Category: Cybersecurity as a Service (SECaaS)

Cybersecurity as a Service (SECaaS) blog topics including Vulnerability Scanning, Response, Reporting and Remediation.

Horrors of Not Having a Disaster Recovery Plan

October 6, 2022

From Server Street to the Cloud, It’s a Nightmare Everywhere!!!!

Cyber criminals aren’t waiting until Halloween to trick you into losing your important data from your business, and you shouldn’t wait to put a Disaster Recovery Plan in place to protect your business either!
Here’s why…

Since COVID-19, the US FBI reported a 300% increase in reported cybercrimes. Around 90% of attacked companies suffer an average cost of $1.55 million USD each year while the average downtime due to a ransomware attack is 19 days. (Coveware)

For many organizations, these negative impacts can result in compliance and regulatory issues, damage to their reputation and profitability, and in some cases even leads to business closures. Business leaders are increasingly finding that the cost of cybersecurity inaction is too high.

If your organization is attacked, are you prepared? Do you have a ransomware recovery or disaster recovery plan in place?

This Cyber Security Awareness Month, Storagepipe is here to guide you through the process and information that you need to gather, assess, and build upon for effective data Backup and Disaster Recovery. Download your copy of our Disaster Recovery Plan Template here!

What are the biggest threats to your organization’s systems and data today?

Gartner Peer Insights and Storagepipe surveyed 100 IT leaders to discover their concerns, predictions, and challenges when it comes to disaster recovery. Read on for key insights or download the full report here!

When asked what they considered to be the biggest threats to their systems and data today, we found that IT leaders believe cybersecurity threats to be a key concern overall. Nearly half of the 100 surveyed (40%) say that ransomware/malware is their top concern, followed by user error (24%) and backup and recovery failure (15%).

These responses bring up the question…

How strong is your Disaster Recovery Plan?

Is your organization using effective cybersecurity and data protection strategies, solutions and/or services to ensure that your data, and systems and your customers’ data and privacy are protected?

When we asked this question, 96% of respondents said they’re using proactive cybersecurity to ensure the availability of their data, but only 59% of respondents said they’re doing this for their business systems.

Protect your organization from Cybersecurity Horrors with our DR Plan

A well-prepared ransomware recovery plan recognizes that a disruption to your business for even a few hours can result in significant financial and reputational repercussions. The plan should include Recovery Point Objective (RPO) and Recovery Time Objective (RTO) directives that guide decisions, procedures, and backup and disaster recovery services that ensure that your business survives with as little damage as possible.

Storagepipe can help identify weak points in your cyber resilience posture and provide a combination of cybersecurity services to help protect your business. Share your cybersecurity concerns today to see how we can help!

Get Your Halloween Disaster Recovery Plan Treat!

There are no tricks here! Read our Disaster Recovery Buyer’s Guide now to learn what you need to be prepared. Download your copy of our Disaster Recovery Plan Template for effective data Backup and Disaster Recovery.

Stay Safe in the Cloud with Storagepipe

How Strong is Your Disaster Recovery Safety Net?

October 6, 2022

Ransomware and other cyberthreats are changing business’s needs for data protection across their on-premise, private cloud, SaaS, and public cloud environments.
If your organization is attacked, are you ready? Do you have a ransomware or disaster recovery plan in place?

Storagepipe has put together a template to guide you through the process and information that you need to gather, assess, and build upon for effective data Backup and Disaster Recovery. Download your copy of our Disaster Recovery Plan Template here!

As ransomware attacks have become an inevitability, disaster recovery is more important than ever before. However, with competing budget and security priorities many organizations are left exposed and unprepared.

Gartner Peer Insights and Storagepipe surveyed 100 engineering, security, IT, and operations leaders to discover their concerns, predictions, and challenges when it comes to disaster recovery. Read on for key insights or download the full report here!

What are the biggest threats to your businesses systems and data today?

When asked what they considered to be the biggest threats to their systems and data today, we found that IT leaders believe cybersecurity threats to be a key concern overall. Nearly half of the 100 surveyed (40%) said that ransomware/malware is their top concern, followed by user error (24%) and backup and recovery failure (15%).

When asked if their organization had experienced a data breach or cyberattack in the past two years, the majority (44%) of respondents said that they did, 42% said they did not and 14% were not sure.

Of those who have experienced a breach in the last 2 years, 61% said that breach was caused by malicious emails.

Additionally, only 2% of respondents said their end users have not experienced some form of email phishing.

Analyzing this data and these responses brings us back to the question –

How strong is your disaster recovery safety net after all?

Is your organization using effective cybersecurity and data protection strategies, solutions and/or services to ensure that your data and systems as well as your customers’ data and privacy are protected?

When we asked this question, 96% of respondents said that they’re using proactive cybersecurity to ensure the availability of their data, but only 59% of respondents said that they’re doing this for their business systems.

How are they protecting their data? Take a look here:

82% of tech leaders are using either a Managed Backup as a Service provider or a Managed Disaster Recovery as a Service provider to protect their business while 72% of tech leaders are using tools available through their Cloud provider to protect their Cloud environments. What’s interesting is that even amongst those using Cloud Provider tools, 80% of those are also using either a Managed Backup as a Service provider or a Managed Disaster Recovery as a Service provider for additional protection and expertise.

If you were attacked by ransomware today, how quickly would you be able to recover all your systems, data, and business operations?

70% of respondents said that if they were attacked by ransomware, they’d be able to recover all their systems within 24 hours, and 12% said it would take more than 48 hours.

24 hours or less is not fast enough for most business recovery time objectives (RTOs). If your current services and solutions are unable to recover and restore your data quickly enough to meet your RTO, the business stands to suffer unacceptable downtime, damage, and consequences.

No matter the size, location, or industry, organizations need to take the time to put together a well-thought-out and practical disaster recovery strategy for implementing cybersecurity and DR best practices.

Organizations should have an easy-to-understand step-by-step guide on what to do in a data emergency so that employees, partners and vendors understand their roles, responsibilities and the resources available to them before, during and after a crisis strikes.

What backup and disaster recovery software does your organization have in place today? Is your organization considering immutable storage to protect data from cybersecurity threats?
Download this report to find out what 100 IT leaders have to say about this!

Strengthen Your Security Posture with our Disaster Recovery Plan

Many companies large and small are searching for flexible and affordable cybersecurity and ransomware recovery services that can help them be more proactive and also recover from ransomware across their endpoints, network, cloud, and SaaS applications.

A well-prepared ransomware or disaster recovery plan recognizes that a disruption to your business for even a few hours can result in significant financial and reputational repercussions. The plan should include Recovery Point Objective (RPO) and Recovery Time Objective (RTO) directives that guide decisions, procedures, and cybersecurity, backup and disaster recovery services that ensure that your business survives with as little damage as possible.

Download your copy of our Disaster Recovery Plan Template!

Ransomware Prevention with Managed Cybersecurity Services

Contact our cybersecurity and disaster recovery experts today to explore your best ransomware protection options!

How Cyber Security Awareness Training Strengthens Your Business

September 9, 2022

No matter how large or small your business is, it’s a target for cybercriminals, and the bullseye is squarely on the backs of employees. Cyberthreats range from malicious emails and social media to sophisticated ransomware attacks. In a related study, Storagepipe found that 61% of surveyed IT pros reported that their organization had experienced ransomware, a data breach or cyberattack caused by malicious emails in the past two years.

Your organization’s cybersecurity is only as strong as your employees’ ability to identify, avoid, and report suspicious activity. It takes a single unwitting click on a phishing link to grant criminals access to everything on a given network and, in some cases, beyond into other systems and applications.

With a reported 150% rise in ransomware attacks between April 2020 and July 2021, it is becoming increasingly important and essential for end users with access to business systems to learn more about how they can protect themselves and their organizations from various types of cyberthreats. Organizations that want to transform end users from the weakest link in the security chain into a truly resilient first line of cyber defense are exploring ways to effectively educate their employees.

Gartner Peer Insights and Storagepipe surveyed 341 tech decision makers to find out what the current state of cyber security awareness training is in their organizations and the common challenges they are facing. Here’s what they had to say:

Most (64%) decision makers describe the average employee’s understanding of cybersecurity best practices within their organization as satisfactory. Over a quarter (28%) believe employee cybersecurity awareness is below where it should be. We think that this is a concerning red flag that savvy IT leaders should heed.

Given our experiences helping customers with data protection and disaster recovery services for over 20 years, Storagepipe understands the importance of cybersecurity awareness training and the difference that it makes to a company’s cyber resiliency. We have seen the damage caused by a careless click or unwitting download and want to share our insights so that you can learn from our experiences pain-free.

Types of Cyber Security Threats That Target Employees:

Here are the top cybersecurity threats that your employees need to be aware of:

Malware Attacks: Malware is malicious software that is specifically designed to disrupt, damage, or gain unauthorized access to a computer system. Examples of common malware include viruses, worms, trojan viruses, spyware, adware, and ransomware.

To learn more about malware, check out our series “Why Malware Happens” where we discuss everything from Spam and Botnets, to Phishing and Social Engineering.

Looking for insights around ransomware prevention and recovery? See our report or book a demo with our team!

Password Attacks: One of the most common forms of corporate and personal data breach is where attackers try to gain access to password protected accounts by stealing passwords using social engineering tactics or guessing them using random or systematic methods. A strong password creation and management strategy as well as two-factor authentication (2FA) or more robust multifactor authentication (MFA) are needed to prevent such attacks.
Social Engineering Attacks: These types of attacks work by convincing victims that the attacker is someone they know like a colleague or friend. Social media platforms are often used to study and access victims and compromised or spoofed email addresses are used to send malicious messages and links. Under the guise of being someone that the victim trusts, the attacker manipulates the victim into divulging sensitive information or performing tasks that aide the attacker in their scam.
Read more about some common social engineering attacks in our April Fools blog where we have 7 Tips for The April Fool in All of Us!

Our suggestions are supported by stats from IT leaders. When we asked 341 tech decision makers what their biggest cybersecurity concerns were, here’s what they had to say:

The most common concern for end user cybersecurity risk among decision makers is phishing scams (77%), followed by passwords/access management (70%), and social engineering (54%). That is why some of the most common cybersecurity protocols in place are strong password policies and phishing tests.
But is that enough?

Security teams can implement an array of cybersecurity tools to protect business-critical assets, but they cannot necessarily control end user behavior around cybersecurity practices. End users may still be responsible for setting passwords and deciding if email is suspicious on a daily basis, both of which are vulnerable entry points for major cybersecurity breaches if incorrectly addressed. The better-informed end users are around cybersecurity, the better they will manage their responsibilities and help mitigate risk to the business.

Employee Negligence One of the Top Threats to Cybersecurity

When we asked IT leaders how serious they think employee negligence is when it comes to cybersecurity risks to their organizations, here’s how they responded:

Most (53%) decision makers agree that employee negligence is one of the top sources of cybersecurity risk. Here’s how serious it is:

Consider the number of user errors that result in security incidents each year. Then think about the subsequent productivity losses and the person-hours required for recovery. Now, factor in any regulatory fines and the loss of customer trust and business reputation. That reduction could easily mean the difference between thriving and struggling as a business.

So, what can organizations do to minimize it? Thankfully, businesses are paying attention and taking preventative and corrective action.

We asked IT leaders and decision makers what measures they have in place to minimize risky user behavior resulting in a decrease in cybersecurity incidents in their organizations. See their responses below:

The most common cybersecurity protocols in place are strong password policies (74%) and phishing tests (65%). Cybersecurity awareness computer-based training (SACBT) platforms (53%) and employee knowledge testing (52%) are also gaining popularity and are not very far behind. Majority of businesses are taking steps to implement cybersecurity awareness training for employees with a multi layered approach.

Storagepipe has found that implementing engaging training courses and faux phishing campaigns to help test end users’ knowledge are key to ensuring that employees gain and retain valuable cybersecurity awareness and skills as well as help to identify employees that are susceptible to phishing. These employees can automatically receive additional training to enable better learning outcomes and overall cybersecurity for your organization.

Download the full report to find out what are the common challenges decision makers face when it comes to providing Cybersecurity Awareness Training to end users and employees. Tech decision makers can use this report to benchmark against their peers. Get your copy today!

Cyber Security Awareness Training Programs:

The National Security Agency reports that over 90% of cyber attacks are preventable with basic Cyber Security Awareness Training. So, by just taking a cybersecurity awareness course and keeping in mind all the points listed in this article, you might already be a few steps ahead of those cyber-criminals and save yourself from serious issues and huge losses!

Running quarterly cybersecurity awareness training programs along with simulated phishing campaigns often results in a reduction in end-user click-through rates on the test emails and their faux links. When the click-through rate on phishing simulations drops during training sessions, end users carry over that cybersecurity savviness into the real world, resulting in reduced clicks on malicious emails.

Storagepipe’s Cyber Security Awareness Training provides the continuous, relevant, and measurable testing and education that businesses need to minimize risky user behaviors and resulting security incidents. We also provide in-depth and executive summary reports on training and campaign results that enable IT departments to easily track and share key performance indicators with organizational stakeholders for improved visibility, decision-making processes, and outcomes.

Secure your business and employees while improving cyber resilience to minimize security incidents and unforeseen costs.

Let’s Connect!

Ransomware Statistics to Guide Your Ransomware Recovery Plan

September 8, 2022

What is Ransomware?

A ransomware attack is when malicious threat actors strike organizations with malware that encrypts data and paralyzes systems and networks, refusing to restore them until a ransom demand is met. Oftentimes even when payment is made, the data is never recovered.

These ransomware attacks first focused on large institutions and enterprises, prompting urgent cybersecurity upgrades across industries. Increasingly, threat actors are shifting their sights from large companies that have made investments in their defenses, to vulnerable small and medium sized businesses that are easier targets.

As ransomware attacks continue to create headlines, the data protection and cybersecurity experts at Storagepipe wondered, ‘What are technology decision-makers really experiencing in the fight against ransomware?’

Gartner Peer Insights and Storagepipe surveyed 331 technology professionals who shared ransomware statistics and insights like:

• How many have experienced ransomware, and what were the outcomes
• What makes an organization vulnerable to ransomware
• Why ransomware attacks have been increasing

Download the full report for Ransomware Insights here!

How Common is Ransomware?

Overall, most IT leaders (57%) believe that their organization is likely to be hit by a ransomware attack in the next 12 months.

Over 70% of IT leaders have worked in an organization that has experienced a ransomware incident.
Of those who have already experienced a ransomware attack (n = 234), 62% believe an attack is also likely in the future, compared to 45% of those who haven’t experienced a ransomware attack (n=97).

How Many Businesses Pay Ransomware?

At least 12% of ransomware attacks involved ransomware payments.

Desperate and ill-advised ransomware payments often fail to return the business to normal and verify for the attackers that the business is a profitable target that they should hit again for ransomware double extortion.

Overall, following a ransomware attack, only 54% of leaders were able to fully recover their data. However, for those whose organization paid the ransom (n = 29), 52% experienced full ransomware data recovery, compared to 65% for those whose organization did not pay the ransom (n = 147).

Despite the common-sense wisdom of ‘never reward bad behavior’ and the ransomware stats to back that up, a staggering 45% of surveyed respondents agreed that ransomware payments should be considered an operating cost for businesses.

And only 22% replied that organizations should never pay ransomware demands. As one VP pointed out, “People are paying, so there is a market. Frankly, I’d rather pay the penalty than pay the criminals.”

What are the Effects of Ransomware on Businesses?

As for repercussions, business reputational damage is viewed as the biggest consequence of a successful ransomware attack (83%), followed by the fear that it could inspire further or copycat ransomware attacks (70%), and concerns around government sanctions potentially being levied against them for making the ransomware payment (34%).

Businesses also acknowledge the negative impacts on their workforce, with 28% replying that they worry about staff redundancies to recuperate costs, and 27% fearing an expected loss of their C-Suite.

What are Ransomware Vulnerabilities?

Employees are the number one vulnerability point exploited by ransomware attacks, with 78% reporting employee negligence like weak passwords and accidental data exfiltration topping the list tied with ransomware attack vectors like email phishing and other social engineering campaigns.

Want more? Download the full report here for ransomware statistics revealing the industries that are most likely to be hit by ransomware attacks and the single main reason an organization falls victim to a ransomware attack!

Now that we understand the current ransomware and threat landscape, let’s look at how we can protect against ransomware with prevention and recovery strategies and services.

How to Protect Against Ransomware?

While it takes some planning, a cybersecurity strategy that is as multi-layered as your business is the best approach. This factors in how to protect your end users from falling prey to phishing all the way to 24/7 network monitoring for threat and vulnerability identification, to cloud monitoring for your SaaS applications like Microsoft 365, G Suite, Amazon Web Services, Azure, Dropbox and more.

Storagepipe has found that cybersecurity awareness training paired with simulated phishing campaigns provide organizations with a capability to evaluate and educate their end users on how to identify and avoid malicious ransomware emails and social media scams. Having cybersecurity-savvy end users leads to a reduction in risky behavior, threat exposure, and cybersecurity incidents.

Ransomware prevention technologies such as managed detection and response services (MDR) and robust anti-spam and anti-virus tools are critical to successful ransomware protection. In an increasingly hybrid office world, implementing strong end user and endpoint cybersecurity is critical. When compared to a centralized office environment that may have firewalls and other safeguards in place, remote work can require additional protections. Modern cybersecurity as a service (SECaaS) solutions combine endpoint cybersecurity with managed detection and response services for a comprehensive cybersecurity plan to protect multiple attack surfaces.

Recovery from Ransomware

Unfortunately, an ounce of prevention does not always result in a pound of cure. Many companies large and small are searching for flexible and affordable ransomware recovery services that can help them recover from ransomware across their endpoints, network, cloud, and SaaS applications.

Storagepipe excels at matching our customers’ business needs to the right disaster recovery services to meet their objectives, budget, and business model. For example, a disaster recovery service can help eliminate downtime impacts on production systems by providing options for full or partial failover so that your business can continue to operate while full restoration is completed behind the scenes. In addition to hot site high availability disaster recovery, Storagepipe offers innovative warm site disaster recovery that enables affordable staged recovery based on the business criticality and priority of your systems.

Contact our disaster recovery experts today to explore your best ransomware protection options!

Cybersecurity Awareness: 7 Tips For The April Fool In All Of Us

April 1, 2022

Let’s be honest, nearly all of us have been victims of a friendly April Fool’s prank at some point. The day (and month!) is full of (mostly) harmless pranks and jokes by friends and family. But let’s not forget that getting targeted by hackers and cyber criminals is also very much a reality. Pranksters love to play jokes on businesses and unsuspecting individuals, but cybercriminals like to take advantage of this time to cause serious security incidents with unforeseen costs.

April fools’ day is not the only day these cybercriminals use to take advantage of people’s naivety and lack of awareness, the frequency of these cyber crimes has actually been growing for a while. With a reported 150% rise in ransomware attacks between April 2020 and July 2021, it is becoming increasingly important and essential for people, especially employees to learn more about how they can protect themselves as well as their organizations from hackers and different types of cyber criminals.

This April Fool’s Day, Storagepipe would like to raise awareness around cyber-attacks, share with you some common examples of the tactics used by cyber criminals and discuss how you can identify scams and protect yourself, your businesses, your employees and your customers.
Let’s get right into it. Here are some of the most famous internet and telephone scams that you must have heard of:

The CRA Scam:

This is a very common scam in Canada, especially during tax season. You might receive calls or emails that may seem to be from the Canada Revenue Agency (CRA). You might be told that you owe taxes or that you are in trouble with the tax department and that you must make payments or give out your credit card or banking information. Sometimes they might even send you links to fake websites that might look exactly like the real CRA website. It is best to just hang up on the call or delete these emails. The real CRA will never call, email, or text you asking for this kind of information.

The Prize / Lottery Scams:

In these types of scams, you might get a phone call or email saying that you have won a prize, such as cash, a car, an iPhone or a vacation. The scammer will tell you that you need to make a payment to collect your prize, and they might ask for your credit card or banking information. You obviously won’t receive the prize that you were promised but now the scammer can make charges on your credit card, or worse drain your bank account. Once you lose the money, you probably will not get it back.

The Nigerian Prince / Emergency / “Grandparent” Scams:

In these types of scams, the scammers pretend to be close friends or relatives in trouble. A very common one is when the scammer pretends to be a long-lost relative who is a Nigerian prince that needs your help to save his life or to move large sums of money internationally. This scam is so popular and successful at reeling in victims that it’s earned the name, ‘cat fishing.’ They might ask you to send money because of an accident, an injury, an arrest, or a robbery. And just like with all the other scams, this is likely just a way for scammers to get access to your bank account. They often target seniors but anyone of any age can be the victim of these kind of scams.

Other examples include phishing, social media account hacking, fake cryptocurrency, fake charities, fake lotteries, fake surveys, fake kidnapping, fake tech support, fake free stuff, identity theft, and the list goes on and on!

Now that we’ve talked about how hackers commonly target individuals and employees, let’s discuss what you could do to prevent yourself from falling for their tactics. Here are some ways you can ensure that you, your data and your systems are protected:

1. Adopt a strong Password Management strategy:

It is always advised to use strong, unique and difficult to guess passwords for all your accounts and devices to ensure your data is protected across all different systems. We understand that it can be hard to remember numerous unique alphanumeric combinations (which aren’t a combination of your dog’s name and your birth date) for different accounts and devices, that’s why we recommend using a reliable password manager service. A secure password manager can automate the process of creating, encrypting and storing individual passwords so that you don’t have to remember dozens of them at all times. Also, don’t forget to keep updating these passwords every now and then as another precautionary measure.

2. Utilize Multi-factor Authentication features:

Using a multi step verification/ authentication process while logging into your accounts and devices adds another layer of security to your data protection strategy. Using a reliable authenticator app or using built in application-based unique one-time-passwords (OTP) through email, text messages or calls are very helpful in this process. They are used to add another layer of protection to prevent access in case hackers somehow gain access to your passwords.

3. Do NOT click on links or attachments from unknown email addresses:

It only takes ONE wrong click to download viruses or give hackers access to your entire computer system. So, if you receive suspicious emails with links or attachments, don’t click on them unless you’re absolutely sure they are from reliable sources.

Storagepipe provides superior protection against ransomware, viruses, malware, spear phishing, email DDOS and undesirable emails. Our Fully Managed Anti-Virus and Anti-Spam Services are just what you need to strengthen your multi-platform threat prevention strategy.

4. Look for the ‘S’ in https:

Continuing with the above listed point, another good indicator of a potential problem is if you receive a URL in an email without the ‘S’ after the http in the link. The ‘S’ literally stands for ‘secure’ and indicates that the website has an SSL (Secure Socket Layer) certificate. You should always hover your mouse over any link to see it’s true destination and if you can’t see the ‘S’, you definitely should NOT click on the URL.

5. Invest in Cybersecurity Awareness Training programs:

The National Security Agency reports that over 90% of cyber attacks are preventable with basic Cybersecurity Awareness Training. So, by just taking a cybersecurity awareness course and keeping in mind all the points listed in this article, you might already be a few steps ahead of those cyber-criminals and save yourself from serious issues and huge losses!

No matter how large or small a business is, it’s a target for cybercriminals. That’s because it can only take a single unwitting click on a phishing link to grant criminals access to everything on a given network and, in some cases, beyond. It’s also why security awareness training and phishing simulations are essential for organizations who want to transform end users from the weakest link in the security chain, into a truly resilient first line of cyber defense.

Storagepipe’s Cybersecurity Awareness Training provides the continuous, relevant, and measurable testing and education that businesses need to minimize risky user behaviors and resulting security incidents.

6. Schedule regular Data Backups:

Storagepipe’s Backup as a Service (BaaS) solutions provide Complete Data Protection for VMware, Hyper-V and Physical Systems among other things.

World Backup Day falls on March 31st every year, the day before April Fools Day, which is perfect timing to make sure all your regular data backups are scheduled are running properly across all devices and platforms. The “I’ll do it tomorrow” approach on World Backup Day could land you in some serious trouble in case you get fooled the very next day on April Fools’ Day!

If you’re not sure where to begin, here’s a guide Storagepipe created with 3 Effective Data Backup and Recovery Strategies to help you plan things better and be prepared with a recovery plan in case disaster strikes! Which brings us to our final point below.

7. Have a Disaster Recovery Plan ready:

No matter the size, location, or industry, organizations need to take the time to put together a well-thought-out and practical strategy for implementing DR best practices and scheduled maintenance.

We hope you can now better understand how common and dangerous cyber threats, hacking, viruses, malware, ransomware and other cyber attacks are. However, more than 90% of these incidents are preventable with the right kind of Cybersecurity Awareness Training.
If you spend some time learning more about how these cyber attacks work, how hackers and scammers approach people, what kind of tactics they use and how you can deal with them, you can prevent cyber attacks and protect yourself from becoming one of their victims.
The World Wide Web is an incredible source of information, innovation, and entertainment! Have fun with it, keep learning new things, all while staying vigilant and safe on the internet!

Learn more about Storagepipe’s Cybersecurity Awareness Training!

Have any questions? Contact Us to learn more about all our services!

Happy April Fools’ Day! We promise we won’t fool you though!

How to Secure Remote Access?

September 2, 2020

Secure remote access safeguards sensitive data transmission when applications are accessed from devices outside of the corporate network. It also enhances cybersecurity by introducing complexities for threat actors. In many cases, vulnerabilities in software applications, especially critical ones, may become harder to exploit as the configuration of the service begins to move away from the generic default to a more customized configuration.

What is Secure Remote Access?

Secure remote access is an umbrella under which a number of security strategies reside. It can refer to any security policy or solution that prevents unauthorized access to your network or sensitive data.

With more remote workers, different techniques may include the use of both VPN and RDP together (using different authentication mechanisms), implementation of multi-factor authentication (MFA), restrictions on which accounts may use remote access, during what times, with what password strength, and internal operating system controls that manage and protect passwords and authentication processes.

Why is Secure Remote Access Important?

If an organization does not implement any other layers of authentication besides the standard login with a username and password, there is a higher probability of a successful ransomware attack which could result in encryption and exfiltration of data, demands for payment, damage to reputation as well as lost data and revenue.

Read our Ransomware Best Practices eBook for insights on security threats and steps that you can take to mitigate your risk and rapidly recover from an attack.

Remote Access Risk Mitigation While Keeping it Simple

Some of the most effective ways to potentially reduce the risks associated with remote access systems are also some of the simplest:

Disable remote access technologies if not absolutely required for the business.
Restrict remote access to only the users that require such access, and restrict individual user access to only the services/systems that such users may require.
Use current versions of operating systems and applications, and regularly update and patch. Critical patches should be applied to remote access systems within 3-7 days.
Enforce a strong password policy with regular password changes. Strong password policy means both strength of the password but also complexity, lock-out policies and similar settings.
Restrict and segment remote access services based on data classification.
Use a VPN with MFA if you do use RDP.
Where possible use multiple account login credentials as opposed to configuring all layers to authenticate via the same active directory.
Implement internal monitoring tools to ensure that access is being used correctly and that systems are not being accessed outside of normal parameters.

Storagepipe Can Help

Old access security measures are no longer enough to ensure that your cybersecurity strategy is protecting your data and business continuity, and must be replaced with safeguards that allow employees and other verified users safe and secure access from anywhere, at any time, from any device.

We can provide your business with a suite of customized options to safeguard your business. Contact us now to get started.

Storagepipe to the Rescue

Your Backup and Disaster Recovery Heroes

Storagepipe is a trusted global provider of comprehensive cloud, data protection and security services.

Since 2001, Storagepipe has provided these robust and secure managed cloud and disaster recovery solutions from a scalable multi-tenant infrastructure, supported by our first-class in-house technical team. Storagepipe delivers highly flexible and responsive solutions with outstanding value and service, using state-of-the-art technology to offer ultimate protection and peace of mind.

We are driven to be your trusted partner and to ensure that we deliver a Storagepipe Experience that meets your business requirements with the reliability, scalability and support that your business demands.

Contact us today to discover your options around data loss prevention and rapid ransomware recovery with services such as DRaaS Veeam managed appliance for VMWare and HyperV, DRaaS physical server replication, and other Storagepipe DR services. Ensure your business continuity by meeting your operational demands while protecting and recovering your most valuable asset – your data.

Questions? Ask Our Experts!

Remove Adobe Flash: End of Life Cybersecurity Threats

August 19, 2020

Adobe has announced that the Flash Player and its respective components will no longer be distributed or updated as of December 31, 2020. While security patches will still be updated as Adobe winds down their management of Flash, it is prudent for businesses and IT professionals to anticipate longer timelines for their deployment, with the exception of critical concerns. Organizations worldwide are being advised to prepare to remove Adobe Flash before the end of life date to mitigate data cybersecurity risks.

Please note that into November and December, there is a good chance that threat actors will take advantage of the less frequent security patch releases and that attacks against Flash will increase following EOL situations. With the discontinuation after December 31, these attacks are predicted to escalate into 2021.

Follow these steps to remove Adobe Flash and ensure a smooth transition:

Perform an inventory.

Understand what systems have Flash currently installed using your software inventory system. Software inventory systems are critical to supporting security patches, pragmatic updates and end of life systems. If an inventory does not exist, security or inventory scanning applications can be used.

Establish a cut-off date.

For example, you may decide to remove Adobe Flash by end of September 2020 to ensure that you have enough time to test your systems post-removal, implement any replacement solution, troubleshoot issues, and acclimatize your end users to the transition before the end of life date forces an abrupt and disruptive change. Examine your calendar for an appropriate day and send a message to all staff that:

Flash will be removed from all systems
The reason why
That it will be black listed
If you use sites with Adobe Flash – let IT know
The date of removal

Determine any systems that use Adobe Flash.

This might be a cumbersome task, but it’s important to know if any of your business systems and applications use Flash. You may be surprised by how many do, and by how many have not removed it yet. For each of these systems and applications, contact the provider and ask what their timeline is for removal and what they plan to roll out in its place. Make sure to check your network gear and servers especially.

Remove Adobe Flash.

Remove Flash from all systems using your inventory control or services automation solution. Centralized removal of software followed by blacklisting is critical to ensure continued security. Make sure to run an inventory check before and after the removal of Flash to confirm that your systems are clean, and then validate every thirty days for 90-days to check for rogue installations. Add this validation to your routine blacklist inventory scanning practice.

Storagepipe to the Rescue

Your Backup and Disaster Recovery Heroes

Storagepipe is a trusted global provider of comprehensive cloud, data protection and security services.

Questions? Ask Our Experts!

Cloud Backups for Ransomware Attack Protection and Recovery

November 13, 2019

As technology becomes more sophisticated, so do cyber criminals and the tactics that they employ. As a result, the frequency of ransomware is becoming more prevalent and increasingly expensive for businesses to prevent, mitigate, and recover from when they don’t have cloud backups. The need for ransomware attack protection is becoming non negotiable.

The question of how to best achieve ransomware attack protection is rapidly gaining urgency in organizations of all shapes and sizes. Keeping recent, reliable, and ready to deploy local backups of your systems and files is one of the preferred ways to recover from attacks that make it through traditional security defenses. Unfortunately, this standalone tactic is rapidly becoming insufficient.

The new challenge facing IT and security industries is the arrival of insidious forms of ransomware that in addition to attacking the live production environment, also target and infect backups. This type of ransomware comes in a variety of deployments and entry points, and can corrupt or infect the backup environment in such a way that malware is still present when the backup is used for recovery. As a result, the live production environment is re-infected, and the attacker can attempt to re-ransom the victimized company.

The very real possibility that you will never actually recover your compromised data or return to business as usual is driving businesses to identify the best way to secure their entire backup process and systems.

Best of breed cloud backup solutions have adapted to include additional security processes to protect against sophisticated ransomware, identify intrusions, and recover data despite attackers’ best efforts to corrupt your information and hold you hostage in perpetuity.

How is Your Data Protected?

Investing some time in understanding how your data is currently protected will pay you back in dividends. Knowing the current state of your security and backup protection will help you identify the gaps and develop practical strategies for fighting ransomware threats.

When evaluating, find out:

How often is my data backed up?
Recognize that a ransomware attack will usually result in the loss of all of your data dating back to your last clean backup. What is the value of the data generated by your business during the delta between that last backup point, and the moment of malware infection? How would the loss of that data affect your business?

How much would it cost to restore my system in the event of a Crypto type attack?
How long would my office be down for? What data would we likely lose? What would it cost to restore our systems? How could we make our data more resistant to attack or loss?

Have the computer users in my office received any type of computer security training?
Can they recognize the difference between valid and malicious email attachments or web links? Most computer infections are brought into an office by poorly trained users that click on a malicious attachment or install a “freeware” program onto their system.

General Recommendations for Data Backup and Protection

Run two forms of backup, ideally a cloud based and internal backup system and then add archiving for air-gapped protection to media such as tape.
It is critical to run two forms of backup, especially if one backup method fails temporarily – you must have an additional solution in place to maintain protection for your data.

Run some form of continuous backup or replication that works to protect your data throughout the day, as your files or databases change and are updated.
Examples of this type of protection include: frequent storage drive snapshots, SQL database replicas, and periodic backup or replication to cloud with Veeam.

Avoid storing data on your end-user computers unless they are also backed up.
Typically, files saved to your ‘My Documents’ and similar local folders on your workstation aren’t included in cloud backups, procedures, or anti-fraud protections.

Advantages of Cloud Based Backup and Recovery

Most cloud-based backup solutions have versioning capabilities that allow for multiple cloud backups, effectively allowing the rollback of ransomware encrypted files to the pre-encrypted version.
These solutions may also provide data protection that automatically monitors for indicators of ransomware activity. For example, a massive number of file extension writes and renames can be a great clue that something is amiss.
As an added countermeasure, these solutions are not linked to the local network and don’t show up as another drive or shared folder – which are often targeted by ransomware attacks.

For more information and insights, read our Disaster Recovery Guide now to learn what you need to be prepared.

Cloud Backups and Ransomware Attack Protection with Storagepipe

With ransomware, what you don’t know or aren’t prepared for really can hurt you. The good news is that with a little extra preparation and a nominal investment of time you can successfully assess and manage this risk.

Working with an experienced backup and disaster recovery cloud provider is one key way to ensure that your data is secure in the face of malicious activities and attempts to hold your valuable business data hostage.

Storagepipe has over 15 years of experience in data protection. We are continually advancing our solution portfolio to combat emerging threats. New features and enhancements from Veeam and Storagepipe such as “Insider Protection” and “Cloud Recycle Bins” are leading the way today in restricting data access and ensuring recoverability from ransomware and other types of sophisticated cyberattacks.

Speak with a Storagepipe data protection specialist today to learn how we can help you to safeguard your business with cloud backups and recovery.

Stay Safe in the Cloud with Storagepipe

Questions? Ask Our Experts!

Storagepipe Acquired by Thrive for Canadian Expansion

Storagepipe Named Veeam Cloud & Service Provider Partner of the Year 2021 for Canada