The Problems with Passwords

Many digital services call for using stronger, more complicated passwords. However, remembering several of these complex passwords is difficult, so people typically use simpler passwords or use the same one over and over again. These simple and repeated passwords are very ineffective security measures. This problem is not a small one. Verizon’s 2013 Data Breach Investigations Report stated that 76% of security breaches involved weak or stolen login credentials. To put that number into context, hackers were able to steal millions of passwords in 2014. Changing passwords after the fact doesn’t offer protection, as data is often stolen weeks before the breach is recognized. According to the 2014 Ponemon Cost of Cyber Crime Study, it takes companies about 45 days to handle the aftereffects of a cyber attack. These attacks have an average cost of $12.7 million.

Improving User Authentication

In light of these problems, IT experts are looking for new ways to enhance the security of a user’s accounts. Some experts even recommend eliminating passwords completely. However, their password-free solutions are extremely hard to implement, and therefore are unlikely to occur in the near future. The US National Strategy for Trusted Identities in Cyberspace (NSTIC) has a similar problem. This plan calls for the creation of one centralized, government-run system that manages user information for a wide array of services. However, the plan lacks widespread support, which is unsurprising given the recent revelations about the NSA. Similar proposals in other countries would likely be just as unpopular. The government is not the only one working on a solution to the problem of account security. An industry consortium is also developing a new approach. This consortium, which is called the Fast Identity Online (FIDO) Alliance, has a number of major IT companies on its list of members, including Google, PayPal, and Microsoft. The consortium has developed two new proposals for user authentication, Passwordless UX and Second Factor UX. Both proposals are built upon the concept of multi-factor authentication, an authentication scheme that involves the use of multiple forms of identification. Passwordless UX calls for getting rid of passwords entirely. Instead, people would use biometric indicators as the means for proving their identities. These indicators might include fingerprints, retina scans, voice analysis, and even the electrical activity of a person’s heart. Second Factor UX would require the use of a USB dongle, in addition to username and password. After logging in using the username and password, the user would be prompted to insert their authentication dongle into the USB port of the computer. The addition of the authentication dongle to the traditional username and password substantially increases the effort required to compromise an account, and strongly resists common phishing attacks. The consortium’s plans are relatively new, having only been announced in December 2014. However, the support of several key players in the IT industry makes them a promising alternative to contemporary means of user authentication.

How to Protect Accounts in the Present

While the FIDO Alliance’s industry-wide effort is still in the early stages, there are plenty of other ways to incorporate multi-factor authentication into a company’s IT strategy. This method is highly recommended by the majority of IT experts, and it can significantly boost the security of a company’s accounts. Companies should also promote the use of stronger passwords. Users should stop using obvious passwords and should not use the same password with multiple accounts. Since most people have trouble remembering their passwords, many experts recommend using a password manager. This tool can keep track of your passwords in one vault. Users can access the vault with a password, and from there, they can access any of their other accounts. People with password managers only have to keep track of one password, but don’t have to suffer the risks involved in using the same password for multiple accounts. Multi-factor authentication, password managers, and better password protection protocols are currently the best means for a company to improve the security of their accounts. As such, they should be strongly considered by all businesses, no matter how large or small they may be.

1. Recognize the Problem

The end of support for an operating system means that Microsoft will no longer provide security updates for it. Running an operating system after support ends is very risky. Outdated operating systems are susceptible to all sorts of remote attacks and malware. Additionally, even after problems are discovered, they won’t be addressed by Microsoft. This means unsupported operating systems remain permanently vulnerable.

2. Assess Your Infrastructure

This is an IT problem, so to solve it, you need to know your IT infrastructure. Make a list of all of your computers, and find out what operating system each one is using. Then figure out each computer’s workload. Microsoft recommends identifying which servers are mission-critical to your business, so that you can focus on upgrading those servers first. Non-essential assets can wait until the end of the process.

3. Find A New Server Operating System

Now that you know what your IT infrastructure looks like, you can determine which new server operating system will work best for you. The server operating systems that Microsoft currently provides are Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, and Windows Server 2012 R2. Some of these options may require you to purchase new hardware, while others will let you reuse the hardware that you have. Companies should have a new server operating system in place before the Windows Server 2003 end of support. They can also move services to the cloud in order to cut costs and reduce the reliance on physical infrastructure.

4. Make the Change

After selecting a new server operating system, companies can begin migration. Migration is the process of moving from one server operating system to the next. Migration can take several months, so companies should start as soon as possible. For help with migration, or any other concerns related to the end of support for Windows 2003, consult an IT service provider.

Visit site:
What You Need To Know About Anthem’s Security Breach

Before your employees’ new phones leave the IT department, make sure your IT staff has loaded them up with some essential software. These essentials should include a disk encryption system that will keep the contents of the phone locked down and out of reach of anyone who happens to find the phone. They should also make sure to install a remote wiping program, and configure the phone to require a strong password to unlock.

Once the IT department is done setting up all the appropriate applications, you need to make sure that your employees understand the importance of mobile security. You should have a policy set up that employees who receive a company phone are familiar with and understand. This should cover things like what kind of passwords to use on mobile devices (stress that they should be no less thorough than those used on desktops), as well as the process for reporting a phone lost or stolen. Remind your employees that the sooner they report a phone as being lost or stolen, the more likely you are to either recover it or lock it down/remotely wipe it.

If a phone is actually lost or stolen, the first thing your employees should do is report it. A lot of phone recovery tools, like GPS tracking or remote wiping, require the phone to be on and in range of the wireless network to use. That means you have a limited time until either the batteries run out, or (if it was stolen) until the thieves remove the sim card, turn the phone off, or otherwise take it offline. As soon as the phone is reported lost, your IT department should lock it down using the remote control software you installed earlier. If the phone has GPS tracking, you should turn it on and immediately try to recover it, if it appears the phone was simply misplaced, or contact the police if it appears the phone was stolen.

If the phone is not recovered within the first few hours, you should have your IT team wipe the phone remotely to prevent any chance of your sensitive information falling into the wrong hands. All the contents of the phone should be backed up regularly to a secure server, so wiping a mobile device clean shouldn’t cause your company to lose any more than a few hours or a day of information.

Remember, security on mobile devices is quickly becoming as important, if not more so, than security on your desktops and corporate networks. Take the time to secure your devices before the worst happens and it’s too late.