000. This was broken down into £4,000 for the loss of Intellectual Property, forensics and legal bills adding around £1,500 with a staggering £24,500 attributable to the loss of income, customers and competitive advantage associated with a data breach
So, the next time you stop off for a cup of coffee and decide to log-on using their free Wi-Fi, just make sure you know which network that you’re connecting to and that you don’t leave your laptop unattended.
Believe it or not, this post was inspired after listening to an ad on the radio. I’ll let you know which one right at the end (if I remember)
Imagine the scenario. You’ve popped out to lunch and drop in to Costa/Starbucks/favourite coffee shop. Food’s on the way, your lovely Espresso/Cappuccino/Cortado/super sized hotta mocha choca machiato is in front of you and you realise that you’ve not replied to a very important email.
You get your phone out and remember that, despite all the fuss about 5G, your town hasn’t even sorted 4G but you’ve been here before and know the cafe has free Wi-Fi.
You remember that the Wi-Fi’s called “Stephen’s Wi-Fi Network” so that people can find it easily. You search for it, find it and don’t worry that you log-in seamlessly although you do notice that the signal is a little stronger than normal.
You open the email app on your phone, find the mail that really needs the reply and peck one out on your phone’s keyboard, hoping that the message in your phone’s email signature, saying that this was sent from your iPhone, will help overcome your mistypes and slightly terse language.
You’ve still got some coffee left and it’s pay day so whilst sat down you decide to check your bank account to make sure your pay has gone in. It has, and you have more than you thought. Enough to buy that gift for your lovely partner. For security’s sake you haven’t stored your card details in your phone. Out comes your wallet and you add your card details to the order screen. Click “confirm” and the order’s on it’s way
As you get up to leave you spot the homeless looking chap in the corner. He’s got a really tatty looking laptop and you feel sorry for him, until you see he’s got a huge grin on his face – you walk on by and head back to the office.
At the end of the day and you’re shutting everything down when your phone rings. It’s your partner – you’re puzzled, they don’t normally call you at work
You answer and hear tears at the other end. They’ve been shopping, found a lovely winter coat and decided to buy it but their card, which is on a joint account with yours, was declined.
You are confused. When you checked the account at lunchtime there was more than enough to cover the cost of the gift you ordered and this coat………where did all the money go?
You log in to your account and it’s empty. You can see your gift order but have no clue what all the other transactions are, you’ve not ordered anything else – and neither has your partner.
The Man in the Middle
What’s happened is that you logged in to the wrong Wi-Fi network and your data has been stolen. No, it wasn’t the homeless looking chap it was the chap you never really paid attention too because he looked like a businessman. And he was, its just that his business was theft, theft of credit card details like yours.
He had set up his own Wi-Fi network using a portable hot-spot, hidden in his backpack and connected to his laptop AND the cafe’s network to provide the broadband. He’d given it a name that was so close to the one that you were used to that it was easy to log on to it, rather than the “real” one.
The cafe’s Wi-Fi was “Stephen’s Wi-Fi Network” and the “man in the middle’s was “Stephens Wi-Fi Network” so when you logged in, all your data flowed through his hotspot to the cafe’s Wi-Fi network and on to the internet. With his laptop he was able to access everything that passed from your phone through the hotspot, including your card details when you made your purchase and off shopping he went.
How to avoid the man in the middle
Either be 100% certain that the network you are connecting to really is the network you want to connect to or avoid Wi-Fi hotspots like the plague. I do………unless there’s no other alternative. And in this scenario I only ever browse the web.
Imagine the scene, you’re between meetings and decide to drop into your favourite coffee shop for a cup of coffee, a cake and to tap into their Wi-Fi to read your emails, refresh your knowledge in time for your next meeting or simply to surf the web.
