It looks like you have JavaScript disabled. Some parts of the site might not work properly or look right. Please consider enabling JavaScript for this site.
If you don't know how to enable JavaScript, click here.

news

Ransomware Prevention

Read More

Everyone seems to have at least a basic understanding of what a computer virus is, but often when you speak about ransomware, people are not sure what it is, the damage it can do and how to protect themselves.

What is Ransomware?

Ransomware is a form of malicious software which aims to install a file lock over certain types of files, usually text, spreadsheets and presentation documents. Once the lock is installed, you won’t be able to access any of your files without a decryption key which only they can provide for a price. They also set a time limit for you to make a decision, and at the end of the time limit, all your documents are locked forever, which of course is aimed to add a little more stress to the situation. It is basically a hostage situation but with all your personal documents.

How does Ransomware gain access to your system?

There are a number of routes ransomware can take to get into your system, but the most common way is through attachments on e-mails. This can be phishing spam, where the e-mail has the look and feel of a genuine e-mail from a real contact, but is actually someone either trying to get information from you, or trying to put something like ransomware on your machine, or it could be that one of your contacts have had their e-mail account hacked and the attacker is using their account to send out these threats. The downloading and opening of these attachments are the key behind ransomware getting on your system, and once it starts, it will spread throughout the network.

Who is usually targeted by Ransomware?

The answer to this is businesses, as the attackers are usually asking for considerable sums to decrypt the files, which general home users usually won’t or can’t pay. The unfortunate thing is though, that general users can get caught up in it if they open the wrong e-mail, so it is still worth following the steps given below to give yourself the best chance of avoiding an attack.

How can I prevent ransomware getting on my system?

Safe e-mail practices

  • Be very suspicious of emails from people or businesses you don't know, particularly ones that promise you money, good health or a solution to all your problems. In business terms, a fake invoice is usually the 'go to' scam.
  • Be suspicious of unexpected emails from your bank or financial institution. Remember banks do very little business via email and never ask for confidential information via email.
  • Be cautious about opening any attachment or downloading any files from emails you receive, regardless of who sent them.
  • Don't email personal or financial information.
  • Don't reply to email or pop-up messages that ask for personal or financial information, and don't click on links in the message or paste a link from the message into your Web browser.

Up-to-date Anti-Virus and Malware protection

An all in one up-to-date anti-virus service will give you a good chance to defend against ransomware. Although not always 100 percent, they will often detect when a malicious program finds it's way to your machine and block it from actually running.

Keep your operating system patched and up-to-date

This is sometimes the most overlooked one, we all hate when we come into the office in the morning, and have to see “Windows is installing updates” screen, however it is necessary. Malicious software can exploit vulnerabilities in your operating system, and Microsoft spend a lot of money trying to stay ahead and fix these vulnerabilities in their system. If you don’t run the updates then you may still be vulnerable to an attack.

Backups

If the worse does happen, and you do find yourself with ransomware on your machine, then by far the best option is to rebuild your machine, and reinstate one of the regular backups you have taken. Of course there is the hassle of having to do this, but it's much better than dealing with the alternative. We here at Enterprise Systems have plenty of experience installing backup systems, so feel free to get in touch if this is of interest to you.

Should you pay the ransom?

This is a debate not suited to this short article, my personal feeling is that if everyone unified and no-one paid then these attacks wouldn’t be out there and the world would be better. However I understand that when a business is hit, especially a big business, the first thing that likely happens would be the cost/benefit analysis. Attackers tend to keep their prices around the £1000 mark, which is an amount companies will usually take up, rather than put up with the associated disruption.

Should you pay the ransom?

Generally, if you follow the e-mail guidance given above, and perform regular backups of your system then you shouldn’t have any issues with Ransomware. The key is that it’s a lot easier to prevent a ransomware attack, than to recover from one. If you’d like any more information on Ransomware, or would like us to help you protect your business against a potential attack, then please get in touch.

🔗

Authentication Best Practice

Read More

We've all been there, tried to access a site which we've signed up for before, and not being able to remember the password. It leads to going through the Authentication steps to recover your account, or just not being able to gain access. This article will cover some of the best practices on how to create and remember a strong password, things not to do, and also some advice which goes beyond just setting a good password.

To start with, why do we need to follow good password practices? Well this is a simple one word answer, security. There is a good reason businesses try to stay up-to-date with the latest security technology, and its to keep their information safe, whether its the latest anti-virus/firewall software to try and prevent access, or developing a solid password management system.

What are the most common practices of poor password management?


  • Creating easy to guess passwords
  • Writing down all your passwords on paper or in a word document
  • Sharing your password with colleagues
  • Using the same password for everything

What can we do to tackle these common issues?

Create and design a password policy

From a business perspective, this can usually be done at the server level. You can apply a set of rules that each user must follow when setting a new password. This is usually something along the lines of, "The password has to have at least 8 characters, with a mix of lower and upper case characters, and also, it must contain a mixture of letters, numbers and symbols." This will help rule out commonly used passwords such as, the word password.

Get a Password Manager

In my opinion, the most frustrating example of poor password management, is writing down all your passwords on a notepad or a word document. I get it, these days we access dozens of sites which require a secure password to access, each with their own restrictions with most requiring a mixture of letters, numbers and symbols, and a set character length. There are better ways to track your passwords though, and the one i'm recommending is use a password manager, such as Keeper (link below). This is software which stores yours credentials online, and usually comes with a browser add-on which allows to to easily save new passwords there as you go, and also to populate passwords directly from the manager. A password manager will usually be secured with one password which you'll have, and will use 2-step Authentication which basically means you have to verify any attempt from a new device with a code from your phone.

Sharing your password with others

Business moves fast, and can't wait whilst people take annual leave. Their e-mails will need to be covered, and documents stored on their system will need to be shared. I understand this issue, but sharing your password with someone to access your computer is not the best answer. In your absence they would be working with your login details, replying to your e-mails, essentially acting as you, and their mistakes become your mistakes. Additionally, if it's a password that you use for anything else, they in theory now have access to that. Even if you trust the person, a better solution is simply to set up mail forwarding rules to the person covering, and to share any files that'll need updated before you go. In case of an emergency that they need access, the administrator of the system will usually have a way to get on and retrieve the files they need, and at least that way the action is logged.

2 Step Authentication

Most systems will allow something called 2 Step Authentication, which as mentioned above, means you have to verify any attempt to access your account from a new device (or after a certain amount of time) using a code from your phone. This is quite common with e-mail accounts, we always enforce this when setting up google accounts for our customers. This is the final step which ensures, even if someone has retrieved your username and password for said site, you will get a notification on your phone when they try to gain access. If you don't allow it, then they won't get in.

Don't use the same password for everything!

Finally, just don't use the same password for everything, even if it is a really complicated sequence of letters and numbers. The risk behind this, is if someone obtains the one password along with your e-mail address, they can now access everything. The best way to tackle this, as above, is to sign up to a good password management service. If this does not appeal to you, then browsers are good at storing passwords these days, the downside being if you need to swap machines down the line its not always easy to transfer them across, although some attempts at portability have been made (notably with Chrome)

What can we do for you?

Having been in the IT field for over 10 years, we have encountered many examples of both good and bad password management. If you want us to review your systems from a password/security perspective and enforce good practice then we can do that. Similarly if you'd just like advice on potential improvements, then we can do that too.

Want to know more, get in touch via the "Write to Author" button at the top of this page.

Resources

Recommended password management tool
https://keepersecurity.com/




🔗

OCR Document Management Systems - You Can’t Manage What You Don’t Measure

Read More

Document Management Systems (DMS) incorporating Optical Character Recognition (OCR) are the bridge between the physical world and your digital one, so having a good understanding of the power and limitations behind this sometimes-mysterious “paperless” technology is the best way to get the most out of whatever DMS you decide to operate.

The concept is a simple one; your business has paper documents which your staff require instant access to for quick and efficient recall during calls or daily administration tasks.

This includes documents like delivery notes, printed quotations, packing lists – all of these are rarely always digitally managed as it would require all customers and suppliers switching to a common platform, and while we are all (slowly) getting there, lots of situations still require the speed and convenience of paper copies. Of course, there’s sometimes just no substitute for a paper copy of a document; in fact, hard copies are often a legal requirement.

That being said, paper is fragile and messy. Working solely from clunky cabinets is slow at best, and unfeasible at worst. Even if you are highly organised and extra careful with your filing systems your business will eventually get to the size where heading to the filing room at every invoice check will bring productivity to a frustrating crawl.

This is where Optical Character Recognition comes into its own. Computer algorithms “read” pages of scanned documents and save the content of the document to a database for intensive searches and archiving. Give the system a document number or tell it what kind of thing you’re looking for and there it is in seconds!

We understand that knowing your tools inside-out is the only way to ensure successful deployment of any system. Our years of experience with numerous off-the-shelf solutions left us disappointed with everything we saw. No one solution we came across did everything our customers required, or it did far too much and was prohibitively expensive, bloated and slow... so we what any self-respecting software company would do and we built our own. OCRchive is our web-based DMS indexing platform which accepts many common digital file formats (including Microsoft Office Documents, JPEG files) as well as PDFs presented by office scanners. Load your documents into the scanner or drag them from your desktop and within minutes these documents start appearing on the system for other users in your organisation to view, download and distribute.

Since 2015, OCRchive has scanned over 2.4m documents for customers in Scotland and England. From estate-management organisations to survival clothing companies, in all cases, we have tailored the solution specifically to the exact requirements of the customer. With our built-in API, we can even interface OCRchive with your existing ERP systems if you require!

There’s an often-underestimated factor to scanning stuff though - things that seems innocuous to us may actually confuse a computer. Smudges on the paper, diagonal scans, coffee stains, poor scan resolution and ham-fisted delivery drivers scribbling on your perfectly pristine print-outs will all break the OCR process to varying degrees. OCR may seem like magic but there are limitations. Poor quality in; poor quality out. That’s why our system introduction will include hands-on training with the software and coaching for the staff handling your documents so you get the absolute best from OCRchive. We want to help you get it right, first time, every time.

Our general recommendations are always:-
  • Ensure good scanning quality from the scanning device.
  • Use correct feeder placement and orientation.
  • Avoid handwritten markings on the paper. Write in the margin and in red or green ink if absolutely necessary.
  • Perform one scan per document – multi-page documents are fully supported by OCRchive.
  • Avoid scanning folded or crumpled papers.

As the industry adage goes, “You can’t manage what you don’t measure.” and this is where OCRchive is very different to other DMS’s. Every document loaded into the application is intelligently reviewed and assigned a scan-score which indicates the read quality of the document.



If the score is in the green, your document has an excellent search rating. If the score is in the red, the user is alerted to the low quality scan and is allowed to assign their own document references manually for searching later or they can re-scan the document under better conditions. Instead of blindly sending your documents down a black hole with no feedback as other DMS’s do, this unique process gives you the transparency and detail you need to monitor the real-world administrative processes at the receiving end to keep record accuracy as high as possible.

Thanks to Google’s powerful Tesseract engine at the core of OCRchive, our search abilities are exceptional, with OCRchive facilitating “fuzzy” searching for things that just look similar (O’s instead of Zeros, 1’s instead of I’s etc). Coupled with instant document previews and advanced concise filtering options, searching for important documents will typically only take seconds, even for an inexperienced user.

🔗

Doing it yourself - the realities of Shadow IT

Read More

Everyone knows the official way to get things done in IT - contact the helpdesk, file a development request, make a business case. That's the way it's meant to be done, so why isn't that the end of it?

Deadlines, objectives and reality get in the way unfortunately. Telling your boss that you can't do what you need to because you're held up by the IT department won't cut much ice - "find another way and get on with it" might be the response.

Contrary to popular belief, the IT department aren't disinterested and unhelpful (well not always anyway!) - they have their own procedures to follow, and with many companies tightening their budgets, your project is probably a long way down the list. "We might be able to fit it in next financial year as long as nothing urgent comes in" is a common response. With a good business case and persistent chasing you might get the go ahead, but for many people it's easier to go round the problem than go through it.

For £5 a month you can rent a share of a data centre-hosted web server with a database and it will be ready to use a few minutes after you order it, allowing you to serve hundreds or thousands of users. Maybe you or someone else in the team did some programming at University or outside work. You also have Microsoft Access installed on your PC, and you've seen formulas and macros used in Excel. All you need is some time and maybe the odd expenses claim, and you can get the whole thing setup in less time than it takes to fill in the "development request" form, let alone navigate the whole process. It's appealing, and your boss won't care, in fact you'll probably get a promotion after having solved the admin problems that have been plaguing a team of 30.

I've seen this happen dozens of times and totally understand why people do it. The IT department can't sleep for worrying about it and send alarmist emails about data protection, backups, information security, unsupported systems and make sure everyone knows that they want nothing to do with it. In the meantime the business benefits from the project and it continues until the requirement ends or IT are persuaded to adopt and support it, in exchange for promises not to repeat the exercise.

This whole process of doing IT without the support of the IT department is called Shadow IT. While I admit to having a soft spot for the people that set these systems up, I have also dealt with them from the IT department side and am aware of the huge number of risks that they introduce. Some IT managers try to introduce ever tighter security to stop it, or threaten disciplinary action against the people that are involved - this is missing the point. When dealing with Shadow IT I would recommend open communication with the people involved and guidance to minimise the long term risk. To summarise:

IT Departments

  • Make your development and support requests simple and easy to use - speak to your users rather than hiding behind forms designed to put them off requesting work.
  • Provide development guidance for in-house applications. This will make future migration easier.
  • Provide internal hosting at minimal / no charge using technologies that you have approved.
  • Maintain a log of Shadow IT apps and work out how they might be migrated in the long term.
  • Use the presence of Shadow IT apps as an indicator of failure in your "strategic" apps. If the strategic app was working well, why would people be building their own replacements? Use this to inform your strategic road map.
Prospective Shadow IT Developers
  • Use technologies that you know the business already uses - it will make it easier to get support.
  • Keep management and IT informed
  • Don't break data protection law - research it online.
  • Don't fall foul of any company policies regarding company data, especially if you are considering uploading any of it to the Internet. It could cost you your job.
  • Back up your whole project regularly (lots of information about this is freely available).
  • Make sure you thoroughly test your work before letting anyone use it.
  • Investigate security (again, lots of information about this is freely available).

🔗

Online Backup - how to look after the data you keep on Google Drive and Office 365

Read More

No-one really wants to talk about backups until there is a problem!

For most small and medium-sized businesses, taking backups involved changing the tapes and remembering to put them in the safe or in the car. For larger businesses it was all down to IT, and you just had to remember to put your files in the right place to make sure they were taken care of - any problems and you just call the helpdesk.

The situation is a bit less straightforward now, as we start to store our data "online" or "in the cloud". It's someone else's computer and there are loads of ways of using it - you can upload files directly, store them direct from your email, and you can even just drop them on your desktop and let synchronisation magic take care of it for you. It's quick and convenient, and most of us don't think about what is happening in the background, or what to do if it goes wrong.

What can go wrong?

Lots of things, but here are the main ones (remember we're just talking about backups / data loss here):
  • Accidental Deletion - you or someone else in your business accidentally deletes your files. This can be obvious - "help, everything's gone!", or more subtle, which is usually worse. You go looking for some files that you are sure you saved and they aren't there. Did you definitely put them there? When? It gets complicated quite quickly.
  • Malicious damage (someone intentionally deletes your files). We don't like to think that this should happen. We trust everyone that we intentionally share our data with. We can't stop trusting people, but we can still be careful. This can manifest itself obviously, or can be harder to detect. Perhaps one or two important files go missing, or get changed slightly but importantly. Think price lists, contract documents, product information.
  • People changes and data ownership. Many businesses are relaxed about where their staff store their data, and let people do their own thing. Everyone has their own favourite tools or ways of working, and many can be registered with a free account. Maybe the shared drives are a bit slow, and it's easier to use dropbox? The problem is that when that person leaves the business, they may take that data with them. It may have been gradually copied over time and without the intention to cause harm. Worse - they may even be able to argue that some or all of it belongs to them. There's enough here for another article, but it isn't as simple as just setting policies and disciplining staff.
  • Ransomware. This is horrible stuff and prevention is most definitely better than cure. However, once it gets on your network it can spread, using your shared drives and cloud storage (in certain cases) to propagate. Ransomware scrambles your files so that you can't use them, uses your own systems to spread through your network and then extorts money to get your files back.

What can we do about it?

There are a huge variety of cloud storage providers, and the story isn't consistent. Some backup features are provided as standard, but I wouldn't recommend relying on it...

Where the service is offered you generally have to restore all data help by a particular user to a point in time (say last Monday), meaning that any changes made since that time have to be tracked separately and copied back in once the backup is taken. You can also check the version history for individual files and restore them (or perhaps use scripting to automate this). Neither of these approaches are easy or straightforward.

The obvious options are:

  • Traditional Backup of some description (maintain a server (either local or remote) with copies of your files, including a history of changes, perhaps every day in the last week, every week in the last month, and every month since you started). This would need the usual programme of monitoring, periodic restoration tests etc.
  • Cloud Backup - this is our recommended solution in most cases. All of your online / cloud hosted files and emails are backed up every night and kept for as long as you subscribe to the service. You can restore some or all of the files whenever you like which is quick and convenient.

Enterprise Systems is a reseller for SpinBackup (G Suite / Google Drive only) as well as for Spanning Backup (Office 365 as well as G Suite). We can easily combine this with your existing G Suite or Office 365 accounts, regardless of how you subscribed. We'll be writing more about these products in another article.

Closely related things I haven't covered

This is quite a complex area and you should be aware of the following related topics:

  • Ransomware Prevention
  • Authentication best practice (passwords and similar)
  • General backup best practice
  • Hardware redundancy
  • Data Protection (including Data Retention)
  • Data Loss Prevention
  • Working collaboratively and co-editing
  • Organising and searching for your data
  • File storage options

More Information Needed?

Please get in touch, we'd be pleased to help.


🔗

Spin Backup Partnership

Read More

We are proud to be able to offer additional peace of mind for your cloud-hosted G Suite SME platform with SpinBackup.

Cloud-to-Cloud Backup & Recovery for G Suite / Google Apps

  • Unlimited Storage
  • Automated Daily Backup to Amazon S3
  • Disaster Recovery (Restore-in-time machine)
  • Migration to another Google account
  • Local Downloads
  • Version Control
  • Centralized user management console for G Suite administrators
  • Encryption in transit and at rest

Cybersecurity for G Suite / Google Apps

  • Automated Daily Security Audit 
  • Audit of the 3rd-party apps installed by employees that have access to corporate G Suite / Google Apps data.
  • Employees Behavior Tracking
  • Identify cases of data leakage, such as items shared with 3rd-party users or unauthorised data transfer from a corporate G Suite account to a private one.
  • Security Alerts 
  • Integration with Gmail or Slack to get notified fast and easy.




🔗