Maintain a “Secure Summer Mindset” While Away from the Office

As employees spend more time outside the office in the summer months, our cybersecurity risks increase. Most of us bring our work, and the devices that we use to access it, with us wherever we go, including on vacations.

It is a real temptation to keep up with work so that we’re not buried when we return from vacation and it is a normal activity; but it is not the healthiest way to decompress.

There is a significantly greater risk of our devices and our user access being compromised while we are traveling than when employees are in the office. The criminal doesn’t have to be a shoulder-surfer to capture you typing in a passcode and then swiping your device. Con men have an easier time plying their trade while someone’s guard is down on vacation.

Since it is unlikely that I will persuade users to leave your laptops, tablets, and smart phones at home, I want to offer some security dos and don’ts that will reduce the risk of you becoming an unwitting accomplice to a security breach. Consider sharing these simple tips with your family and friends.

  1. Be suspicious of public Wi-Fi hotspots

It’s tempting to connect to public hotspots to download a movie or catch up on your favorite soap before jumping on an airplane. But if you connect to a dubious Wi-Fi hotspot like “FREEPUBLICWiFi” or “Jims_Phone,” the provider can intercept your traffic or even redirect you to alternate websites that will download malware on your device so they can control it or access it at will.

Best to plan ahead and download that movie or other large data downloads before you travel. For smaller data usage, your wireless cellular data plan is a far more secure method of connecting to the internet than unfamiliar Wi-Fi hotspots. If you’re going to use public Wi-Fi, check with posted signs at airports and hotels to make certain that the network you are connecting with is the officially-provided one. And if you are connecting to conduct work-related tasks, use a VPN for optimal security.

  1. Keep your device secured

Many organizations use mobile device management software or have policies that require a pin code to access mobile devices to access business email. If this is not required, add a personal pin code to your device anyway. To reduce the inconvenience of typing in your code every time you want to access your device, use biometric access like a fingerprint scanner or facial recognition.

Devices are lost every day – left at airport security, stolen on a train, or abandoned in a hotel room. Do you really want to give immediate access to everything on it? Always know where your device is. Lock your devices in the hotel safe provided in your room when you are going to be away, even for short periods, like going to lunch or dinner.

  1. Use Multi-Factor Authentication (MFA or 2FA)

We’re all familiar with passwords. They help to provide authentication, which is a fancy way of saying that you are who you say you are. Passwords are an example of one type of factor for authentication – “something you know.” The other factors are “something you are” and “something you have.” Something you are is provided through biometrics and something you have can be the physical device itself or a card, as examples.

2FA means using a combination of factors for more security to authenticate. We do this all the time when we use a credit card and enter our zip code on a fuel pump. Access to sensitive or work-related apps, such as Google accounts, can be made far more secure by taking advantage of 2FA when it is offered. With 2FA, even if someone steals your password to an account, unless they have your thumbprint or your device, they can’t use the password alone to access your accounts.

  1. Out of Office messages

Many of us turn on out-of-office notifications to let our colleagues know that we won’t be responding to that urgent email they just sent. But if you turn on that notification for those outside of your organization, without limiting it to your contacts, you may be guilty of providing too much information.

A common confidence scam is to send email to many different addresses (found on social media) to check and see who is on vacation. Attackers then use that information to contact a work colleague and convince them that the absent employee is requesting urgent but sensitive information that is needed that you promised them, but that you failed to provide before they left.

It may be unavoidable to use out-of-office notifications externally if you are in a customer-facing role. But consider sending a pre-emptive out-of-office notification to specific external parties so you don’t have to use the indiscriminate version built into your email client.

  1. Update your software

The recent ransomware attacks have highlighted the need to keep software updated. Malware such as viruses, worms and ransomware are possible because of vulnerabilities that exist in software. Software developers are constantly eliminating these vulnerabilities as they are found, which means that if you aren’t allowing your updates to proceed, you are leaving yourself vulnerable to malware.

As travel exposes your devices to more risk, it’s a good idea to check that your operating systems, anti-virus and web browsers are updated before you leave the office.

Enjoy your time off, and be safe!

To learn more about TCC’s IT Managed Services, please visit our website https://e-tcc.com/managed-services.

 

Benefits of Blockchain in the Public Sector

Posted by Rick Fowler, TCC Director of Mainframe Services

While blockchain is most notably used in the financial sector, I have been studying the application of blockchain technology in various industries.   According to an article on the Oracle website titled The Benefits of Blockchain Across Industries. (n.d.). Retrieved April 13, 2017, from http://www.oracle.com/us/corporate/profit/big-ideas/041316-siyer-2982371.html there are benefits to be derived in the public sector by the use of this technology.

Blockchain is an encrypted, distributed database shared across multiple computers or nodes that are part of a community or system. Transactions and data that use blockchain technology do not allow changes to data once it is written unless all or a majority of participating computers agree to the change. Blockchain has the ability to make the secure transfer of data simpler and easier between entities.

This article notes the potential uses of blockchain technology in the defense, legal and energy industries. It also discusses that the ability of blockchain to link data between government departments that typically work is silos. This can benefit citizens because the exchange of information between departments is in real time, after the agency and the citizen agree to share data. Information would no longer be delayed, resulting in greater efficiency and better service to citizens. It could also increase transparency and reduce fraud and abuse.

It is clear that blockchain holds much promise in the ability to provide secure and transparent transactions. We will continue to study the evolution of this technology.

To learn more about TCC’s Mainframe Managed Services please visit our website at https://www.e-tcc.com/managed-services.

 

AWS Introduced an Updated CJIS Workbook for Customers

Posted by Mike Boyle, TCC Director of Business Development

Many of our state government clients must adhere to Criminal Justice Information Services (CJIS) requirements to protect sensitive data. Their IT infrastructure must allow them to easily and securely move, store and process criminal justice data in the cloud.

I read an AWS Security Blog that announced the creation of the CJIS Workbook, which is a collection of several documents that assist customers in aligning with the FBI’s CJIS Security Policy. Gile, C. (2017, November 15). Updated CJIS Workbook Now Available by Request. Retrieved January 12, 2018, from https://aws.amazon.com/blogs/security/updated-cjis-workbook-now-available-by-request/

This workbook serves as a framework to help define and test controls and develop CJIS compliant architecture in the AWS Cloud.

I think it is a great resource for state government agencies to help frame policies and understand the roles and responsibilities associated with protecting criminal justice data in the cloud.

For more information on TCC’s IT Managed Services and our AWS expertise, please visit our website https://www.e-tcc.com/managed-services or contact Mike.Boyle@e-tcc.com.

Mainframe Application Workload Rehosting

Posted by Rick Fowler, TCC Director of Mainframe Services

I read a whitepaper published by LzLabs that outlined two methods for migrating applications to a new target environment without rewriting or recompiling the source code. Both utilize a complex rehosting infrastructure to provide a seamless migration. The Software Defined Mainframe – Leveraging “the Power of Modern”. (2017, September). Retrieved February 22, 2018, from https://cdn2.hubspot.net/hubfs/2158025/Power%20of%20Modern%20Umbrella%20Campaign/Power%20of%20Modern/LzLabs_Leveraging_PoM_SEPT2017.pdf?submissionGuid=a7164fe3-c729-4d5e-9a35-4b9194257cf2

Application Workload Rehosting operates on the premise that the only thing that is important is to be sure the applications continue to operate reliably and with the same outcomes. This method enables applications to be rehosted without source-code changes or recompilation, and no need for legacy operating systems or subsystems.

Application Workload Rehosting avoids the technical difficulties and increased overhead costs of the Operating System Rehosting method, and can result in reduced cost and risk when migrating applications. We will certainly keep an eye on this technology and how it is being implemented.

To learn more about TCC’s Mainframe Managed Services please visit our website https://www.e-tcc.com/managed-services.

Click this link to download the whitepaper: https://cdn2.hubspot.net/hubfs/2158025/Power%20of%20Modern%20Umbrella%20Campaign/Power%20of%20Modern/LzLabs_Leveraging_PoM_SEPT2017.pdf?submissionGuid=a7164fe3-c729-4d5e-9a35-4b9194257cf2