Cyber Security Solution

Cloud, Microsoft, Technology, Uncategorized, VMware

Prepare Your Business for Windows 7 End of Life


No Comments

Why would you ever change a good thing? Because of end of life, that’s why. Grab your tissues, we’re delving into the topic that’s provoking international furore and mourning; the painful issue of Windows 7 end of life. When it comes to desktop and laptop operating systems for both personal and professional use, Windows 7 has been number one since its release in 2009. Originally intended to be an incremental upgrade to Microsoft Windows, especially after the disaster that was Windows Vista three years prior, it maintains hardware and software compatibility. A major improvement to its predecessor, Windows 7 quickly won the hearts of every computer user worldwide. Sadly, tech hard- and software are not designed to last, and it was only a matter of time before it would see end of life. Though Microsoft has tried to ease the public into the idea of something bigger and better with the release of Windows 8 (which didn’t go down as well as expected) and Windows 10 (which just isn’t Windows 7), the truth is, frankly, hard to swallow.

“But why?” you sob, “We don’t have to let it go, no one would know!” Unfortunately, it doesn’t quite work like that. Well, it could, but it would open your organisation to all of the nasties that would just love the chance to infiltrate your system. The main problem here is support. You might be surprised to hear that mainstream support for Windows 7 ended all the way back in 2015, which means that Microsoft hasn’t been releasing feature update and service packs since then. That might give you some hope, but alas, I’m here to dash those completely. The only reason that you’ve been safely able to use Windows 7 up until now was thanks to the security patches released through the extended support period, which will end on the 14th January 2020.

Technically, you could continue to use Windows 7 after the extended support period, but the risk of a cyberattack would be significantly higher, and you’d have to ask yourself if it would be worth the risk. Microsoft won’t be taking any responsibility for any security breaches that happen to a Windows 7 operating system after the end of life date, and any breach could land you in deep water (and a deeper fine) in terms of the new GDPR regulations. The issue with end of life is the loss of the security updates that fix vulnerabilities that hackers exploit. Any new computer viruses and malware being created would be far more advanced compared to the old security patches. Why put so much money and time into protecting your business data only to leave your organisation wide open to any cyber attack that happens to be the goût du jour? You might think that 14th of January is miles away. And it is, but in terms of IT it’s not long at all.

So, if ever it was time for a spring clean, now would be it! The more time you have to plan, the less disruption your IT team and end users are likely to experience, which is likely to happen if your software is incompatible with your new operating system. Compatibility is likely to be an issue here, as is old hardware (oh look, a new reason for your printer to refuse to cooperate) and your legacy systems. Since it’s effectively changing the very foundation on which your laptops and desktops rely on, it’s important to make sure that your systems remain interoperable with one another. Some applications might have newer, more compatible versions available which will work flawlessly on your updated operating system. Another option is to move your legacy applications to a virtualised computing environment, easing the change. Before jumping straight into an OS change, it’s important to have a strategy in place to prevent everything from going a bit pie-shaped and cause any more tears. The good news is, if you’re relying on a cloud-hosted system, upgrading your operating system shouldn’t be much of an issue at all.

With the release of Windows 10, Microsoft has introduced the ‘evergreen’ Windows as a service model. This is a complete revolution in terms of OS, and it has launched the idea of a ‘final’ desktop release. Instead of having to migrate to new versions every three years, Windows 10 will continuously update every six months or so, providing continued support and patched security. With shorter release periods (only 18 months now), Windows 10 can’t be treated like a traditional version. To make things that much easier, it’s now possible for an in-place upgrade, meaning that you don’t need to migrate your data and reinstall all of your programs. Windows 10 provides plenty of new features for users when compared to Windows 7, such as Windows Autopilot, which automatically provisions and enrols your device when you sign in, provided that you’re connected to the internet.

January 14th next year will be an incredibly sad day for the millions of Windows 7 users who have so far refused to move on. We’re expecting a world-wide shortage of tissues, ice cream and Windows 10, a resounding wail of “Not Windows 7! What is this Windows 10 malarkey?” reverberating in the crisp January air. Here at Cetus we know that change is scary and unwanted. We feel the pain of saying goodbye to Windows 7, but know that when it comes to your organisation, we will help ease all parties into the next operating system step. Make sure to have a chat with our experts, who will provide the tissues during this painful time, and every other OS change in the future. If you want the most in-depth info and latest tips, make sure to register for our exclusive hands-on workshop with VMware in May.

Speak to an expert

Directors-9619Missy Beaudelot – Digital Marketing Executive
With a background in journalism and an interest in all things tech, Missy keeps our social media in check while monitoring our websites and developing our digital presence.

 

Blog, Cloud, Cloud Hosting, IT Solutions, Technology, Uncategorized, VMware

Workspace ONE: Everything You Need In A Workspace


No Comments

There has been quite a lot of excitement surrounding VMware’s Workspace ONE since its announcement in February 2016. The modern version of VMware’s 2016 Workspace Suite; Workspace ONE integrates identity management and EMM, modernising end user computing. With regular updates, the platform continues to excite users across the globe; truly revolutionising the flexible ‘any app, any device’ vision that runs the mobile workspace reform.

Workspace ONE is a secure enterprise platform that delivers and manages any app on any mobile device; that integrates identity management, real-time application delivery and enterprise mobility management. It accelerates how workspace services can be delivered, while engaging digital employees, reducing the threat of data leakage and modernising traditional IT operations for the mobile cloud era. And with yet more announcements as recently as November during VMworld in Barcelona, here are the reasons why Workspace ONE really is everything you need in a modern workspace.

Embrace your inner SaaS
Workspace ONE allows organisations to embrace SaaS and mobile apps while supporting existing enterprise applications (think of your legacy systems), and all securely.

Productivity is the name of the game
The best way for your users to be productive is to provide them the tools that give them the freedom to work, while maintaining the right data security and compliance; which Workspace ONE delivers.

Adopting Windows 10
Windows 10 is taking over the enterprise space and, with Workspace ONE, the accelerated adoption of the platform by using the same modern management framework designed for mobile devices.

Authentication that adapts
With adaptive conditional access; ensure the right level of security for each individual user based on authentication strength, data sensitivity, user location and device posture.

Cyber security with a difference
A huge issue for organisations is the users’ disregard for individual responsibility towards cyber security. Workspace ONE delivers improved security and employee engagement, incorporating next-generation automation and insight.

Improved user experience
The new Workspace ONE hub is truly user-centric, streamlining onboarding and user experience across all platforms.

And all delivered as a service
To speed up app transformation, Workspace ONE delivers virtual applications and desktops as a service.

By adopting VMware’s Workspace ONE platform, join the future of work today and combine an excellent user experience with the ease of management for any IT team. Have a chat with our Workspace ONE-centric VMware experts to get you started.

Speak to an expert

Directors-9619Missy Beaudelot – Digital Marketing Executive
With a background in journalism and an interest in all things tech, Missy keeps our social media in check while monitoring our websites and developing our digital presence.

 

Blog, IT Solutions, Security, Technology, Uncategorized

The New Hero of Cyber Security; Zero Trust


No Comments

The ability to work from anywhere, on any device, has quickly become one of the greatest developments in the workspace of all time. It’s not an exaggeration either. In the UK, 4.2 million people were working from home in 2015. In fact, between 2012 and 2016, the mobile workforce increased by 12.35%, and that percentage is growing exponentially year on year. It’s widely predicted that by 2020, half of the UK workforce will no longer be plonked in an office all day. That means that it’s time to invest in nice shoes and/or new pj bottoms. And while that’s an amazing turn of events, it will cause some significant security concerns for everyone concerned. With so much of your workforce wandering the plains of the UK, your network is no longer secure by actual brick and mortar perimeter.

Today’s increasingly decentralised enterprises have become a bit of a headache for IT, who now have to keep you secure even when you’re not potentially clicking on some dodgy email phishing links. Zero trust has evolved to answer the issue. Back when cybercrime was still all the way at Gen III, most organisations assumed that their security protection was robust enough to keep them safe. Those few who did err on the side of caution deployed security operations centres or other cyber monitoring solutions, but for the most part IT departments assumed that anything inside the perimeter was safe. Oh, but those were far simpler times.

By working on the assumption that any resource in the network might be compromised, zero trust puts monitoring solutions in place so that you have the power to take remedial action if it’s needed. With this new solution, no one service or server is considered more secure than the next. It’s basically a data-centric network design that puts micro-perimeters around specific data or assets, giving you the flexibility to apply more-granular rules can be enforced. It solves the ‘flat network’ problem of hackers infiltrating your network and scurrying around undetected. With the right guidance (you’re welcome in advance) and a little bit of know-how, it only takes a couple of steps to get started with zero trust.

Identifying your sensitive data is the obvious first step. It sounds like an easy way to start the process, but it’s a little more challenging than you’d think. You can’t possibly protect data that you can’t see or know about. You need to know where your employees store their data, exactly who uses it, how sensitive it is and how they, your partners and customers use it. Without knowing all of this, you’re putting your data and your organisation at risk. And you can’t exactly start investing in security controls until you know what it is you’re actually trying to protect. When you have a better idea of what you’re dealing with, it’s time to classify it all. I suggest procuring the help of your most organised member of staff before moving onto mapping your data.

To understand how you’re going to employ zero trust, and therefore micro-segmenting specific sensitive data, you need to know how it flows across your network as well as between users and resources. This is a fun (probably not) exercise to have with your stakeholders, such as application and network architects, to fully understand how they approach information. To give yourself a bit of a springboard, security teams should streamline their flow diagrams by leveraging existing models. A zero trust network is based on how transactions flow across a network, and how users and applications access data. Optimising the flow to make it simpler, and start identifying where micro-perimeters will be placed and segmented with physical or virtual appliances. In a network where the compute environment is physical, the segmentation gateway will usually be physical as well, whereas a virtualised compute environment will deploy a virtual segmentation gateway.

Micro-segmentation is the name of the game after you determine the optimum traffic flow, by determining how to enforce access control and inspection policies at the segmentation gateway. The point of zero trust is to enforce identity rights, so that you can control who has the privileges to access specific data, so it’s important to know exactly which users need to access what data. You need to know more than the source address, port and protocol for zero trust to work, since security teams need to understand the user identity as well as the application to establish access rights. Having created your ecosystem, it’s important to ‘Big Brother’ it to identify malicious activity and areas of improvement. There’s no point only logging traffic if it comes from the internet- god only knows what kind of infectious diseases your network could contract from a wild-spirited USB. With your shiny new zero trust network, the segmentation gateway can send all of the data flowing through it, which includes traffic destined for both internal and external network segments, straight to a security analytics tool that inspects it properly.

Now that you’re the proud owner of a zero trust network, you can rest easy knowing that your network is being monitored effectively. Here at Cetus, we believe that building the best architecture is just as important as keeping it safe. We’re experts in all things datacentre and cloud, so make sure to have a chat with one of our specialists who can help you through all of your security challenges. And while you’re at it, book yourself in for our complimentary security posture review to identify where your organisation is being exposed to the nasty things that lurk on the outside of your perimeter.

Speak to an expert

Directors-9619Missy Beaudelot – Digital Marketing Executive
With a background in journalism and an interest in all things tech, Missy keeps our social media in check while monitoring our websites and developing our digital presence.

 

Blog, Cetus Solutions, Check Point, IT Solutions, Security, Technology, Uncategorized

Here Phishy, Phishy, Phishy….


3 Comments

A couple of weeks ago, there was a mandatory ‘here’s how to help keep the company from falling prey to cyber attacks’ lecture at Cetus. We all trooped downstairs, cramming into one of our board rooms, mugs clinking and teas sloshing. One of the lovely ladies from Barclays came in to give us a word of warning- or forty- on how to spot nefarious activity and not fall prey to a scam. By the end of it we were all ready to delete our Facebook, Twitter and Instagram accounts, never use an ATM, and I seriously started questioning my role within social media. It was quite the terrifying afternoon. Between social engineering, ransomware and phishing, it’s a miracle we all aren’t in debt from scammers. But the most terrifying aspect was learning just how prevalent phishing attacks are.

Big ransomware scams make the news constantly- splashed across the news, Sharon from HR standing at the water cooler to share the details in whispers to anyone who passes by- but phishing is the bigger threat here. In reality, a ransomware attack usually only demands several hundreds of pounds from the organisation it invades, while a phishing scam generally scams thousands of pounds from the victim. Not only that, but it’s easier for the cyber criminal to carry out a phishing attack. Now that I’ve given you something short of a heart attack (sorry), let’s turn this around shall we? Here are a few key ways of keeping you off the phisherman’s hook.

Beware of the sender
It doesn’t really matter whether it’s personal or corporate, receiving an email either makes you want to go on an extended holiday or celebrate. At work you’re usually too busy opening and replying in record time to get on with the mountain of tasks that grows with every email. It’s fair to say that you don’t always check who the sender is. I mean, we’re all weary of any Arabian Prince trying to get into contact, but aside from that we’re pretty chill for the most part. If they’ve gone to the trouble of finding your email address (I still can’t figure out how people manage to find me) then chances are they really need to chat, right?

Depending on how much of a nightmare you are in life, you probably won’t know the hacker. So before you jump into your emerging pile of unopened emails, take a quick look. If you suddenly get an email from someone you don’t speak to regularly on the topic of something that you don’t normally think about, be slightly weary. Check the sender’s address- does it look a bit weird? Is there a random ‘0’ instead of an ‘O’? Could that ‘i’ actually be Vietnamese character ‘ỉ’? Is there an extra letter or number in the address that shouldn’t be there? If you see one of these little tricks, bonus points for your great eyesight, and definitely get the email checked out.

‘I get scammed with a little help from my friends’
Did the email check out, but you’re still not 100% sure if you need to detonate your computer immediately to avoid any viruses escaping through the network? Take a quick look at the list of people that received the email. Do you know them? Is it a strange group, ie the sales group being added one name at a time instead of the group link? The cyber criminal might be targeting a large number of people in your organisation, so if you see people on the list that you wouldn’t normally be in contact with, or from a department that has nothing to do with yours, be extra careful.

Bit of a dodgy subject line
Aside from Sharon’s bi-monthly suggestion for drinks in the pub across the way after work on a Monday night, you should really only be getting emails that directly relate to your job function. That is, unless you’re in marketing- we seem to get our noses into plenty of unrelated jobs. If you’re getting emails about things that you know you’re not privy to or they make absolutely no sense to you, don’t open it. If it’s not spam, it’ll be malware. If you do happen to open it (oopsie), check if the email is a reply to one that you didn’t send. Does the message match the subject line? A misalignment of the two should send up an army of red flags. Also, while we all have the office oddball that likes to reply to emails at 3am, is it normal to be receiving this email from this sender at this particular hour?

Attachments and hyperlinks of doom
We’ve all opened random attachments or clicked on hyperlinks that we weren’t quite sure about and sighed with relief when it was just a video of cats acting strangely. We know we shouldn’t, but that curiosity can’t be helped. Besides, it could be important, or cats, after all. A few things to check before you right click; did you expect the attachment? Is it a common file type that you would normally receive? Does it have a weird name, or strange symbols in the file name? If you answer yes to these, maybe don’t open it. It’s quite likely to be malicious.

Not quite what you were expecting?
If you receive an email that contains unsettling, startling or urgent content that requires immediate action on your part, it’s most likely a phishing attack. There have been so many of these popping up recently, panicking the nation. At the moment, a common scam is an email from your bank claiming that your account has been hacked and you need to login straightaway, or even move the rest of your funds to another account. For the Netflix lovers among you, there have also been emails being received saying that billing information needs to be updated. Don’t fall for it. If the email includes a link to login or change account details, be extra weary. Don’t use links, web addresses or phone numbers.

Keeping yourself protected from any cyber crime can be a scary business, but even more so when it’s something you could very well unwillingly stumble into. It takes more than trusting your spam filter to keep yourself safe, having a strong cyber security solution is crucial. We work very closely with Check Point to craft solutions that stand tall against phishing, ransomware bots and all kind of nasties, using their SandBlast advanced endpoint threat prevention. Have a chat with our experts to see how we can whisk some cyber security into your perfect infrastructure solution so that it’s one less thing you need to worry about.

Speak to an expert

Directors-9619Missy Beaudelot – Digital Marketing Executive
With a background in journalism and an interest in all things tech, Missy keeps our social media in check while monitoring our websites and developing our digital presence.

 

Blog, Cetus Solutions, Check Point, IT Solutions, Security, Technology, Uncategorized

Skyscraper: When Cyber Security Goes Wrong


No Comments

It was one of the biggest blockbusters of the summer. Dwayne Johnson’s Skyscraper thriller grossed $304.1 million during the hottest summer in living memory. Honestly, it probably would have made more, but for the fact that half of the UK population was sitting in any available patch of sun with a beer in their hands. I was one of those people, although with fruity cocktails instead. That was when I wasn’t in the office writing witty blog posts on Citrix Workspace, of course. Alas, while I had every intention on going to see the film, I never got around to it. So it was my pleasure, two Saturdays before Christmas, to snuggle in my pjs and pop it on (I lead the most exciting life when I’m not in the office). Well. While it’s action-packed with an interesting futuristic spin, I couldn’t help but spend the whole movie pointing out, sadly to no one in particular (I’m going to have to get a cat), all the various cyber security blunders that Johnson’s character made. Not one to waste my breath, or a good writing idea, I’m going to lay it all out in this blog post so that you can giggle along with me. Before we go any further though, there may be a spoiler or two, you have been warned.

In a nutshell, Johnson plays ex-FBI hostage-negotiator-turned-private-security-expert Will Sawyer, who gets called to Hong Kong in order to assess the security of the world’s tallest skyscraper. The Pearl, 225 stories and a whopping 1,100 metres tall, needs an inspection of the upper residential half before it can be opened to tenants. Since we are, after all, living through the ‘IOT for all of the things!’ revolution, no matter how mundane the appliance, it’s no surprise that the Pearl was built with tech in mind. It’s basically a giant computer, full of safety features and automations that make living and working there slightly more exciting than your average building. We saw absolutely zero evidence of it, but I’m still sure the lights turn on and off by clapping your hands. Anywho, we see Sawyer being given a tablet that controls the entirety of the 225 floors and shooed out of the door to go inspect the offsite security centre that controls the skyscraper. The tablet, obviously, isn’t in his possession for long, as it gets robbed by a group of terrorists who succeed in burning down the $200 billion structure with it. The sad part is, if the IT department had deployed a better cyber security solution, it could all have been avoided. Typical.

Who needs an effective authentication method, am I right?! This was mistake number one. For some incomprehensible reason, the only way of unlocking the tablet that controls the entirety of the building is via facial recognition. That’s it. Sure, in cinematographical terms this looks the best. It’s impressive and futuristic, suave and savvy. It’s every nerd’s dream. And facial recognition as part of multi-factor authentication is really effective. In the blink of an eye, it can analyse billions of tiny little markers on your face to unlock your device. But who on earth would think that it would be enough? For god’s sake, just signing into my Facebook requires my password, mother’s maiden name, list of my three favourite chocolate bars (in order) and the promise of my firstborn. Truth be told, facial recognition alone was irresponsible, and about as effective of protecting all that important data as using ‘1234567’ as a password. Hell, put a photo of Sawyer in front of the camera and that would probably fool it. There are so many effective ways to authenticate identity (I wrote an entire post on it). Why not have a secondary form of authentication, like having a password activate on Sawyer’s smartphone? That would have been clever.

Mistake number two; not informing the IT department of the breach. Err, this should have been the first point of call when Sawyer’s tablet got robbed. Instead, being the idiot that he is, he threw caution to the wind and went running off to save his family. Just one minute on the phone to IT and they could have stopped the disaster that was about to unfold. A good cyber security solution would have removed access to the tablet in a couple of clicks, rendering the terrorists’ efforts moot. In fact, it would have taken no time at all to wipe the data clean from the device, essentially turning it into an expensive, albeit sleek-looking, paperweight. It does echo a current issue facing organisations in terms of cyber security; the majority of security breaches come from employees who, inadvertently or not, allow the threat to infiltrate the network. This can happen from clicking on a dodgy link in an email (it’s sadly not a video of cats acting strangely)- in fact, phishing attacks are more prevalent and more likely to scam large sums of money from an organisation. Realistically, in this situation, Sawyer seriously neglected his responsibility to inform the IT department. While he undoubtedly performed some incredible gymnastics and it was thoroughly enjoyable to watch, I would have loved to hear his rationale when all was said and done. I doubt he’d be hired to assess the security of a paper bag after that!

The moral of this story is, and I’m sure it’s what director Rawson Marshall Thurber wanted to portray; don’t let your organisation become the Pearl and burn down to the ground- make sure your cyber security solution ticks all the boxes. We work closely with Check Point to incorporate secure technology into our solutions, effectively avoiding the risks that we saw Sawyer facing in the film, and many more besides. Have a chat with our cyber security solution experts here at Cetus, and in the meantime book yourself in for one of our complimentary security posture reviews!

Speak to an expert

Directors-9619Missy Beaudelot – Digital Marketing Executive
With a background in journalism and an interest in all things tech, Missy keeps our social media in check while monitoring our websites and developing our digital presence.