As tax season approaches, both individuals and businesses must prepare to file their returns. Since threat actors ramp up their efforts to exploit vulnerabilities and launch cyberattacks during this time, it’s important to make sure you are safeguarding sensitive financial information.
How do you prevent your company, your clients, or your employees from falling victim to identity theft, financial fraud, and other cyber threats over the next several weeks? In this blog, we will walk through some very simple and practical tips to navigate through cyber threats and effectively protect your data during tax season.
The first step to safeguarding your data during tax season is updating and strengthening your passwords. This is one of the simplest yet most effective ways to enhance your security. Don’t make it easy for attackers to guess your credentials and harvest your data.
Here are some best practices when it comes to passwords:
Opt for a combination of letters, numbers, and special characters.
Steer clear of using easily guessable information such as your name or birthday.
Don’t use the same password in multiple places—I know, I know—easier said than done right?
To help you create passwords that meet these criteria, consider using a reputable password manager app—there are many options such as 1Password, LastPass, or RoboForm. A password manager allows you to generate and store complex passwords securely and conveniently—which means you won’t need to sacrifice security for convenience.
Tip #2: No Easy Access
Another way to enhance your overall cybersecurity posture and keep sensitive financial information safe is by enabling Multi-Factor Authentication (MFA). With MFA, users are required to provide two forms of identification before accessing an account. It typically involves a verification code sent via text, email, or through a dedicated application.
By implementing MFA, the risk of unauthorized access to financial accounts is significantly reduced. Enabling MFA provides an additional layer of security during tax season and beyond.
Tip #3: Spot the Fakers
During tax season, it is crucial to BEWARE OF PHISHING. According to Cloudflare, 90% of successful cyberattacks start with email phishing attempts. Threat actors frequently send fake emails masquerading as legitimate tax authorities or financial institutions.
To mitigate risk, always verify the sender’s email address and refrain from clicking on any links or downloading attachments from unknown sources. Be assured that legitimate institutions DO NOT request sensitive information through email. By remaining vigilant and skeptical of unexpected or suspicious communications, individuals and businesses can better protect themselves from phishing scams that could compromise their financial data.
Tip #4: Inspect Your Statements
The final tip to help you avoid tax-time cyber threats is to monitor your financial statements regularly. By carefully checking your bank and credit card statements for any unauthorized or suspicious transactions, you can keep an eye on cyber threats and take action before things get out of hand.
If you detect any inconsistencies or irregularities, promptly report them to your financial institution for investigation. Early identification of fraudulent activity is crucial in minimizing potential financial losses and mitigating the impact of cyber threats. Stay proactive and attentive to your financial statements so you can effectively protect your accounts and assets from unauthorized access.
Prevention is the best policy
As tax season approaches, prioritizing cybersecurity is essential to safeguard your financial well-being. By following these tips and remaining vigilant, you can reduce the risk of falling victim to cyber threats, ensuring a secure and stress-free tax season. Remember, staying informed and adopting proactive security measures are the keys to protecting your sensitive financial information in today’s digital age.
Do you want to implement a more proactive approach to cybersecurity? Contact Ostra to learn more about our best-in-class, fully managed cybersecurity services.
Eunice Asemnor is a Security Analyst at Ostra Cybersecurity, a multi-layered and fully managed Security as a Service. With expertise in SIEM technologies, cybersecurity solutions, and advanced threat defense, Eunice plays a key role in protecting Ostra’s clients as a member of Your Trusted Cybersecurity Team.
https://www.ostra.net/wp-content/uploads/2024/02/Tax-season-blog-cover-image-larger-file922x615px-2.png12301844Eunice Asemnorhttps://www.ostra.net/wp-content/uploads/2023/08/Ostra-logo-2023.pngEunice Asemnor2024-02-27 08:00:282024-02-28 10:12:434 Tips to Avoid Online Dangers During Tax Season
How does one go about building a community in the cyber wild? It starts with networking and connecting with like-minded individuals in the industry.
In our latest “Fireside Chat,” Ostra Founder and CEO Michael Kennedy chats with Evan Francen, CEO of SecurityStudio, and Frank Gurnee, SecurityStudio’s Channel Director, on the topics of AI and Cybersecurity Marketing.
There’s lots of great information in the wisdom of these industry thought leaders, from their views on AI to thoughts on the importance of authenticity and honesty in marketing. Listen in and learn from the best on how to build a community in today’s cyber wild.
AI and Technology
The conversation begins with AI (artificial intelligence) and its impact on technology. While AI is still in its infancy, tools like Chat GPT have made this powerful technology available to anyone with a computer or a laptop.
Our panel discusses both the upside and shortcomings of AI in output accuracy and whether it can (or should) integrate into automated processes in information technology and cybersecurity.
Marketing and Community Building
The discussion then shifts to marketing and community building. Michael and Evan devote a lot of time to the key elements that form the basis of any technology solution’s marketing strategy.
Both cite honesty and relational sales methods focused on solving clients’ issues and/or providing quantitative value as the core properties of a sound marketing ethos.
View The Entire Conversation
Click on the video link below to watch the entire video chat or scroll down to read the full transcript.
So thanks for joining us again today, guys. We are excited. A lot of what we’re gonna be talking about today was based on your feedback from the last fireside chat we had. So with that, I want to introduce our my esteemed co-hosts here. So first and foremost, we have Michael Kennedy, who’s known as Kennedy. So Michael Kennedy runs Ostra, and Ostra is a managed Security-as-a-Service company. And so done a ton of amazing things in the industry. Been around a long time. As you can see, we all have the gray hair, and we’re just talking about our ages here. So their beards are a little longer than mine though, so I, I gotta catch up guys. So Michael Kennedy, and we’ll call you Kennedy, going forward here. How are you doing today?
I’m good, thank you. Thanks for having me. A little, a little cooler here in the office with a big fire back there, but then if I, I have a bright light shining on top of me, so you might get a little bit of that every once in a while, but
So also we have Evan Francen. So Evan is the, well, you’re the CEO of SecurityStudio. You are the founder of FRSecure. And just kind of changed spots there as, as CEO to step down, but still a integral part of the whole thing. And man, Evan Francen’s been doing amazing things in this industry for many, many years. And and we’re really excited to have you on as well. Evan, how are you doing today?
Well, awesome guys. So, you know, what we heard a lot in the last fireside chat was you know, guys are, are really wondering or wanting to pick your brains around things in the sales and marketing side of things. So we’re gonna get into a little bit of that today. But anybody have any opening remarks? Anything you guys have been seeing out there? Anything you want to talk about that’s kind of hit in 2024 where we kind of jump into those things?
I don’t know. I was talking to a professor friend of mine this morning from the University of Minnesota, Master’s or whatever, and he got me started on AI and that, that led to a whole long discussion. Yeah, I mean, you could take this anywhere. I don’t even know where to start.
Yeah, well, what what Elon just just turned on a new link, so we heard that Right. And we heard obviously AI, man, that’s, that’s kind of going crazy these days, so you’re right. What impacts do you think some of that stuff’s gonna have this year?
Well, it’s like anything, you know, there’s nothing wrong with the tool. It’s are you using the tool? Right. You know it’s about being responsible with the tool. You know, there’s nothing wrong with a table saw, you know, but I wouldn’t give a table saw to a toddler, you know, so I wouldn’t get Yeah. AI is the same way, you know it. So what I use AI for, other than, you know, stuff that other people probably shouldn’t, but is you know, create ideas a lot. I’ll use AI. You know, I’m working on the latest curriculum for securing complex environments. And so I asked, you know, just work with Chat GPT to give me some ideas on what I can create for an exercise for this course. You know, stuff like that. And I was talking to a friend about bias and, and people don’t, and an un an irresponsible way to use AI is to, is to not be discerning with the input, with the output, to not understand where it comes from.
One of the things my father taught me as a child that was, thank God, was always considered the source. And so people, you know, will argue that, well, AI is not biased or whatever. But, so I, I did a demonstration where I asked AI to, if God exists, you know, let’s see the bias. And when you ask a yes no question, and this is a tip for anybody, when you ask a yes no question, the only unbiased response, valid responses are yes, no, I don’t know. Anything else is bias. And so, you know, this long discussion with AI before you finally get to a point where, and it’s talking about its beliefs, and I didn’t ask you about your beliefs. I mean it all the way to the point where it finally admitted it didn’t know. But I think somebody who’s not discerning and doesn’t think critically would’ve taken the first answer that AI would’ve given it, given them and just gone with it, you know? Yeah. And so that led to a whole discussion to this morning about, you know, where AI is going and what I think it’s gonna do to us.
Yeah, I think that’s a good point. The source, right? I mean, I mean, because it’s trained, so it’s trained on something from something. And, you know, how accurate was that information that it was fed? You know, what was it provided? That sort of thing. So that makes, makes a ton of sense. Yeah. As far as something that should be a concern to everyone, right? Because especially as you lean more and more on the validity, the information, you know, the, the, is, is this true? Is this not? Or, or you’re just blindly sending it out, right. Which I think a lot of people are using it for content and things like that, that you know, could essentially be completely wrong at the end of the day. And so, you know, that’s put out there and lives on Google and everywhere else as the truth, as fact, and it very well may not be. Yeah.
So go ask AI if God exists and, and play around with it. That’s one of, that’s one of the great questions because us as humans, you know, still debate that all the time, right? Yeah. Belief, belief in faith. But it’s, it is a yes no question. And so the, it’s yes, no, or I don’t know. And anything, you know, beyond that, and the same use, the same thing when you’re talking with people with humans,
You know, identify, you know, the places where there’s bias and, and then you get to choose which one to do with it. ’cause There’s nothing necessarily wrong with bias, but what’s wrong is bias, ignorance, where you ignore the fact that there is bias. Yeah.
Yeah. And I, you know, so what’s interesting about this topic, and, and we’re just kind of, kind of talking here, is you know, I, we go to these shows, we go to events, we’re hearing lots about cybersecurity. And man, the buzzword in the industry is AI. I mean, every cybersecurity solution out there is touting some type of AI. We AI this, we AI that, right? So is that just a buzzword or is that, is it truly something that they’re building into these platforms that is good for cybersecurity or I know I know your, your guys take Kennedy as, as people, right? A lot of, a lot of eyes on, on things. So, you know, what’s, what is the difference there? And, and, you know, how would you guys differentiate those two things when we hear this buzzword about AI and cybersecurity so much?
First, I think. I think I do. Oh, I think there’s a couple per, so it, it got overused in the beginning, especially last, I would say before the Chat GPT and all the different LLM models. Everybody was in AI, AI, AI. And when you look, when you would peel that back, it never really, there wasn’t really anything true, like in, and, you know, as AI stands for and differentiated intelligence, right? So what the way that we look at it is, and why, where we wanna apply it or apply it, is around patterns, noise reduction kind of more of the data analytics, automation, running scripts and putting scripts together, and then automating those scripts to have it look at to help us reduce the noise for our SOC team. I, I, I think that like what Evan was talking about with the Chat GPT and, and how people use it is really going to be where we see some of that, that differentiator of, are they using it for as a tagline, or are they actually trying to use it for a specific initiative?
And I think a lot of companies started with it as a tagline and to machine learning and AI, and really but most of it is, is kind of in that, that l lms, the, the language models, the putting, you know, Chat GPT on top of it. But for us it’s, I it’s gonna be probably, it’s gonna be a and it’s, I dunno, it’s like all of those, I think about it is operationally. So IUI use it, I use Chat GPT, you know, to figure out what kind of I itinerary, I want to go on a trip, you know, going down to Mexico, what do I want to do? What are the things that I can do? I look at it to talk about if I, if I’m struggling to write something, then use it as an outline. And it’s the same with the way we as an organization try to use those tools of it’s only as good as the information you put in. And it’s not, it’s not I don’t, I don’t know, I I don’t call it intelligence because it doesn’t, it’s not sentient to me. So I, I call it you know, a bunch of automation scripts that scroll through everything and then help you decide on different parameters that are set. So
Yeah, it seems like, it seems like that, you know, AI, at least in my mindset, when all of these vendors, you know, tout AI, it, to me, it, it, it’s almost like, I think of it like, like that’s doing the analyzing or it’s looking at things and it’s, it’s a person which, you know, both, both Ostra and Security Studio, I think think of their services as professional services with people. And people are doing the analyzing and asking the questions and doing all of those things where, you know, it seems like a lot of vendors out there are, you know, again, touting this, this AI type of thing, which makes me think of like a person almost sitting there analyzing or doing these things, which, you know, maybe it’s a misconception. Maybe it’s, we’re just thinking of it wrong. But that’s, that’s how I envision it. Is that how you guys see it as well? Like from a marketing standpoint, what they’re essentially doing?
But it’s, you know, it goes back to the buyer beware too, right? Why would I buy something if I don’t know how to use it, if I don’t know how to use it properly? So why would I even give two craps about AI if I don’t understand how AI would actually benefit me? Right? So, you know, it’s not only do you have to deal with the bias in any AI, any AI, every single AI ever will have bias. ’cause It was written by human beings, right. The, the algorithm. And the second thing about AI that, that I think we often overlook is the, the number of bugs. Mm. That in AI, right? On average, seven to 10 errors per KLOC. A KLOC is a thousand, a thousand lines of code. My truck that I just bought, I was telling you guys about today, has 150 million lines of code in it.
You know, and so a security guy like me being a weirdo like me, which, you know, it’s sad that it’s weird ’cause it shouldn’t be weird, is I’m thinking through as I’m driving this truck, like, what happens if the accelerator sticks? What happens if, you know, I don’t know what all the things that these, that the code controls, but I’m trying to think of things that I, I’m gonna do when it goes sideways.
Especially something like with AI, when you sell it early on, like they were doing in, in the marketing, that should tell you that there’s a, a rush to production. (Yeah.) Right. There’s a rush to get it out. Well, when you do that, you cut corners. So if in fact it is AI, which it probably isn’t, but let’s say, you know, benefit of the doubt it is AI it’s probably buggy as hell,
Yeah. It’s something, you know, we combat a lot in the risk management side of things is the automated tools, the AI kind of thing, you know, people out there, oh, you know, you just run this on the network and you have a risk assessment done. And the reality is like, you know, I’m, I’m, I always kind of bring it up, like that’s all well and good. It might tell you there’s a backup on your network, but does it tell you how often it’s backed up when the last time you tested it? No automated tool can tell you that. So you have to ask questions, you have to have that professional approach and talk to people. And I imagine that’s the same, you know, when we talk about AI. So no, that’s fantastic. So down the marketing road, guys, like, you know, one of the things that came up in the last call we had you know, a lot of these businesses want more help in, in marketing and understanding in, in sales and all that good stuff. And you guys have both built, built, successful businesses. And so with that you know, what, what do you guys think are some things you’ve learned over the years marketing your businesses, maybe some failures, some things that you’ve run into that, you know, lessons learned, if anything. Do you guys have any of those? So I don’t, why don’t we start with Kennedy?
Oh, I got lots of them. The two or three things that hit the top of my mind is honesty and authenticity is, is the first one. When we are authentic, we go in and we’re transparent in our conversation and, and, and what we’re talking about then then, like our internally, we, if we don’t, we don’t lie. We don’t have to remember the lie, because it’s a lot easier to remember the, the honest truth. The, the other side of it too is I think where we, where we’ve struggled in the past is understanding who our buyer is in the business instead of, you know, we, we talk about, I’ve been in tech industry for quite a while, and where I’ll always end up going is very technical. Start talking about the packets and the widgets and, you know, the, the network design and the security tools.
Instead of and like Evan talked about, I think last time, it, it really, it’s pulling that back and it’s understanding the business drivers, understanding the business initiatives. How is that bus, where does security fit into their business plan? And then looking at it in that way, look, working with them as a a business entity rather than someone that’s just, just buying a widget. (Yeah.) And, and when we can, when we can get into that more of that thought leadership and that conversation with them around their business, then we seem to, we do better in that marketing and that, that stream, we get more adoption, we get more interest as well.
Yeah. I think that’s a good point, Kennedy, because the, the idea that we’re all kind of tech minded, right? And we, we love the tech side of things. We love everything we’re doing, and we tend to, if we’re the ones in charge of marketing, right? We’re, we’re usually like trying to drive the conversation around the tech and the, the high tech stuff and thinking about our product or our solution and what we do instead of thinking about the customer, what their needs are, who they are, do they even care about the tech, right? All of those things. And I think that’s, that’s one place where a lot of businesses, you know, have a, have the wrong focus or, or have bad, you know, spend money on bad marketing around the tech side of things sometimes. So That’s a good point.
I was gonna say, I was gonna say even to check a box too. (Yeah.) And they, they think they need an EDR, so they go buy an EDR, and then they, like we were talking about, they don’t, they don’t know what to do with it. Yeah. And now they have, and, and then they, it’s not configured, it’s not patched, it’s not updated, you know? Anyway, so, sorry, I’ll Yeah,
No, no, that, that totally makes sense. How about you, Evan? Any, anything that that comes to mind as far as failures in marketing or, you know, lessons learned things that you’ve done in the past with, with the couple companies that you have?
You know, so, and it, it is funny ’cause when, when I started Security Studio, I, I had a call with Stu SjouwermanKnowBe4, he’s the guy who started KnowBe4, people who don’t know. And I asked him, look, man, you’ve had so much success before. Where should I spend my next dollar? You know, gimme some advice. And he said, without hesitation, he said, marketing. I was like, marketing, what the hell would I spend money on marketing? That doesn’t make any damn sense to me. So I didn’t, and I think, you know, on, you know, I like, I know better than just do. I’m gonna do what I do <laugh>. And so that was one, what it reminded me is that there is value in marketing for sure. Right? And so then how do you create the right boundaries? And I think FRSecure, you know, on that side, they’ve done a fantastic job at marketing, you know, and they’ve grown enough to have a dedicated marketing team.
Same thing, you know, at, at Security Studio. And I think if you’re, if you’re a mission driven organization, it’s easier to market. (Yeah.) (Sure.) Because there’s things that we will never do. And if I find out about it I don’t know. I never had to, I don’t know what I would do, but it would be bad. And so you never lie to a customer. You never take advantage of a customer, right? (Yeah.) So there’s, there should be value in your service or in your product that you don’t need to exaggerate, that you don’t need to lie, you don’t need to take advantage. I’m, you know, this, this entire industry, the entire information security industry is a service industry. This is not a product industry. And so, keep that in mind when you’re selling products. If nobody knows how to use your damn product, or if it takes five people to, you know, to, to manage your product, weigh that against the value you’re getting out of the product.
I mean, go through this logical thought process because it, you’ll never, you’re never gonna be able to solve the people problem with technology. (Mm-Hmm.) (Yeah.) You won’t be able to solve AI won’t be able to solve it with any kind of spam filtering any other crap you’re putting, putting in place. You know, this is really a, a life issue. So from a marketing standpoint, it’s just tell people the truth. And we found that it only takes three things. I like simple, right? Don’t overcomplicate crap. It takes three things to get a customer trust, credibility, and likability. That’s it.
Yeah. There, you know, there’s a few things that come to mind too in this conversation for me specifically around the business angle and, and marketing. You know, first and foremost, like you said, it’s, it’s, it’s not our wheelhouse, right? As business owners out there, as you know, tech-minded guys, you know, though, though, we’d love to do everything in the business, it’s probably something that we should either bring someone in or hire out to do. The second thing…
Yeah. (Right?) Yeah. I mean, and, and, you know, so many, so many business owners get caught up in the, in the little details because again, we’re, we’re tech-minded and focused. The color right? Or the (Right.) Or this you know, font or whatever. But that’s not getting your message out there. And the longer you sit on stew on that kind of stuff, the, the, you know, you’re not going very far while you’re doing that. But you know, another thing. So, so there’s that. Get outta your, get outta your own way, you know, hire someone to do it. The other failure I’ve seen a lot in business is you know, going out and hiring the wrong people and based on on promises, we’re gonna get you this many leads. We’re going to buy this date, have this, right, these, these promises of, of marketing and leads and, you know, generating X amount of business.
And you guys, I’m sure have run into this over time in both of the businesses where you’ve sank money into something and it just didn’t come to fruition. And of course, there’s no guarantees, right? They might tell you (Right.) there are, but so you, you really have to be careful there. I’d I’d say, you know, from that, that side, you know, going out and, and doing your research and making sure that, you know, you’re, you’re talking to people who can refer that, you know, a company to you that that’s gonna do a good job for you, I think is, is really important. The last thing I wanna mention, I’ll let you guys both comment on, on these, these things. But the last thing that I wanted to mention was just in that same kind of realm of things, the going out and spending that money and doing that is all well and good.
But there is not a guarantee, at the end of the day, you’re, you’re not gonna be guaranteed new business. So where you can almost guarantee business, especially in the MSP world, is your existing customer base. They’re the ones that are gonna refer 90 plus percent of your new business. So go back out to those guys and take care of your existing customers. It’s easy for MSPs to jump, always be looking for the next customer, but there’s so much that you can do with the existing ones. And especially as we build into this cybersecurity realm of things, that’s an area where you really can go back out to those existing customers and, and educate them on what’s going on out in the world. So…
Well, and I can promise (Any takes on that?) I can promise you, I can promise to any customer, and I can promise to any friend. I can promise to anybody that I’ll tell you the truth (Right.) (Mm-Hmm.) you know, and so value the truth, you know, the, you know, that’s why mission is so important to me. It keeps me honest. You know, if you focus on the mission, you’ll make money. If you focus on the money, you won’t make the mission. It’s that simple. And so, and you, you know, you live in a place like this, you know, it’s paradise and, you know, just bought a truck, you know, I mean, money’s not really a, it’s never been a focus for me either, but, but the, the coolest thing about it is I go to bed every single night knowing I never took advantage of somebody.
I didn’t sell them something they didn’t need. I didn’t lie to them to, to get them to buy some service that they didn’t need. I mean, and if I did, it was unintentional, and I need to know about it. You know what I mean? And that’s an open invitation to anybody at any time, because it goes against what I’m trying to be, you know, in the, in this, in this world. So you can always do that. You can always tell people the truth. You know, there’s always times when, yeah, can you do this one thing? No, I can’t do that. Or can I do this one thing? I think I can do, do it, but I’ve never done it before. You know, people love that. I’ve never had a project ever taken from me. I don’t do projects anymore, which is, well, I do projects, but, you know, weird shit.
The but it’s cool because I’ve never had a customer not take me up on that offer before when I was just honest. Like, I was asked to do an FDA validation. Have you guys ever done an FDA validation? Who the hell would ever want to do an FDA validation? But I was asked to do an FDA validation. I was like, so I read about it, I was like, I think I can do it, but I’ve never done it before. And they hired us, you know, and I think I did all right, you know, they still do business with us. But, you know, it’s stuff like that where I think we have to put up this facade like we’re something that we’re not in order to get customers, you know, we focus so much on our competition without realizing that 80% of the market ain’t even doing shit.
So rather than focusing on the competition and trying to beat them out all the time, why don’t you focus on yourself, be the best you can be, market that, and then then you’re not intimidated by your competition, right? Because I’m not competing against you. What I’m trying to do is partner with you so that we can go get the 80% that’s not doing anything, rather than fighting over the 20% that is. So, you know, I think so much of marketing is just, you know, trying to one up each other and it’s all, it’s all bullshit.
Yeah. Yeah. That makes sense. That makes a ton of sense. So yeah, with that, I mean, I think, you know, one of the things, so we talked about failures and, and things you shouldn’t do. And I think Evan, your advice to, to someone from a marketing perspective would be to tell the truth. So that, (Always.) that makes, you know, that makes a ton of sense. And I think you absolutely should.
And just to clarify on that too, really quick. ’cause There’s two types of lies. There’s lies of commission and there’s lies of omission. A lie of commission is something that I told you that was outright untrue, right? And then there’s lies of omission. That’s me not telling you something that I should have told you.
And so it’s on both sides, the commission, I have the lies of commission, I have like zero patience for. None. (Right.) And you get fired for that. You know, it’s, it’s our number one core value you can’t compromise ever. And then the second one, the lies of omission, I’m a little less of a hard ass on that one, you know? ‘Cause I do that to my wife. I mean, she would’ve left me on that stuff. But, but the lies of commission and, and it, and it’s, so you have to live it out. It has to be part of your being. Like I told I’ll give you an for example. Oscar, Oscar Minks over at FRSecure, he asked if I could run this query for him of on this database right? To get a whole bunch of data for reporting and whatever.
And I told him, yeah, for sure. And then he checked in like a week later, he is like, so, you know, where’s it coming? I’m like, I sent the email off to the developers, you know, I’ll I’ll check in again. And, and then I realized this went on for like a couple weeks. And then I realized on Sunday that I never actually sent the damn email to the developers. And so I called him up on Sunday night. I’m like, dude, I never sent the email. It’s like, oh, that’s all right. And I’m like, yeah, but I gave you the impression that I did. You know, and in my opinion, that’s a lie of omission. I need to come clean on that shit. So, but I mean, you have to have that, that fabric of integrity, I think. And, and if you, unless you want to be, unless you’re in this business to just take advantage of people and make a shitload of money which makes you a target for people like me, which is fine too. I mean, I’m probably not gonna do anything, you know, outright, but I don’t know how you can sleep well at night knowing that you just took somebody’s money and you didn’t provide any value. Value that was commensurate with that money. So,
No, that’s great advice. And, and Kennedy, you know, thinking about, you know, our audience here, MSPs, IT business owners, cybersecurity consulting firms, you know, when, when we’re talking about for them going out and marketing to businesses, you know, what advice would you have to, to those guys? As far as, from a business standpoint, from a business owner, like, you know, getting out of their own way kind of thing. What, what, what’s your advice?
I mean, honestly, everything we’ve talked about, you know. Tell the truth. Getting out and doing QBRs, understanding the business, asking the questions of, you know, where is the business going? Where are they growing, what new systems they’re buying and, and then working, you know, do they have a compliance, really, they’re trying to win a contract for compliance. So I, I, I always kind of look at this, you know, you talk about the mission before money. I also kind of think of it as, you know, we talk about like servant leadership. It’s also kind of, we’re here to serve our, our customers or our partners and then their, their customers. So that that end business user or that client that gets the emails that does the day to day, that’s the one I’m trying to take care of. And if we, when we go in with that mindset and our, and our partners, MSP partners that have that same kind of mindset of they’re there to help make it easier for that business to do their job you know, really that’s when that net net revenue, net revenue retention just skyrockets, when you carry that mission, mission in.
So I mean, it’s, it seems like it should be common sense. I mean, again, going back to telling the truth, you know, I, I don’t, I don’t have to remember the lies. ’cause The truth is reality. So, so…
Yeah, I think you’re a hundred percent right. And, and it’s, it’s believing in what you do is, is such a big part of this, right? I mean, like, there’s no gimmicks. You don’t, you don’t have to rely on, on all of that. If one, you’re telling the truth and you truly believe in what you’re doing, if you understand that this is a necessary thing that, that every business owner has to look at, should be doing, should be dealing with, then I think it’s really easy at that point to, to, you know, have people believe you because you know, you, you truly believe yourself, right? It’s just not just something you’re selling. So that’s, that’s, that’s great. I think the last thing on marketing really is, you know, I wanted to hit on was, you know, do you guys think that there’s like specific target markets?
These guys should be hitting MSPs who’ve dealt with small businesses for so long or, you know, are we thinking of it wrong? And it really is an opportunity for every business out there. Like, cybersecurity to me is something that is necessary for all businesses. But you know, a lot of people are saying, no, it’s compliance, but it’s this, it’s that. Right? So, but to me, it’s, there isn’t a business out there. I don’t care if it’s the smallest business, the who, you know, it could be the coffee shop down the street. The threat is the same. So to me, that’s, that’s how I think. What do, what do you guys think about that?
Oh, yeah. We gotta lock some stuff up. So I, I, all business needs what the, the problem that I see in the news and, and the cybersecurity in, you know, that is that we get the noise is the big ones. MGM Tar, you know, somebody was just talking about Target again the other day. All of these big organizations that have a data breach. I’m not talking about my dentist who had a data breach that now all my pi, PHI data is now out, out for sale. It has been out for sale for a while, but it’s out for sale. And then there was a ransomware that he couldn’t recover from, and now he had to shut down. So we don’t hear about the hundreds or thousands of businesses, small businesses that close every day. We only hear about the big noisy you know, the, the big tech executives sitting in front of Congress.
And, and we don’t, we don’t see those small businesses. So I, I think it’s a, sometimes it’s a disservice that people are have the awareness. They think they’re, they’re, they’re too small. They don’t have anything that’s gonna be compromised. But one, you know, 15 minutes. I mean, probably most of the people on this webinar in 15 minutes could probably own five or 10 businesses in this office park and, you know, an ACH transfer, and then they have to shut down. So I don’t know where I was going with my rant…
I mean, this, this kind of rolls into sales a bit. Yeah. It rolls into sales a bit. Yeah, Evan, when, you know, when thinking about this and thinking about those smaller businesses who really need cybersecurity help, but are not convinced or don’t believe that it can happen to them, right? Yeah. They, you could tell ’em all day long, Hey, you need to be worried about this stuff. How, how do, how do you convince them or get them to understand that this is something that they absolutely need and should be part of, you know, just your normal tech package or, you know, whatever your offer, your offering is. How do, how do you convince those people that this is a real thing?
Well, it starts with a relationship. You know, I mean, information security is a relational, it’s a people thing, right? And so we track a lot, you know, like time-to-close and, you know, all these metrics and numbers, and it kind of doesn’t matter. You know what I mean? It shouldn’t, I mean, I understand that, you know, to make business, you know, to make money, you need to track that stuff and make sure, you know, you know, make it smaller, whatever they do. That’s obviously not my strong suit either. But the it’s establishing a relationship, you know, over the years there’s been so many companies that said no to us upfront for whatever reason. And, but we maintain the relationship and they came back later and did the right thing. You know? So I think from an MSP standpoint, if you’re newer to the cybersecurity industry, meaning you’re offering services or products that you haven’t offered before, one; have the confidence to know that whatever you’re selling provides value to them.
Right? Because that’s gonna help you defend where you’re coming from, right? And so, and if you have problems defining where those values come, that’s why people like us are here. You know, ask me, I’m not gonna steal your customer. I got too much work to do already. You know what I mean? I would love to help you serve the customer. What I don’t want you ever to do is to serve the customer wrong. I don’t want you to ever take advantage of a customer, because that’s more mess that I have to clean up later. Plus, I hate seeing people get taken advantage of, you know? So when you talk about the market to approach whatever market you feel comfortable, every single business, everywhere that’s ever existed needs a risk assessment. Start with that. Right? And that should point you in the direction of what other investments you need to make,
if you’re confused about that or have a trusted you know, relationship with somebody like, like Mike, that can be like, ’cause Mike’s never gonna sell you anything you don’t need. If he doesn’t have a product to sell you, he’s still gonna have the relationship point you in the right direction. And if there’s a need later on, he is gonna, you’re gonna come back to him. You know, those are the kinda relationships you need to have. What, one of the things I would never, ever do is ever buy a product from anybody who is trying to sell me something that doesn’t know me, right? So if you’re, if you, if I get a cold email or a phone call and you’re trying to sell me some, I was gonna mention a whole bunch of company names, but I’m not gonna do that. No.
You need to know yourself well enough to know what you want, to know what you need without a vendor telling you what you know, you know, what you want, what you need. Right? Right. And if you don’t know what you want or what you need, that’s where you need to spend your time right now. Yeah. Because it’s your business. It’s not my business. If, if your business goes under, it’ll break my heart, but I’m still doing fine. You know what I mean? And so we oversaw self fear, but, and what I’ve been going a lot more lately is trying to sell value, right? We’ve always in, in our industry being, ’cause information security is a risk thing. And risk is always based on a negative consequence. So it’s always a loss prevention sort of discussion. But now that we’ve been doing it wrong for so long, I think it’s a great opportunity for me to create actual value to actually add something to your bottom line.
And one, for instance would be to do an asset inventory, start with the hardware assets. Let’s find all the hardware assets that you’re not using anymore, that you don’t need anymore. Let’s get rid of ’em. We just saved you money doing that. And from a risk perspective, from a CISO perspective, we just reduced the tax surface. Those are systems I don’t have to patch anymore. I don’t have to maintain anymore. I don’t have to worry about ’em anymore, and then go to software, do the same damn thing, right? And you’ll find that in a 12 month period, if you’re just engaging with a, with a, a new customer, mid-size customer, you might be able to save them tens of thousands of dollars, maybe hundreds of thousands of dollars just in those two things where I’ve now added to your bottom line. You know, because the language of business, we talk about that crap a lot. The language of business, according to Warren Buffet, who knows, like business stuff is accounting. So start communicating to them on how you’re going to make them more money.
Yeah. A lot of us in the managed service world use that with with communications, telecom agents and things like that. We would bring someone in and let them quote out and look at the existing telecom network, communication network and in doing that, typically pay for our managed services because they were on old antiquated T1s and things like that, all this kind of crazy stuff, right? And they’d come in, they’d say, we can put all this new high-speed stuff in, and you’re gonna save X amount of money. And we’d say, well, right there, paid for our managed services. There you go. Right? So in the same, in the same respect going in and doing asset inventory and things like that…
I was talking to another business leader who was, you know, complaining about sales last year or whatever. He says, ’cause they cut information and security budgets across the board. And I’m like, hell yeah. It’s like, what do you mean? I go, that’s less money that they’re misspending. You know what I mean? If you, if you can’t, if you don’t understand how, I mean there’s so many classic examples, and I keep going back to like the SolarWinds breach, right? This super sophisticated attack, which it was pretty cool, could have been mitigated with a firewall. Chances are really good every one of your MSP customers has a firewall. So is it being used properly? Right. And it’s not ingress, it’s ingress and egress. Right? It’s both ways. So there’s a great opportunity right there. I could, and there’s something I could use for marketing as an example.
Everybody heard of the SolarWinds attack, right? Did you know that the SolarWinds attack was mitigated by the IRS? And this is all public information because they had egress filtering properly in place. We wanna do the same thing for you. And the reason why I wanna do the same thing for you is present the same kind of attack, but also maybe identify some command and control, maybe a place where you, you know, we can do some threat hunting with that information. Whatever. It’s just a prudent thing to do, but you already have the tool, why not use it right.?You know?
Yeah. I think the biggest sales opportunity right now for MSPs is to go and create that next QBR. Go out to that customer that you have today and talk about what you’re doing. Do a risk assessment. You know, use our core assessment or whatever you have. If you have a spreadsheet, use it. Whatever you gotta use, do a risk assessment. Right? And that opens the door to the cybersecurity conversation, which funny enough, most, most of the customers think you’re handling this for them. So you have to like, you have to communicate to them that you aren’t. And in your next QBR, you could do that. You could say, Hey, we’re gonna come out, we’re gonna do a risk assessment for your business. It’s just part of our, you know, new thing that we’re doing or whatever. Go out there, do it. And then sit down with that customer and say, here, you know, there’s some things we haven’t done for you, and this is fairly new stuff, but you’re hearing about these things, breaches all this stuff in the news. It’s real, it’s here and now we can provide a solution that covers you for that. It’s not something we’ve covered before. And it only costs you this much more to add it to your solution. By doing that, not only have you notified them, it’s not something you cover, maybe you get additional revenue, but on top of that, you cover your ass, right? Because…
Well, not only are you not doing that for your customer, you can’t do that for your customer. (Yeah.) The people who are ultimately responsible for information security in that organization is the customer. (Right.) So have that discussion with them. How am I responsible for this? What information should I know on a regular basis? And that’s how I serve you. Right? I mean, any business that, I mean, you know, financial risks, you know, compliance risks, you know, legal risks, you know, all these other things, why wouldn’t, you know your information security risks. It’s just another risk. And (Absolutely.) You know, the MSPs that are good at serving their customers understand that and help their businesses.
I was gonna say, I think it’s how you approach it too, with them, right? You don’t going in with them and saying, how, how do you, how do one of the things that like we like to do in the QBR is, how is your organization with security awareness training? Are they, do you think they’re doing pretty well? How do you feel that they’re doing, getting them to kind of think about it and buy in versus us coming in and saying, you guys are failing at phishing. You have all this stuff. You’ve gotten a couple of BBCs lately. You really need to get security awareness training because you guys kinda suck. Instead of taking that tack, I mean, that’s honest, it’s truthful, but..at the same time it….
Because some of those customers, I do have that kind of relationship where I can just come right out and tell you, you suck. But some, some don’t. You know?
Yeah. But then at the end of the day, if you can give them the data, so for instance, like with Teams or with with S2ME, you can send out the, you know, those, those assessments to the employees and then all of a sudden you have the data to say, look, yeah, we’re not doing so well here as you can see, you know, we sent this out to the, to the folks in the, in the organization. And so, you know, what we think would be a good plan would be to get you on some security awareness training, which would, you know, help, you know, potentially cover those, those issues that we’re seeing
You de-suck. I guess, I guess what I was trying to say is, is I want them to, I want ask ’em the question in a way that they’re thinking about it. Rather than listening to me just tell them that they need to give security awareness training. I want them to, I want to ask them in a way that says, what do you, how do you guys think this is going? And, and I want to get their feedback. ’cause Then I also, I hear different things too. They, if I’m just selling in that widget of security awareness training or, or getting ’em onto it, but I don’t get the feedback that they all hate it. It’s cumbersome. If they got it tweaked a little bit, they would do better. Or they’re, they’re afraid and, and because they think they’re gonna be policed and get in trouble for it. So…
Yeah, I think one of the biggest, biggest failures, I think one of the biggest failures we have as kind of tech-minded people going in and trying to sell things is exactly that. We’re trying to sell a thing to somebody. (Yeah.) So instead of selling the thing, we should be talking to them about how we’re gonna help them, what we’re gonna do. (Correct.) You know, what, what is it that it’s not the tech, it’s not this EDR solution or XDR or SOC or whatever, or you know. This type of protection. They don’t care about the thing. So your solution stack of what you put together is not correct. The thing you’re selling, you’re selling them the, this mindset, this idea, this protection, this, this peace of mind. Right? That’s what we’re, we’re providing to them and selling to…
Yeah, exactly. And yeah, so that’s, those are great. Alright. So cool. Just thinking about, you know, sales and, and things like that I think a lot of people get caught up in not understanding how to get educated, what to do, this is all new. Would you guys say it’s a good idea for them to lean on their vendors that are providing these services and solutions to help them? I know for us, we help beyond even what people understand or know. So things like sales trainings and talking to them about, you know, their solution and their stack and pricing it and all these things that you wouldn’t think would come from a vendor. Is that, I, I know with Ostra you guys do a lot of similar stuff as well. Do you think that these guys should be leaning on their vendors to help educate them on all this stuff?
I do. I think it’s you for sure. You have to lean on your vendors, talk to other vendors you know, get involved in different cybersecurity type events, attend stuff like this, where you can hear people talk about different products or, you know, solutions in, in our cyber industry. The, the more it’s kind of going goes back to it, and I think you had it, you were talking about the more you know, you know, it’s like those, those PSAs. Yeah. And, and, and be able to, because I think for me, the biggest problem is making sure you don’t the Kool-Aid. So, you know, I’m never going to ask you to and go out and take a picture or video of you. You know, that honesty, that authenticity, that, that kind of transparency. That’s what you wanna look for in these vendors. And when you go have those conversations with them, pay attention to that and, and, and judge for yourself go with, you know, like what I do, I always go with my gut.
I listen to it. If it feels squeamish, then I’m not gonna carry forth and then I’ll validate with that vendor. But lean on them to kind of help you understand the tool and the product. Understand. And they’re not gonna know your customers like you do though, right? I mean, that’s, that, that’s really, they’re not gonna know how to communicate into the industry or the, the market that you sell into. That’s your sweet spot. That’s why you’re successful as an MSP in there. But definitely leverage them to help you, you know, kind of convey that messaging why this product or the services is important for them. Like security assessment. You two would be, if, if I needed to talk to somebody about why they should do a security assessment, I would pull you two into a conversation and say, “here…”
Yeah. Yeah. I think you know, it’s, it’s, it really comes down to understanding as you choose your vendors and as you kind of get in bed with the vendor and you understand (wait a second, what?) if they’re focused on just them, it’s, it’s not a good relationship. Right. If if the vendors…
No the, you know, the, the idea of like the vendors, if, if all they want to know is how many of my thing are you gonna sell? You know, I’ll help you sell my thing. They’re not interested in your business. They’re not interested in seeing you grow. It’s really, every time I get on a call with, with any of our partners, it’s really about me understanding how to make their business successful. And, you know, some of that’s gonna kind of involve our solution or our product and sometimes it doesn’t and that’s okay. You know, I’ll have that conversation with someone to help them as best as I can with the, you know, 25 plus years of knowledge in this industry. Right. So, and I’m sure you guys are the same way,
That would be kind of funny though. But it goes, it, it goes back to that kind of, that that survey side of, you know, the mission before money really, it, it, that’s, that’s it.
So someone mentioned in when we’re talking about AI that they’re already seeing software developers using AI to automatically complete questionnaires for things like PCI, SOC two, et cetera. I mean, that can’t be a good idea. Is it <laugh>? I mean,
Well, I mean, I don’t know. I mean, I don’t know. It’s I don’t know what a, I don’t know what the AI is, you know, how it’s been set up, how it’s, you know, the algorithm, I don’t know. It’s plugged into, you know, so generally no, but you could, you could use it for that.
Because that would be all, that would be all subjective data inputs. And the good thing about AI for compliance is it’s all, it’s all not subjective, objective. The good thing about a AI is it’s, it should be used for obje objective things. Check boxes. Yes/No questions. Stuff like that.
Yeah. Yeah. And, and in, in automation, I think there, there is a pla there is a place, there’s, there’s things that can, (bags under my eyes) can’t automatically been done, you know, be done.
So, Jason said amen to whatever Evan is saying right now. That was a little earlier. Or you know, maybe when you’re (Jason, check’s in the mail. I’ll…) talking about getting in bed with vendors…
So Lyle, ask the question. So for marketing, how would you explain the difference between information security compared to cybersecurity? Since most businesses think of cybersecurity as a tool. So how do you
So literally cybersecurity is a subset of information security. So information security covers administrative, physical, and technical control. So the people part of security, the physical part of security and the technical part of security, right. And I use, like if I was going to attack an organization, I would attack the people. I wouldn’t attack your computer. You know, I could, but the return on the investment is much easier just to ask you for a password than it is to crack one. So the administrative controls piece is really important and it doesn’t really matter how great your firewall is if I come and steal your server. So we can’t negate the physical controls as well. And then you’ve got the technical piece and the difference between that and cybersecurity. Cybersecurity, by definition, cyber is over pertaining to computers. It’s technical. So, and if I only now, and that’s why I have to ask a lot. ’cause We don’t speak the same language in this industry. When somebody’s talking to me about cybersecurity, I have to stop them and usually ask, are you talking cybersecurity or information security? And I may ask it that way, or I may ask it a little with a little more tact, but I need to know if we’re talking about the same thing which, you know, usually helps. ’cause If you’re not talking about the same thing, if you’re treating this like, this is a technology problem, then we’ve got a problem.
Yeah. Yeah. So, okay. That’s great. If you have any other questions, feel free to jot them really quickly. I know we’re getting to the top of the hour here. What final thoughts do you guys have as far around any of this sales, marketing, AI, any of this stuff?
My final thoughts are, I think Mike is awesome. I really dig him. I look forward to him coming down to see me. And you know, whenever you’re coming and you know, Frank, I think you’re awesome too. That’s all I got. Yeah.
You can’t go wrong, man. I mean, sometimes you miss out on things like, yeah. We’ve missed many projects over the years, I’m sure. Where we wouldn’t compromise on that, right? Yeah. We’re not gonna tell the customer something that we’re not going to be able to do. And the competition did. And in that case, we’re not competing anyway. We’re playing different games. So, you know, sometimes it does hurt and you have to be prepared for that. But overall, I think you do get a reputation, which is important, you know, in this industry that you, you, you may not like to hear what I’m gonna say to you, but you know, it’s not gonna be a lie. (Right.) And, you know, I’m gonna be open to, you may not feel like it, but I’ll be open to criticism. I need to be criticized. I need to be held to account.
Like, if I tell you something that I think is the truth, I would never tell you something that I didn’t think was the truth. But if it comes out, turns out that it’s not the truth and you don’t say something to me, you’ve now, not you, you’ve, I, you’ve, you, you need to save me for myself. And you need to save the people that listen to me from me. So tell me when I’m not telling, you know, or challenge if it, even if you think what I’m saying just doesn’t seem right, get clarification either way, the conversation is gonna be awesome because you’re gonna come away smarter. And so am I. So, you know, tell the truth all the time. Don’t be afraid to question the truth. You know, ask your vendors, if a vendor’s ever, you know, really asking you, you know, trying to sell you something, ask them how it’s gonna provide value to your business.
Right? And, and if they say, well, it’s gonna save you from ransomware and billion dollars of losses or whatever, explain to me how that’s gonna do that. And is this my most significant risk? And if they say yes, call bullshit right there because they don’t know you. How the hell would they know that? Only you know that. And if you don’t know that, that’s the damn problem. You know? So I think, and, and that’s how you, that’s how I identify a lot of transactional salespeople. I’m not, I’m done with transactional, you know what I mean? I, I do relational. And so if I ask, if I ask you challenging questions about how your product’s gonna provide value to me, if it is the, where I’m supposed to spend my next information security dollar, show me how that is, ’cause according to my risk assessment that I just did last quarter, your shit’s not on here.
So tell me how it’s gonna solve any of these problems for me. And, you know, so I, you just have to be, I think more discerning. You have to be able to, ’cause at the end of the day, it is your problem. It’s not my problem. Right. It, it’s the same thing at like home, you know, we’re all CEOs of our houses, right? It’s just like little businesses, you know, we have budgets and we take money in and we spend it and just like a little business. And the risks are pretty close to the same. They just scale. And so you’re responsible for information security at your own home, right? The same thing would be at your business. It’s whoever’s at the top. And so you wanna make sure that if you, if you really care about your business, that you’re making good risk decisions. If you’re not sure there are answers to get those answers.
You know, if I figured if you put something like that in here, like I have to you have to trust all these developers that they coded some good shit. And I don’t know if you’ve met many developers. There are lots of developers who don’t code good shit.
The medical industry and medical devices and all that good stuff. So you know, we’ll keep that for, for the next one. Thank you guys so much for, for being on today and, and having this conversation. I think this…
Yeah, yeah, yeah. So we’ll, we’ll continue these. With that, you guys all the attendees should be getting some surveys and, and questionnaires. If you receive that, if you have ideas for more topics you want to hear about, feel free to jot those down on those. So we’d love to hear from you and, and have these formulated. So when we do these, it brings you the most value that we possibly can. Thanks guys again for, for jumping on today, a ton of value. And and thank you everyone for, for showing up and taking your time with us. We really appreciate it.
Yeah, if you guys want to check out Ostra, ostra.net, jump over there. You know, tons of good stuff for MSPs with all this managed service and MSSP stuff. And then if you’re interested in learning more about risk management, feel free to jump over to SecurityStudio.com. We’ll take care of you. Thanks guys. Have a great one.
As Your Trusted Cybersecurity Team, Ostra makes cybersecurity simple and accessible to businesses of all sizes. Ostra provides its partners and their clients with a multi-layered, comprehensive and fully managed Security as a Service.
https://www.ostra.net/wp-content/uploads/2024/02/fireside-chat-building-your-community-in-the-cyber-wild-922-x-615-px.png615752Ostra Cybersecurityhttps://www.ostra.net/wp-content/uploads/2023/08/Ostra-logo-2023.pngOstra Cybersecurity2024-02-13 08:00:122024-02-16 15:34:06Fireside Chat: Building Your Community in the Cyber Wild
Prioritize Data Privacy to Protect Your Company, Employees and Clients.
Maybe you can relate to a metaphorical question I often ask myself: Are there any fires I need to put out today? Or, when faced with smaller sparks of chaos on the horizon: What can I do NOW to prevent a wildfire later?
In my experience, prioritizing data privacy is the best way to prevent security-related incidents that can wreak havoc in the lives of your employees and clients.
As a cybersecurity leader whose team handles urgent problems on a regular basis, I know it’s not possible for humans to invest our time and energy into every cause the world throws at us. But data privacy is a top priority for me, and I believe it should matter to everyone. Keep reading to find out why.
Data Privacy Week
There are a couple of reasons why this is the perfect time of year to focus on data privacy. First January is the start of a new year. It’s all about new habits, new beginnings, and new goals. For more info on the basics of data privacy, check out this short article by the National Cybersecurity Alliance: What Is Data Privacy? (staysafeonline.org)
More importantly, January 21-27, 2024 is Data Privacy Week, an international effort led by the National Cybersecurity Alliance. The goal is to empower individuals and businesses to respect privacy, safeguard data and enable trust.
The theme for this year’s Data Privacy Week is “Take Control of Your Data,” which is something we talk about a lot with clients and colleagues at Ostra. Visit staysafeonline.org to access plenty of free resources and practical tips to better protect yourself, your business, and your employees.
What Factors Create “Fire Hazards” Online?
The digital age has made it easier for criminals to get their hands on private company data and personal information. It’s almost unbelievable to consider this: less than 30 years ago, most criminals could only commit fraud if they could steal wallets, retrieve hard-copy documents, or access electronic information from the inside.
Whether their target was an insurance company, bank, retailer, hotel, manufacturer, pharmacy, auto dealer, school, or private residence—they had to get inside a physical location, often past lock and key, to get that data.
How times have changed. Today, our smartphones and laptops are loaded with highly personalized apps—from fitness trackers to online shopping apps and cloud-based calendars. We do our research online, barely thinking about who is seeing our browsing/buying habits or how they may be monetizing this data.
We share personal details, often in real-time, on social media: birthdays, vacation destinations, or events we are attending. We conduct online meetings, use online banking, and make online dinner reservations. The list goes on.
Unfortunately, all these online activities leave a digital footprint. In addition, many public records are now available online. A passive approach to data privacy is like putting dry kindling in the forest. Cybercriminals only need opportunity and an internet connection to light a match that can lead to ransomware, identity theft, embezzlement, intellectual property theft, and more.
Real World Scenario
Let’s walk through a potential scenario. If I have your name and phone number, I can find lots of other info about you online.
Beyond basic Google, I could also pay a small fee to use a people search directory that might turn up some good dirt on you. After discovering your old addresses and mortgage info, I might even find a public record of a petty misdemeanor from two years ago when you got a parking ticket.
Being the brilliant scammer that I am, now I’m going to use ChatGPT to write a fake but very convincing letter informing you that your $200 parking ticket (which you already paid two years ago) is delinquent and past due. My very convincing letter also states that you owe $1200 and if you don’t pay immediately, you’ll face criminal charges.
Now, you’re terrified. If I’m lucky, you’ll pay me the $1200 without thinking twice.
This fictional scenario is actually something that happens all too often. Unfortunately, scammers can facilitate even scarier scenarios by digging up information that is a lot more personal or embarrassing than a parking ticket.
Aware vs. Scare: What Can You Do?
At this point you may be thinking: If my basic information is already on the internet, is there really anything I can do? Scammers are going to scam people no matter what, right?
These questions are a great example of why fear tactics don’t help anyone. Around this time last year, I shared some thoughts about the importance of cybersecurity awareness—as opposed to the polar extremes of apathy and paranoia, which both lead to inaction. To dive deeper into this topic, read this blog: Awareness Leads to Action: Why Data Privacy Matters (ostra.net).
While it may be both unrealistic and impractical to completely erase your digital footprint, there are things you can do to stay safe online:
Opt out of data broker lists. Don’t make it easy for data/information brokers to collect and sell your data. They research both online and offline sources to get your personal information, which is perfectly legal—unless you opt out! This takes a little footwork but can be worth the effort. Learn more here: How To Opt Out of Data Broker Sites (identityguard.com)
Stay aware of what you’re opting into. Yes, you should actually take time to read the privacy policy! The National Cybersecurity Alliance has a great article on this topic: Take Control of Your Data (staysafeonline.org)
Increase awareness – Google yourself and be aware of what’s out there about you and your family. The more you know, the less likely you’ll be scammed. Always be careful about pictures and info you share—whether it’s via social media or an online form.
Stay vigilant. The Internet is a powerful and useful tool that can be used for good, but it can also be used as a weapon by scammers and threat actors. Stay cautious, and don’t let your guard down. Don’t click on links or jump to action before vetting the source. This article has additional tips on what all individuals can do to stay vigilant: Take Control of Your Data (staysafeonline.org)
Data privacy is our shield against exploitation in the digital world. By minimizing opportunities for misuse, we empower ourselves to protect our personal, professional, and financial well-being.
Curious about how Ostra can help you protect your employees’ and clients’ personal data?Contact our Trusted Cybersecurity Team to start an honest, down-to-earth conversation about data privacy.
Michael Kennedy is the founder of Ostra Cybersecurity, a multi-layered and fully managed Security as a Service. Recognized as a cybersecurity industry trailblazer, he is a dynamic leader, speaker, and fierce advocate for data privacy.
https://www.ostra.net/wp-content/uploads/2024/01/prioritize-data-privacy.png615922Michael Kennedyhttps://www.ostra.net/wp-content/uploads/2023/08/Ostra-logo-2023.pngMichael Kennedy2024-01-23 08:00:572024-01-22 14:48:06Prioritize Data Privacy: Don’t Get Burned!
We are constantly connected to the digital world. From social media to online shopping to SaaS for business, our personal and company information is stored and shared on a daily basis. Every online interaction exposes us to potential cybersecurity threats, making it necessary for us to be aware and vigilant about protecting our data.
This raises concerns about privacy and security, leaving many wondering who they can trust in the vast cyber landscape.
Two Guys Walk Into a Podcast…
In this “Fireside Chat” with Michael Kennedy (Ostra) and Evan Francen (Security Studio), you’ll gain insights into the latest cybersecurity threats and how businesses can better protect themselves and their customers.
You’ll also learn about the importance of building a strong security culture within your organization, from training employees to implementing proper protocols.
How Safe Is The Platform?
One of the key players in safeguarding our digital information is the company or platform we are interacting with. It’s important to know who we can trust in this digital wilderness and the measures they take to keep our data safe.
When it comes to online privacy policies, most of us simply click “agree” without reading through the fine print. However, as responsible users, we must take the time to understand where our data is going and how it will be used. This allows us to make informed decisions about the platforms we use and holds companies accountable for their actions.
But how can we trust these policies? With an endless stream of data breaches and hacking scandals, it’s easy to feel like no company or platform is truly secure. However, there are steps that responsible companies take to ensure the safety of their users’ data.
Encryption is one such measure. This is the process of converting information into code to prevent unauthorized access. A reputable company will use robust encryption methods to protect sensitive data such as passwords and credit card information.
“Understand what the name of the game is. It’s risk management.”
A Data Breach! Now What?
Another essential aspect to consider is how a company handles its data in case of a breach. One way to do this is through regular backups and secure storage systems. In the event of a breach, this allows for quicker recovery and minimizes the impact on user data.
Additionally, responsible companies have dedicated teams and protocols in place to detect and respond to any potential threats or breaches. This includes regular security audits and updates to their systems to stay ahead of any vulnerabilities.
Do Privacy Policies Mean Anything?
Furthermore, companies that value the safety and privacy of their users will have clear and concise privacy policies in place. These policies outline what data is collected, how it is used, and who has access to it. Users must review these policies before agreeing to share their personal information with a company.
Honesty: The Best Policy
Transparency is another important factor when it comes to safeguarding user data. A responsible company will be open about any data collection practices and provide users with options to control what information is shared.
Stay In School, Kids!
Lastly, responsible companies prioritize educating employees on proper data handling procedures and regularly conduct training sessions on cybersecurity best practices. This ensures that all employees are knowledgeable about protecting user data and can identify potential threats or breaches.
Final Thoughts
In conclusion, choosing to share your personal information with a company is a decision that should not be taken lightly. It’s important to do your research and only trust companies that prioritize the security and privacy of their users.
Remember, you have the right to control who has access to your information and it’s crucial to exercise this right to protect yourself from potential risks. Remember these tips when navigating the digital landscape and always prioritize your online safety.
The brutal reality is that no one is immune to cyber-attacks. Individuals, businesses, and even governments have fallen victim to hackers seeking confidential information or monetary gain. It’s not a matter of ‘if’ your data will be targeted, but ‘when.’
That’s why taking proactive measures to protect your digital identity is absolutely necessary. This can range from simple actions, such as regularly updating your passwords and using multi-factor authentication, to investing in more advanced security software and services.
Good afternoon everybody, and thank you for joining us today for this fantastic fireside chat or Jungle Chat, as we can see in some of those more white background chat <laugh>. So either way, my name is Frank Gurney. I am the channel director at Security Studio. And we have a lot of really fun stuff we’re gonna be doing today. But I do have a couple a couple knuckleheads here with me. So with that, I’d like to introduce them. So, first and foremost, I have Michael Kennedy on the line, also known as Kennedy. And so Michael Kennedy is recognized as a cybersecurity industry. Trailblazer, he’s a founder of Ostra Cybersecurity is a multi-layered, fully managed security service. Austra’s solution combines Fortune 100 caliber tools, tech, and talent to ensure threats are not only detected and hunted, but also fully remediated for business of all sizes. Previously, Kennedy led, built and scaled security platforms for Fortune five companies before setting out on a mission to protect SMBs Kennedy, good to see you. How are you doing today? Yep.
Also, on the line, we have Evan Francen. So if you don’t know who Evan Francen is, he is the CEO of Security Studio. He’s the co-founder and CEO of FR Secure as well. He’s an expert level security consulting, which is an expert level security and consulting company. And Evan has over 30 years, 30 years only. Don’t look that old to me, Evan. But a practical experience in information security and is a well-known thought leader and specializes in the industry. He founded Security Studio in 2017, and co-created the software’s key capabilities, including the S two score. Evan is continually working on the mission of fixing a broken information security industry and advising, high profile profile cybersecurity breaches to developing the first ever vcso training program. So, with all that he is also an author of a very cool book called unsecurity. And with that, how are you doing, Evan?
Yeah, this fire is gonna get hot, so we better get this going and get it over with because no marketing’s idea around a fireside chat, but it’s already like 75, 80 degrees here, so it’s gonna get hot. Can
Imagine how much we were talking about that, about this fireside chat thing. And so I took a lighter and I was like, I could start a fire too, but this is my wife’s garden, so I think that wouldn’t,
Well, excellent guys. We so we really wanted to create this around being more of a video podcast style, just so you guys know what the format’s like no slides, no you know, no craziness here. We’re just gonna be three dudes talking and really it’s about you guys today. So with that, you know, I wanted to start you guys with kind of a year in review. I mean, I know 2023 is just about at an end here. We’re all kind of getting ready for the holiday season, and there’s been a lot that’s been going on out there as far as security is concerned. You know, there’s been a number of high profile breaches this year. I mean, a few that affected me personally the MGM Breach 23, and me, LastPass, there’s been a ton of ’em. And a lot of these large companies have large budgets. You know, we hear a lot from our MSP and IT partners that their customers think it’s never gonna happen to them. Right. And I’m just wondering what you guys are thinking about one, how do MSPs or IT companies or anybody deal with that mentality of, you know, it’s not gonna happen to me. And, you know, what do you think about all these breaches as well? Let’s start with Kennedy. What do you think?
So from an, from an MSP standpoint, I, the first thing that comes to my mind always is SolarWinds and how, you know, in that supply chain as an MSP, how do you ensure that you’re being protected? And, and then protecting your customers, you know, ’cause those are, those are the, that’s the end goal is to protect those customers. And are you protecting yourself and providing the right tools to protect those customers. So I really think that’s created a lot of change in the thinking that, you know, people are looking at the supply chain differently. The other side of it too is like, from that customer standpoint, you get a lot of that apathy in, in clients and customers that, oh, we don’t have any data. It’s not gonna happen to me, but you, you see, you know, business email compromise is just crazy right now. And, and we’re seeing more and more of these like, high profile companies being attacked and targeted. But there are probably five times the 10 times that of these small businesses that don’t have to report that are being, having breaches or having to pay and getting ransom.
I don’t know, I if I, if there’s a, like a right answer of trying to convey that message. Mm-Hmm. <Affirmative>. But it, you know, it comes back to like, what we always talk about is the education. We need to educate ’em. We need to bring ’em into speed into the place. We don’t wanna take ’em all the way to the paranoia, like where I live, but we wanna, you know, bring them up closer to that and that, and that awareness side of things. So and I think, you know, and I think later we’ll move, talk about it too, of like risk assessment and you know, bring it to a customer’s attention and being honest about it and authentic about here’s the products, here’s the solutions you have, this is what you need to implement. Right? And otherwise it’s out of our hand.
So yeah, having that conversation with the, with the customer in some way, shape or form Mm-Hmm. <Affirmative> and how to start that obviously is, is a big one. But at the same time, I think you made a good point there of like, you know, we see all these news stories, we heard about those big breaches that I just mentioned, including SolarWinds, that, that you said hit the MSP world. But at the same time, you, you don’t hear about the small businesses, right? I mean, that’s the, the thousands that are getting hit every day that are having issues. Those are, those are the ones that even though they’re not hearing about it, it’s a huge issue for them. They just don’t realize it. Right. And so, I, I totally get that. And Evan, any thoughts on this? This subject?
Yeah. Well, I mean, sadly, 2023, it’s a lot of, it’s the same old, same old, you know what I mean? It’s for a long people that have been in this industry for a while, it’s you know, that’s just, we’ve made progress. You know, I hate to be negative all the time because I think that’s one of the things that ends up, you know, shooting ourselves in the foot, is we’re trying to help people. Positives, you know, I think it’s, it’s front and center more mm-Hmm. <Affirmative>, we’re starting to see, I think, more of a move towards accountability. We still have a long ways to go. The bad things are, you know, I think pe not enough people still take it seriously. There’s a lot of ignorance still, you know, in our industry, even amongst our own clan. You know, you talk about, you know, basic fundamental things.
You talked about the solar winds breach. You know, I, I grew up early in my career, I was a network guy. You know, I was a big Cisco, you know, and I can’t ever imagine putting in a firewall without using it properly, right? I mean, a firewall, it’s not just ingress, right? It’s egress. That’s the reason why we’ve got inbound and outbound rules on firewalls. And so I’ve always, and life was simpler then, right? I mean, it was easier for me to control traffic flows on a network because I didn’t have so many traffic flows. Right? But, you know, so until we get, there’s just, until we get the fundamentals, it doesn’t matter. It, it really doesn’t, you can continue. You almost keep, it’s like you keep pushing the ball further and further away from you, right? The more and more technology you continue to adopt without using it properly.
And if you don’t know how to use it properly, that’s fine. We all start there, right? But you need to learn how to use it properly, otherwise people suffer for it. And today, you know, with that lack of accountability, I’m not sure too many people feel the pain. You know, it’s more of a shared pain, right? If I have a breach, I gotta send a letter, but I get so many letters anyway. Nobody really is gonna hold you accountable for it. Yeah. Well, those things will continue to just kind of mass up and there’s going to be a day when we’re all going to have to pay for it. Yeah. Or you’re gonna have to pay for it, you know yourself. So we’re trying to get out ahead of that, but until people slow down a little bit, I think we’re still gonna be chasing.
Yeah, that’s a good point. Evan. And I, I, you know, one of the other things that that came to mind while you’re, you’re talking about that is that I know you’ve been really close and, and had a lot of information around kind of government compliancies and things that they’re building in the government to help <laugh>, right? Help Mm-Hmm. <Affirmative> you know, this whole cybersecurity threat thing. And have you, are you hearing about things that are gonna drive compliancy or drive specific things that small businesses are gonna have to do? No matter what Is that, is that coming down the pipe?
Yeah, I mean, it, it will, I mean, either you choose to do it or you get forced to do it. And one of them is a hell of a lot less painful. Mm-Hmm. <affirmative>. Right? I like to use the analogy of like, and one of them is checking the box, which I doesn’t do it anyway, right? You’ve got the letter of the law and the intent of the law. It was like, you know, I’ve raised five kids and they all lived, I think they’re all still alive. And it was a difference between, it was a difference between me telling them to clean the room and them actually wanting to clean the room.
One was actually clean, the other one wasn’t. Right. You picked up stuff, but, you know, I, I look under your bed or, you know, look in the closet somewhere. So it’s the same kind of just human nature, I think, until people actually want to do this, and they won’t want to do this unless they see an advantage to it or there’s pain associated with it. And right now we’re still kind of in this gray area where I don’t see the advantage.
And that, you know, I, and I think in the MSP world, and as more MSPs start to go down the cyber road just like, you know, their managed service offerings that they had for so long, they built out their stack of services. That was, it was non-negotiable. It’s part of a managed service agreement is to have these pieces in place. And I think that’s what we’re gonna start to see as well, is like every customer of a, a managed service provider or any other cybersecurity consultant or anyone has to have these pieces in place in order for them to be able to provide service to them. And I think that’s, that’s a way you kind of get a handle on these things, if that makes sense.
What, I’d love to see us to sell more. Like, I would be thinking the same thing. If you came to me as an MSP and you wanted to sell me security services, or you wanted to do an assessment of my business, whatever, if I don’t see the advantage in it, if I don’t see what’s in it for me, then I’m not gonna do it. I’ve got other stuff to do. I’ve gotta grow my business. I’ve got, you know, bottom line I’ve gotta deal with. So us as security people, it’d be a lot better to, for us to approach that way. What’s in it for you? Well, what’s in it for you is a more efficient business. What’s in it for you is, you know, all chances are pretty good. We’re going to be able to remove a whole bunch of software that you’re paying for that you’re not actually using that’ll improve your bottom line. So taking that approach as opposed to kind of the fear tactics. ’cause Everybody, you know, they’re, they’re deaf to it. Yeah. That would be too.
Yeah. Yeah. And they have the insurance, the insurance that they think they have. And Yeah, we right though we have, we have to get it some normalization in it, and we have to do, I mean, and you kind of touched on it too, we have to share the same languages when we talk about this and, and not, not go in with this, the fearmongering and, you know, predatory sales tactics towards people. It’s the education and it’s showing ’em where the ROI and the importance of doing this to, to the business. Like, you always talk about it too, avin about, you know, knowing, understanding their business so that you can talk to them in their business language versus coming in and saying, you need security tool because it’s ’cause you do. Right. So,
Yeah. And then you know that you speak, you speak well, sorry, Evan to the stand, you know, standardization, I think that was the normalization, right? That you’re
Standardizing the practice around the things that are doing. And this just as I was saying, really is the way that managed service providers built their businesses because it was, you had an RM tool, you had a PSA, you had Yeah. A backup and disaster recovery device. You had antivirus tool. You know, you had all these things that you, you had in there and it was a standard way of doing business. So it’s gotta go that route as well. Sorry, go ahead Evan.
Oh, no worries. What do you guys think that that 2024 is gonna look like? Do you guys think it’s just more of the same, do you think with all this AI stuff that’s gonna be something Skynet, is that coming in <laugh>? I dunno. You know, what do you think? No,
Not, not, not yet. I don’t think we’re ready for, I think maybe about three years is when we’ll have Skynet. Okay. But I I I think it’s gonna be continuation of the same. Yeah. I think that, I think there’s a huge desire for an easy button and, and, and really just, you know, when you talk about AI really kind of look at the ease and the sophistication of the attacks, they’re, they’re shifting and they can really write a very very telling email or business email <inaudible> phishing or, or phishing with, with like a chat GBTE and, and shoot it out. So I think there’s gonna be, it’s easier to have access for people to, to do those attacks. And, but I think, you know, there, there’s also a lot of businesses and MSPs that we’re kind of talking to, are really looking for more of that kind of that easy, you know, ability to reduce the noise or reduce what they’re kind of looking at.
You know, we’re, we’re still I don’t, I don’t know. I I, there’s a lot of times too, I think about we’re still trying to find our way after Covid and how we interact with people and how we kind of had that shift and that mentality. And now we’re virtual, we’re not virtual remote users, not remote users. Cloud versus not cloud. And there’s this kind of, we’re in this like this, this, I don’t know, Meyer, what are we, where are we going? Or what are we doing? But I, but what I see a lot of is that it’s, people are looking for something that, that it’s like this easy. And, and I don’t know if that’s part of it. You know, we really some influx in what the, the ease of grocery shopping, the ease, and I want something, I just click a button and then I have it delivered here. Yeah. And I think I, go ahead. Yeah,
That’s a good point. And and Evan, you know, this is funny because it, it fits right into kind of what we, we talk about a lot, but I feel like in cybersecurity in general, you know, if you’re doing consulting and you’re doing services, there just isn’t an easy button. And even though every vendor out there wants to build that <laugh>, the reality is in risk and in, you know, figuring all this stuff out. You just, you, you can’t throw something on the network and it’s gonna do it. Right? No, I mean, you, you have to, you have to get your feet dirty. And I think one of the things I learned from you, Evan, a while back, is, you know, we sell hard work a lot of times. What are, what are your thoughts around this concept of an easy button around cyber risk and cyber in general?
Well, I mean, I think longer term, I think for, for businesses that actually want to be around, you know, long term, you know, you gotta think beyond one year anyway. Mm-Hmm. <affirmative>, I would wanna put my pos my business in a position to have competitive advantage right. In the marketplace. The, when I look at the way I can integrate information security into my business and actually enable my mission, make more money, top line and bottom line ideally you’d see a lot more planning. I, ’cause there’s gonna be a day when the people that didn’t plan for this are the ones that are gonna be not to use scare tactics. Yeah. But it’s, it’s just, it’s logic. Yeah. It’s just logic. And so when the compliance comes, you can’t wait for the government on anything. So waiting for the government to tell you what to do or to provide services for you, good luck with that.
I mean, it’s, it’s, again, it’s not gonna provide you the competitive advantage. So in 2024, I think you’re gonna see a lot more of this us trying to find ourselves out thing. And I think there are people in our industry that already know the answers, but you’ve got other powerful people in our industry that kind of don’t want the answers to be known. Right? Right. I mean, if I was going to, you can’t do informa, for instance. I can’t do information security without doing a risk assessment period. Now, the question is, you can do a crappy risk assessment or a good risk assessment. That’s up to you. The right type of risk assessment would be one that would be actionable, that would give me something to do afterwards to improve or manage my risk. It would put risk into perspective. The easiest people to take advantage of from an attacker’s point of view, whether you’re a red teamer or a blue teamer, is to take advantage of ignorance. You know, the people that aren’t paying attention are the easiest targets. Mm-Hmm. <affirmative>, you know, and I think there’ll be a time when the people that are doing it right will get tired of paying for the people that aren’t doing it. Right.
You know, why would I, why should I have to pay more in insurance rates? Why should I have to pay more bank fees when I’m a responsible, you know, I’m responsible to the technology I’m using. My, my account didn’t get hacked, so why am I paying for the people that whose accounts did get hacked?
It’s, it is interesting you brought up insurance too, because I feel like that’s another area where we’re already seeing this, these huge changes, right. In the way that the insurance companies kind of,
And that’s the frustrating part. We, we told them this. Yeah. I mean, that’s the frustrating, your nine question questionnaire is not going to be enough to underwr insurance. You’re checking, you’re checking the box. Yeah. And so that, that mentality, and again, people aren’t gonna change unless they see an advantage in it for them, or they feel the pain from it. There’s a great question here from an anonymous attendee. Do we think CISOs facing jail time will have no impact? What about the SEC reporting requirements? And I wanted to address that because the one who’s ultimately responsible for information security in any organization isn’t the ciso. It’s not the ciso, the one who’s ultimately responsible for information security at any organization is who’s ever the top of the list. So the CEO, the board, if there is a board, but it’s not the ciso. So I think what, what what’s gonna happen with the CISO piece is who the hell wants to be a ciso?
But you won’t gimme the checkbook. So, you know, that’s a catch 22. The SEC thing, it’ll be like any other compliance we had. HIPAA did the same thing. GLBA did the same thing. I mean, on and on. We just keep repeating the same mistake. So what will happen with the SEC is people will do the minimum necessary to get compliant and then call themselves good. But until, you know, until you hold a board, if you hold a board of directors responsible for information security at a public company, you’re gonna see some changes.
Yeah. The, the problem with, with all of that, that you’re saying though, you know, just meeting compliance is you’re not doing the best security for your company at that point, right?
No, no. You’re checking a box. And when you, and when something does happen, and what the problem is is you’ve kind of brushed that under the rug already. You’ve not done the security assessment, you’re not aware, you’re not implementing the plans against those things. Yeah. And what I was saying
In our industry too, if we had, like, if you don’t do these three things, whatever those three things are, make two, maybe one, if you don’t do this one thing, you’re negligent. And just pick one thing. You know, we don’t have to argue about it in our industry about, well, it should be this, it should be that. Just pick one who caress
What, what I was saying, go ahead. I, yeah, I wanna say, when I was saying easy button, I wasn’t referring to like an easy button. I got security or an easy button. It’s what I think what pe what I feel like is, and you kind of touched on it, is the industry has been sold a specific product and a specific, like this will take care of it. No more worries. And what the, what I think MSPs and, and clients and the industry’s looking at is like that that’s a false narrative that it wasn’t. Now I ha I’m still getting all these alerts that I gotta go address to you. I thought you were taking care of the alerts. I thought you were doing the remediations. I still had a breach, but I have you and I’ve been paying you, you know, tens of thousands of dollars. And so that’s what I think people are looking at for, is they want to reduce stats based what they thought they got. That they’re really, I I would say 24 p that won’t become more of a focus for organizations.
Well, that’s what I was saying about the ignorance, right? Yeah. ’cause It’s not just the, your traditional bad guys that are the ones taking a, that, that take advantage of <crosstalk>. We have people in our industry, lots of them, lots of the biggest names in our industry who are taking advantage of people by selling them products they don’t need that don’t work, that don’t solve a problem.
And they’re making millions, billions of dollars from it. You know, and I’m not gonna mention the na, I would love to mention names. Maybe I’ll do that in a d different podcast. Yeah. But one that comes to mind, their tagline is to end cyber risk. What? You can’t.
That’s impossible. So what I would love to see is I would, you know, the FTC has, you know, laws, oh yeah. We have laws against this, you know, this false advertising truth in advertising is a thing. I would love to see us enforce that. But I think the government itself, I think is ignorant enough outside of a few people to be able to do that. Yeah. But we, I thought that me off probably more than anything is when somebody in our industry who comes off as somebody who you can trust, sells you something that you can’t need. That you don’t need. Yeah.
That’s part of our last call, wasn’t it? <Laugh>? We live next now. Yeah. Guys, our next, our next subject really we wanted to jump into kind of circles of trust, mental health a little bit. You know, so with that, you know, we know that MSPs have a ton of technical knowledge. You know, a lot wanna be seen as the expert. Cybersecurity’s pretty new for most of them. So what advice would you guys have for them to navigate those feelings of kind of stress or anxiety or inadequacy of not always having all the answers when it comes to cyber because it is new as they enter kind of this new, new bus side of business for, you know, that is all new to a lot of them. Any, any thoughts of how to deal with that?
I think there’s three things that make an MSP really successful. And I think any consulting company, it’s trust, credibility, and likability. So I think as an MSP, if you focus on those three things and whatever service you’re gonna provide, so if you don’t know the answer to something information security related, it’s okay to say that you’re not necessarily paid to know all the answers. You’re paid to provide all the answers. So relying on, so, you know, relying on a partner, relying, you know, Mike’s, I’ll give you Mike’s phone number. I’ll put it in the chat. You can call Mike anytime. He’ll help you. I won’t because I don’t want to No, I’m, I’m kidding. But
<Laugh>. The truth is, I’m 30 some odd years in this industry. Yeah. I don’t have all the answers. I still have to go to people and find out what this is and how this works. And, but what I won’t do is, is, and that’s where I think imposter syndrome comes in, is when you try to act like you’re somebody that you’re not. Correct. Authenticity. You should, should, yeah. Should you should feel uncomfortable doing that because you’re probably doing a disservice to your customer. Right? Right. So playing in that gap, you know, I see on a, you know, Lyle asked a question. You know, I think some MSPs are scared to work with InfoSec companies to do proper risk assessments for their clients. The MSP is too focused on the stack that they’re afraid to do what the risk assessment will find.
And we’ve run into this, this is nothing new. We’ve run into this, you know, forever be because we treat it like it’s an IT issue. Right? Right. This is not an IT issue. This is a great opportunity for the MSP. Even if you find that there are some tech things that you didn’t install correctly that maybe they didn’t, they didn’t need them, right? You can continue down the path of just ignorance and, or you can actually address it at some point. And this is a great opportunity for you to elevate it to where it actually belongs, which is with the board, which is with the ceo EO. So anything you find that looks bad at the organization, it’s actually a reflection of them. It’s not a reflection of you. Yeah. So I, I wanna point that out because I think a lot of people struggle with that. Well, what if I find that I did crap wrong forever? Well, you learn from it and, you know, let’s adjust.
I’ll, I’ll admit something here. I used to when I was a, when I had a little MSP shop myself, I used to configure Windows machines, and I would go in and I would disable updates, Microsoft updates for people, because you don’t need that. And then it’ll suck up your bandwidth and cause problems with your computer and then create more phone calls for me. I mean, it was, again, it was 20 years ago I was doing it, but it, you know, now I would go <laugh> if it, if it had been more recent, I would go back to all of those people and talk to them about it. You touched on like the, and then somebody mentioned transparency. And the question too, that authenticity you to, to have authenticity, you have to know yourself. Mm-Hmm. <Affirmative>, you have to be honest with yourself to be able to be honest and be authentic with other people.
And, and, and that, you know, everything you said around, if you don’t know, it’s okay not to know. It’s okay not to, you know, it, it’s okay to surround yourself with people that are smarter in the industry and, and, and what, and so that, that, and I didn’t think about it. And it’s interesting from the imposter syndrome too. Why we get sucked into that is because we, we are trying to compare our insides to other people’s outsides. Because I look outside and I see something, or someone, or an MSP or a security vendor, and, you know, I’m, I’m looking at what I internally. And so having that authenticity, knowing that we don’t, I don’t know at all. And then having friends and, and people like you guys to, to talk to about it. So that is the number one that makes a
Ton of sense. Kennedy. And, and you know, the, it it reminds me, Evan, of, of a couple conversations you and I have had where you’ve been out at events or shows, and there’s a bunch of guys who are just full of themselves, <laugh>, right. Who know everything. Right. And, and just being in those situations and feeling like that inadequacy, like maybe you don’t know as much as those guys do, but, but do they really, at the end of the day, they’re just posturing, right? I mean, they’re just, they’re, they’re just trying to show off in front of everybody else. So I don’t think that that’s,
We do a lot of posturing. And I think Yeah. And it’s, it’s never a question of intelligence either. I think I’ve been, I’ve had CEO many, you know, CEOs over the years, you know, who say they feel stupid or, you know, I’m asking a stupid question. It’s like, this isn’t an intelligence thing. It’s just a learning thing. Right? Yeah. Right. A lot of the things that I’ve learned over the years have nothing to do with how smart I am. They just happened to be things I was part of. I was there, I got my kicked. It hurt. You know what I mean? Mm-Hmm. <affirmative>. And I wanna save other people from going through that, that same thing. Right? So yeah, the same will happen with MSPs When you’re first starting out anything, it’s gonna feel uncomfortable. It’s gonna feel very mechanical. You’re gonna have to, what I tell a lot of people who start in this industry is where you lack credibility. Borrow somebody else’s.
So an an example that would be like I’ve, maybe I’ve never done an assessment before, or I’ve never, I’ve never been a bcso before. And so I’m gonna take what I learned from somebody who’s been a vcso for many years, and I’m gonna say what they say and do what they say, not trying to be them, but to borrow their credibility. And so then when I get challenged, which is the part I think where a lot of us feel threatened, you know, really uncomfortable. ’cause What happens if a customer asks me, well, why did you ask me that question? Why? Why is this so important? Mm-Hmm. <affirmative>, you can, that’s when you can borrow credibility. Well, ’cause, you know, according to this thing that I read from Mike Kennedy, it said, these reasons are why it’s important. Right? Yeah. So that’s a way you get away with, you know, not having that experience, you know, steal somebody else’s experience.
Yeah. It’s interesting that we see, like, I see this a ton on the, the kind of partner side of things. Like, you might get an MSP or IT company who’s really interested in doing all this stuff and like going down this path, but then they’re, they don’t have their employee buy-in. And that can be an issue. And you guys are both business owners. So I, you know, this wasn’t on our, our list of things to talk about, but I think it, it’s important because you are both business owners. You both understand this. Like, you guys go to things and you get excited and you find something that you think will really help your business and help you grow in the future. How, how do you guys get that buy-in from your employees? Or, or even make that decision, Hey, you’re gonna go down this path, right? That, is that something you guys wanna Yeah. Talk about a little bit.
Physical threats. You know, I think I, you know, for me, I, I, I’m a very collaborative person and, and, and, and I’m a, and I’m an overthinker. I think of butt thinking. And so when I see that type of stuff, or I hear those commentary, then it, for me, it’s coming, bringing it back to the, to the organization and saying, Hey what do you guys think about this? Look at this product. And then challenge when they, and if they don’t, then challenging ’em. Why aren’t they looking at that product and, and validating against, or, or or a, a show to go to, or a marketing exercise or anything along those lines of, you know, how, how do, how do we challenge and work together as an organization to propel us forward? Because, you know, I, I am, you know, there’s a, there’s a, you can’t really see it, but there’s a, a, a framed squirrel picture back there that my aunt gave me. ’cause I, squirrel and shiny objects are horrible for me. And so I’ll have a new shiny object every afternoon. And, and so I, I have to rely on the, the people that I work with to ensure that we validate that and, and we go through it. And getting that buy-in is, is really important. But also
Helping them to see that vision of where you see the company going next. Right. Because I think sometimes we can throw things at, at, you know, employees and people and, and say, Hey, here, here, we want this done. But without giving them that vision of, look, here’s where we’re taking the business over time, context
Yeah. I mean, it, it, it, some people are good leaders, some people aren’t. You know, I think it it comes, there’s a couple things I think are really important. You know, one is, you know, do, do your employees trust you? Do they think that you’re credible? Hmm. You’re not an. So it’s the trust, credibility, and likability piece that still, you know, applies
But at the end of the day, everybody, everywhere is always, whether it’s out, out in front of your mentality or it’s subconscious, everybody’s always wondering what’s in it for me?
So being able to paint the picture of how this decision benefits you, right. It benefits us corporately, but you specifically, this is how it benefits. And I think the more you can prove those things out, the more you kind of add to your credibility bank account. Yeah. Mm-Hmm. <Affirmative> there are times when you do have to spend your political capital where you just need to overrule something for whatever reason. Mm-Hmm. <Affirmative>. But I think always being cognizant of how much political capital I have in my account, and, you know, trying to add to that.
Well, both you, both of you guys are really huge on education and educating folks. And it shows in austra and security studios, onboarding of new partners. It’s really about taking them through a path of education to get them up to speed and, you know, to a whole nother level, really at the end of the day of, of even becoming the CISOs for our side. And, and you guys take them through a huge education path on the Ostra side. Where does that passion come from for, for you guys? I mean, what’s, what’s the idea or thought or mindset around educating?
I was gonna say, I mean, very self I hate saying this, but selfishly from an operational standpoint, then in a process and communication, all of that, it’s, it comes back to the more that we communicate, the more that we educate, the more that with the time that we spend with you going through what we do, what you do, how we develop synergies together, you know, maintains the healthiness of our relationship and operationally long term, it it reduces all that back and forth noise. You know, we’re, so there’s that piece of it. But then also the other side of it is too, that, you know, what we kind of talked a a little bit earlier about, of getting to a place where we have the common language, we share the same values, we share the same messaging around what we’re trying to accomplish in this industry. And if we can align in that during that education process, getting the feedback from those partners to say, you know, that’s not gonna work with my clients. And if you did it this way, it would work. Having that feedback loop is, is critical so that we can adjust as well. But really it’s, it come, it comes back to just such a, a, a synergistic operational side. When, when we’re all happy and headed in the same direction, we’re all super happy. So, yeah.
I, I agree. And it’s, it’s a big mission. You know what I mean? My mission isn’t about me. You know, it’s not about how much money I can make. It’s not about, it’s just not about me. Right. The mission is about us. It’s about this industry and everybody who’s affected by it. And I think the more you can teach, the more you can empower, the more you can benefit, you know, personally with a career, you know, maybe a new career. What I don’t want you to, I think part of the education motivation too, is to, to stop you from doing it wrong. Mm-Hmm. <affirmative>. Because this is, you know, and I’ve said it a million times, this is not a product industry. This is a service industry that’s dominated by products. Totally different. Right? So because people are the biggest risk, right? Yeah. They’re the ones who cause most of the issues.
What, and it’s not the end user clicking on buttons that I’m talking about. It’s the developers developing crappy code. You know, why do I have to patch all the time? If you didn’t have bugs, you probably wouldn’t have to patch all the time. <Laugh>. You know, I mean, they’re not, you’re not patching for new features. Those are called upgrades. Yeah. Right? And so, you know, it’s, it’s us corporately as people, we have to do better than this. There will, we will pay the price. And so I think, you know, giving it your all try and to empower people, you know, to consult other people. Well, yeah. And then also being open to criticism. ’cause I don’t have all the answers. We already talked about that. And so if I’m teaching this way and you’re like, yeah, but that doesn’t work. Being open to that criticism, you’re not attacking me personally.
You’re attacking the way I’m doing something, right? Yeah. And so being open you know, well, you know, you’re, I benefitted tremendously from this industry. I’m live in, I live in Mexico, I live in this. I don’t want any more money. I want other people to benefit, right. By doing good security. So if you can live out a good example that you can do security correctly and to make money, they’re not mutually exclusive. But the thing is, if you focus on the mission, you’ll make money. If you focus on the money, you won’t make the mission. So totally different. So going out there and selling people products that they don’t need, going out there and giving them crappy advice because you were afraid to say that you didn’t know the answer. Things like that, you know, oftentimes that’s putting money or ego ahead of the mission and people suffer for it.
Yeah, for sure. No, that’s great. And you know, and I think it all goes back to what we were talking about earlier, which is standardizing the way that all of these things are done. ’cause If there’s no standardization around the services that CISOs or MSPs or anybody provides, then you’re just kind of, everybody’s doing something differently, right? Which doesn’t serve anyone at the end of the end of
<Laugh>. Alright guys. But that’s the thing. But that’s the thing. If you, if you had a product that was actually as good as a lot of these people say is they would be rushing down your door to come by from you. Yeah. But the thing is, you don’t have that product. You may say you do, but again, anybody with discernment knows well enough that you don’t. And so I think what good marketing is, is it’s honest, it’s transparent. And in all of that, what’s in it for me as a buyer, right? How would I benefit from this? How would I benefit from your service? How would I benefit from your product? And don’t make up some. Like truly. And I can hold you calm to that. That would be good marketing. ’cause Then I would buy it and I’d be like, oh my God, everything you said, yeah, you did. Right. And I’m, I’m gonna go tell the masses about this. That
Actually leads us into our, our next conversation point, which is, you know, there’s all these vendors out there that are, that are jumping on the cybersecurity bandwagon. You know, they’re all talking, but it, it feels like there’s a lot of misinformation going on out there. How do MSPs know what to believe? I mean, what would you guys say? How, how do you, how do they know?
Well, I love that that first que I think it’s tied to that first question that Jason posed, you know, in the chat. Mm-Hmm. <affirmative>, yeah. Understanding the basics of what information security actually is. Mm-Hmm. <affirmative>. Right? That’s what keeps you safe from buying the crap. You know, because you think, if you think about it, like, what I’d rather mis, I’d rather not spend a dollar on information security than misspend a dollar on information security. Because at least one, I’m not ignorant enough to believe that I’m actually protecting myself. I’m not living in a false sense of security. And I didn’t away that dollar. Right? So when you, what are the fundamentals of information security One, understand what the name of the game is. It’s risk management. Risk management, not risk elimination. Impossible. So anybody who ever tells you that they can end cyber risk, it’s.
You can’t, right? So it’s risk management. Well, what would I need to do in order to manage risk? One, I would need to understand it. I would need to diagnose it, right? Like I take a car to a an auto mechanic. They run diagnostics before they start pulling out the wrenches and tearing your car apart. The same thing with information security. So before I’m going to manage something, I have to understand it. So that would require a risk assessment, right? And so risk, we overuse that word a lot. It’s likelihood of something bad happening. And the impact, if it did, it’s not vulnerabilities that’s different. It’s not threats that’s different. It’s when a threat compromises a vulnerability, that’s when you have a risk. So I think understanding those basics. And then if you did a good risk assessment, I think then you build a roadmap. You did. ’cause Part of the management is assessing it, then making decisions. What are we gonna do? Yeah. There are these 10 risks that are unacceptable. They’re just too much for us. Right? Let’s do something about them, and then that will lead to your budget. So it’s all tied in nicely together, but it’s all work, you know, it’s simple and people get confused, but simple must mean easy. No different things.
Well, I know we’re, we’re at the, our 45 minutes here guys. And I, I, do you guys have a, a little extra time? We can, we can spend here if, if you on the call coming
Right. If those of you on the call here can, can stay a few, few more. We have a few more questions we can go through. And of course I’d like to get through your questions as well. But all of this subject, you know, that we’re talking about really, you know, speaks to this, this mindset or idea of guarantees. And I’ve heard this from a number of cybersecurity companies out there, vendors touting a hundred percent ransomware protection, or, you know, something of this nature. I mean,
Cross? No, we can’t. Yeah, a hundred percent of the time. Nobody’s a hundred percent. That’s all you gotta think about. Yeah. Nobody’s a hundred percent. It’s all a bunch of, and that, that goes back to your previous question around, you know, how do you, you know, wade through this noise? Yeah. And, you know, just don’t trust vendors who say like that. I mean, ’cause and, and to Evan’s point about risk assessment of like, there’s no, nobody’s a hundred percent. It’s just not, it’s not possible. I mean, there’s just no way. And well, I, and
If, and if that’s what your goal is, if you’re actually driving towards that, yeah. You’re going to fail. Yes. And you’re going to be disappointed. So just, you’re just setting yourself up for failure right out of the gate.
It’s the goal isn’t even to prevent all breaches. Correct. That’s not the goal. You can’t do it. Nobody can do it. It doesn’t matter. No ai, nothing. It’s impossible. We’ve seen it forever. Right? So take it from somebody who’s been in this industry and seen this same crap recycle over and over again. Oh
And you know, so, and if you don’t, and if you don’t have expertise in those areas, then find somebody that you can trust who does, has ex does have expertise. Somebody who’s not going. Like if you said to, to me, like I’ve, I’ve heard like invisible processes, you know, I was in a meeting and I was asking them, oh, this is a really cool technology. Can you tell me how it actually works? And they said, well, you know, it went on to something. I’m like, okay, I’m still not getting that. Explain to that more. Well, it’s invisible processes. I’m like, what? There’s no such thing as an invisible process. <Laugh>
Yeah. Interesting. No, I mean, that all makes sense, guys. And, and you know, it’s just, it’s more of, more of, that’s how you weeded it, weeded out the, you know, those folks and, and you know who you can trust if they’re saying things are creating guarantees. It’s just not correct. Well,
And in this, in this industry, as a rule of thumb, I would never buy anything from anybody who told me that I needed to have it. Right? Meaning if it was a salesperson, right? I should already know. Like, it’s the same thing, like at my house, right? So take this. ’cause We used to be two different things, right? Cybersecurity or information security and life, right? They were separate from each other. Like I wasn’t online until I booted up my modem and connected to a OL, right? So they were separate things, but they’re not separate anymore. There’s an intersection between everything I do in daily life and everything I do. Cyber. I mean, they’re just, you can’t separate them anymore. Mm-Hmm. <Affirmative>. So the same risks, the same concepts of risk apply, right? So if you were going to guarantee me that I’m never going to get hacked, can you guarantee me that I will never get in a car accident?
Can you guarantee me that I’ll never trip going down the stairs? Can you guarantee me that I’ll never have a heart attack? Can you guarantee me I’ll ever have any of these things? No, you can’t because that’s life, right? So what we do is we do things to manage that, right? Mm-Hmm. <Affirmative>, I manage the risk of me having a heart attack by maybe not smoking, watching my weight getting exercise, if that risk is important enough to me, right? And the same thing with cyber. There’s some risks that maybe just aren’t important enough to you, but what’s not acceptable and it’s not defensible, is to be ignorant to just not know, not care, play my, you know, like, play. You’d have better chances at MGM where they lost your information.
That’s great. You know, I wanted to get one more question out before we kind of get to the q and A here. And you know, that’s it. If, if you two were MSPs today, you know, handling networks for small businesses you know, what would you be focused on doing in your business in 2024? Like what, how to help these guys and, and what would be those next steps for you? Any thoughts?
Security assessment. I would go and, and sit down with it every single one of the clients and walk them through security assessment first and foremost. And then, and then take that back. Because then that, that enables me to understand the gaps that I’m not providing them. And it understands the gap, the gaps of what tools or solutions that I need to look at as an MSP to bring in to, to provide them. But sitting in <laugh> this, I would sit down and do an S two assessment, an assessment with these one of these clients, and then identify like what you just said, Evan, what, where’s the risk? And, and then what, what weight do we put against that risk? And then, and then work, build a plan together, partner with that business, and build a plan together and get the remediation done.
Yeah. Yeah. I think absolutely. And I, and not missing out, like and I’m learning all the time, you know, I mean, 30 some odd years, and I’m still like, ’cause I was stuck on this thing. I, I was with a bunch of CIOs at a round table and they kept talking about speaking the language of business, speak the language of business, speak the language of business. And I was on this round table and I was the only security guy there. And they asked me, you know, and I wasn’t saying anything. I was just listening. And then they noticed I didn’t say anything. And they’re like, Evan, what do you think? And I, and I didn’t think before I said, what? I said, none of you speak the language of business.
And they’re like, what? And they were just blown away. I’m like, yeah. Because all I hear is like, it’s so hard to keep up with the unrealistic technology demands of the business. It’s, you know, we’ve got all these assets, we don’t have enough staff, we don’t have enough budget. And I’m like, none of that speaks to me like you speak the language of business. No. So then the, this is, this was the learning thing. ’cause Then I thought about us, you know, I thought about information security people, and do I speak the language of business? I mean, I’m not gonna beat these guys up and I’m not doing it. And so I, I did research on what the language of business is and the language of business according to what’s his name? Who’s the guy from Omaha?
Warren Buffet. Yeah, Warren. Because he knows a lot about business, you know what I mean? He said the language of business, and this was a quote is accounting. And I was like, son of a. All right. That makes sense. So as an MSP, if I were starting an MSP today, or I was providing consulting services for a small to midsize business, I would approach it as how can I use, how can I provide value to your business and make you more money,
Either top line. So a competitive advantage in the marketplace depending on what market we’re operating in. You know, some, some places touting security gets you business, right? Or gets you through the third party vetting process faster. Right? Right. Whatever. On the bottom line, if I know complexity is the worst enemy of security, I’m looking for every opportunity possible to simplify this crap. So if I walk into a small to mid-size business and I find I would do an asset inventory, what stuff do we have here? Right? Now that we don’t need, we’re not using anymore legacy hardware software that we’re paying for, that we’re not using. ’cause From a, from a risk management perspective, I just reduced risk quite a bit because those are things I don’t have to configure anymore. I don’t have to secure them anymore. I don’t have to worry about passwords. They’re gone from a business perspective. At the same time, this is the alignment that I’m talking about. At the same time, I just saved my, my small to mid-size business, a couple hundred thousand dollars, which by the way, totally paid for all the risk stuff that we did. So I think always looking for opportunities to show how you provide value to them. I’m gonna get paid either way. If I don’t provide value, I I hope you’d fire me.
Yeah. Yeah. Great points, guys. So I wanna jump in some of the questions here. I know we only have about five minutes till the top of the hour, so we’ll try to go through these quickly. I’m not sure that you guys can recommend any tools or software. Someone asked if if there were any tracking vulnerability tools that you guys would recommend for smaller organizations. Anything that you guys, it’s
Address it. That’s almost a commodity now in our industry. So you’ve got, you know, Nessus, Qualys, rapid seven. I mean, there are a number of players. You
Okay. Let’s see here. What do you guys think good cyber marketing looks like? Any messaging that you’ve found that resonated with customers and is honest. So, so marketing for them to their potential customers. Anything that comes to mind that might
A beard. No, we don’t need a beard. I think it’s, it, it’s the authenticity, right? Yeah. You know, not, we talked about it not having a hundred percent, or not having guarantee the, just the fin the finite we do, you know, we’re, you know, it’s, it’s the, the messaging that comes across is we wanna, we wanna partner, we wanna, how do we help you?
They, they had a saying, they have a saying at FFR Secure, they’ve used for years that if you see Evan panic, it’s time to panic <laugh>. So, I mean, that means that there’s a time for fear, right? There’s a time to be afraid. But, you know, you gotta be really careful. And when you play that card, man, because people are, it, we got taught, that’s a crazy thing about this industry too. We were taught this stuff as like little kids, you know, in nursery rhymes. Remember the boy who cried wolf?
I was already taught this. So, you know, are these boys who are crying wolves or men? I guess, I dunno what gender we’re talking, but there would be people that are crying wolf to sell you something and there’s no justification for it. So, you know, continue to ask it, ask the questions.
No, very good. This is just a statement. So you hit a great point, Evan. Linking the business need to, a personal benefit creates buy-in, we’ve seen this in implementing good cyber practices and linking them to employee’s, personal online shopping, banking activities such as that. So that was a great point from Matt. We had an anonymous attendee. Attendee let us know that Kennedy’s beard routine is, is more intense than his haircare routine. So that’s always good.
Somebody said the box with lots of exclamation marks. So <laugh>. And then we have from Carrie, absolutely risk management. But what about people management? Get it, people are risk. But any other thoughts on that that you guys can provide?
What comes down? I mean, we were taught this in college too. I don’t know if how many people went to college, but psychology 1 0 1, right? They taught you you know, Pavlov, I think it was you know, how to motivate dogs, but people kind of what’s in it for them? What pain do they have if they don’t do it right? So it, it comes down to the same thing. So put it into their language in ways that they can understand. And people are so unique that you can’t, you can’t just generalize, right? Because what works at FR Secure in my company or security studio, my company may not work in your company. I don’t know what motivates, I don’t know what your culture is in your organization. So that’s why can training and awareness program is really limited in its effectiveness. It has to be custom to the people that you’re actually serving so that it resonates with them
All. Perfect. and I think we hit on this. Lyle’s had just talked about the a hundred percent guarantees and, you know, outside of that, if the market’s flooded with that, how do we educate people on business and risk mitigation? Like if there’s all these guarantees out there going on and people, you know, marketing that way, how do you get guarantee
Yeah. Yeah. Good, good point. I mean, that, that is you know, you’re, you’re just gonna have to combat it with reality, right? Reality. And, and that, that there just is no guarantee. But
You know, and, and it, and it’s okay. I think the other thing too is we get this like, we ha we have to win the deal. We have to win the deal. We have to win the deal and, and, and, and go through it. It’s okay not to win the deal. It’s okay that we’re not a, like Evan said it a couple of times, it’s okay that we’re not a fit for your business. I dunno how many times I’ve told people that’s it’s okay that, you know, we’re, we’re not gonna work for you. You know, and six months later we get a phone call, it’s like, you, you, we need you. ’cause The path we went didn’t work out for us. And that’s great, but you can’t, we’re not magicians. We’re not, we don’t have, you know, that ability to change people’s minds, right? You can only express and be authentic. And if they, if they don’t onboard, okay, it’s okay.
Yeah. There’s plenty of others that do want to get on board. Yeah. I’ve done the same thing with, with executive management that just, you know, they don’t give a and it doesn’t matter. You try all the different angles, try to figure out all the different ways, and they still don’t care. Rather than me continuing to waste my time here and maybe get it over this hump, screw it, I’ll go, I’ll go work for other places where they actually have good management.
Yeah. Right. So we’re at the top of the hour, guys. There’s, there’s one last question here that I, I’d love to hit and then we’ll we’ll, we’ll get our ending going here. But Jason asked, other than fr secure C-I-S-S-P mentor program, blogs and ostra.net blogs, are there any publications, websites, organizations that are better than others for staying up to date on cybersecurity news and events? Do you guys have any recommendations where these guys can go to check out stuff?
I can tell you what I do. I, I I actually don’t go to any news source. I create Google search alerts. So there’s certain things that I’m interested in hearing about on a regular basis. And so with Google you can, you know, set up certain search criteria and then have it email you digest of those things. Mm-Hmm. <Affirmative>. So I get sources like if I’m interested in, you know, counties that have been hacked, you know I’ll do a search with county breach data, whatever, whatever my search criteria are, and then I’ll get updated on those. ’cause Then I can read it without somebody’s interpretation of what it is. Right.
Any thoughts? I use, I use an app Flipboard and I configure it the same way that Evan talks about. I have different parameters in there for a secure related industry related just world events type stuff. And then I, I go through and I, and read myself. I mean, there, there are a lot of good organizations and a lot of really good people out there that, that publish podcasts, that talk industry related stuff. That, you know, I just, I read through that stuff as it comes too. But yeah, I customize, I do the same thing. Customize
And certainly what my friends are doing, you know what I mean? Mm-Hmm. <affirmative> people that are really respecting this industry. So, you know, and I’m not pitching it. I think it’s good, you know, like Hackle Box, my good friend, you know, Oscar, you know, leads that, and I always want to kinda keep up to date on what he’s up to and what he is doing. So. Mm-Hmm. <Affirmative> That’s a good point. You know, Mike, the those podcasts as you make friends, you know, in this industry, follow your friends, see what they’re up to.
Awesome. Well, guys you know, this has been super informative. We’re, we’re planning to do, you know, a series of these over time. So I think that’d be great. At the end of this, you guys they’re listening. We’ll have a survey, just like to know what it is. Two questions I think or something. So, so let us know what you thought of it and anything that you wanna see in the future or talked about. So feel free to, to fill that out for us at the end. Any final thoughts? Kennedy, I’ll, I’ll start with you. Any final thoughts?
Come out with me, man. Yeah, I think, you know, start with protecting what’s most important to you. Yeah. Start with protecting yourself and your family. You know, we talk about business a lot, but at the end of the day, you know, what are your kids doing? You know, because I can recover from, if you hack my bank accounts, which has happened many, many times ’cause it’s just nature of the beast, I can recover from that. What I can’t recover from is you stealing one of my children’s innocence. Yeah.
I can’t recover from that stuff. So start there. You know, start with personalizing this, get yourself, get your family secure, and you’ll be, you’ll, you’ll be amazed at how much you learn from doing that, that you can then take to your work. So my, my, it’s the same with like, when I tell, when people ask me, you know, how do I get into, you know, pen testing and I’m like, hack yourself,
Yeah. What do you mean? Like, hack your house? Like I, you know, and the normal, you know, American House has like 12, 13, 14 devices connected to the network, right. Hack all that crap. Yeah. You’re not gonna go to jail for that and you’ll learn so much. So the same thing. You know, make this personal, protect your family, protect yourself, and see where good things go from there.
Want in, they wanna install Snap Snapchat on their thing. Okay. Read the policy and tell me where, what, where your data’s going, and then you can have it. Right. So, nice. That’s awesome. And they, yep. Yep.
That on everything. Right. Oh, great. Great stuff guys. This has been super informative and awesome. Really appreciate your time from both of you. And, and I think that we’ve, we’ve learned a lot today. We went over a little over, but most people have stayed with us, so that’s fantastic. If you guys wanna learn a little bit more, this was not about, you know, our, our solutions or anything like that, but if you’d like to learn more about ostra ostra.net, feel free to jump over there and check those guys out. Mm-Hmm. If you’d like to learn more about Security studios, just security studio.com, check us out and thanks everyone for joining us today. There’s been a great fireside chat getting Kennedy all warmed up there.
As Your Trusted Cybersecurity Team, Ostra makes cybersecurity simple and accessible to businesses of all sizes. Ostra provides its partners and their clients with a multi-layered, comprehensive and fully managed Security as a Service.
https://www.ostra.net/wp-content/uploads/2024/01/who-can-you-trust-in-cybersecurity-922-x-615-px-2.png615752Ostra Cybersecurityhttps://www.ostra.net/wp-content/uploads/2023/08/Ostra-logo-2023.pngOstra Cybersecurity2024-01-16 08:00:212024-01-17 09:46:12Navigating the Digital Wilderness: A Managed Cybersecurity Fireside Chat
Ostra Hires Chris Pridemore as Security Operations Manager
Ostra Cybersecurity, a leading provider of world-class cybersecurity solutions for small and medium-sized businesses, recently welcomed Chris Pridemore as Security Operations Manager.
In this new management role, Chris will help improve and expand Ostra’s existing Security Operations Center (SOC) to meet the needs of current and future clients as the company grows.
Chris brings over a decade of experience in IT systems infrastructure and cybersecurity to the operations side of the business. He has built successful cybersecurity programs in large enterprise environments with experience leading both Governance, Risk & Compliance (GRC) and SOC teams.
With this latest hire, Ostra was able to shift many of the day-to-day responsibilities for technology and security operations management to Chris, enabling Vice President Emad Bhatt to focus more heavily on Ostra’s IT Strategy, Roadmap, and Product Development priorities.
Adding a dedicated security operations leader further demonstrates Ostra’s resolve to protect more clients and scale its Diversified Managed Cybersecurity offerings. This hire comes on the heels of the recent unveiling of Ostra EncompassTM and Ostra ExtendTM, which are designed to meet the evolving needs of small and medium-sized businesses as well as the managed service providers (MSPs) and IT firms that serve them.
“Chris is a welcome addition as we continue to expand and mature our team of great people with the technical skills to stand between our clients and cyber threats,” Emad said. “His skill set will be pivotal as we protect an increasing number of clients while incorporating automation and highly scalable processes.”
With a focus on being the Trusted Cybersecurity Team for its clients and partners, Ostra’s market niche is ensuring that top-notch data security solutions are accessible for small and medium-sized businesses. Ostra’s Managed Cybersecurity offerings—combined with the service expertise of its channel partners— protect clients through best-in-class, multi-layered, and fully managed solutions.
Chris earned a Bachelor of Science degree in Cybersecurity from Metropolitan State University in St. Paul, Minn. Chris has spent more than half his career as an Intelligence Analyst in the U.S. Army National Guard, earning an Army Commendation Medal in 2008. Over the years he progressed in various IT roles, including positions at IBM and Hays Companies. Most recently, he served as a Senior Security Analyst at Andersen Corporation before joining Ostra.
In his new position, Chris looks forward to drawing on his leadership skills and deep technical background to support Ostra’s mission. He said, “I am excited to do my part to proactively protect our clients’ systems and data, especially as Ostra continues to grow.”
As Your Trusted Cybersecurity Team, Ostra makes cybersecurity simple and accessible to businesses of all sizes. Ostra provides its partners and their clients with a multi-layered, comprehensive and fully managed Security as a Service.
https://www.ostra.net/wp-content/uploads/2023/11/Chris-announcement-graphic-922-×-615-px.png615922Ostra Cybersecurityhttps://www.ostra.net/wp-content/uploads/2023/08/Ostra-logo-2023.pngOstra Cybersecurity2023-12-05 08:00:142023-12-20 11:50:03Ostra Hires Chris Pridemore as Security Operations Manager
When it comes to mental health, the fall and winter months can be especially challenging for many people—including those of us who work in the high-intensity world of cybersecurity.
Recently, I shared some perspectives on mental health within the cybersecurity industry at Hacks and Hops 2023, an information security event series hosted by FRSecure. This year’s event (held October 5, 2023 in Minneapolis) brought together hundreds of security professionals to learn and network. The timing of the conference coincides with Cybersecurity Awareness Month in October. Celebrating its 20th Anniversary this year, the Cybersecurity Awareness Month campaign is a collaboration between government and private industry to raise awareness about digital security and empower everyone to protect their personal data from digital forms of crime.
Taking a Moment for Mental Health
With so much focus on cybersecurity best practices and tips on staying safe online being shared this month, it also seems like the perfect opportunity to have a transparent conversation about a topic that doesn’t always get the same level of attention in our industry: mental health.
At this point you might be wondering: What does cybersecurity awareness have to do with mental health? Or maybe you believe that everyone who works in cybersecurity is on an inevitable path to constant anxiety (I know I certainly feel that way sometimes).
Sure, the daily grind of a career in cybersecurity can be stressful and overwhelming. The first reason is that security professionals are especially at risk for cybersecurity fatigue due to staff/skills shortages on their teams that make it harder to stay on top of vulnerabilities. For example, “there will be 3.5 million unfilled cybersecurity jobs globally in 2023—enough to fill 50 NFL stadiums,” according to Cybersecurity Ventures. (For more on this topic, read Ostra’s blog, Overcoming Cybersecurity Fatigue: Help For IT Service Providers.)
Secondly, it’s hard to be constantly watching out for the bad guys and witnessing the scary stuff happening on the dark web without it impacting your mental health.
All About Balance
In my experience, taking a balanced approach to cybersecurity awareness is empowering. Armed with the right information, we can take actionto protect our data—and that’s a great feeling. By contrast, the opposite extremes of either apathy or paranoia will have a paralyzing effect that solves nothing. The diagram below illustrates this concept in more detail.
4 Tips to Promote Positive Mental Health
As someone who has spent more than 20 years in the cybersecurity industry, I have dealt with my share of stress, fatigue, what-if thinking, and random episodes of sheer panic. But I have survived and learned a lot in the process. So here are 4 tips that have helped me pursue positive mental health habits. Hopefully, they will help you as well:
Having thoughts of impending doom does not mean doom is impending. That tightness in your chest or pit of your stomach is a natural response to what we are seeing every day on the front lines of cybersecurity. It’s your cue to take a step back and find something good, funny, or hopeful to think about. Refresh your perspective.
Normalize talking about how you feel. As soon as you acknowledge it and say it out loud to someone else who understands exactly what you are going through—because they are going through the same thing—it becomes less scary. Addressing mental health in the workplace and fostering a safe environment for sharing feelings of stress is also crucial for employers and company leaders to promote employee well-being, enhance productivity, and create a positive, inclusive culture.
Do what works for you. When it comes to relieving stress and anxiety, some people take walks or go to the gym. Others lean into mental health apps, meditation or deep breathing exercises. Personally, I like to recharge by finding ways to help other people and spending time outdoors. Whatever your go-to method for shedding stress or anxiety might be, I promise the time will be well spent.
Reach out to another human who can support you when you need it most. It can be a friend, mentor, spouse, trusted colleague, neighbor, or mental health professional. If you or someone you know is experiencing a mental health crisis, call or text 988 immediately. If you are uncomfortable talking on the phone, you can even chat with someone at the Suicide & Crisis Lifeline at 988lifeline.org, or text NAMI to 741-741 to be connected to a free, trained crisis counselor on the Crisis Text Line. You don’t have to suffer alone—there are so many people and communities who are ready to help.
During the month of October and beyond, please join me in promoting cybersecurity awareness while also making mental health a priority in your own life but also within your organization. Our world needs people who will bring their best selves to the difficult mission of protecting clients—let’s step up.
For more information about Cybersecurity Awareness Month, including tips and resources to help you stay safe online, visit staysafeonline.org.
Michael Kennedy is the founder of Ostra Cybersecurity, a multi-layered and fully managed Security as a Service. Recognized as a cybersecurity industry trailblazer, he is a dynamic leader, speaker, and fierce advocate for data privacy.
https://www.ostra.net/wp-content/uploads/2023/10/Blog-cover-photo.png600800Michael Kennedyhttps://www.ostra.net/wp-content/uploads/2023/08/Ostra-logo-2023.pngMichael Kennedy2023-10-24 04:00:222024-01-18 13:30:20Well-Informed and Well-Balanced: The Link Between Cybersecurity Awareness and Mental Health
Tips to consider when investigating “XDR” solutions
Over the past few years, it has become apparent that many cybersecurity vendors are experts at blurring the lines of meaning in their carefully crafted descriptions of their solutions. Unfortunately, this has only increased confusion while reducing cybersecurity effectiveness for customers.
We are bombarded with terms like Web 2.0, XaaS, Cloud, SASE, Zero Trust, and endless other vague marketing jargon — but who is spending the money and effort to shape our vocabulary in this way? Well, it’s primarily coming from vendors touting their capabilities in EDR, MDR, XDR, and other variations of this service.
The problem is that none of these “XDR” terms really have an actual, singular definition. Each vendor can create their own meaning to suit their go-to-market objective and capabilities.
However, the one letter that consistently appears in all these acronyms is “R” for response. Unfortunately, this word is often the most misleading part of the service description since vendors can have different interpretations of what “response” looks like.
As showcased above, many vendors have only added to the confusion of the overwhelming cybersecurity landscape with the vague use of these R-related cyber terms. This approach raises several concerns:
Visibility
Vendors can only respond to what they can see.
For many cybersecurity providers, visibility is created by deploying sensors, agents, and scanning tools in the relevant customer environment, typically at the endpoint. The problem with this process is the service vendor can only see what is sent back by those monitoring tools.
Frequently, systems get missed or are outside of the service scope, which creates more risk exposure. Items that can be easily missed include operational technologies such as a control system in a manufacturing environment or an IoT device providing physical security or environmental controls. Or it could be as common as a server running a legacy application that wasn’t addressed in the scoping definition for “XDR.”
A complete security assessment, asset inventory, and scan must be completed before purchasing any “XDR” vendor’s solution to determine fit and coverage.
Response
A vendor’s response to the event doesn’t actually correct or counteract anything.
At best, computing devices can be isolated from the network when a threat is identified. However, the actual investigation, remediation and resolution of that quarantined device are still left to the client or their service provider — putting the burden of remediation back on internal teams without enough time, resources, or expertise to address the problem adequately.
Action
A vendor only provides vulnerability and security operations recommendations.
With few exceptions, the “XDR” vendor is only providing guidance through voluminous reports and dashboards notifying the customer’s IT team of remediation items to address. The vendor is typically not providing any hands-on work for the significant fees charged, draining resources from an already depleted staff and budget. That means the day-to-day staffing and knowledge burden, which is by far the biggest cost and most challenging need, is still left unresolved for the customer to address.
Questions to Ask Your Vendors
Despite these trends, XDR services are often advertised as “end-all, be-all” solutions that offer full protection from cyber risk protection. Unfortunately, no such solution exists (and no, not even Ostra can be your all-in-one solution). Building a comprehensive cybersecurity strategy involves more than installing the right products or working with the right partners.
To be clear, there are many great services and solutions on the market (including MDR, EDR, and XDR platforms). But it’s up to the IT service providers and the clients they serve to ask the right questions — especially SMBs who have limited budgets and resources to utilize and zero to waste. When investigating ways to fill your operational and technical needs through a cybersecurity program, ensure that these questions are answered to your satisfaction:
Is your solution built on proven and reliable security platforms and tools?
The cybersecurity landscape is constantly evolving. Find a provider with vast industry knowledge and one that continuously evaluates the marketplace to ensure their products are updated with the latest and best features to protect clients in a scalable way.
Does your solution cover the critical categories of cybersecurity?
Cybersecurity is a very broad category with several sub-specialties. When picking a security partner, make sure their services cover the most critical elements at a minimum. A layered solution should include cyber risk protection from the firewall and VPN all the way to endpoints, including email and mobile devices.
Have ALL cybersecurity components been integrated and orchestrated to optimize efficiency?
Vendors often have either an endpoint-centric approach or a limited integrated solution through a hodgepodge of agents, scanners, and sensors with limited correlation and intelligence. Make sure your provider takes a comprehensive approach to guarding the clients’ entire environment.
Is the solution utilizing advanced analytics and data collection 24 hours a day, 365 days a year?
It requires significant resources to actively monitor, respond, AND resolve (with hands-on resources) any suspicious security events on behalf of the partner and customer. These resources include advanced information correlation and analysis and the actual security analysts with the right cybersecurity skills — whether they are members of the vendor’s team, the customer’s internal IT/Security Operations team, or both.
Although these points seem nuanced, they highlight some critical differences in the marketplace. Decoding the R-words in cyber jargon can help you choose a holistic solution that protects clients from devastating cyber risks versus the over-sold capabilities of the alternatives advertised on airport billboards and the sides of race cars.
Ostra Cybersecurity is committed to helping our network of consultants, IT firms, and Managed Service Providers enhance value for their small to medium-sized business clients by delivering Fortune 100 tools, tech and talent. As your trusted cybersecurity team, Ostra’s ecosystem allows for true remediation and resolution — not just alerts. Learn more about our unique approach to Managed Cybersecurity solutions, or reach out to us anytime to start a conversationon how to partner with us.
Wade Hoffman is the EVP of Channels & Strategy at at Ostra Cybersecurity, a multi-layered and fully managed Security as a Service. Wade leads the Channel Team responsible for growing Ostra’s network of trusted Channel Partners and the SMB clients they serve.
https://www.ostra.net/wp-content/uploads/2023/10/3-Rs-of-Cyber-Jargon.jpg600800Wade Hoffmanhttps://www.ostra.net/wp-content/uploads/2023/08/Ostra-logo-2023.pngWade Hoffman2023-10-10 08:00:582023-10-16 15:06:00Decoding the R-words of Cybersecurity Jargon
Wade Hoffman to lead sales channel network and strategic sales initiatives.
Ostra Cybersecurity, a leading provider of world-class cybersecurity solutions for small and medium-sized businesses, recently named Wade Hoffman to a new role as Executive Vice President, Channels & Strategy.
This latest hire affirms Ostra’s continuing drive to meet the needs of small and medium-sized businesses (SMBs) through its rapidly growing network of Channel Partners.
Wade will be leading the Channel team to grow its network of trusted Channel Partners and the client base the channel serves in Ostra’s mission to protect as many SMBs as possible from cyber threats.
“Wade’s extensive experience in channel development as well as his intense focus on fostering successful partnerships will strengthen our leadership team and contribute to our ongoing success,” said Ostra President Joe Johnson. “As we grow and evolve, Wade will help Ostra provide a scalable approach to support our future expansion and progress.”
Prior to Ostra, Wade built a career defining and selling complex solutions and services for clients ranging from SMBs to global enterprises. He brings broad experiences across industries and solutions such as data analytics, business continuity, unified communications, and information security.
One common theme Wade has seen across various industries and companies of all sizes is the value of capturing, organizing and protecting the most valuable business asset: data. “Information security has been my passion over the past 10 years,” Wade said. “I am proud to work with Ostra partners and clients to ensure they have a strong information security program in place to protect that asset.”
Wade earned a bachelor’s degree in computer science from South Dakota State University and an MBA from Keller Graduate School of Management. He also holds credentials as a Certified Information Systems Security Professional (CISSP) and a Certified Virtual Chief Information Security Officer Course (CvCISO).
Stacey Kusnier is the Marketing Director at Ostra Cybersecurity, a multi-layered and fully managed Security as a Service. With a passion for fostering mission-driven culture and B2B marketing, Stacey drives campaign strategies to support Ostra’s sales team and Channel Partners.
https://www.ostra.net/wp-content/uploads/2023/09/wade-hoffman.png615922Stacey Kusnierhttps://www.ostra.net/wp-content/uploads/2023/08/Ostra-logo-2023.pngStacey Kusnier2023-09-12 08:03:292023-09-18 06:30:19Ostra Cybersecurity Names EVP to Senior Leadership Team
With the rapid evolution of technology and the increasing threat of cyber-attacks, businesses of all sizes are seeking robust cybersecurity solutions to protect their sensitive data and operations.
This has led to a growing demand for cybersecurity resellers who can provide comprehensive security solutions tailored to diverse business needs. If you’re interested in becoming a cybersecurity reseller, this article will guide you through the process.
Understanding the Role of a Cybersecurity Reseller
A cybersecurity reseller acts as an intermediary between cybersecurity solution providers and end-users, helping businesses access top-tier cybersecurity technologies and services.
As a reseller, you don’t develop the solutions yourself; instead, you partner with established cybersecurity providers to offer their products to your clients.
This partnership allows you to tap into cutting-edge technologies and leverage the expertise of established players in the industry.
The Benefits of Being a Cybersecurity Reseller
Access to Expertise: Cybersecurity resellers collaborate with established providers with deep industry knowledge and expertise. This means you can offer your clients solutions backed by a team of professionals who understand the intricacies of cyber threats and prevention.
Minimized Overhead: Developing and maintaining your own cybersecurity solutions can be costly and resource-intensive. As a reseller, you can avoid these overhead costs and focus on delivering value to your clients.
Diverse Product Portfolio: Cybersecurity providers offer various solutions that address cybersecurity aspects, from ransomware prevention to cloud data protection. This allows you to provide tailored solutions to clients based on their unique needs.
Efficient Time-to-Market: Partnering with established providers lets you quickly enter the market with proven solutions. This efficiency can be crucial in a rapidly evolving cybersecurity landscape.
Steps to Success With Cybersecurity Reselling
The first step to becoming a cybersecurity reseller is understanding the market. This involves gaining knowledge about various types of cybersecurity threats, such as ransomware, malware, and phishing, as well as the different tools and technologies used to combat them.
It’s also crucial to understand the specific needs of businesses in terms of mobile device security, cloud data protection, and other aspects of cybersecurity.
Once you’ve gotten up to speed on the basics of cybersecurity, these steps will walk you through the process of establishing a cybersecurity reseller partnership:
Research and Choose Your Partners: Research reputable cybersecurity providers like Ostra Cybersecurity. Look for providers with a strong track record, a comprehensive product suite, and a commitment to ongoing innovation.
Understand Your Audience: Identify your target market and understand their cybersecurity needs. Different industries and businesses have varying requirements, so tailor your offerings to these specific needs.
Build Relationships: Establish strong relationships with your chosen cybersecurity providers. This collaboration is built on trust and ensures you can effectively communicate your clients’ needs to the provider.
Education and Training: Gain a deep understanding of the cybersecurity solutions you’ll be reselling. This knowledge will enable you to effectively consult with your clients and provide them with the best solutions for their needs.
Value-Added Services: Consider offering additional services alongside the cybersecurity solutions, such as consulting, training, and ongoing support. This can set you apart from competitors and create a holistic cybersecurity solution for your clients.
Marketing and Sales: Develop a marketing strategy highlighting your offerings’ benefits. Educate your clients about the importance of cybersecurity and how your solutions can safeguard their digital assets.
Customer Support: Provide exceptional customer support to your clients. Quick response times, troubleshooting assistance, and regular check-ins can go a long way in building solid and long-lasting relationships.
Partnering with a Managed Cybersecurity Provider
Once you’ve gained a solid understanding of the market, the next step is to partner with a managed cybersecurity provider.
This provider should offer a comprehensive solution that tackles both known and “zero-day” threats – those that are brand new and unknown to security professionals.
The solution should be constantly updated to keep up with evolving threats and seamlessly integrate into clients’ IT environments.
Ensuring Seamless Integration and Support
In choosing a provider, ensure that they can integrate their solution into your current security suite with minimal effort on your part. They should take care of everything behind the scenes, from setup to ongoing management, allowing you to focus on your core business.
Look for a provider offering expertise, educational resources, training, sales and marketing tools, and ongoing support. This will help you provide the best possible service to your clients and grow your business.
Customizing Solutions to Fit Client Needs
Every business is unique, with different cybersecurity needs. As a reseller, you should be able to offer customizable solutions tailored to your clients’ specific requirements. This means working closely with your provider to understand their offerings and how they can be adapted to fit different business contexts.
Ready. Set. Go!
Becoming a cybersecurity reseller can be rewarding, providing an essential service to businesses while offering significant growth opportunities.
You can establish your successful cybersecurity reselling business by understanding the market, partnering with a reputable managed cybersecurity provider, ensuring seamless integration and support, and customizing solutions to fit client needs.
Remember, it’s not just about selling services; it’s about being a trusted advisor who can provide comprehensive data security that eliminates risk and meets clients’ compliance requirements.
Ostra has the exceptional talent to not only hunt for and identify threats but also remediate and eliminate them in real time for a fraction of your insourcing cost.
Our robust, secure product offerings are designed to meet the needs of small and medium-sized businesses in any industry. Our team of experts is available to provide assistance and support throughout your journey as a reseller. Contact us today to learn more!
FAQs
Q: What is a cybersecurity reseller?
A: A cybersecurity reseller is a business that sells cybersecurity solutions provided by a third-party supplier. They act as a bridge between the cybersecurity provider and companies that need these solutions. They can offer added value through consultation, customization, and additional support services.
Q: Why is partnering with a reputable cybersecurity provider important?
A: Partnering with a reputable cybersecurity provider is crucial as it ensures you have access to high-quality, effective cybersecurity solutions. A reputable provider will have a track record of success and will offer comprehensive, updated solutions to tackle both known and emerging cyber threats while minimizing liability risk exposure.
Q: What are the key capabilities to look for in a cybersecurity provider?
A: Key capabilities to consider include a comprehensive and constantly updated solution suite, seamless integration with existing IT environments, and robust support services. The provider should also be able to offer customizable solutions to meet varying client needs.
Q: How can a reseller add value to the cybersecurity solutions they offer?
A: Resellers can add value by offering additional services such as consulting, training, and ongoing support. By understanding their clients’ specific needs, they can also tailor the cybersecurity solutions to provide a more effective, personalized service. Offering a holistic cybersecurity package is also beneficial, setting your services apart from competitors.
As Your Trusted Cybersecurity Team, Ostra makes cybersecurity simple and accessible to businesses of all sizes. Ostra provides its partners and their clients with a multi-layered, comprehensive and fully managed Security as a Service.
https://www.ostra.net/wp-content/uploads/2023/08/newest-blog-photo-1030x686-1.jpg6861030Ostra Cybersecurityhttps://www.ostra.net/wp-content/uploads/2023/08/Ostra-logo-2023.pngOstra Cybersecurity2023-08-31 08:20:222023-09-16 08:23:49How Do I Become a Cybersecurity Reseller?
Outsourcing Cybersecurity: Most Companies Can’t Handle Cybersecurity On Their Own
Cybersecurity has become an essential aspect of business operations. With the increasing complexity of cyber threats and the value of sensitive data, organizations must adopt robust strategies to protect their assets.
When implementing a cybersecurity practice, companies often face the critical decision of insourcing or outsourcing their cybersecurity efforts.
Both approaches have their merits and drawbacks, making it essential for businesses to carefully evaluate their unique needs before determining the best course.
Understanding Insourcing and Outsourcing in Cybersecurity
Before delving into the comparison, it’s important to understand what insourcing and outsourcing mean in the context of cybersecurity.
Cybersecurity Insourcing
Cybersecurity insourcing refers to handling cybersecurity internally, wherein an organization establishes its in-house team of cybersecurity professionals responsible for safeguarding the company’s assets.
Cybersecurity Outsourcing
Cybersecurity outsourcing involves partnering with external cybersecurity service providers to handle security tasks on behalf of the organization.
Hybrid Cybersecurity Approach
The hybrid approach to cybersecurity is a combination of insourcing and outsourcing, wherein an organization outsources certain tasks while keeping the remainder in-house.
The Advantages of Insourcing Cybersecurity
One of the primary advantages of insourcing cybersecurity is its level of control and customization. An in-house team allows organizations to tailor their security measures to align with their specific needs and requirements.
Additionally, in-house teams can better understand the company’s operations and culture, leading to a more effective security strategy.
Insourcing can potentially lead to cost savings in the long run. While initial setup costs might be higher, the absence of third-party fees can result in lower overall expenses over time.
With a dedicated team on-site, response times to security incidents can be faster, potentially minimizing the impact of breaches or attacks.
The Challenges of Insourcing Cybersecurity
Despite its advantages, insourcing cybersecurity also presents certain challenges. Building and maintaining an expert cybersecurity team demands significant recruitment, training, and continuous education investment.
As the threat landscape evolves rapidly, it can be challenging for in-house teams to keep up-to-date with the latest threats and security technologies.
Moreover, for smaller organizations or those with limited resources, assembling a comprehensive in-house team with diverse skill sets can be cost-prohibitive. In such cases, insourcing might result in a trade-off between the breadth of expertise and the available budget.
The Benefits of Outsourcing Cybersecurity
Cybersecurity offers several compelling benefits, making it an attractive option for many organizations. Access to specialized expertise is one of the primary advantages of outsourcing.
By partnering with a reputable cybersecurity service provider, businesses can tap into a pool of highly skilled professionals with extensive knowledge of the latest threats and security practices.
Outsourcing cybersecurity can provide around-the-clock monitoring and support, ensuring that security incidents are promptly detected and addressed, even outside regular business hours.
This constant vigilance can significantly enhance an organization’s ability to respond to threats in real-time.
The Considerations and Drawbacks of Outsourcing
While outsourcing can be beneficial, it’s not without its considerations and potential drawbacks. One critical aspect that requires careful attention is data privacy and security.
Sharing sensitive information with external parties carries inherent risks, and organizations must ensure that the chosen cybersecurity provider adheres to the strictest data protection standards.
Another potential drawback is the lack of complete control over the cybersecurity process. Relying on external providers means entrusting them with critical security responsibilities, and organizations must thoroughly vet potential partners to establish trust and ensure alignment with their security objectives.
“One thing is for sure: The biggest challenges facing the future will be keeping up with the growing sophistication of attackers.”
Evaluating Your Cybersecurity Needs
Before deciding between insourcing and outsourcing, organizations must thoroughly evaluate their cybersecurity needs. This assessment should encompass various factors, including the organization’s size, industry, budget, existing in-house expertise, and the level of security required to protect sensitive data and assets.
Consideration of the company’s growth trajectory and future expansion plans is crucial, as scalability plays a vital role in determining the sustainability of the chosen approach.
Cost Analysis: Cybersecurity Total Cost of Ownership
An accurate cost analysis is essential for making an informed decision. This analysis should consider the initial setup costs and the long-term expenses associated with each approach.
While outsourcing might have more apparent upfront fees, it could prove cost-effective when considering factors like recruitment, training, and retention of in-house cybersecurity professionals.
Organizations should calculate the Total Cost of Ownership (TCO) for insourcing and outsourcing options to understand the financial implications comprehensively.
Risk Assessment: Identifying Vulnerabilities and Threats
Conducting a risk assessment is a fundamental step in cybersecurity planning. This assessment involves identifying potential vulnerabilities and threats the organization might face and understanding how each approach addresses these risks differently.
Both insourcing and outsourcing have risk profiles, and organizations must weigh these risks against their capabilities and risk tolerance to make an appropriate decision.
Hybrid Approach: The Middle Ground
In some instances, a hybrid approach combining elements of both insourcing and outsourcing might be the best fit for an organization. A hybrid model allows companies to leverage their in-house expertise while complementing it with external resources for specific security functions.
For example, an organization might choose to maintain an in-house cybersecurity team for routine tasks and day-to-day monitoring while outsourcing incident response and penetration testing to external experts.
Real-World Examples and Case Studies
A recent client specializing in software development had been managing its cybersecurity internally for several years. However, as the company expanded its operations and the cybersecurity landscape evolved, it faced challenges maintaining a robust and up-to-date security posture.
Seeking a more efficient and comprehensive solution, the client decided to outsource its cybersecurity to Ostra Cybersecurity, a reputable external cybersecurity service provider.
The Challenge
As our client’s business grew, so did their digital footprint, making them a more appealing target for cyber threats. The company’s internal IT team needed help to keep up with the increasing complexity of cyber threats and the demands of managing security across its expanding network.
Regular updates to security software, threat monitoring, and incident response were becoming overwhelming tasks, diverting attention from the core business functions.
They also had concerns about the potential for data breaches and their impact on their reputation and customer trust. They needed a cybersecurity partner with expertise and resources to safeguard their sensitive data and intellectual property effectively.
Choosing Ostra Cybersecurity
After thorough research and evaluation of potential cybersecurity partners, our client decided to partner with Ostra Cybersecurity. Ostra’s reputation for providing comprehensive and proactive cybersecurity solutions and its focus on SMBs aligned perfectly with the client’s needs.
The decision to outsource their cybersecurity was based on several key advantages offered by Ostra:
Expertise and Specialization: Ostra Cybersecurity boasts a team of highly skilled cybersecurity professionals who specialize in various aspects of security, including threat detection, incident response, and compliance. This expertise allowed the client to leverage cutting-edge security practices without needing continuous internal training and skill development.
24/7 Monitoring and Support: Ostra’s round-the-clock monitoring and support services provide the client peace of mind. The continuous monitoring allowed for real-time threat detection and immediate response to potential security incidents, reducing the risk of extended breaches and minimizing potential damage.
Advanced Threat Detection Technology: Ostra Cybersecurity utilized advanced threat detection technology, including AI-powered tools and machine learning algorithms. This technology enabled early identification of emerging threats and potential vulnerabilities, ensuring proactive mitigation before they could pose a significant risk.
Enhanced Data Protection: Data security was a top concern for the client, and Ostra Cybersecurity addressed this by implementing robust data protection measures. Encryption, access controls, and secure data storage practices were employed to safeguard sensitive information from unauthorized access or data breaches.
Regular Security Updates and Patch Management: Ostra Cybersecurity assumed responsibility for managing security updates and patches across the client’s systems. This helped to keep their infrastructure updated with the latest security patches, reducing the risk of exploitation through known vulnerabilities.
Scalability and Flexibility: As the client grew, they needed a cybersecurity solution that could scale with their evolving needs. Ostra’s flexible service offerings allowed for seamless adjustments to accommodate changes in their network size and security requirements.
The Results and Benefits
By outsourcing their cybersecurity to Ostra Cybersecurity, our client experienced several significant benefits:
Enhanced Security Posture: With Ostra’s expertise and proactive approach to security, they saw a marked improvement in their overall security posture. The timely identification and mitigation of potential threats reduced the likelihood of successful cyber attacks.
Cost Efficiency: The cost of outsourcing their cybersecurity proved to be more cost-effective than maintaining an in-house cybersecurity team. The client optimized their cybersecurity budget by eliminating the need for continuous training and expensive security tools.
Increased Focus on Core Business: With Ostra managing its cybersecurity, our client’s internal IT team could redirect their efforts towards improving software development and other critical business functions.
Compliance Adherence: Ostra’s expertise in compliance requirements ensured that the client remained compliant with industry regulations and data protection laws, mitigating the risk of legal and financial consequences.
By partnering with Ostra Cybersecurity, the client successfully transitioned from internal cybersecurity management to an outsourced, proactive approach.
Ostra’s expertise, advanced technology, and 24/7 monitoring bolstered XYZ Technologies’ security posture, allowing them to focus on their core business operations without compromising data protection.
The decision to outsource their cybersecurity proved to be a strategic move that fortified our client’s resilience against cyber threats in an ever-evolving digital landscape.
What’s Best For You?
Choosing between insourcing and outsourcing for your cybersecurity practice is a mission-critical decision that requires a comprehensive evaluation of your organization’s unique needs, risk tolerance, and available resources.
Each approach has advantages and drawbacks, and there is no one-size-fits-all solution. By carefully considering the factors outlined in this blog, your organization can make a well-informed decision that enhances your cybersecurity posture and protects your valuable assets in an ever-evolving digital landscape.
Discover the benefits of outsourcing cybersecurity in business operations. Make an informed decision for your practice. Protect assets effectively.
Q: What is the difference between insourcing and outsourcing cybersecurity?
A: Insourcing involves handling cybersecurity internally, with an in-house team responsible for security. Outsourcing, on the other hand, entails partnering with external cybersecurity service providers to handle security tasks.
Q: What benefits does outsourcing cybersecurity provide?
A: Outsourcing provides access to specialized expertise, around-the-clock monitoring and support, and the ability to tap into a pool of skilled professionals. This can enhance an organization’s ability to respond to threats promptly.
Q: What considerations should organizations make when evaluating insourcing vs outsourcing cybersecurity?
A: Organizations should evaluate factors like their size, industry, budget, existing expertise, and security needs. They should also assess their growth trajectory and scalability requirements.
Q: What is a hybrid approach to cybersecurity, and when might it be beneficial?
A: A hybrid approach combines both in-house and outsourced cybersecurity elements. It can be beneficial when an organization wants to leverage its in-house expertise while supplementing it with external resources for specific security functions.
Q: What should organizations consider when deciding between insourcing and outsourcing cybersecurity?
A: Organizations should weigh factors like control, customization, expertise, cost, data privacy, and risk tolerance. An accurate Total Cost of Ownership (TCO) analysis is essential, as well as a thorough risk assessment.
As Your Trusted Cybersecurity Team, Ostra makes cybersecurity simple and accessible to businesses of all sizes. Ostra provides its partners and their clients with a multi-layered, comprehensive and fully managed Security as a Service.
https://www.ostra.net/wp-content/uploads/2023/08/outsourcing-cybersecurity.png10001500Ostra Cybersecurityhttps://www.ostra.net/wp-content/uploads/2023/08/Ostra-logo-2023.pngOstra Cybersecurity2023-08-15 08:00:542023-09-07 11:06:19Insourcing vs. Outsourcing Cybersecurity:How to Find the Best Approach for Your Practice
IT service providers face many challenges when trying to serve their clients—especially smaller businesses. Generally speaking, it takes a special breed of human to thrive in the often-overwhelming field of cybersecurity. There are many reasons why these challenges can be even more felt among managed service providers (MSPs).
Overworked and Short-Staffed
In the IT world, cybersecurity is a niche that can be incredibly overwhelming and stressful. Consider the following statistics:
83% of IT security professionals felt more overworked going into 2020 than they were at the beginning of 2019, according to a Tripwire survey.
On average, one study found that a security operations staff member handled 3.5 major functions as part of their job in 2019; Some staff handled as many as twelve functions.
45% of the 400 international operations professionals surveyed in 2020 saw a sharp increase in cyber threats and security incidents compared to previous years.
Second, it is very difficult to find qualified cybersecurity specialists to cover the vastly-growing need to protect clients against ransomware, various types of malware and other threats. Being short-staffed has become a way of life, as it can take several months to fill positions such as a Security Analyst. For example:
More than two-thirds of security professionals surveyed in 2019 said a cybersecurity skills shortage was impacting their ability to stay on top of vulnerabilities.
As of January 2021, there were 4.07 millionunfilled cybersecurity positions globally, up from 2.93 million in 2020. This includes 561,000 in North America alone.
Cyber Fatigue is Real
Staff burnout is another problem that IT firms and small cybersecurity teams grapple with. Cybersecurity is a high-stakes venture that involves constant vigilance to protect sensitive data and keep mission-critical business functions operational.
Little time to decompress between security alerts and up to 80% false positives
Working long hours, including weekends
Pressure to keep up with constantly changing landscape—from new threats, tactics and technologies, to new laws, regulations, guidelines, frameworks and standards
These challenges are why many service providers choose to partner with a Managed Security Services Provider (MSSP). Rather than having to seek out, hire, manage and compensate a full-time team of IT experts with the right cybersecurity credentials, they can work with a trusted resource that can handle it all—freeing them up to focus on bigger IT strategy initiatives for their clients.
For example, Ostra Cybersecurity’s team includes experts in the field of relationship management, IT integrations and decades of combined cybersecurity expertise. Our proactive, behind-the-scenes approach provides 24/7 monitoring, automated threat detection and response before the threats get in. This not only saves businesses time and high payroll expenses, but also saves them tens (or hundreds) of thousands in dollars versus dealing with data breaches after they occur.
The Challenges of Tech Silos
Today’s IT service providers are responsible for delivering a number of critical services to clients—including network, application, infrastructure and security services. We know technology silos can be a significant barrier for service providers in terms of their productivity. As technology is advancing, processes are becoming more detailed and companies are formalizing their approach to areas like risk management and threat intelligence.
It can become difficult, especially within fast-growing organizations, for MSPs to maintain their expert-level knowledge while staying agile and able to quickly navigate in and out of these various specialty areas. That’s why it is helpful to partner with a cybersecurity specialist who knows how to prevent ransomware, understands the types of malware attacking their systems, and ultimately gives them the best cloud data protection.
Small Businesses are a big target
In January 2021, HelpNet Security reported on a Cynet survey of 200 small and medium businesses with cybersecurity budgets of $1 million or less. They found that 63% of CISOs “feel their risk of attack is higher compared to enterprises, despite the fact that enterprises have a larger target on their back.” Small businesses depend on their MSP to protect them, which is why having adequate protection for your clients is critical for them, and your status as their trusted IT advisor.
With the increased targeting of smaller businesses by cybercriminals, MSSPs are increasingly needed to step in to protect these at-risk companies. This article discusses why it’s important to simplify cybersecurity for MSPs and channel partners who serve small businesses:
“All businesses—including IT service providers—are faced with the reality of limited resources while they face an exponentially-growing need for security and cloud data protection. Orchestrating a robust defense against ransomware and various types of malware impacts costs, personnel, and other resources within the organization.” – Paul Dobbins, Chief Growth Officer, Ostra Cybersecurity
As Your Trusted Cybersecurity Team, Ostra makes cybersecurity simple and accessible to businesses of all sizes. Ostra provides its partners and their clients with a multi-layered, comprehensive and fully managed Security as a Service.
https://www.ostra.net/wp-content/uploads/2021/05/luis-villasmil-mlVbMbxfWI4-unsplash-cropped-849x566-1.png566849Ostra Cybersecurityhttps://www.ostra.net/wp-content/uploads/2023/08/Ostra-logo-2023.pngOstra Cybersecurity2023-08-01 08:00:242024-01-18 13:33:43Overcoming Cybersecurity Fatigue: Help for IT Service Providers
As someone who has worked in the technology space for over a decade, I often hear from Managed Service Providers (MSPs) who are frustrated by the amount of research, problem-solving time, and day-to-day management that is required to provide comprehensive cybersecurity to their clients. Adequately protecting clients from the growing landscape of cybersecurity threats gets more challenging every day.
For service providers, most of their pain points center around three areas:
Tools: Working with multiple platforms and disjointed software products is complex. It’s frustrating and time-consuming for MSPs when cybersecurity tools do not integrate well or talk to each other.
Technology: Cybersecurity technology is constantly changing. It’s time-consuming and challenging for many MSPs to stay on top of all the latest product developments, new tech, and best practices that will help them stay ahead of threats and protect their clients.
Talent: Today’s MSPs have a lot on their plates, and their teams are overwhelmed. Many providers don’t have in-house cybersecurity experts or 24/7 resources to provide robust prevention, management and remediation of threats.
Finding the right support
The good news is that MSPs don’t have to battle these frustrations on their own. Finding a cybersecurity partner can relieve your team’s cybersecurity fatigue while making sure your clients are protected.
The right partner can take on the burden of researching and selecting the right cybersecurity software tools for your business, as well as managing the solution after it is installed. Make sure you choose a cybersecurity solution that utilizes enterprise-grade, constantly updated tools and software.
It is also helpful to work with a partner that has strong and influential relationships with software and technology providers—especially when quick product support or remediation is needed.
For example, Ostra’s proprietary infrastructure and architecture offers a comprehensive 24/7, 360-degree cybersecurity package that leverages the most secure and proven platforms available today. We configure the very best and latest technologies into one easy-to-install platform, which enables our partners to protect their clients with a simplified solution.
If you are the one responsible for addressing the cybersecurity needs of your organization, it is common to become exhausted by research. It takes time and patience to stay on top of the latest software products, tools, and services on the market.
The field of cybersecurity is broad, deep, and ever-changing. Covering all of your clients’ cybersecurity gaps can be a challenge for MSPs—especially with so many technology silos and specialty areas to navigate.
For example, it’s important to think about 24/7 SOC & SIEM coverage, email threat protection, endpoint security, the right firewalls, VPNs and more for your clients. You’ll also want to make sure your solution is backed by human expertise to make the best decisions and act on threat intelligence.
That’s why a layered, proactive approach is essential to protecting small businesses and medium-sized companies from cyber threats. This will help you eliminate threats that others do not—which gives your SMB a competitive advantage.
Partner up for best results
As an MSP, it’s vital to have a cybersecurity expert in your corner, whose advice and quick response you can count on to support your business.
Industry trends show that MSPs are relying more and more on MSPs to separate cybersecurity responsibilities from the rest of the things IT departments are covering, and to make things easier. For example, this Rasmussen University article lists some common cybersecurity problems that most organizations face—including treating cybersecurity like just another IT issue. And this Tech Republic article, “The Rise of the CISO,” illustrates why cybersecurity is its own animal, and can’t just be expected to be absorbed by IT. It needs dedicated resources that can adequately address security threats.
When it comes to a partnership model, Ostra takes a unique approach. Rather than simply signing up channel partners and their customers, Ostra is intentional about partnering with a variety of IT service and solution providers—creating a network that can cover the full range of client and industry needs. This allows Ostra to provide our clients with trusted referrals for their other IT requirements, which also helps our partners grow.
Ostra is committed to helping our network of consultants, IT and Managed Service Providers enhance value for their small to medium-sized business clients by offering comprehensive data protection solutions. Our technology suite—combined with the service expertise of our channel partners—delivers a comprehensive solution that meets the unique IT challenges facing business owners today. Contact Ostra to explore the benefits of partnering with us.
Mike Barlow is the Senior Director of Channel Success at Ostra Cybersecurity, a multi-layered and fully managed Security as a Service. As a sales leader, Mike Barlow is focused on growing and promoting the long-term success of Ostra’s Channel Partners.
https://www.ostra.net/wp-content/uploads/2022/02/Featured-Image-MSP-relief-for-3Ts-01.jpg17072560Mike Barlowhttps://www.ostra.net/wp-content/uploads/2023/08/Ostra-logo-2023.pngMike Barlow2023-07-18 08:00:062023-10-12 09:34:09Tackling the Top 3 Cybersecurity Hassles for MSPs
The threat of ransomware is a growing concern for businesses of all sizes. Large corporations invest heavily in cybersecurity, but it isn’t just the big companies that must be prepared to protect their sensitive data.
This Is Not a Drill
Despite significant advances in cybersecurity, a recent press release by Thales, a global leader in advanced technologies, states that:
48% of IT professionals reported an increase in ransomware attacks, with 22% of organizations polled experiencing a ransomware attack in the past 12 months
51% of enterprises do not have a formal ransomware plan
Small and medium-sized businesses, along with their employees, must also take steps to protect themselves from ransomware attacks or risk losing valuable data and revenue. Cybercriminals are constantly evolving their techniques to exploit vulnerabilities and hold data hostage, demanding hefty ransoms for its release.
What is Ransomware?
Ransomware is malicious software designed to encrypt files on a victim’s computer or network, rendering them inaccessible until a ransom is paid.
Cybercriminals employ various tactics to infect systems, such as phishing emails or exploiting compromised websites or software vulnerabilities. Understanding the gravity of this threat is essential to better protect yourself and your digital assets.
The Cost of Inaction
A recent article in Forbes Magazine titled “The Sobering Truth About Ransomware for the 80 Percent Who Paid Up” provides insights into the alarming reality faced by those who have fallen victim to ransomware attacks. The article delves deep into the experiences of the 80 percent who have made the difficult decision to pay the ransom, shedding light on the harsh consequences and long-lasting effects of such actions.
The Forbes article highlights the difficult choices organizations and individuals face when confronted with a ransomware attack. It reveals that many victims still suffer significant setbacks despite paying the demanded ransom. The payment, often made as a last resort to regain access to crucial data or systems, does not guarantee a seamless restoration process. In many cases, the restored data may still be compromised or contain lingering vulnerabilities that can be exploited again in the future.
An Ounce of Prevention . . .
In light of the sobering truths presented in the Forbes article, it becomes evident that prevention and proactive measures are paramount in the fight against ransomware. Your organization can significantly reduce its susceptibility to such attacks by implementing the safeguards below. Investing in robust cybersecurity practices, staying informed about the latest threats, and establishing comprehensive incident response plans to mitigate the devastating impact of ransomware attacks are crucial.
To safeguard your business and avoid falling victim to ransomware attacks, it is necessary to adopt proactive measures and stay well-informed. Below, we list 23 effective ways to protect yourself from ransomware and preserve the security of your valuable data:
1. Install and Update Reliable Antivirus Software
One of the best defenses against ransomware is robust antivirus software. Choose a reputable antivirus program that provides real-time protection against malware, including ransomware. And make sure you or your security team regularly updates the software to ensure it can detect and neutralize the latest threats effectively.
2. Keep Your Operating System(s) Up to Date
Operating system updates often include crucial security patches that address vulnerabilities cybercriminals exploit. Set your system to automatically install updates or regularly check for updates manually. By keeping your operating system up to date, you fortify its defenses against ransomware attacks.
3. Enable Automatic Software Updates
In addition to your operating system(s), enabling automatic updates for all your software applications is equally vital. Popular software, such as web browsers, office suites, and media players, frequently release updates to enhance functionality and security. Enable automatic updates to ensure you have the latest versions installed, equipped with robust defenses against ransomware.
4. Exercise Caution When Opening Email Attachments
Phishing emails are a common delivery method for ransomware. Exercise caution when opening email attachments, especially those from unknown or suspicious senders. Verify the sender’s authenticity before opening any attachments, and if in doubt, refrain from opening suspicious emails altogether.
5. Beware of Suspicious Links
Similar to email attachments, ransomware can also be delivered through malicious links. Be cautious when clicking on links, especially those received via email, social media messages, or unknown websites. Hover your cursor over the link to preview the URL before clicking. If it seems suspicious, avoid clicking to mitigate the risk of a ransomware infection.
6. Implement a Robust Firewall
A firewall acts as a barrier between your computer or network and the internet, monitoring and filtering incoming and outgoing network traffic. Configure a robust firewall on your system to establish an additional layer of protection against ransomware and other cyber threats.
7. Secure Your Wi-Fi Network
Securing your Wi-Fi network is crucial to prevent unauthorized access and potential ransomware attacks. Change the default administrator credentials of your router, use strong WPA2 encryption, and regularly update the firmware to ensure the network remains secure.
8. Create Strong, Unique Passwords
Using strong, unique passwords is fundamental to protecting your digital assets. Avoid using easily guessable passwords, and consider using a password manager to generate and store complex passwords securely.
9. Implement Two-Factor Authentication (2FA)
Two-factor authentication adds an extra layer of security by requiring users to provide additional verification, such as a temporary code sent to their mobile device, in addition to their password. Enable 2FA whenever possible to enhance your defenses against ransomware attacks.
10. Regularly Backup Your Data
Regularly backing up your data is crucial in mitigating the impact of a ransomware attack. In the event of an infection, having up-to-date backups allows you to restore your files without paying the ransom. Automate the backup process and ensure backups are stored securely and frequently.
11. Store Backups Offline or in the Cloud
It is essential to keep backups separate from your primary system to prevent ransomware from encrypting them. Consider offline storage options like external hard drives or cloud-based backup services that offer robust security measures.
12. Use Encryption to Protect Sensitive Data
Implementing encryption for sensitive data adds an extra layer of protection, even if it falls into the wrong hands. Utilize encryption tools or software to encrypt files and folders containing valuable or confidential information.
13. Educate Yourself and Your Team
Education is key in the fight against ransomware. Stay informed about the latest threats, attack techniques, and preventive measures. Implement a security awareness training program to consistently educate yourself and your team about the best practices to identify and avoid potential risks.
14. Stay Informed About the Latest Threats
The landscape of ransomware threats is continually evolving. Stay informed by regularly visiting reputable cybersecurity websites like CISA and subscribing to their newsletters. You can adapt your security practices accordingly by staying up to date with the latest threats.
15. Limit User Privileges
Granting administrative privileges to all users increases the risk of ransomware spreading throughout your network. Limit user privileges to ensure only authorized personnel can access critical system functions and sensitive data.
16. Disable Macros in Office Documents
Ransomware can exploit macros in office documents to infect your system. Disable macros by default in programs like Microsoft Word and Excel, and only enable them when necessary and from trusted sources.
17. Use a Virtual Private Network (VPN)
When accessing the internet, especially on public Wi-Fi networks, use a VPN to encrypt your internet traffic and protect your data from potential eavesdroppers. A VPN adds an extra layer of security and anonymity, reducing the risk of ransomware attacks.
18. Implement Intrusion Detection and Prevention Systems (IDPS)
Intrusion Detection and Prevention Systems monitor network traffic, looking for suspicious activity and potential ransomware threats. Implement an IDPS to proactively identify and neutralize threats before they can compromise your systems.
19. Monitor Network Traffic
Regularly monitor your network traffic to identify any anomalies or suspicious activities. Unusual patterns or unexpected connections may indicate a ransomware attack in progress. Implement network monitoring tools to detect and respond promptly to potential threats.
20. Perform Regular Vulnerability Assessments
Regular vulnerability assessments help identify weaknesses in your systems and infrastructure that ransomware attacks could exploit. Engage the services of a reputable cybersecurity firm to conduct comprehensive vulnerability assessments and remediate any identified vulnerabilities promptly.
21. Employ Data Loss Prevention (DLP) Solutions
Data Loss Prevention solutions help detect and prevent the unauthorized transmission of sensitive data, providing additional protection against ransomware attacks. Implement DLP solutions tailored to your organization’s specific needs and industry regulations.
22. Develop an Incident Response Plan
Preparing an incident response plan is essential for effectively responding to a ransomware attack. Define roles, responsibilities, and procedures to follow in the event of an incident. Regularly review and update the plan to account for changes in the threat landscape.
23. Engage Managed Cybersecurity Services
We get it. This list looks overwhelming. While many of these measures can be implemented with minimal technical skill, there is a steep learning curve to proficiency in protecting against the threat of ransomware. As new threats and vectors emerge, the need for skillful cybersecurity professionals increases.
Most SMBs lack the technical resources to implement these measures in-house. To ensure your systems and data are secure, consider engaging the services of a managed cybersecurity service provider (also referred to as “Security as a Service” or “SECaaS.” They employ trained experts with the experience and resources to provide comprehensive protection against ransomware attacks.
Investing in managed cybersecurity services will help ensure your data stays safe and secure. A managed cybersecurity solution can provide advanced monitoring, detection, and response capabilities to strengthen your defenses against ransomware attacks and ensures that new threats are identified quickly and addressed–even as they evolve.
Take Action Now to Protect Your Business!
Don’t wait until it’s too late to safeguard your valuable data from the growing threat of ransomware. Implement the 23 effective ways listed in this article to fortify your defenses and avoid becoming a victim.
Ostra Cybersecurity is here to help. Our managed cybersecurity services provide comprehensive protection against ransomware attacks. Our expert team will monitor, detect, and respond to threats, ensuring your data stays safe and secure.
Take the proactive step towards a secure future. Contact us today to learn more about how Ostra Cybersecurity can empower your business and keep you protected from ransomware. Don’t let cybercriminals hold your data hostage – act now!
FAQs (Frequently Asked Questions)
Q: What is ransomware?
A: Ransomware is a form of malicious software that encrypts files on a victim’s computer or network, demanding a ransom for their release.
Q: How can I protect myself from ransomware?
A: You can protect yourself from ransomware by installing reliable antivirus software, keeping your operating system and software up to date, exercising caution with email attachments and suspicious links, implementing a robust firewall, securing your Wi-Fi network, creating strong passwords, and regularly backing up your data.
Q: Are automatic software updates important?
A: Yes, automatic software updates are crucial as they often include security patches that address vulnerabilities exploited by ransomware and other malware.
Q: What is two-factor authentication (2FA)?
A: Two-factor authentication is a security measure that requires users to provide two verification forms, such as a password and a temporary code sent to their mobile device, to access an account or system.
Q: Should I pay the ransom if I get infected by ransomware?
A: Paying the ransom is not recommended, as it encourages and funds cybercriminal activities. Instead, focus on restoring your files from backups and implementing preventive measures to avoid future attacks.
Q: Can professional cybersecurity services help prevent ransomware attacks?
A: Professional cybersecurity services offer expertise, advanced tools, and proactive monitoring to effectively detect and mitigate ransomware threats.
Conclusion
As ransomware attacks continue to pose a significant threat to individuals and organizations, taking proactive measures to protect your digital world is imperative. By implementing the 24 ways to avoid becoming a victim of ransomware discussed in this article, you can significantly enhance your security posture and minimize the risk of falling prey to these malicious attacks. Stay informed, stay vigilant, and safeguard your valuable data against the ever-evolving threat of ransomware.
Contact usto learn more about what it means to be powered by Ostra Cybersecurity.
As Your Trusted Cybersecurity Team, Ostra makes cybersecurity simple and accessible to businesses of all sizes. Ostra provides its partners and their clients with a multi-layered, comprehensive and fully managed Security as a Service.
https://www.ostra.net/wp-content/uploads/2023/07/ransomware.jpg10001500Ostra Cybersecurityhttps://www.ostra.net/wp-content/uploads/2023/08/Ostra-logo-2023.pngOstra Cybersecurity2023-07-04 08:00:572023-07-17 14:41:5623 Ways to Avoid Becoming a Victim of Ransomware
False positives in security alerts are a common problem that can plague security professionals, consuming valuable time and resources while decreasing the effectiveness of security measures.
A recent survey by Security Magazine found that 20% of security alerts are false positives, which can be a significant issue for organizations with limited resources.
What is a SIEM?
A Security Information and Event Management (SIEM) is a security management system that collects, stores, analyses, detects and responds to security events from multiple sources across an IT environment.
SIEMs are the eyes and ears of security teams, collecting a wide range of security data and alerting teams when suspicious activities occur.
However, this means SIEMs can often trigger false positives due to the wide range of data and sources it processes. This is where thorough investigation comes in, as investigations can help determine whether an alert is valid or a false positive.
In a Security Operations Center (SOC) environment, false positives are particularly prevalent due to the high volume of alerts that analysts must process. This leads to the critical question of how best to handle false positives without overlooking possible vulnerabilities or being bogged down by excess false positives.
How are False Positive Security Alerts Handled in a SOC?
One approach to handling false positives is to conduct a thorough investigation each time an alert is triggered. This approach ensures that no potential vulnerability or compromise is dismissed. Investigations can be conducted in several ways, such as checking the IP address, running hashes, and scanning files through approved file checkers.
Checking the IP address can help determine if the source of the alert is legitimate or if it is a false positive. Running hashes is another approach that can help determine if a file has been modified or tampered with. Scanning files through approved file checkers can also help identify any malicious files that may have triggered the alert.
Thorough investigations can be time-consuming and require additional resources, including a second analyst’s review to ensure that no oversights or gaps in the investigation occur.
Assume the Worst Case.
Ignoring alerts, assuming they are all false positives, can decrease the effectiveness of security measures. This can open vulnerabilities and make it easier for attackers to access sensitive information.
Therefore, it is vital to be vigilant and thoroughly investigate each alert, even if it is a false positive, to ensure that possible vulnerabilities or compromises are not overlooked.
Another issue with false positives is that they can result in a waste of resources of time and money. Analysts must spend time investigating alerts that ultimately turn out to be false, taking away from the time they could have spent investigating genuine security threats. This can be a significant issue in environments with many false positives.
Can the SIEM be configured to generate fewer false positive alerts without missing genuine threats?
In many cases the SIEM can be configured to reduce false positives without compromising security. This includes tuning the rules and adjusting thresholds to reduce the number of false positives generated. Changing the parameters around traffic and data sources can also help reduce false positives.
Here at Ostra, to address false positives, we follow a systematic approach that includes daily checks to ensure alert consistency. We use multiple checkers to confirm that data stays unchanged and to identify new information. This helps us stay updated and respond effectively.
We also implement policies to reduce unwanted noise, allowing us to focus on genuine threats. Learning from past experiences, we prevent previously validated alerts from reoccurring. This ongoing process of review and adjustment helps our team effectively manage false positives.
One real-world example we’ve experienced at Ostra involves frequent alerts from a popular RDM application used by our clients. Rather than investigating each alert individually (which is very time-consuming and inefficient) our team implemented a policy in our SIEM and XDR systems to suppress these regular alerts. To ensure ongoing efficacy, we then verify monthly with the client that they’re still using the application and cross-check the alert parameters. This approach has saved time and allows for prioritizing more urgent alerts.
To reduce the number of false positives and improve overall security in the SOC environment, it is crucial to remain vigilant, conduct thorough investigations, and utilize multiple investigative techniques. It is also essential to balance the need to investigate thoroughly with the need to avoid being bogged down by an excess of false positives.
The Bottom Line.
False positives in security alerts are a significant issue for security professionals that can consume valuable time and resources while decreasing the effectiveness of security measures. Partnering with a trusted cybersecurity partner like Ostra can provide much-needed relief and cutting-edge expertise to your stretched IT operations teams.
Contact usto learn more about what it means to be powered by Ostra Cybersecurity.
Eunice Asemnor is a Security Analyst at Ostra Cybersecurity, a multi-layered and fully managed Security as a Service. With expertise in SIEM technologies, cybersecurity solutions, and advanced threat defense, Eunice plays a key role in protecting Ostra’s clients as a member of Your Trusted Cybersecurity Team.
https://www.ostra.net/wp-content/uploads/2023/05/false-positives-in-security-alerts.jpg10001500Eunice Asemnorhttps://www.ostra.net/wp-content/uploads/2023/08/Ostra-logo-2023.pngEunice Asemnor2023-05-16 08:00:532023-09-09 06:38:22Don’t Ignore the SIEM Who Cries ‘Alert’: The Importance of Thoroughly Investigating False Positives in Security Alerts
Five years ago, the decision to start Ostra Cybersecurity was not an easy one. Leaving a successful, well-paying IT job with Fortune-5 company perks so that I could help small businesses become more secure was definitely a mission-motivated move, but that was not my only reason for wanting to make a change. I was looking for more balance in my life and needed to increase my time spent with family and friends as well, so I took the plunge.
In 2018, that first year building out Ostra’s brand and taking our first crack at a security solution was fun and exciting, not to mention a vastly refreshing change of pace from hopping on an airplane every week to shake hands with higher-ups across the globe as the corporate grind pushed my body, mind, and soul to its limits.
Those early days working with various industry professionals to develop Ostra’s sales materials—while at the same time tackling the design engineering of our technology stack—made for long days and nights that blended together. Our first set of customers were patient with us and provided the invaluable feedback we needed in order to solidify our messaging and our solution so we could continue to grow.
Key Milestones
Since Ostra’s inception, there have been some key milestones that created inflection points for the business and our constant growth along the way. The first was my chance introduction to Joe Johnson, a transformational business leader who would later become the president at Ostra.
That following year, Joe and I were able to double the business and grow Ostra enough so we could move our operations out of my basement and public library conference rooms to our very first office space. Hiring the first four employees soon followed.
That momentum would continue with the addition of Paul Dobbins as Chief Growth Officer. This kicked off a fast-paced season that included building our channel partner program and adding 20 more employees, taking us to our current (and much larger) office space in Minnetonka, Minn.
Most recently, having my long-time friend Emad Bhatt join Ostra as VP of IT not only put one of the smartest engineering architects on our leadership team but secures our position as a technology leader in the security-as-a-service space.
As we mark our five-year anniversary in 2023, I am just blown away by how much Ostra has achieved. Being surrounded by my new Ostra family, building and growing a business with a mission to protect small businesses, and creating a positive culture that values people over money are just some of the things that have made this story so amazing.
For those who need a reminder of why Ostra exists—including the specific incident that led to our mission to fiercely defend and protect small businesses—check out this blog: The Ransomware Attack that Sparked Ostra Cybersecurity.
Remembering to pause and look at all the things creating gratitude in my life is sometimes hard to do in our fast-paced industry. But as I look around at all the employees, people, clients, and partners that have impacted this journey, I am forever grateful for every single person, challenge, and opportunity we have come across.
You have helped bring Ostra to where we are today. Thank you. (Off to grab another box of tissues.)
Michael Kennedy is the founder of Ostra Cybersecurity, a multi-layered and fully managed Security as a Service. Recognized as a cybersecurity industry trailblazer, he is a dynamic leader, speaker, and fierce advocate for data privacy.
https://www.ostra.net/wp-content/uploads/2023/04/Ostra-5-Year-Anniversary-1.jpg10001500Michael Kennedyhttps://www.ostra.net/wp-content/uploads/2023/08/Ostra-logo-2023.pngMichael Kennedy2023-04-25 08:00:012023-09-08 15:39:21The Ostra Journey: Reflecting on 5 Amazing Years
Emad Bhatt to lead Technology Services team as Vice President of IT.
Ostra Cybersecurity, a leading provider of world-class cybersecurity solutions for small and medium-sized businesses, recently welcomed Emad Bhatt as Vice President Information Technology. This latest hire speaks to Ostra’s significant expansion as a company, as well as the development of its Technology Services team—allowing us to provide more robust protections to an increasing number of clients.
Previously, Ostra Founder Michael Kennedy led many of the security operations responsibilities for the company. Having a new, dedicated leader who is laser-focused on technology and security operations will allow Kennedy to devote more time to his executive responsibilities and other initiatives as a visionary leader in the cybersecurity industry. By adding Emad to the Senior Leadership Team, Ostra further demonstrates its resolve to help consultants, IT and Managed Service Providers (MSPs) protect their clients through best-in-class, multi-layered, fully managed cybersecurity solutions.
In this key leadership role, Emad provides hands-on guidance to drive an effective, engaged and motivated team for Ostra’s growing Technology Services. He is responsible for IT Strategy, Roadmap, Product Development, setting, implementing, and providing nonstop evaluation of consistent standards for IT Architecture, Engineering, Security Operations Center and support systems that protect Ostra’s clients.
With a focus on being the Trusted Cybersecurity Team for its clients and partners, Ostra’s market niche is ensuring that top-notch data security solutions are accessible for small and medium-sized businesses. Ostra’s technology suite—combined with the service expertise of its channel partners—delivers a comprehensive solution that addresses a unique set of specialized IT challenges for businesses.
Emad’s expertise in strategic leadership and business/technology transformation, combined with his impressive background in Information Security Solution Architecture, are just a few strengths that make him a valuable leader and subject matter expert at Ostra
Previously, Emad led the Global M&A Architecture Team at UnitedHealth Group (Optum), where he worked with complex M&A integrations for almost a decade. During this time Emad enjoyed becoming a close colleague of Ostra’s founder, Michael Kennedy. The experience not only provided many opportunities for collaboration, but also laid the foundation for what later prompted Kennedy to launch Ostra as a Fortune 100-caliber cybersecurity service that’s accessible to SMBs.
“In addition to working together at Optum, Emad and I have been good friends for several years and there is no one whose technical expertise I respect more,” Michael said. “Bringing his expertise and leadership skills to the team takes Ostra to a whole new level in our ability to fight the war on cyber terror.”
Emad earned a Bachelor’s degree in Engineering (Computer Science) from Visvesvaraya Technological University (VTU) in India. He also maintains his accreditation in Cisco Certified Internetwork Expert Security (CCIE Security) and completed his Program for Accelerated Capability Enhancement (PACE) from Indian Institute of Management, Bangalore.
In his new role at Ostra, Emad is excited to empower the team to drive business transformation and strategic growth. “I have a passion for building cutting-edge technology—particularly in the areas of cybersecurity, digital innovation, and new product development,” Emad said. “Here at Ostra, I am thrilled to be in the position to help others maximize the value of their investment in cybersecurity.”
Stacey Kusnier is the Marketing Director at Ostra Cybersecurity, a multi-layered and fully managed Security as a Service. With a passion for fostering mission-driven culture and B2B marketing, Stacey drives campaign strategies to support Ostra’s sales team and Channel Partners.
https://www.ostra.net/wp-content/uploads/2023/03/E-Bhatt_Ostra-background_3-8-23_922x615-1.png615922Stacey Kusnierhttps://www.ostra.net/wp-content/uploads/2023/08/Ostra-logo-2023.pngStacey Kusnier2023-03-14 12:44:522023-03-14 12:44:52Ostra Cybersecurity Expands Senior Leadership Team
As we officially begin the new year, we’re humbled to share some our top accomplishments of 2022. As Your Trusted Cybersecurity Team, Ostra is grateful to all of our Channel Partners, clients, shareholders and industry colleagues who helped us achieve great things last year. Here’s to an even more spectacular 2023!
Blocking Threats in 2022
In response to a huge increase in cyber threats throughout the year, the Ostra Cybersecurity Defense Team was busier than ever in 2022.
Security Stats
Ostra processed over 80 billion cybersecurity events in 2022
Of the 80 billion processed events, approximately 225 million were designated as active threats
The average downtime for a ransomware attack is 24 days.3
Cyber Jargon won’t Protect Clients
Ostra believes in listening to our clients, partners and peers in the industry, which is why we continue to engage our current clients and partners with Voice of Customer (VoC) surveys. Here’s what we learned in 2022…
SMB leaders shared they need solutions that reduces drain on internal operations and IT. Many prefer cybersecurity offerings that can be managed by their MSP as part of their service.
SMBs want their IT or MSP partner to care about their business and employees.
Survey respondents indicated they value a cybersecurity team that can provide hands-on, 24/7 support.
We were able to test and validate that the market trusts us to provide a comprehensive cybersecurity solution with real people and expertise behind it—NOT cyber jargon or IT people to talk over their heads.
Ostra is proud and humbled to be Your Trusted Cybersecurity Team—providing clients with the right tools managed by good people. And we could not protect our clients the way we do without our growing Channel Partner Network, which grew by more than 300% last year. These partnerships also enable Ostra to help our clients who are seeking referrals for MSP services, IT consulting, cyber insurance and/or security advisory services such as assessments, compliance and vCISO services.
Top Resources from 2022
Ostra’s mission remains focused on educating our community with cybersecurity news, trends and best practices. Here’s a roundup of some of our favorite blogs from 2022:
Why Businesses Keep Losing the War on Cyber Terror: A 3-Part Series
We will continue to deliver more educational content in 2023, directly from our cybersecurity experts. Stay tuned for more on our blog and on LinkedIn.
Ready to explore how our Trusted Cybersecurity Team can support your business in 2023 and beyond? Contact Ostra today.
Stacey Kusnier is the Marketing Director at Ostra Cybersecurity, a multi-layered and fully managed Security as a Service. With a passion for fostering mission-driven culture and B2B marketing, Stacey drives campaign strategies to support Ostra’s sales team and Channel Partners.
https://www.ostra.net/wp-content/uploads/2023/01/Ostra-Blog_2022-Year-in-Review_Featured-Image.png35565333Stacey Kusnierhttps://www.ostra.net/wp-content/uploads/2023/08/Ostra-logo-2023.pngStacey Kusnier2023-01-05 10:50:272023-01-26 06:52:28Ostra’s Year in Review
Next up in Ostra’s Employee Spotlight series is Anthony Stephens, Advanced Security Analyst. We recently sat down with him to discuss his role at Ostra, what makes him tick, his experience and his life outside of work.
Career & Life at Ostra
Describe what you do at Ostra in one sentence.
I oversee the Security Operations Center here at Ostra by providing insight and analysis of all logs to protect our customers.
What initially interested you about Ostra Cybersecurity in the first place? What about our mission do you connect with?
The mindset and passion of the team is what initially interested me about Ostra. Right from the start I could tell they cared about protecting their customers and providing the best security solutions.
What do you believe is the best thing about Ostra or the Ostra team?
The best thing about Ostra is the team’s passion, everyone truly takes security to heart and are passionate about protecting our customers.
What’s the first thing that you do when you start working every day?
I start each day by reading news articles and catching up on security research blogs and twitter feeds.
What do you find most challenging about your role at Ostra?
Knowing we must strive to succeed 100% of the time against adversaries, but threats only have to succeed one time.
What advice would you offer someone looking to take on a role similar to yours?
To keep asking questions, reading and learning. Take steps back and look at each situation through the eyes of your adversaries and find choke points within the environments.
OK, now for some fun questions
Where’s your favorite place in the world?
Sitting on a server room floor within the hot aisle
If Ostra announced a last-minute day off for tomorrow, what would you do with your suddenly free day?
I would spend the day with my family.
Three words to best describe you.
Husband, Father, and geek.
What’s your motto or personal mantra?
I will get it done when everyone else is asleep
Want to be a part of Ostra’s culture and team? Learn more about working at Ostra and apply for open positions!
As Your Trusted Cybersecurity Team, Ostra makes cybersecurity simple and accessible to businesses of all sizes. Ostra provides its partners and their clients with a multi-layered, comprehensive and fully managed Security as a Service.
When it comes to phishing, attackers are becoming highly creative in the way they deliver the phish. They are doing a lot more reconnaissance work and it is our duty to ensure we are being more alert to avoid this form of social engineering.
SIGNS OF DANGER
Recently, Ostra came across a case of “phishing by association” that is a great reminder of why it is important for businesses to foster open and transparent relationships with vendors and partners.
One Friday evening, a client contacted us to say that she strongly believed her workstation had been compromised. After hearing her concerns, the Ostra Cybersecurity Defense Team started vigorously working on the situation.
We began with a few questions to get more information as to why she believed her environment had been compromised. She mentioned a vendor she was doing business with had been breached, and the cyber criminals sent phishing emails to their contacts. When she received the phishing email, she unfortunately clicked on it because she thought it was a legitimate email from the vendor.
CONTAINING THE THREAT
The first thing Ostra encouraged the client to do was to reset all her passwords. In situations like this, attackers are gathering credentials to hold for future use. Changing passwords immediately prevents the use of the credentials.
After ensuring the client changed her passwords, we immediately started reviewing her traffic logs to search for any suspicious events.
Fortunately, everything seemed healthy on her workstation and connected devices. However, Ostra continued to monitor the situation over the weekend and through the following week until we were satisfied that no damage had been done and her environment was secure.
Eunice Asemnor, Security Analyst at Ostra, stated that it was especially helpful that the client reached out immediately after clicking the email in this case. “It gave our Cyber Defense Team the ability to promptly remediate and handle the situation.” She added that this scenario illustrates the importance of being cautious with every email you receive—even from trusted vendors.
TAKEAWAYS FROM THE TRAIL
Although many phishing emails come from strangers, “phishing by association” is a tactic where cyber criminals send emails that appear to originate from a vendor that the client has worked with in the past.
Shown above is an example of what this type of phishing email might look like, along with some clues that it warrants further scrutiny.
Even if a company has all the best cybersecurity measures in place, they can still be vulnerable to attacks if their third-party vendors are not protected. This is why Ostra encourages clients to build trust through proactive communication with outside vendors, while also holding them accountable to ensure they are keeping up with the best security practices.
5 Tips for Phishing Prevention
Ostra recommends taking the following steps to minimize your risk of falling victim to a phishing scheme:
When using email, always be careful and take necessary precautions before clicking links or opening attachments.
Watch for the following red flags, which are indications that the email could be a phishing attempt:
Spelling mistakes, typos, unusual phrases or poor grammar.
Calls to action that include deadlines or suggested consequences to create panic.
Beware of bogus links. Like in the case of our client, phishing attempts may include a legitimate-looking link. Simply hover your mouse over the link and it will reveal the actual URL. Most trustworthy banks and financial institutions use “https://” in their URL. You can also search for the company’s official website, and then compare their domain to the URL being represented in the email.
Be diligent in examining “From” addresses, which can be forged to appear legitimate. Attackers can use a minor typo to make it appear like it is coming from your CEO or bank. Be very alert to check if the email is coming from a true source.
Emails requesting personal information should always be handled with care. Do not provide usernames, passwords, or other personal company information without due diligence.
Eunice Asemnor is a Security Analyst at Ostra Cybersecurity, a multi-layered and fully managed Security as a Service. With expertise in SIEM technologies, cybersecurity solutions, and advanced threat defense, Eunice plays a key role in protecting Ostra’s clients as a member of Your Trusted Cybersecurity Team.
https://www.ostra.net/wp-content/uploads/2022/07/FeaturedImage_Blog_07-21-22_PhishedByAssociation.jpg17072560Eunice Asemnorhttps://www.ostra.net/wp-content/uploads/2023/08/Ostra-logo-2023.pngEunice Asemnor2022-07-25 16:16:342024-01-18 13:34:01Field Report: ” Phished by Association”
Today’s leaders of small businesses and medium-sized companies are busy. These multi-taskers are launching new products, building workplace culture, growing their organizations, and figuring out how to attract and retain top talent. Not to mention… keeping up with technology and managing cyber risks in an ever-evolving digital landscape.
Since ransomware perpetrators are increasingly targeting SMBs, cybersecurity should be on every business owner’s radar. But how do you get started? In the video below, Ostra Cybersecurity President Joe Johnson shares tips for finding the right trusted advisor to help build a comprehensive cybersecurity strategy.
A recent Forbes survey revealed that 78% of small business owners planned to make technology a top investment in 2022. Their priorities included things such as digital transformation initiatives, improving internal processes/workflows, and more.
But most leaders—even CIOs—don’t have the time or expertise to stay ahead of every curve and sub-specialty in the area of technology. That’s why it is important to work with a trusted cybersecurity advisor who is interested in protecting your organization, not just driving sales for their organization.
Watch the video above to learn more about how a trusted advisor can help you take steps to ensure you’re taking a proactive approach to cybersecurity with a comprehensive strategy and program. Or, to hear more from Joe Johnson on this topic, check out this free, full-length webinar: Get a Grip on Cybersecurity and Cyber Insurance, Presented by Ostra and Trava.
Contact Ostra to learn why our multilayered, comprehensive cybersecurity solution is essential for businesses of every size.
Joe Johnson the president of Ostra Cybersecurity, a multi-layered and fully managed Security as a Service. Joe is a transformational business leader skilled at taking a company’s vision and turning it into reality.
https://www.ostra.net/wp-content/uploads/2022/06/Featured-image-Joe-J-for-TrustedAdvisor-vlog-blog-copy-1.jpg17072560Joe Johnsonhttps://www.ostra.net/wp-content/uploads/2023/08/Ostra-logo-2023.pngJoe Johnson2022-06-14 08:34:012023-09-10 05:13:00Getting Started With a Trusted Cybersecurity Advisor
Next up in Ostra’s Employee Spotlight series is Claudia Madrigal, Executive Administrator and Project Manager. We recently sat down with her to discuss her role at Ostra, what makes her tick, her experience, and her life outside of work.
Career & Life at Ostra
Describe what you do at Ostra in one sentence.
I coordinate the onboarding of new Ostra partners and clients, implement internal and external processes, and handle various operational tasks. I also take it upon myself to pet all the dogs that visit our office!
What initially interested you about Ostra Cybersecurity in the first place? What about our mission do you connect with?
The fact that Ostra was a start-up initially interested me. As a part of their mission, Ostra puts people first always, both clients and employees. I experienced this firsthand when I had to take several weeks off due to COVID immediately after I started working for Ostra. It’s a very supportive environment.
What excites you most about your position and growth opportunity at Ostra?
I enjoy the variety of work I do, as well as liaising with different departments and clients. Although Michael Kennedy keeps asking me how I want my role to grow in the company, I still don’t know what I want to be when I grow up!
What do you believe is the best thing about Ostra or the Ostra team?
Ostra encourages autonomy, self-development and work-life balance. The company climate, spirit of cooperation and my team members’ senses of humor are what make it so enjoyable to go to work every day.
What’s the first thing that you do when you start working every day?
Coffee first always. The Nespresso machine is the main reason why I come into the office every day. After coffee, I meet with Ostra’s Cybersecurity Operations team to plan the day’s priorities.
What do you find most challenging about your role at Ostra?
Balancing the strategic work with the operational needs of a growing company. Currently, the majority of my time is taken up with onboarding new clients and partners— a fun problem to have!
What advice would you offer to someone looking to take on a role similar to yours?
Always look for what can be done more efficiently and how you can best support your team.
What would you do for a career if you weren’t doing this?
I don’t see myself being pigeon-holed into a narrow role and I’m always interested in learning new things. I would probably continue to work in operations, but maybe in a completely different industry.
OK, now for some fun questions
Where’s your favorite place in the world?
I’m originally from Portugal, so it will always be my home. But my favorite place is anywhere I haven’t visited yet.
If Ostra announced a last-minute day off for tomorrow, what would you do with your suddenly free day?
If the weather was nice, I would be out riding my motorcycle. However, if it’s cold or raining, I would curl up with a book and the New York Times Sunday crossword puzzle.
Name one thing not a lot of people know about you.
I can make balloon animals!
Three words to best describe you.
Independent, get stuff done, and versatile.
What’s your motto or personal mantra?
Learning for the sake of learning.
Want to be a part of Ostra’s culture and team? Learn more about working at Ostra and apply for open positions!
As Your Trusted Cybersecurity Team, Ostra makes cybersecurity simple and accessible to businesses of all sizes. Ostra provides its partners and their clients with a multi-layered, comprehensive and fully managed Security as a Service.
Did you miss “Get a Grip on Cyber Security & Cyber Insurance,” the free webinar presented by Ostra and Trava on April 20? With cybercrime and ransomware increasing exponentially in today’s business climate, small and medium-sized businesses must be more cyber-savvy than ever in their day-to-day operations.
Watch a free, on-demand replay of the webinar to learn how SMBs can better protect themselves and manage risks by sharpening their grasp of cybersecurity and cyber insurance. The webinar was co-hosted by Trava, one of Ostra’s trusted Channel Partners. Trava is a cyber risk management firm that integrates assessments, vCISO insights, and insurance to protect small and midsize businesses from the potential damage of cyber threats.
In this educational 30-minute session, Trava’s CEO/Founder Jim Goldman moderates a discussion with Ostra’s President, Joe Johnson, as well as Ryan Dunn, Director of Insurance at Trava. These cyber industry experts cover topics such as:
What is the relationship between cyber security maturity and cyber insurance for small and medium sized businesses?
How can SMBs sort through the noise of cyber security and cyber insurance in order to prioritize strategies?
What action items should an SMB take to establish their own comprehensive cyber security program?
Are there key questions to ask your tech team and vendors when assessing cyber solutions?
What’s the difference between cybersecurity vs. cyber liability insurance? Do you really need both?
The current situation
Ryan Dunn shared that insurance is always more successful when carriers have enough data on hand to effectively predict probabilities and risk factors. However, since cyber risks are constantly changing, risk profiles from even five years ago are no longer relevant today.
Compounding the problem, many of today’s cyber insurance applications are full of overly-technical or irrelevant questions that have no ability to uncover the real-time, gaping holes in a company’s cybersecurity strategy. For example, if a company says they are using multi-factor authentication as part of their cybersecurity strategy, is anyone fact-checking or validating that? Also, just because a company might have adequate guardrails around their data today—or at the time of their insurance application—doesn’t mean they will still be safe tomorrow, next week, or next month.
In summary, hardly anyone is comfortable in the current cyber insurance landscape. On one hand, business owners are dealing with insurance premium increases with almost no losses. Meanwhile, insurance agents are dealing with increased cybersecurity requirements and stipulations from insurance carriers—they are not cybersecurity experts, and yet they have to relay this news to clients. A massive increase in cyberattacks is fueling the cycle, yet it’s practically impossible to predict a cybersecurity loss using traditional actuarial tables.
The path forward
Tackling cybersecurity and cyber insurance can produce an overwhelming sense of “doom and gloom” if you are looking at it from reactionary standpoint. Being proactive, taking stock, and having a plan is a much better approach.
According to Joe Johnson, it’s essential for SMBs to understand their cybersecurity vulnerabilities before proceeding with a plan of attack. In practical terms, he recommends the following sequence.
Building Your Cybersecurity Strategy
Conduct cybersecurity assessments to identify in vulnerabilities
Find a vCISO or a trusted advisor with a vested interest in protecting your business and your clients
Provide regular, ongoing cybersecurity training for employees
Put cybersecurity policies in place to protect your organization
Deploy cybersecurity tools with multiple layers of high-caliber defense to protect against known and unknown threats
Prepare for an event, which should include cyber insurance as well as an incident response plan, regular penetration testing, and active monitoring
Since most business owners and even IT departments don’t have in-depth cybersecurity expertise, an important first step is to reach out to an expert or trusted advisor who can partner with you in these steps. Download: Cybersecurity Strategy Tips from Ostra and Trava.
Access the Free, On-Demand Replay
To access a free replay of this webinar, click here.
As Your Trusted Cybersecurity Team, Ostra makes cybersecurity simple and accessible to businesses of all sizes. Ostra provides its partners and their clients with a multi-layered, comprehensive and fully managed Security as a Service.
https://www.ostra.net/wp-content/uploads/2022/04/Copy-of-Ostra-Webinar-1080-×-1080-px-5333-×-3556-px.png35565333Ostra Cybersecurityhttps://www.ostra.net/wp-content/uploads/2023/08/Ostra-logo-2023.pngOstra Cybersecurity2022-04-27 11:40:142023-09-08 15:49:22[Webinar Recap] Get a Grip on Cyber Security & Cyber Insurance
Mike Thompson from FRSecure and Ostra Cybersecurity’s own Michael Kennedy recently teamed up to present a free, 30-minute webinar: “A Titanic Mistake: Incident Response Without Active Monitoring.”
If you missed the live webinar, keep reading to get the overview or watch the full webinar recording here.
Webinar Highlights: Lessons from the Titanic
Co-hosted by Ostra and FRSecure, this online event offered participants the chance to learn from two of the region’s most well-respected leaders in cybersecurity, delivered in an accessible and engaging format.
Potential cyberattacks are often like icebergs: they’re floating all around you, and you can’t be sure exactly what lies beneath the surface. So how do you give your organization the precious resources it needs to outmaneuver an iceberg-sized cyber event and avoid a dangerous hit?
In their informative 30-minute session, Thompson and Kennedy covered:
How to assess what’s underneath the surface in the “ice field” of threats to uncover the full impact of an event
Real-world examples of cyber event “icebergs” and what we can learn from them
Best practices for steering around the “Bergy Bits” with layered security and vigilant SOC monitoring
Actions companies can do to minimize the danger of a “sinking ship” when incidents occur
It’s not just about icebergs—facing the reality of internal threats, both intentional and accidental
Although no cybersecurity method is completely infallible, there are a number of measures that can aid in minimizing the likelihood of an attack and shortening the time it takes to detect one. For example, a key point that the co-presenters discussed in the webinar focused on the need to simply raise awareness about how outside organizations are interacting with your data, and the level of risk that might be involved.
“Organizations of all sizes are bigger than they seem,” Kennedy pointed out as he and Thompson shared more about how threats can lurk beneath the surface. As it turns out, most companies—even the smallest ones—are giving some sort of access to outsiders such as web developers, marketing firms, facility management vendors, printer support vendors, and more. Kennedy urged participants to consider a very important question: “Who has third-party access to your data?”
Thomspon agreed, pointing to Target and Okta as just some of the more publicized examples where domain addresses and credentials were compromised by third parties. But he cautioned, “For every one company that you hear about, there are probably 1000 that you don’t.”
In case you missed this latest educational collaboration between FRSecure and Ostra, be sure to check out the on-demand video recording here.
About the Presenters
As the Incident Case Manager/Team Lead at FRSecure, Mike Thompson is an information security veteran who has had a front-row seat to the damage done when companies neglect to actively monitor cyber threats.
Likewise, Ostra Cybersecurity Founder Michael Kennedy is recognized as a cybersecurity industry trailblazer. Prior to starting Ostra, he spent more than 20 years building, leading and scaling security platforms for Fortune 5 companies including the world’s largest healthcare provider.
Both Thompson and Kennedy share a passion for utilizing a proactive strategy to protect vulnerable businesses—especially small and medium-sized companies. Their extensive experience has convinced them that prevention is far easier and more cost-effective than trying to recover from a data breach or ransomware event that has already occurred.
How Ostra and FRSecure Collaborate
Ostra enjoys partnering with companies like FRSecure who share our commitment to protecting businesses. Learn more about the proactive partnership that FRSecure and Ostra share when it comes to data security in our Cyber Allies blog.
Launched in 2012, FRSecure is an innovative, Minnesota-based consulting and testing company that is known for being Information Security Experts on a Mission to Fix a Broken Industry. Their award-winning technical team performs risk assessments, penetration testing, incident response forensics, technical research, and cybersecurity planning. FRSecure also advises clients who have questions about how to integrate cybersecurity into their existing environment, or who need help creating an overall cybersecurity strategy to fill gaps in their current systems.
As Your Trusted Cybersecurity Team, Ostra makes cybersecurity simple and accessible to businesses of all sizes. Ostra provides its partners and their clients with a multi-layered, comprehensive and fully managed Security as a Service.
https://www.ostra.net/wp-content/uploads/2022/04/featured-image.png17072560Ostra Cybersecurityhttps://www.ostra.net/wp-content/uploads/2023/08/Ostra-logo-2023.pngOstra Cybersecurity2022-04-12 08:00:302023-09-08 15:49:32[Webinar Recap] A Titanic Mistake: Incident Response Without Active Monitoring
Ostra Cybersecurity, a leading provider of world-class cybersecurity solutions tailored for small and medium-sized businesses, is pleased to welcome Laura Riebschlager as Director of Partner Success. This new hire is the latest example of the company’s strategic investment in its Channel Partner program, which continues to generate exponential growth for the company.
Ostra Cybersecurity’s channel partner program is designed to help its network of consultants, IT and Managed Service Providers (MSPs) enhance value for their small to medium-sized business clients by offering comprehensive data protection solutions.
In this role, Riebschlager will focus on building a team of talented experts who can ensure that Ostra never loses its personal touch with clients, despite the rapid growth that is occurring. Among other things, she will support new and existing Channel Partners by developing strategic plans, trainings, marketing resources, and tools that make it even easier for them to meet their goals.
Ostra’s market niche is ensuring that top-notch data security solutions are accessible for small and medium-sized businesses. Many of today’s organizations are navigating massive changes in their virtual workforces, IT infrastructure and data security regulations. Ostra Cybersecurity’s technology suite—combined with the service expertise of its channel partners—deliver a comprehensive solution that addresses a unique set of specialized IT challenges facing business owners today.
Riebschlager is a fierce advocate for partners and clients in the technology industry. With more than 17 years of sales and operations experience, she specializes in working with SMBs as well as top tech leaders. Prior to joining Ostra, Riebschlager already had experience collaborating with the core leadership team at Ostra—including Director of Strategic Partnerships Mike Barlow, Chief Growth Officer Paul Dobbins, and President Joe Johnson. Their careers all intersected at various tech-related companies over the years.
According to Barlow, Riebschlager’s account leadership experience in the technology space makes her a valuable asset to Ostra’s partner success team.
“Ostra’s growing Channel Partner network has been like a fast-moving train over the past year,” Barlow said. “And we don’t see it slowing anytime soon. We are thrilled to have Laura as a dedicated resource to connect our partners with the cybersecurity expertise and support to accelerate their own success.”
Previously, Laura worked as an Account Director at Phobio, where she co-created multiple programs for SMBs to buy and sell used electronics. Laura also held sales management roles at companies such as Fortegra, the second largest credit insurer in the U.S., and Brightstar, the global leader of end-to-end mobile device lifecycle management solutions. Laura earned a bachelor’s degree in Psychology from the University of Nebraska.
“This is an exciting opportunity to help ensure that Ostra is constantly delivering on its mission to provide Fortune 100-level protection for businesses of all sizes,” Riebschlager said. “As someone who really enjoys thinking outside the box to solve problems for clients, I am thrilled to be a part of Ostra’s service-driven culture.”
Stacey Kusnier is the Marketing Director at Ostra Cybersecurity, a multi-layered and fully managed Security as a Service. With a passion for fostering mission-driven culture and B2B marketing, Stacey drives campaign strategies to support Ostra’s sales team and Channel Partners.
https://www.ostra.net/wp-content/uploads/2022/04/Laura-for-web-RGB_with-Ostra-logo-and-background-recropped.png17072560Stacey Kusnierhttps://www.ostra.net/wp-content/uploads/2023/08/Ostra-logo-2023.pngStacey Kusnier2022-04-05 13:00:392022-04-04 21:55:28Ostra Cybersecurity Adds Director to Lead Partner Success Team Through Exponential Growth
Ostra is kicking off our first employee spotlight with our Security Engineer, Johnathan Erwin from Ostra’s Cybersecurity Operations team. We recently sat down with him to talk about his role at Ostra, what makes him tick, his experience, and his life outside of work.
Career & Life at Ostra
Describe what you do at Ostra in one sentence.
I help support Ostra’s Cybersecurity Operations, and make sure everything runs smoothly for our team and clients. (And whatever else Michael Kennedy tells me to do! Haha.)
What initially interested you about Ostra Cybersecurity in the first place?
I worked with Michael Kennedy previously at Optum, and really enjoyed working with him. I was interested in learning more about cybersecurity, so joining the team at Ostra made a lot of sense.
What excites you most about your position and growth opportunity at Ostra?
I like that the opportunities are ever changing. I also enjoy building new tools, learning something new or finding something new to try. At Ostra, there is always something new to try, learn or take on.
What do you believe is the best thing about Ostra or the Ostra team?
The best thing about Ostra is our work environment. Ostra’s leaders have built an amazing culture where people are here to work and help each other. Our team cares for each other, is flexible and communicates well.
What do you find most challenging about your role at Ostra?
At Ostra, I never know what the day will hold. I can come prepared with my best laid plan, and then something shifts, and I must switch gears. Each day it is something new, and I must always be prepared for whatever comes.
What advice would you offer to someone looking to take on a role similar to yours?
I would say to get really good at using Google. Haha! But seriously, be comfortable asking questions, multi-tasking, shifting gears often and being prepared for a changing workload.
What would you do for a career if you weren’t doing this?
I would love to do something in the music business. I have played bass and guitar for the most of my life and would pursue that as a career.
OK, now for some fun questions
Where’s your favorite place in the world?
My favorite place in the world would definitely be a concert. It doesn’t matter which one, simply any concert.
Name one thing not a lot of people know about you.
I have a huge sweet tooth—cookies are the best bribe!
Three words to best describe you.
Silly, hardworking, and caring.
Name the most interesting place you have ever visited.
I had the opportunity to visit a gem mine in North Carolina called Emerald Hallow. A memory I will never forget!
What’s your motto or personal mantra?
I’ll rest when I’m dead.
Want to be a part of Ostra’s culture and team? Learn more about working at Ostra and view ouropen positions!
As Your Trusted Cybersecurity Team, Ostra makes cybersecurity simple and accessible to businesses of all sizes. Ostra provides its partners and their clients with a multi-layered, comprehensive and fully managed Security as a Service.
Although today’s businesses of every size are busy navigating data security issues, cybercriminals know that small and medium-sized businesses (SMBs) are even more vulnerable.
In the U.S. alone, there are 32.5 million small businesses—defined as having fewer than 500 employees. They make up about 99.9% of all U.S. businesses (Small Business Administration, 2021). For cybercriminals, that’s a wide-open field of prime targets for ransomware.
Why are SMBs more vulnerable? There are several factors, including:
Smaller IT/security staff and infrastructure
Lack of awareness or knowledge about how to protect themselves
A false sense of security (e.g., “criminals only target huge companies”)
Belief they cannot afford to implement the same robust safety measures as larger firms
Some SMBs rely on consumer-grade, off-the-shelf solutions to protect their data. But SMBs deserve a better approach to protecting one of their most valuable assets—their data, and their customers’ data. Read more about why cybersecurity should be on every business owner’s radar.
Know Your Risk
Consider these alarming statistics about the impact of cyberattacks on SMBs:
47% of small firms (1- 50 employees) and 63% of medium sized firms (50-249 employees) experienced one or more cyberattack in 2019. Source: Hiscox Insurance
Over 4,000 ransomware attacks PER DAY took place around the world in 2021. Source: TechJury/ FBI
66% of SMBs experienced a cyber-attack in 2019; and yet 45% of SMBs surveyed said that their processes are ineffective at mitigating attacks. Source: Ponemon Institute
There were 226.3 million global ransomware attacks between January and May 2021, an increase of 116% year-to-date over 2020. Source: SonicWall
From Big to Middle
According to Coveware, an incident response and recovery firm, ransomware continues to affect small businesses disproportionately because “the profits ransomware actors generate are too high, and the risks are too low.”
“In Q3 almost 44% of attacks impacted businesses with between 101-1,000 employees, up from 38% in Q2, reflecting threat actors potentially shifting from Big Game Hunting to Mid Game Hunting.”
Awareness Inspires Prevention
Many ransomware perpetrators try to gain access to data through human error, weak or compromised passwords, or even by attempting to get a company insider to assist them. That’s one reason that Ostra advises SMB clients to raise awareness among employees about data security. Staff who are trained, aware and committed to data privacy can provide an invaluable layer of defense against ransomware.
For an inspiring example of this, read Ostra’s blog about a vigilant Tesla employee who helped prevent a massive ransomware attack at the company. Admittedly, Tesla is definitely NOT a small business—but the same principle of being prepared can benefit SMBs as well.
The Ransomware Attack that Sparked Ostra
Cybersecurity trailblazer Michael Kennedy started Ostra Cybersecurity after a ransomware attack wreaked havoc on his friend’s small business. Read the full story here.
Ostra was founded with the belief that SMBs should be able to access the robust, layered data protection tools and strategies that the world’s largest companies rely on. Ostra’s managed cybersecurity solution offers Fortune 100-caliber, 360-degree protection that allows companies of all sizes to protect their most valuable asset—their data.
Ready to learn more about how to prevent ransomware and other cyber threats from impacting your company or your clients? Contact Ostra today.
As Your Trusted Cybersecurity Team, Ostra makes cybersecurity simple and accessible to businesses of all sizes. Ostra provides its partners and their clients with a multi-layered, comprehensive and fully managed Security as a Service.
https://www.ostra.net/wp-content/uploads/2022/02/ransomware-blog-featured-image.png6281200Ostra Cybersecurityhttps://www.ostra.net/wp-content/uploads/2023/08/Ostra-logo-2023.pngOstra Cybersecurity2022-02-11 20:00:462023-09-08 15:50:23Why SMBs are hot targets for ransomware (and how to avoid becoming a statistic)
To anyone who is familiar with Ostra’s history as well as our team culture, it is no surprise that we are passionate about data privacy. Ostra is a proud 2022 Data Privacy Week Champion because we were founded on the belief that all businesses and individuals have a fundamental right to data privacy and security.
January 24 – 28, 2022 is Data Privacy Week—a global initiative to generate awareness about the importance of online privacy. In addition to educating citizens on how to manage and secure their personal information, Data Privacy Week encourages businesses to respect data and be more transparent about how they collect and use customer data.
What does data privacy mean?
Individuals and businesses approach data privacy in slightly different ways:
As individuals, we are usually more concerned with protecting our personal information, securing our financial or health records, keeping our families safe on social media, or reducing the risk of personal property being stolen.
For businesses, however, data privacy is more complex. It’s not just about protecting the data of their company, employees, or investors. They also need to be accountable for how they are handling data for their clients, vendors, or any other organizations that they interact with.
But in all cases, data privacy is simply about minimizing opportunities for others to exploit data for personal, professional, political, social or financial gain.
The path to action
According to a Pew Research Center study, 79% of U.S. adults report being concerned about the way their data is being used by companies.
Yet, at the same time, many of us in the information security industry hear comments like, “Who cares if Big Brother is listening to what kind of cereal I like?” People know they are being targeted, but the outrage has worn off.
When Ostra conducts cybersecurity assessments for our clients, we typically try to find out where they fit on the scale of concern for their data security and data privacy.
After spending more than 20 years in this industry, I’ve seen attitudes about data privacy that range from apathy to paranoia. Both ends of this spectrum are problematic.
How can we best position ourselves to champion data privacy? I am a big fan of awareness that leads to action. This concept is illustrated below:
On the left side, Apathy leaves people unmotivated, leading to careless inaction. On the other end, Paranoia creates a fatalistic outlook, which can be just as paralyzing. Neither of these extremes tend to move people forward. But right in the middle is Awareness, which leads to action.
Businesses can build employee awareness about data privacy by asking these questions:
Whose data do we have?
What kind of data do we have? (Financial, personal/health information, etc.)
Should we even have this data?
Who has access to this data? (And is anyone overseeing these permissions?)
How do we secure this data?
Individuals can take data privacy more seriously by thinking about:
Where is my personal data being stored?
Who has access to my personal data?
Privacy Frameworks
As companies dive further into the topic of data privacy, they should also develop an official Data Privacy Policy or framework if none exists.
What is a Data Privacy Policy? It is simply a roadmap that your company can follow to keep sensitive data secure. Your policy might outline the following:
Methods you use to manage/store private data
Standards or procedures for encrypting your data
What to do if an employee is on the receiving end of private data that they should not have access to
Procedures about who is a gatekeeper for sensitive, confidential or HIPAA-protected data
Definitions about what is considered private or confidential data
Guidelines for sharing or forwarding data to non-gatekeepers
Train your employees (and then train them again, and again…)
A policy is only as good as the people who follow it—or don’t. So once you have a framework in place, it’s time to ensure your employees are properly trained, regularly updated, and are inspired to share your commitment to data privacy.
Training topics or roundtable conversations might include:
What is protected information?
What are some scenarios where private data might be exposed, unintentionally?
What should I do if I accidentally receive something from a client or employee that I shouldn’t?
How do I report a data privacy breach or incident?
What are best practices for keeping my laptop, smartphone or network files secure?
Data privacy training doesn’t have to be formal or complicated. It could be a casual lunch-and-learn or Q&A session. The goal is to get employees thinking and talking about their role in ensuring data privacy at the company.
At a minimum, I recommend that businesses host quarterly or monthly data privacy trainings for every employee and contractor. Since Ostra believes so strongly in data privacy, our security team talks about it at least once per month—sometimes as part of our all-company town halls, or even more frequently at smaller gatherings. We know that regular, ongoing conversations about data privacy are crucial to proactively protecting ourselves, our company and our clients.
Links between personal & business data privacy
Your personal and company data might be more interconnected than you realize. Cybercriminals are constantly looking for cracks in the armor to help them gain access to a company’s client list, financial data, intellectual property, or other important information.
Whether you are the CEO or a part-time intern, it’s important to consider:
How much information are you sharing on your personal social media accounts that might make your password easier to crack? (i.e. birthdates, anniversary dates, middle names, location details, etc.)
Do you participate in online surveys or quizzes that gather your personal details? If so, could your answers be used to put your data at risk?
Do you ever check email from an unsecured network—e.g., while at home or at your local coffee shop?
Have you checked the privacy settings on the many apps have installed on your smartphone?
By collecting unsecured personal information, impersonators can build profiles of employees to gain access to sensitive data at the places where they work.
Of course, many people can’t imagine their company might be a prime target for things such as ransomware—especially those who work for SMBs. But cyber attacks are not just aimed at multi-national, Fortune 100 corporations. A 2Q 2021 Coveware report stated that more than 75% of ransomware cyberattacks occur on companies with less than 1,000 employees.
Impersonating employees by researching their personal data is a common strategy that criminals can use to initiate ransomware attacks, credit card fraud, industrial espionage and more.
About Data Privacy Week
January 24 – 28, 2022 is Data Privacy Week. In 2022, National Cybersecurity Alliance expanded its annual Data Privacy Day campaign from a single day (January 28) to a week-long initiative. Data Privacy Day began in the United States and Canada in January 2008 as an extension of Data Protection Day in Europe, which commemorates the Jan. 28, 1981 signing of the first legally binding international treaty dealing with privacy and data protection (known as Convention 108). For more info about Data Privacy week and other initiatives from the National Cybersecurity Alliance, visit staysafeonline.org.
About Ostra
As a next-generation MSSP, Ostra Cybersecurity combines best-in-class tools, proprietary technology and exceptional talent to deliver Fortune 100-level protection for businesses of all sizes. The result is a multi-layered, 360° solution that allows you to set it and forget it. For more information, visit www.ostra.net.
Michael Kennedy is the founder of Ostra Cybersecurity, a multi-layered and fully managed Security as a Service. Recognized as a cybersecurity industry trailblazer, he is a dynamic leader, speaker, and fierce advocate for data privacy.
https://www.ostra.net/wp-content/uploads/2022/01/Ostra-Blog_DataPrivacyFeatured-Image_01-20-22.png35565333Michael Kennedyhttps://www.ostra.net/wp-content/uploads/2023/08/Ostra-logo-2023.pngMichael Kennedy2022-01-25 15:00:342023-09-08 15:51:02Awareness Leads to Action: Why Data Privacy Matters
As a 2021 Cybersecurity Awareness Month Champion, Ostra is proud to help shed more light on security vulnerabilities and help secure our interconnected world.
In cooperation with the National Cyber Security Alliance, Ostra Cybersecurity invites our clients and partners to join us as we continue to use the month of October to spread more awareness and take action to protect the valuable data that is online.
Below are tips to help guide our community to better data privacy in the world of remote work. These tips are more relevant than ever, as remote and hybrid workforces continue to shape how companies interact with their employees and customers.
Remote Working Trends
In this day and age, employees are more connected than ever. The hybrid workplace is here to stay, and for employees, this means relying on connected devices from their home office setups.
According to recent data, smart home systems are set to rise to a market value of $157 billion by 2023, and the number of installed connected devices in the home is expected to rise by a staggering 70% by 2025. In this new normal where smart devices and consequently online safety are a must, here are some tips for securing those devices.
Remember smart devices need smart security
Make cybersecurity a priority when purchasing a connected device. When setting up a new device, be sure to set up the privacy and security settings on web services and devices bearing in mind that you can limit who you are sharing information with. Once your device is set up, remember to keep tabs on how secure the information is that you store on it, and to actively manage location services so as not to unwittingly expose your location.
Put cybersecurity first in your job
Make cybersecurity a priority when you are brought into a new role. Good online hygiene should be part of any organization’s onboarding process, but if it is not, then take it upon yourself to exercise best practices to keep your company safe.
Cybersecurity has become a loaded concept. There are so many things to consider when protecting your data—whether you are working at home, remotely/on the road, or in a traditional office setting.
Some basic precautions include performing regular software updates, and enabling MFAs. You can also contact Ostra to explore how a cybersecurity assessment can reveal what vulnerabilities you may have, and how you can stay ahead of threats.
Make passwords and passphrases long and strong
Whether or not the website you are on requires it, be sure to combine capital and lowercase letters with numbers and symbols to create the most secure password. Generic passwords are easy to hack. If you need help remembering and storing your passwords, don’t hesitate to turn to a password manager for assistance.
If you are a business owner, it’s more important than ever to make sure you are doing everything you can to protect your most valuable asset—your data, and your clients’ data.
Malware attacks, phishing scams and ransomware events are increasingly targeting small and medium-sized businesses. Being prepared and preventing these disruptions is not just about convenience; it can be a matter of survival. Check out our blog, Why Cybersecurity Should Be On Every Business Owner’s Radar, for tips on how you can protect your business.
Never use public computers to log in to any accounts
While working from home, you may be tempted to change scenery and work from a coffee shop or another type of public space. While this is a great way to keep the day from becoming monotonous, caution must be exercised to protect yourself and your company from harm’s way. Make sure that security is top of mind always, and especially while working in a public setting, by keeping activities as generic and anonymous as possible.
Turn off WiFi and Bluetooth when idle
The uncomfortable truth is, when WiFi and Bluetooth are on, they can connect and track your whereabouts. To stay as safe as possible, if you do not need them, switch them off. It’s a simple step that can help alleviate tracking concerns and incidents.
These are just a few simple steps towards achieving the best online safety possible. Staying safe online is an active process that requires constant overseeing at every stage – from purchasing and setting up a device, to making sure that your day-to-day activities are not putting anyone at risk. By following these steps, you are doing your part to keep yourself and your company safe from malicious online activity.
Now in its 18th year, Cybersecurity Awareness Month continues to build momentum and impact with the ultimate goal of providing everyone with the information they need to stay safer and more secure online.
The Cybersecurity Awareness Month Champions Program is a collaborative effort among businesses, government agencies, colleges and universities, associations, nonprofit organizations and individuals committed to the Cybersecurity Awareness Month theme of ‘Do Your Part. #BeCyberSmart.’
As Your Trusted Cybersecurity Team, Ostra makes cybersecurity simple and accessible to businesses of all sizes. Ostra provides its partners and their clients with a multi-layered, comprehensive and fully managed Security as a Service.
https://www.ostra.net/wp-content/uploads/2021/10/FeaturedImage_Blog_10-26-21_CAM-repurposed-content.jpg17072560Ostra Cybersecurityhttps://www.ostra.net/wp-content/uploads/2023/08/Ostra-logo-2023.pngOstra Cybersecurity2021-10-26 10:56:032024-01-18 13:30:49Remote Control: Prioritizing Cybersecurity in the Hybrid Workplace
Did you miss the Hacks & Hops Virtual Security Conference on October 14? We weren’t able to connect in person this year, but this year’s event did not disappoint even though we got together virtually.
Hosted by FRSecure, one of Ostra’s Channel Partners, Hacks and Hops is a free, full-day virtual conference that brings information security professionals together to learn, network and enjoy beer (over Zoom, anyway!) Ostra was a proud sponsor of this year’s event.
Getting Real: The Problem with Technology Providers and MSSPs
It was a jam-packed day of best practice sharing from experts across the industry. Several speakers presented on topics ranging from mental health, cyber insurance, MSSPs, and more. We hosted a thought-provoking conversation with Ostra’s Founder, Michael Kennedy.
In his engaging and authentic style, Michael shared a 40-minute presentation entitled The Problem with Technology Providers and MSSPs. It explored cybersecurity best practices, challenges being ignored (by clients and providers), and opportunities for all to keep learning and do better.
In the first portion of his presentation, Michael shared how an MSSP/Tech Provider’s best practices of honesty, advocacy and transparency are key to recognizing and rewarding clients’ current cybersecurity efforts.
In the cybersecurity world, there’s a lot of good being done, but we still have more to do. In his session, Michael shared his top three best practices that are key for any MSSP or tech provider to recognize and reward clients’ on cybersecurity efforts.
1. Best Practice #1: Honesty
It’s important to recognize what clients are doing right. Michael reminded participants, “If it’s a competitor tool and it’s a pretty good one, give them credit for getting something implemented—we all know it’s difficult to buy, implement, and manage tools.”
Another way service providers can be honest is to build trust—not fear. This can be hard, especially if you find out a customer is doing something that is really putting their organization at immediate risk. But Michael encouraged tech providers to first care about their customer’s business, what they do, and why they are successful before starting to critique their attack surface.
“A foundation of trust helps clients honestly share their concerns and fears. This lets us, as their partners, truly help them detect, prevent and remediate threats.”
2. Best Practice #2: Advocacy
When clients get a list of things to do that they don’t know how to execute, a good technology partner will be their advocate and help relieve the burden.
According to Michael, “Reports mean nothing if we are not there to walk customers through it or help them.” He emphasized the need to educate customers so they understand the tools and resources they are using, and how they work—versus just selling them a product or a blinking light.
In his experience, it’s about being the trusted partner who can detect, prevent and remediate. “We see quite a few businesses who are tired of not knowing how to manage the tools that were sold to them.”
3. Best Practice #3: Transparency
Michael believes in sharing the pros and cons of competitors, and said MSSPs should not be afraid to work with multiple channel partners or give outside referrals if that’s the best solution for customers.
Being open and transparent with so-called competitors can also bring surprising results. Michael shared some of Ostra’s learning experiences in this area.
“A perfect example of this is, we were being constantly compared to a couple of other companies in town.” But rather than building marketing to compete with them, Ostra took another approach. “We called them up, sat down with the leadership and technical teams, and discovered we are not even close to being competitors—and now we have strategic partnerships and can help each other out.”
Contact Ostra today for a free cybersecurity assessment for your business or your clients.
About Ostra Cybersecurity
As a next-generation managed security service provider (MSSP), Ostra Cybersecurity combines best-in-class tools, proprietary technology and exceptional talent to deliver Fortune 100-caliber protection for businesses of all sizes. The result is a multi-layered, 360-degree solution that allows you to set it and forget it. By making cybersecurity technology simple and accessible to business of all sizes, Ostra is helping create a world with greater data privacy and protection for all of us. For more information, visit www.ostra.net.
As Your Trusted Cybersecurity Team, Ostra makes cybersecurity simple and accessible to businesses of all sizes. Ostra provides its partners and their clients with a multi-layered, comprehensive and fully managed Security as a Service.
Ostra Cybersecurity enjoys building relationships with like-minded companies who share our commitment to protecting clients. That is why it is especially rewarding for us to work with Channel Partners like FRSecure, whose focus is crystal-clear: Information Security Experts on a Mission to Fix a Broken Industry.
Launched in 2012, FRSecure is a Minnesota-based consulting and testing company in the information security space. Its award-winning technical team is best known for performing risk assessments, penetration testing, incident response forensics and technical research—as well as regularly taking down hacking challengers at industry events such as DEF CON.
Although they typically work with organizations that employ less than 500 people, FRSecure also serves much larger companies that need to fill a gap in their security expertise. In addition to assessments and testing, clients consult FRSecure for advice on cybersecurity planning, leveling up their current staff, or integrating security into their business.
One of FRSecure’s specialty areas is helping clients identify which security projects they should prioritize—and showing them how to implement those plans in a cost-effective way. With this in mind, becoming an Ostra Cybersecurity Channel Partner made sense for a number of reasons.
Paul Dobbins, Chief Growth Officer at Ostra, explains: “FRSecure is a perfect example of what Ostra’s Channel Partner Program is specifically designed for… naturally adjacent companies in the cybersecurity ecosystem. Together we’re breaking down silos within the industry to make sure companies are protected with holistic solutions.”
Culture Cues
“First and foremost, what FRSecure looks for in a partner is culture fit,” shares John Harmon, President at FRSecure. “Are they interested in helping us fix the broken industry? Are they interested in helping us solve the same kinds of problems and serving the same kind of customers that we serve?”
The mission-driven culture at FRSecure resonates with I.S. professionals who want to make a difference in their industry—which has helped the company attract a team of bright, highly committed experts.
This mirrors the Ostra team’s passion for protecting clients from the devastating effects of cyberattacks, which are increasingly targeting small and medium-sized businesses. (A friend’s devastating experience with ransomware is one of the reasons Michael Kennedy founded Ostra—read more about the Ransomware Attack that Sparked Ostra Cybersecurity.)
Shared Values
Another important consideration in any partnership is common values—such as collaboration and truth-telling. Both Ostra and FRSecure are strong advocates for transparency.
“What we liked most about Ostra was their leadership and their willingness to let us look under the hood,” Harmon recalls, “so we could verify what they were claiming to do and who they were planning to serve.” Allowing this level of access to their proprietary solution—which Harmon says is rare in the cybersecurity industry—built trust and empowered FRSecure to refer clients to Ostra with confidence.
Another factor that contributes to the success of this Channel Partner relationship is the willingness of both companies to tackle tough problems together. Being open to feedback and communicating clearly ensures that nothing is lost in translation.
“We’re constantly working through issues, trying to find the best solutions for our clients—and sometimes that can get uncomfortable,” admits Harmon, “But with Ostra, we can speak plainly… and we can move a lot faster to help our clients.”
FRSecure was also drawn to Ostra’s technical expertise in filling the gaps left by other cybersecurity products. The holistic Ostra solution was able to measurably solve security issues for their clients.
Vision & Leadership
How does Ostra typically add value to Channel Partners and their clients? In FRSecure’s view, Ostra’s top strength is being able to identify the client’s real issue, knowing what the gaps are, and having the skill to fill those gaps in the most responsible way.
“Ostra is not trying to shoehorn their solution into things, hoping it works,” John Harmon explains. “Ostra is very good at vetting the issues… customizing their solution to make sure it fits, and [making sure] our customers are happy when they’re through.”
Harmon also admires the way Ostra has been able to package its very high level of cybersecurity expertise into a solution, and scale it in a way that benefits businesses of every size—including FRSecure’s clients.
“[Ostra Founder] Mike Kennedy is a visionary,” Harmon says. “He’s somebody who saw a problem in the industry and, despite all odds and despite hulking competition, created an offering that is going to be viable in our industry… I’m so happy that we are a part of that journey.”
Facing Reality
In recent months, there have been dramatic policy changes at cyber insurance companies and at the regulatory level. As a result, both Ostra and FRSecure have seen organizations start to shift their strategies; instead of just relying on cyber insurance, companies are realizing their need to put a proper incident response plan in place.
According to Harmon, “There is now no choice but to take preventative measures and have insight into your network and your security program.”
To meet this need, FRSecure offers several compliance preparation services (such as SOC2 audit, Vendor Risk Management and more) to clients. Ostra is also uniquely positioned to help businesses learn to use insurance in a more responsible way. For example, in a June 2021 webinar presented by Ostra (The Ultimate Reality Check for Cybersecurity), panelists shared tips to protect small business owners from losing everything due to a data breach caused by malware, phishing or ransomware schemes.
No Surprises
Leaders at Ostra and FRSecure agree that when it comes to cybersecurity, nobody likes surprises. That’s why it’s crucial for organizations to account for every potential vulnerability and get a clear view of the situation before moving forward with a cybersecurity solution.
“You can’t secure what you don’t know you have,” John Harmon warns. “One of the first things that we coach our clients is to understand: What are all the assets in your network, in your data pool, even in your staff?”
Whether companies need a risk assessment, cybersecurity program planning, a cyberattack simulation or compliance preparation, FR Secure can provide a detailed analysis of their vulnerabilities as well as options for fixing the problem.
Joe Johnson, President at Ostra Cybersecurity, sheds some light on how Ostra fits in to this equation. “FRSecure helps clients understand their current reality, which is foundational to building an effective cybersecurity strategy.” He continues, “Ostra can offer a Fortune 100-caliber, layered cybersecurity solution to FRSecure clients who are looking for 24/7 threat prevention, management and remediation.”
A layered approach to cybersecurity is vital to helping companies confront the brand-new (also known as “zero-day”) exploits that sneak under the radar, in addition to the known threats that are logged by threat intelligence engines.
John Harmon summarizes: “Make sure that you are protecting yourself against everything… and not just what you can see.”
Partnering for Results
“Partnerships by definition should be a two-way street and FRSecure is a shining example,” stated Mike Barlow, Director of Strategic Partnerships at Ostra. “We are continually evaluating new channel partners including MSPs, vCISO, consulting, assessment and incident response firms. Selected Ostra Certified Partners like FRSecure are partners we trust explicitly in recommending to our clients in need of services outside of our area of expertise.”
Proactive partnerships with cyber allies like FRSecure are worth celebrating. The shared values, complimentary culture, and continuous improvement mindset of our Channel Partners ensures we are creating the best data security outcomes for clients.
About Ostra’s Channel Partner Program: For more information on the benefits of becoming an Ostra Cybersecurity Channel Partner, visit the Partner page on our website or connect with Mike Barlow, Director of Strategic Partnerships, on LinkedIn.
About FRSecure: FRSecure is a full-service information security management company that protects sensitive, confidential business information from unauthorized access, disclosure, distribution and destruction. Ostra is proud to have FRSecure as one of our official Channel Partners. To learn more about FRSecure and its award-winning technical services team (Team Ambush), visit frsecure.com
About Ostra: As a next-generation MSSP, Ostra Cybersecurity combines best-in-class tools, proprietary technology and exceptional talent to deliver Fortune 100-level protection for businesses of all sizes. Visit ostra.net to learn more about our multi-layered, 360° solution.
As Your Trusted Cybersecurity Team, Ostra makes cybersecurity simple and accessible to businesses of all sizes. Ostra provides its partners and their clients with a multi-layered, comprehensive and fully managed Security as a Service.
https://www.ostra.net/wp-content/uploads/2021/09/FeaturedImage2_CyberfinTestimonialBlog.jpg17072560Ostra Cybersecurityhttps://www.ostra.net/wp-content/uploads/2023/08/Ostra-logo-2023.pngOstra Cybersecurity2021-09-22 07:00:172023-09-08 15:57:13Cyber Allies: FRSecure and Ostra are proactive partners in data security
featuring Ostra’s Michael Kennedy as speaker – October 14, 2021
Hacks & Hops is an event hosted by one of Ostra’s Channel Partners, FRSecure, that brings information security professionals together to learn, network and enjoy beer.
Save the date from 9a-5p on Thursday, October 14 for this free full-day, virtual conference that includes 12 speakers and 8 topics—ranging from mental health, cyber insurance, MSSPs, and more. Michael Kennedy, Founder of Ostra Cybersecurity, will be the final speaker of the day. Attendees can earn CPE Credits* by participating in this event. Visit https://hacksandhops.com/ to register.
Ostra is a sponsor of this free event.
*CPE Credits – Up to 5 hours of self-study – Learn More Here
Presenter information
Learn from experts in various niche areas of cybersecurity. The lineup of engaging speakers for this virtual conference includes:
Joe Scargill, Special Agent in Charge Twin Cities at Secret Service: Opening Keynote
Arin Brown, Chief Technology Officer at SEACHANGE: How to Build a Security Program From the Ground Up
Tony Lambert, Senior Intelligence Analyst at Red Canary and Mike Thompson, Incident Case Manager – Team Lead at FRSecure: Panel Discussion
Amanda Berlin, Chief Executive Officer & Owner, Mental Health Hackers: Mental Health Hackers
Oscar Minks, Director of Technical Services at FRSecure and Sonu Shankar, Head of MDR Product at Arctic Wolf: How to Stay Ahead of Threat Intelligence
Tim Smit, Cyber Security Practice Lead & Owner at Lockton: What’s Going On With Cyber Insurance and Why It’s Still Important
Mike Kennedy, Founder at Ostra Cybersecurity: The Problem With Tech Providers and MSSPs
In his 40-minute presentation entitled The Problem with Technology Providers and MSSPs, Ostra Founder Michael Kennedy will share:
Best practices to recognize and reward clients’ current cybersecurity efforts
Obvious challenges being ignored (by clients and providers), and what to do about it
Opportunities for ALL to step up, keep learning and doing better, plus some words of advice to the cybersecurity industry
Additional Q&A (time permitting)
How To Register
Registration is free. Visit https://hacksandhops.com/ to learn more or register for this all-day event (9a-5p CT) on Thursday, October 14, 2021.
About Ostra Cybersecurity
As a next-generation managed security service provider (MSSP), Ostra Cybersecurity combines best-in-class tools, proprietary technology and exceptional talent to deliver Fortune 100-caliber protection for businesses of all sizes. The result is a multi-layered, 360-degree solution that allows you to set it and forget it. By making cybersecurity technology simple and accessible to business of all sizes, Ostra is helping create a world with greater data privacy and protection for all of us. For more information, visit www.ostra.net.
Learn more about cloud data protection, email threat prevention, and how to prevent ransomware, various types of malware and more. Contact Ostra today for a free assessment to see what vulnerabilities may exist for your business or clients.
As Your Trusted Cybersecurity Team, Ostra makes cybersecurity simple and accessible to businesses of all sizes. Ostra provides its partners and their clients with a multi-layered, comprehensive and fully managed Security as a Service.
As a next-generation managed security service provider (MSSP), Ostra Cybersecurity works closely with some great companies in the technology space. In my role as Director of Strategic Partnerships, I enjoy finding ways to support and collaborate with our Channel Partners that serve on the front lines of cybersecurity for diverse client groups around the world.
CyberFin is a Minnesota-based company that provides relentless protection for closely regulated businesses such as insurance agencies, financial advisors, real estate brokers and registered investment advisors. As one of Ostra’s Channel Partners, CyberFin focuses on cybersecurity in the insurance and financial space.
In early 2021, Ostra began working with Managing Partner Chris Steffl and the team at CyberFin. In the wake of unprecedented cybersecurity challenges in the post-pandemic world, Ostra came alongside CyberFin with solutions to strengthen their business model and help them stand apart in a crowded field.
The first great thing about our partnership with CyberFin is that their mission and values are aligned with Ostra’s—being proactive and never settling for anything but the best for their clients.
In addition, both Ostra and CyberFin love to educate small businesses and mid-sized companies about cybersecurity. Chris Steffl, Managing Partner at CyberFin, shared a bit about how Ostra supports CyberFin in this area:
“We’re taking an industry that has very little knowledge or understanding about cybersecurity and we’re trying to make it simple and easy for them to understand…
One of the big things that Osta is excellent at is the deployment of their tools, and how their team works with our organization and the clients that we have. Ostra made it really easy to bring those tools in, and explain it to our clientele… financial planners or insurance agents that aren’t in the cyber industry… so that they’re able to figure out what tools they need to put in place.” – Chris Steffl, Managing Partner at CyberFin
In terms of CyberFin’s particular expertise, they are a trusted advisor in the finance and insurance space. With decades of experience, they have been in the trenches and know what their clients need. This makes CyberFin a fierce advocate for their clients—they are constantly on the lookout for any security threats or compliance issues that might arise. So getting the right tools, technology and talent behind their solution was extremely important.
“Ostra is really a next-generation level of cybersecurity,” summarized Chris Steffl. “They are able to comprehensively pull together all the different tech stacks that they’ve got, and deploy that in a very easy manner. And I think that’s one thing that set’s them apart from other cybersecurity firms is the ability to pull all these tools together to make an easy, simple deployment of the products.”
Ostra is proud to work alongside Channel Partners like Cyberfin to ensure financial and insurance businesses of all sizes—even small firms and start-ups—get the same level of best-in-class, layered cybersecurity that Fortune 100 companies rely on.
To learn more about how Ostra and our Channel Partners can deliver expert-level cybersecurity or improve your data security compliance, contact our team today.
Mike Barlow is the Senior Director of Channel Success at Ostra Cybersecurity, a multi-layered and fully managed Security as a Service. As a sales leader, Mike Barlow is focused on growing and promoting the long-term success of Ostra’s Channel Partners.
https://www.ostra.net/wp-content/uploads/2021/08/FeaturedImage_Aug-blog_CyberfinFinal.jpg17072560Mike Barlowhttps://www.ostra.net/wp-content/uploads/2023/08/Ostra-logo-2023.pngMike Barlow2021-08-25 07:00:152023-09-08 15:58:38Banking on Expert Cybersecurity: CyberFin Partners with Ostra to Protect Financial & Insurance Clients
On July 12, Ostra presented a free BrightTALK webinar: The Ultimate Reality Check for Cybersecurity. In this informative discussion, our panel of cybersecurity experts—including Ostra Co-Founder Michael Kennedy and Chief Growth Officer Paul Dobbins—shared how real-life threat events during the pandemic have forever changed the cyber threat landscape for businesses.
The presentation also included tips and strategies for combating threats in the face of endpoint visibility and control challenges—which have become harder for businesses to manage as remote workstations, virtual meetings and cloud-based apps and file sharing has become commonplace.
Organizations of all sizes are increasingly being targeted by cybercriminals—through ransomware, phishing schemes or other malware attacks—due to insecure endpoints. The panelists discussed some of the recent, high-profile cyberattacks that are still impacting the business world, and whether the latest governmental actions will be effective.
Panelists for this webinar presentation included: Michael Kennedy, Co-Founder and CTO at Ostra Cybersecurity; Oscar Minks, Director of Technical Solutions and Services at FR Secure; and Heidi J.K. Fessler, Founder and Cybersecurity/Data Privacy Attorney at Innova Law Group. The discussion was moderated by Paul Dobbins, Chief Growth Officer at Ostra Cybersecurity.
Why endpoint security matters (now, more than ever)
Over the past 12-15 months, a lot has changed in the cyber-threat landscape. The Covid-19 pandemic forced many companies to rapidly shift to a remote workforce; an unprecedented number of employees were suddenly working from home, sometimes with little technical/configuration support.
“During lockdown, we saw companies using old machines that had not been patched, or they had vulnerabilities,” shared Michael Kennedy. Although Ostra helped those clients with remediation, the more ideal scenario is to be proactive. “Make sure everything is patched and updated,” he advised. “Be ready for it. Plan this out. Have a policy.”
Amid the rising tide of virtual transactions, Ostra also heard from business leaders who wondered why they should prioritize cybersecurity when so much personal and financial information was already available online. Would it even matter?
“I think we have become numb to all these cyber events—the Target breach, the Experian breach,” stated Michael Kennedy. But he warned that complacency is dangerous, since ransomware events can have a significant impact—and most small businesses don’t recover.
Adding to Michael’s point, attorney Heidi Fessler shared an alarming statistic: “Eighty percent of SMBs that experience a data breach will lose their business. It is terminating,” she said. “Mostly because you didn’t think it could happen and you’re not ready.”
Heidi has also worked with small businesses that had a false sense of security about avoiding ransomware or malware because they worked with a managed service provider or an IT person. “IT and information security are not the same people,” she stated. “Data loss prevention is on the data security side. Just because someone is keeping your computers running, they are not [necessarily] a security person.”
Tackling zero-day exploits
The panelists also discussed the challenges of dealing with zero-day exploits.
“Zero-day is a newly discovered vulnerability with no fix for it,” explained Oscar Minks. “There can be work-arounds, but nothing is properly patched or corrected at this point.” Since the pandemic, the number of zero-day attacks has increased significantly. How can businesses better protect themselves against them?
Oscar suggested that the first step is to take inventory: businesses should know their environment, know their endpoints, know their network, and don’t let them be exposed.
“Innately, we should consider all of our applications are insecure,” Oscar shared. “Even if they are properly patched, protecting and isolating those services is important. Be proactive to protect those assets.”
Other real-world cybersecurity topics
In the remaining segments of the webinar, our panelists covered several other real-world cybersecurity topics including:
How should businesses hold an MSP or MSSP accountable?
What is ransomware-as-a-service, and how does it work?
Why is it important to separate IT and Information Security roles in your organization?
What are common misconceptions about cloud security?
What is the most important thing businesses can do to make endpoints more secure?
What role do policies, processes and insurance play in cybersecurity?
Do government actions work? What else can help fix a broken cybersecurity industry?
The Ultimate Reality Check for Cybersecurity is a free, 50-minute webinar. To watch the on-demand presentation in its entirety, please visit our event page on BrightTALK.
As Your Trusted Cybersecurity Team, Ostra makes cybersecurity simple and accessible to businesses of all sizes. Ostra provides its partners and their clients with a multi-layered, comprehensive and fully managed Security as a Service.
https://www.ostra.net/wp-content/uploads/2021/07/Featured-Image_BrightTALK-Webcast-2021-resized-1.png576864Ostra Cybersecurityhttps://www.ostra.net/wp-content/uploads/2023/08/Ostra-logo-2023.pngOstra Cybersecurity2021-07-21 08:00:242023-09-08 17:47:06Highlights from BrightTALK Webinar: The Ultimate Reality Check for Cybersecurity
Introducing The Ultimate Reality Check for Cybersecurity from BrightTalk. In this free webinar, four presenters—including Ostra Co-Founder Michael Kennedy as one of the panelists and Chief Growth Officer Paul Dobbins as a moderator—shared how real-life threat events during the pandemic have forever changed the cyber threat landscape.
Large-scale data hacks and ransomware events have made global headlines recently. But far from the glare of media attention, organizations of all sizes are increasingly being targeted by cybercriminals due to insecure endpoints.
In this session, panelists shared real stories from the front lines of cybersecurity, as well as strategies for combating new-age threats in the face increasing endpoint visibility and control challenges.
Our panelists also discussed how recent high-profile cyberattacks are still impacting the business world, and what changes organizational leaders can anticipate from recent public hearings and governmental actions.
Timely topics
Here are just a few of the questions and topics that our panelists unpacked:
How is the cyber-threat landscape changing?
If our data is already out there, why should we care?
What is really happening with “new threats” and ransomware, how are they being covered in the media?
How has cloud computing and having a remote/hybrid workforce changed the way we think about endpoint security?
What are strategies for combatting malware and cyberattacks?
Why is it important to separate IT and Information Security roles in your organizations?
Is the government doing anything to protect businesses, and will it work?
How can companies improve compliance and risk mitigation when it comes to cloud data protection and cybersecurity?
Panelist overview
The three panelists and our moderator for this event all work in the trenches of cybersecurity and risk management on a daily basis. They help businesses mitigate risk while learning how to improve cloud data protection, and how to prevent ransomware, malware and data breaches.
Participants included:
Michael Kennedy, Co-Founder & CTO, Ostra Cybersecurity (panelist)
Paul Dobbins, Chief Growth Officer, Ostra Cybersecurity (moderator)
Oscar Minks, Director of Technical Solutions and Services at FR Secure (panelist)
Heidi J.K. Fessler, Founder and Cybersecurity/Data Privacy Attorney at Innova Law Group, PLLC (panelist)
How to Watch
To watch a FREE replay of this 50-minute webinar that was first presented on July 12, click here.
As Your Trusted Cybersecurity Team, Ostra makes cybersecurity simple and accessible to businesses of all sizes. Ostra provides its partners and their clients with a multi-layered, comprehensive and fully managed Security as a Service.
Working in the technology space for many years, I have noticed that cybersecurity is a loaded concept. Similar to other words—such as history or intelligence—there can be multiple ways of describing it, depending on your angle.
The multi-faceted nature of cybersecurity is one reason why small- and medium-sized businesses sometimes find it frustrating to evaluate their options. It takes time to explore the latest software products, tools, and services. It can be difficult to make apples-to-apples comparisons when the packages and solutions in question are addressing different vulnerabilities.
For example, there are trustworthy brands and powerful technologies behind many of today’s cybersecurity solutions. But do they cover all your vulnerabilities, or just endpoints? Do you need multiple software tools for preventing ransomware, removing malware and protecting mobile devices, or is there a great all-in-one option? Are services such as updates, management, and tech support included in the cost?
As someone who has spent my career protecting data for small start-ups to Fortune 10 companies (and everything in between), I have found one thing that every business has in common: the need for a holistic, layered approach to cybersecurity.
If you are the one responsible for addressing the cybersecurity needs of your organization, it is common to become exhausted by research. It takes a lot of time and patience to stay on top of the latest software products, tools, and services on the market.
7 Cybersecurity Must-Haves
Here is an overview of seven cybersecurity essentials that every business should assess. By comparing your current state with these must-haves, you can better prioritize how to fill any gaps that might exist:
24×7 Security Operations Center (SOC) – Will you have a knowledgeable team of specialists to provide round-the-clock support for cybersecurity issues that arise?
Security Information & Event Management (SIEM) – Does your solution incorporate the latest threat intelligence? Will it provide security orchestration, event logging, and analytics?
Email Threat Prevention (ETP) – How are email-based threats handled? Will you utilize machine learning and AI to identify attacks that evade policy-based defenses? Does your solution weed out credential-phishing URLs or impersonators?
Endpoint Security (Antivirus & Malware Protection) – How will you know when connected devices and infrastructure access points are compromised? Do you have integrated malware and antivirus (AV) defenses that analyze behavior and learn from it?
Firewall & VPN Security – Are your systems protected against new and malicious URLs? What happens if a “zero-day” exploit is successful in targeting a loophole in your software?
Cloud Security (CASB) – Is your solution built for cloud computing models such as SaaS and IaaS? How does it work with cloud-based services (i.e., Office 365, Box and AWS)? Are on-premises, mobile and remote users protected?
Mobile Device Management & Security (MDM) – How secure is your data across laptops, tablets, phones, IoT, & other devices? Is there seamless integration with existing architecture?
Comparing Costs & Risks
Once you review all these aspects of cybersecurity, the next step is to compare hard costs, soft costs, and risks.
For example:
Acquisition: How much will you invest to acquire the right products or services? (What happens if you don’t?)
Integration: How do you ensure that your solutions will integrate with your existing systems and software? (What happens if they don’t?)
Maintenance: What will you spend to maintain and update those products or services? (What happens if you fall behind schedule?)
Effectiveness: How will you know your solution is working or not working? (Who in your organization will manage the response or remediation for any flagged issues?)
How an MSSP Can Help
A Managed Security Services Provider (MSSP) can relieve the burden of researching and selecting the right cybersecurity software tools for your business, as well as managing the solution after it is installed. Not all MSSPs are equal, so make sure you choose one that utilizes enterprise-grade, constantly updated tools and software.
It is also helpful to work with a managed security service provider that has strong and influential relationships with software and technology providers—especially when quick product support or remediation is needed.
Finally, make sure that product training/education, seamless integration, expert-level technical support, and ongoing threat management are in your MSSP’s wheelhouse.
Ostra is a next-generation managed security services provider (MSSP) that aims to make cybersecurity technology simple, comprehensive, and accessible to businesses of all sizes. By combining best-in-class tools, proprietary technology, and human expertise, Ostra is helping create a world with greater data privacy and protection for all of us.
Michael Kennedy is the founder of Ostra Cybersecurity, a multi-layered and fully managed Security as a Service. Recognized as a cybersecurity industry trailblazer, he is a dynamic leader, speaker, and fierce advocate for data privacy.
https://www.ostra.net/wp-content/uploads/2021/05/featured-image_Loaded-Concept_r2-1030x689-1.jpg6891030Michael Kennedyhttps://www.ostra.net/wp-content/uploads/2023/08/Ostra-logo-2023.pngMichael Kennedy2021-07-06 11:20:352023-09-08 17:47:49Cybersecurity – a loaded concept
Most people know about the large-scale data hacks and ransomware events that top the national and global headlines. Recently, for example, the Colonial Pipeline cyberattack has gotten significant coverage on every major news outlet; last winter, everyone was talking about the SolarWinds breach. But what many people don’t realize is that, far from the glare of worldwide media attention, small and medium-sized businesses are increasingly being targeted by cybercriminals.
Cybersecurity in the Age of Risky Business
There are a few reasons why the risk of cyberattacks are increasing for smaller businesses. First, over the past year the COVID-19 pandemic has forced businesses to figure out a way for an unprecedented number of employees to work remotely. This has opened up new security challenges across the board:
“Remote work has challenged enterprise security monitoring in numerous ways from the platforms used for communication to the devices people are using and networks on which they transmit data. We have seen an increase in social engineering opportunities as cyberespionage and cybercriminal groups attempt to take advantage of vulnerable employees unfamiliar with managing their technology environments.” – 2020 Cyber Threatscape Report by Accenture
Although businesses of every size are navigating these issues, cybercriminals know that small and medium-sized businesses (SMBs) are even more vulnerable. Some SMBs don’t take the time to develop a cybersecurity strategy because they think they are too small to worry about being attacked. Others rely on consumer-grade, off-the-shelf solutions to protect their data.
The following statistics about the impact of cyberattacks on SMBs are alarming:
Insurance carrier Hiscox reported that in 2019, 47% of small firms (1- 50 employees) and 63% of medium sized firms (50-249 employees) experienced one or more cyberattack.
According to IBM, small and mid-sized businesses are hit by 62% of all cyber-attacks, or about 4,000 per day.
Smallbiztrends.com stated that 43% of cyberattacks are aimed at small businesses, while only 14% are able to mitigate such risks effectively.
The Denver Post shared a S. National Cyber Security Alliance report that 60% of small businesses victimized by a cyberattack will go out of business within six months.
In reality, if your business or clients handle customer data—whether it’s banking/credit card info, medical records, sensitive research data, tax information, customer databases, legal documents, proprietary product information, or anything else that criminals would love to access—then you are at risk and should learn how to prevent ransomware. Small businesses with many clients are the most vulnerable for ransomware attacks. Don’t be forced to pay to get your data back—instead, be proactive in order to protect it adequately.
The Problem With “Off-The-Shelf” Protection
Consumer-grade, off-the-shelf (COTS) cybersecurity products are widely available on the marketplace. At first glance they can seem appealing to small business owners. These COTS options tend to be free or low-cost; they may be conveniently bundled with other business software. They may also be pre-installed, “standard” features on new devices or laptops that you purchase from the manufacturer, or they are recommended by your managed service provider. Seems suitable for a business owner who is working with a limited technology budget, right?
But cybersecurity insiders and hackers know that COTS solutions have a lot of gaps that can actually leave companies vulnerable. They simply don’t protect businesses at the same level as top-tier cybersecurity solutions.
For example, consumer-grade tools are typically updated about once or twice a month. First, the manufacturer has to create the update and make it available. Next, the end user needs to see that the update is available, and manually update their device—or, if they are an IT director at a company, they will manually update many devices. Unfortunately, two or three weeks is too long for a business owner to be left vulnerable—when new threats are being created on a daily basis. The cybersecurity solution that was updated a month ago just can’t recognize or respond to a threat that was deployed yesterday.
This article on the U.S. Cybersecurity Infrastructure & Security Agency (CISA) website explains why COTS software is generally an attractive target for cybercriminals:
“… the major COTS packages typically manage important information and connect to more systems… Further, the information and experience obtained in one attack can be used again on the same package elsewhere.” – Craig Miller, Cigital, Inc.
Smarter Tools, Quicker Updates
By contrast, the latest generation of cybersecurity tools are updated constantly. They utilize the latest technologies—such as real-time threat intelligence, advanced analytics, and machine learning/AI—to proactively anticipate and respond to threats. Sophisticated cybersecurity tools don’t just react to known threats, but they also prepare for unknown threats (a.k.a. “zero-day exploits”) that occur on the same day that a software weakness is identified.
Many of today’s most crippling cyberattacks are coming from new threats being created every day. The best way to guard against these unknown variables is to deploy a solution that is constantly on the lookout for these unknown variables. For example, Ostra is constantly monitoring and collecting threat intelligence info from around the globe to provide automatic updates all our clients within minutes. Ostra’s solution is customized and automated, so our clients do not have to spend time maintaining it.
Are You Ransomware Bait?
Another reason every business owner needs to make cybersecurity a priority is because of business liability issues. Laws are expanding on a daily basis in terms of the data that businesses are legally expected to protect.
Dealing with ransomware is a great example of a liability that many business owners do not prepare for—until it’s too late. Have you ever been locked out of your house or car? It’s pretty inconvenient. Now imagine getting locked out of your business because of a ransomware event. Suddenly you cannot make or receive payments, communicate with clients, or even access important files.
In addition to your company’s data, any customer information on your system is now being held hostage as well, unless you pay the criminal to get it all back. Learning how to prevent ransomware is key. (Preventing ransomware is one of the reasons our company was founded—read more about the Ransomware Attack that Sparked Ostra Cybersecurity.)
A comprehensive cybersecurity strategy, paired with the best technology, can help you avoid these liabilities.
Building an Effective Cybersecurity Strategy
There are three important steps that every business can take to effectively protect against cyberattacks.
Step 1: Develop an overall cybersecurity strategy.
Business owners should never have a false sense of security by relying on technology alone to protect their data and systems. For example, Ostra’s best-in-class approach to technology combined with multiple layers of defense will go a long way in protecting your business—but technology is not the only piece of the puzzle. In addition to choosing the righttechnology, business owners should also develop an overall cybersecurity strategy that includes:
Conducting cybersecurity assessments to find gaps in vulnerability
Providing regular, ongoing cybersecurity training for employees
Putting cybersecurity policies in place to protect your organization
Step 2: Back up your data (and keep backups in a safe place).
This is a bit like fire insurance—you hope you’ll never need it. But the U.S. government recently issued an Alert urging businesses to help prevent business disruptions caused by ransomware attacks. In addition to regular data backups, make sure you isolate those backups from all of your network connections.
Step 3: Use multiple layers of high-caliber defense.
Cybersecurity is a very broad category that can cover a lot of different areas. Make sure all of those are covered (keep reading below for the top 6 things to look for in a cybersecurity solution). For example, while it is great to pay for the perfect firewall, you still have a lot of vulnerabilities if your email, mobile devices, or cloud applications are not protected.
Building a comprehensive cybersecurity strategy involves more than installing the right products or working with the right partners. Make sure that you have those other safeguards in place as well.
Top 6 things to look for in a cybersecurity/MSSP solution
Working with a Managed Security Services Provider (MSSP) is one important piece that should fit in with your overall cybersecurity strategy, in order to help with managed detection and response to threats. Once you realize that a multi-layered approach is needed, the next step is to decide which areas are the most important to address.
I recommend covering your bases in the following areas:
Have a Security Operations Center (SOC) and Security Information & Event Management (SIEM) system in place. Ideally, you want 24/7 monitoring, combined with technology that provides the latest threat intelligence and insights from the front lines. Employing SOC & SIEM gives you the added protection of on-call staff that can provide full support that includes investigating and remediating all of the alerts. . This will ensure you have the best protocols, cybersecurity experts and technologies to stay ahead of future attacks, while also providing analysis that helps you learn from past threats.
Provide employees with Email Threat Prevention (ETP). Email is the number one vehicle for data breaches. Effective ETP will include advanced URL defense against credential phishing and impersonation. It should utilize machine learning, AI and analytics to identify and block both known threats and new, malicious campaigns.
Pay attention to Endpoint Security, Antivirus (AV) and Malware Protection. Your solution should effectively block threats, secure your data and intellectual property, and provide a system that can isolate a device if it detects a threat so it cannot spread across your network. It should use intelligence-led, real-time detection to cover all access points—laptops, desktops, servers and more.
Choose your Firewall and VPN Configuring the firewall is a complex process, so make sure it is done well, and by a professional. An effective Firewall and VPN will automatically detect and prevent “zero-day” (brand new) exploits and various types of malware, as well as known threats. You’ll also want a solution that offers automated, intelligent policy recommendations and machine learning-powered visibility across your IoT and other connected devices.
Select the right Cloud Security (CASB) for cloud-based apps, software and services. Successfully protecting information (with automatic blocking, quarantining or encrypting data) helps companies maintain legal compliance in the cloud without impacting productivity and cost. Your CASB solution should allow you to govern cloud and web use for all users whether they are on-premises, mobile or remote.
Don’t forget about Mobile. With more employees staying connected to work email and networks via smartphones, mobile security has never been more important. Make sure you have a mobile security (MDM) solution that can seamlessly integrate with your existing architecture to protect apps, documents, content and data on any device (using any operating system) from a single platform.
Why is Third-Party Validation Important?
When business owners are assessing cybersecurity solutions, it’s also important to look for third-party validation. This is the process of getting an independent, third-party source to test your product or solution and make sure it does what is claimed.
For example, in this article about the importance of third-party validation for cyber solutions, one industry expert noted:
“…without in-depth testing no-one really knows whether or not an Endpoint Detection and Response (EDR) agent can do what it is intended.”- Simon Edwards, founder and director at SE Labs:
Choose to work with a partner whose goal is to safeguard your company, and not just to sell a particular program or technology solution. There are many great products and organizations in the cybersecurity space, so make sure the one you select has a vested interest in protecting your business and your clients.
Ostra’s approach to cybersecurity
Ostra’s expert team understands how cybersecurity works at large corporations, so we know how to leverage top-tier tools and technologies to create the best sphere of protection possible. Our dedicated experts are constantly monitoring and assessing the best tools available on the market. This allows us to create a solution using the same resources Fortune 100 companies use, but we’ve made it simple, accessible and affordable for small and medium businesses.
In the process of building Ostra’s Cybersecurity solution, we have also been fortunate to work closely with some outstanding tech companies—some of the biggest and best in the world—who are continually evolving with the constantly changing cybersecurity landscape. Combining these best-in-class tools across every category of cybersecurity enables us to protect our clients with a holistic solution.
Ostra is continuously evaluating the marketplace to see who can fit that space, to make sure that our solution is up-to-date with the latest and best features to protect your business. Our highest priority is delivering a high quality, simple-to-use, efficient cybersecurity solution that allows our clients to “set it and forget it.”
Learn more about how to prevent ransomware, types of malware and more. Contact our team today for a free assessment to see what vulnerabilities may exist for your business or clients.
Joe Johnson the president of Ostra Cybersecurity, a multi-layered and fully managed Security as a Service. Joe is a transformational business leader skilled at taking a company’s vision and turning it into reality.
https://www.ostra.net/wp-content/uploads/2021/05/flattened_tech-approach-blog-feature-imageR2-1030x687-1.png6871030Joe Johnsonhttps://www.ostra.net/wp-content/uploads/2023/08/Ostra-logo-2023.pngJoe Johnson2021-05-27 05:00:192023-09-10 05:14:06Why Cybersecurity Should be on Every Business Owner’s Radar
The acceleration of technology and cybersecurity transformation has left many organizations unprepared. The migration of entire work teams from traditional offices to virtual teaming is daunting when there’s time to plan, catastrophic when pushed upon companies in response to COVID-19. Considering cybersecurity measures has never been so challenging, and so very important to preventing ransomware, protecting from malware, and establishing protocols for cloud data protection.
No business has faced a harsher reality than small and mid-sized businesses. Companies who cannot afford a CISO (Chief Information Security Officer) are left to read between the lines of numerous promotions and promises from various software and consulting companies promoting their individual solutions.
Gartner says COVID-19 is still top challenge for most organizations
Though a shortage of technical, security and IT personnel is problematic, and the rapid migration to cloud computing is challenging, Gartner states that “responding to COVID-19 remains the biggest challenge for most security organizations in 2020.” Beyond 2020, companies are still reeling from the digitization acceleration they were unprepared to tackle – and smaller companies need to find solutions that work like the big guys but are manageable for the little guys. In the Gartner Top 9 Security and Risk Trends for 2020, threat detection and response capability improvements took the #1 trend spot. It is not enough to respond after a threat has been made or a hack has begun, technology needs to detect, prevent and protect businesses from a cyber-attack.
Additionally, Gartner trends data privacy in the #5 spot. Privacy is no longer just a compliance, legal or auditing issue according to Gartner, it is an “influential, defined discipline of its own affecting almost all aspects of an organization.” Protection of data and privacy integrated in an overall cybersecurity transformation plan is essential for small business. So, who is providing Fortune 500 solutions in ways that are attainable to smaller sized businesses?
Gartner says now is the time to accelerate cybersecurity transformation
According to Gartner’s article, Why Now is the Time to Accelerate Digital, “organizations have to change, now. There is no option to continue on as they have. It has to be done to preserve the business and the future of the business.” Cybersecurity is a key part of the digital transformation that smaller companies must adopt and prioritize for their health and well-being.
Gartner suggests organizations apply digital business acceleration in these five dimensions:
The “everything customer,” who requires both deep personalization and ironclad privacy
Right-scoped growth, which may involve new customer segments and the abandonment of incumbent value propositions
A composable technology foundation that balances efficiency with resilience
An adaptable workforce, equipped with the skills, processes, information and autonomy to flex in the face of disruption
Any-scale operations that can spin up and down with demand and unforeseen circumstances
Ostra stands ready to help small business with digital transformation
“With cyber-attacks and security breaches on the rise, the need for better cybersecurity solutions and real system protection is no longer something to think about for the future,” said Michael Kennedy, Founder of Ostra Cybersecurity. Kennedy and his executive team, Joe Johnson and Paul Dobbins, have made it their mission to combine the best Fortune 500 technology into an easy-to-use suite of services manageable for smaller companies.
Seeing the opportunity to help smaller companies, Ostra went even further in its mission and designed a go-to-market strategy that marries them with the best technology companies already providing products and services to the small and mid-sized business market – Ostra’s channel partners.
An Ostra Cybersecurity solution can scale with a business, protect customer privacy, enable an adaptable workforce and be part of the technology foundation that sets a company up for long-term success.
Ostra Cybersecurity – Solving Problems Before They Happen
With Ostra Cybersecurity comes a team of experts in the field of relationship management, IT integrations and decades of combined cyber security expertise. We operate behind the scenes to protect businesses by managing Detection and Response before threats get in. This saves our clients time and tens of thousands of dollars dealing with costly problems associated with simply reacting to threats and data breaches after they occur.
Ostra makes it manageable for small companies to have access to Fortune 100 services and to understand how to prevent ransomware from infiltrating their systems. Ostra provides cloud data protection to avoid the various types of malware. Waiting until an attack happens is not a sound strategy, and we have made it our mission to provide data protection services to companies of all sizes.
By making cybersecurity technology simple, comprehensive, and accessible to business of all sizes, Ostra is helping create a world with greater data privacy and protection for all of us.
As Your Trusted Cybersecurity Team, Ostra makes cybersecurity simple and accessible to businesses of all sizes. Ostra provides its partners and their clients with a multi-layered, comprehensive and fully managed Security as a Service.
https://www.ostra.net/wp-content/uploads/2021/03/Ostra_Stock-Image_digitization-5140072_1280.jpg8531280Ostra Cybersecurityhttps://www.ostra.net/wp-content/uploads/2023/08/Ostra-logo-2023.pngOstra Cybersecurity2021-03-31 09:57:272023-09-08 17:56:55How to Accelerate Cybersecurity Transformation for Small Business
Taking care of your business’s data and sensitive information means staying vigilant against cybersecurity threats at all times. This is made more difficult each year, as new types of viruses, technologies, and methodologies for cybercriminals are created. For example, since its inception in the 70s, many variants of malware viruses have been created, amplifying the danger of cybersecurity threats for small and medium-sized businesses.
To help defend your organization against malware, we’ve crafted this guide of 11 of the most common types of malware and how to effectively get rid of them.
11 Types of Malware: How They Get in Your System, What They Do, & How to Get Rid of Them
1. Ransomware
How it Gets in Your System: Phishing emails that contain malicious downloads or attachments are often the source of ransomware.
What it Does: Blocks access to a computer system or computer files until a sum of money is paid.
How to Get Rid of it: Unfortunately, paying the ransom is the easiest way to remove this malicious software. This makes prevention all the more important.
2. Spyware
How it Gets in Your System: This type of malware gets in through drive-by-downloads or another inadvertent action by an internal employee—such as clicking on a link in a phishing email.
What it Does: Steals internet usage data and sensitive information (credit card and bank account information, PII)
How to Get Rid of it: A spyware removal tool can be used, depending on the severity of the infection. More drastic actions may need to be taken if the virus is robust.
3. Adware
How it Gets in Your System: Enters via malicious apps or pops-ups that take advantage of browser vulnerabilities.
What it Does: Bombards your devices with unwanted advertisements on your computer, attempting to get you to download malicious software.
How to Get Rid of it: In some instances, you can simply uninstall the adware. With more serious adware issues, you’ll need to use anti-adware software to get rid of it.
4. Malvertising
How it Gets in Your System: An employee clicking on malicious ads that appear legitimate will cause malvertising to be downloaded onto the system.
What it Does: Attempts to inject malicious code that installs malware or adware on the user’s computer.
How to Get Rid of it: Delete any files that were downloaded, use a virus scanner, and eliminate. In some instances, you’ll need to work with a cybersecurity team to totally rid the computer of the virus.
5. Trojan Malware
How it Gets in Your System: A trojan virus will typically enter a system through a piece of malware attached to an email. The file, program, or application appears to come from a trusted source.
What it Does: Damage, disrupt, steal, or in general inflict harmful action on your data and network.
How to Get Rid of it: Installing an antivirus program that will search, isolate, and remove the virus is one of the best ways to get rid of a trojan virus.
6. Fileless Malware
How it Gets in Your System: Phishing emails are a common culprit for fileless malware. Unlike many other viruses, fileless malware doesn’t touch the hard drive but instead embeds itself into the memory.
What it Does: Gains access to your secure data and exploits it.
How to Get Rid of it: Fileless malware can be particularly difficult to purge from your system. Preventative measures are a must for this type of malware.
7. Worm Malware
How it Gets in Your System: Traditionally gains access to a system through a phishing email. It can also be inadvertently downloaded online.
What it Does: As a self-replicating virus, worm malware can quickly spread and wreak havoc on a company by gaining access to their valuable and private data.
How to Get Rid of it: Using a dedicated removal tool will assist in eradicating a worm virus in your system. If the virus has spread too fast, you may need to bring in some outside help.
8. Mobile Malware
How it Gets in Your System: Mobile malware is exactly what it sounds like—malware that gains access through a mobile device. This can be done by drive-by-downloads, trojan viruses, mobile phishing, and browser exploits.
What it Does: Gains access to private information and data.
How to Get Rid of it: Restoring your phone from an earlier back-up can potentially rid your mobile device of the malware.
9. Rootkit Malware
How it Gets in Your System: Often derive from unintentional downloads online. They are designed to remain hidden on your computer.
What it Does: Remotely control your computer to gain access to your system and data.
How to Get Rid of it: Because rootkit malware is difficult to detect and get rid of, this is another type of malware where prevention is key.
10. Keylogger Malware
How it Gets in Your System: Phishing emails and trojan viruses are two of the more prevalent ways in which keylogger malware infects a computer.
What it Does: A keylogger is a type of spyware that can be used to track and log the keys you strike on your keyboard, capturing any information typed—including PINs, credit card numbers, usernames, passwords, and more.
How to Get Rid of it: Anti-rootkit software is oftentimes your best bet when dealing with keylogger malware.
11. Bot Malware
How it Gets in Your System: Malicious pop-up ads or the downloading of dangerous software from a website are often the starting points of bot malware.
What it Does: Bot malware is a self-propagating malware capable of infecting its host and connecting it back to its central servers. Obtaining financial information, exploring back doors open by worms, content scraping, email address harvesting, and more can all be done by bot malware.
How to Get Rid of it: A robust antivirus software will need to be deployed to get rid of bot malware.
The Best Offense is a Good Defense
In order to best protect your business from malware, prevention methods must be integrated into your system. Ostra has Malware protection built into our integrated technology so threats are blocked before they get in.
Ostra’s multi-layered solutions make keeping your data safe simple, as it prevents viruses from compromising your system in the first place. Instead of piecing together a cybersecurity solution from multiple providers, you can choose Ostra and cover your emails, endpoints, mobile devices and your entire network with one centralized solution.
Ostra works around the clock to protect and secure your data. After all, cybercriminals don’t take days off—your cybersecurity solution shouldn’t either.
Reach out to Ostra to get started on combating malware and other cyber threats today.
As Your Trusted Cybersecurity Team, Ostra makes cybersecurity simple and accessible to businesses of all sizes. Ostra provides its partners and their clients with a multi-layered, comprehensive and fully managed Security as a Service.
https://www.ostra.net/wp-content/uploads/2021/02/AdobeStock_300154624-scaled.jpeg13942560Ostra Cybersecurityhttps://www.ostra.net/wp-content/uploads/2023/08/Ostra-logo-2023.pngOstra Cybersecurity2021-02-25 16:58:462021-02-26 13:16:4311 Types Of Malware + How To Detect & Remove Them
The importance of data security has taken on new life in recent years. While initially an area of interest for industries like healthcare and financial services, our digital era has made data security something that all companies—regardless of what field they operate in—must integrate into their business plan. The cost of failing to do so can be detrimental to a company’s customers, bottom line, and reputation.
But, what does the future have in store for data security—in particular, what will it look like this year, in 2021? Before we get to that, it’s important to first look back at 2020 and the lasting impact it will forever have on cybersecurity going forward.
How the Coronavirus Pandemic Forever Changed Cybersecurity
One of the most significant challenges of cybersecurity is accounting for all the endpoints and devices throughout your company. Securing all of your endpoints was made even more difficult as offices transitioned to remote work where employees connected from personal networks and devices.
As a result of remote working, cybersecurity threats and incidents skyrocketed. The FBI reported that cybercrime increased 400% during the initial months of the pandemic. Over the course of the year, ransomware attacks, phishing scams, and crypto-jacking all skyrocketed, growing by 252%. Simply put, maintaining a secure, robust cybersecurity approach is tough when employees are scattered throughout the country.
But, once the vaccine has been distributed to enough Americans, we can go back to working in our offices again, right? Well, not exactly. First, even when we reach herd immunity—which experts estimate to be somewhere around 50-80% of the population—it’ll still be quite some time before everyone is allowed back to their offices.
In addition, over 80% of business leaders plan on allowing partial work from the home structure after COVID, according to Gartner. While there have been many claims during COVID that suggested this or that as “the new normal,” remote working IS the new normal. Businesses have learned that their employees can still be productive while working remotely and that it is necessary to allow remote working conditions for employees that have families and live busy lives.
This all goes without mentioning the tools that cybercriminals now have at their disposal, which makes them difficult to thwart. Cyberthreats are getting more complex, as evidenced by the recent FireEye and Solarwinds breaches that tie back to Russia. Thanks in large part to the quick actions on FireEye’s part, the threat was able to be mitigated—proving that having systems in place to catch and contain breaches is essential. But, the point remains—these cybercriminals are getting smarter and, to some degree, more daring.
Protecting Your Business in 2021: Cybersecurity Strategies to Adopt That Will Keep Your Company Secure
Move to the Cloud
One of the smartest moves you can make in 2021 to improve your company’s data security is adopting a cloud-based cybersecurity solution. In fact, we’re likely to see a huge burst in cloud adoption in 2021. A recent study by Next Pathway Inc. found that 65% of companies are making cloud migration a top priority in 2021.
With its many benefits and its overall convenience, the push for cloud adoption was inevitable. This includes the ability to grow with your organization, as well as allow your employees to access the data they need, regardless of where they are. A cloud-based cybersecurity solution also allows you to centralize your security.
Businesses that were already using cloud-based security were able to better protect their data in 2020. To ensure that you’re doing everything you can to keep your data secure, consider looking into cloud solutions in 2021.
Integrate a Proven Mobile Cybersecurity Solution
Mobile threats also accelerated during the COVID-19 pandemic, as cybercriminals saw them as another way to gain access to a company’s sensitive data. Employees have their emails linked to their smartphones, which provides another avenue for data thieves to gain access. In addition, smartphone owners also download apps onto their phones. If they aren’t careful, they may accidentally download a malicious app that can compromise one of your business’s network endpoints.
For these reasons, finding a cybersecurity solution that incorporates mobile security into its services is of the utmost importance. Because tablets are often used for business functions, they need to be protected as well.
To ensure that your employee’s mobile devices are secure, invest in a proven mobile cybersecurity solution this year.
Work With a Quality SaaS Provider
The benefits of working with a Software-as-a-Service (SaaS) provider cannot be overstated. Perhaps most importantly, SaaS providers offer a way for companies that have fallen behind on their cybersecurity to get themselves up-to-speed fast.
Teaming up with a third-party cybersecurity team allows you to be proactive with your data security without sacrificing internal hours. You can focus on growing your company while your cybersecurity partner keeps your data safe. Working with a SaaS provider enables you to be more flexible internally with how you allocate your time and resources. Instead of building out an internal cybersecurity team, which can take months, if not years, in 2021, we’ll see more companies opting to work with a reputable, high-quality SaaS team.
Ostra’s Enterprise-Grade, Cost-Effective Solution is Perfect For SMBs
It’s clear that 2020 forced companies to take a long hard look at their security measures, with the above strategies being just some of the many moves we’ll see this year.
This pivot to a more robust cybersecurity plan is especially true for small and medium-sized businesses that didn’t have the resources to make the switch to remote working as seamlessly as large companies. If you want to avoid becoming a headline in 2021 for a cybersecurity breach, then you need to ensure that your data is protected from all angles and devices, it’s essential to integrate a robust, comprehensive cybersecurity plan into your system.
At Ostra, our mission is to provide best-in-class data protection for businesses, which means effectively stopping known and unknown internet threats from getting at your protected data. Our services cover mobile devices, endpoints, firewalls, email security, and cloud solutions.
We believe that everyone is entitled to quality, professional-grade cybersecurity. That’s why we offer cost-effective, enterprise-grade cybersecurity solutions for SMBs.
As Your Trusted Cybersecurity Team, Ostra makes cybersecurity simple and accessible to businesses of all sizes. Ostra provides its partners and their clients with a multi-layered, comprehensive and fully managed Security as a Service.
Cybersecurity can be an obscure and broad term covering everything from sophisticated digital systems to simple Norton anti-virus software. It’s important to know the nature of cyber threats and how you can protect your business against them.
Experts predict that cybercrime in 2021 will cost companies around the globe $6 trillion. By 2025, that number is expected to increase to $10.5 trillion. We have to treat cybersecurity protection as an essential part of business operations.
In this guide, we’ll be breaking down cybersecurity concepts and why it matters in 2021. With an increase in remote working and a rise in cyberattacks, protecting your sensitive data is more important than ever. Understanding the basics of cybersecurity is essential to protecting your business and keeping your data safe.
Regardless of industry – manufacturing, financial services, healthcare, etc.— sensitive data is at the core of business operations. This data can include credit card information, passwords, financial records, patient information, and more. Data breaches can cause a loss in profits, and even more severe, an irreparable break in consumers’ trust. While it is critically important to protect other people’s data, a business also needs to protect its own and ensure it can maintain operations (and reputation) and properly defend against a ransomware attack.
According to this Forbes article, in today’s digital age, every company is a data company, and with this data comes the responsibility of ensuring its safety. It’s our duty as business managers to protect our business operations, our data.
The Importance of Cybersecurity in 2021
This year COVID -19 has forced businesses to adapt their digital security measures as they navigate working remotely. Even after a vaccine becomes readily available, working from home is likely to continue indefinitely.
Businesses and employees have adjusted to remaining productive and carry out business-as-usual while working from home. But, remote workers connecting from personal devices and open networks open the door for an increase in cyberattacks.
The FBI recently reported that the number of complaints about cyberattacks to their Cyber Division went up to as many as 4,000 per day. This represents an astonishingly 400% increase from the complaints they saw pre-COVID.
Today, the question for many business owners is, how to adapt to remote working and still protect their business, clients, and data.
Cybercriminal Methods: What to Be on the Lookout For
In the mid-2000s, 80% of cybercriminals worked independently or were freelancers. They made up an unsophisticated and less skilled group of cyberattacks. As more data is exchanged online and technology has evolved, cybercriminals have gotten more sophisticated. Today, 80% of cybercrimes are part of an underground cybercrime organization and weave complicated and novel cyberattacks.
A pyramid outlining the levels of a cybercrime organization.
The methodology of cybercriminals has evolved over time. Initially, viruses had to be transferred through computer discs. Today, viruses can spread through the internet like wildfire.
Here are some of the key cybersecurity terms and ways in which cybercriminals will attempt to gain access to your company’s data:
Social Engineering and Phishing
Social engineering and phishing involve an attempt at getting personal information under the guise of a trusted source. For example, receiving an email from an email address that looks like your local bank’s email address saying they need you to confirm your account by providing personal information. The email address may also look like the company’s email, and the sender (cybercriminal) may request login credentials.
When an employee’s information is compromised, the hacker may try to bypass security perimeters, distribute malware inside a closed environment, or gain access to secured data.
How to Keep Phishing Threats at Bay:
Implement two-factor authentication
Enforce strict password requirements
Educate employees about the dangers of phishing
Malware
Malware—or malicious software—is one of the most popular types of cybercrime. Able to exist in many different formats, it is a versatile method. It can take the form of atrojan virus,worms, orspyware and can be difficult to get rid of.
For an example of malware in action, let’s look at the trojan virus. An employee sees an ad online for an ad blocker. They download the blocker, which turns out to be a virus posing as helpful software. Once the virus has been downloaded, the hacker is free to wreak havoc by accessing sensitive data and then modifying, blocking, or deleting the data.
How to Stop Malware Attacks in Their Tracks:
Secure your network through security solutions like firewalls
Work with an experienced cybersecurity provider
Install anti-virus software
Ransomware
Ransomware—a type of malware—is malicious software that locks up all the operating systems of a computer and displays a message demanding a fee to regain control of your system. Ransomware can be especially difficult to deal with, as you don’t want to pay the ransom. However, you also don’t want to have your system locked for too long, as this can endanger productivity for your business.
Ransomware can come in different forms, with phishing emails being one of the more popular vehicles. Say an employee opens up one of these emails and clicks on a link asking them to reset their password. Once they click the link, the ransomware downloads itself onto the computer and locks the user out. A pop-up message appears on the screen saying that they need to pay a ransom if they want to regain access. The company pays the ransom, and then they must go through their system and fix any issues and assess the damage. At this point, income has been lost due to these delays and any compromised data. In addition, the company loses credibility with its clients, suppliers, and other stakeholders.
How to Avoid Ransomware Attacks:
Make sure all your software is up to date with patches
Use reliable antivirus software and a firewall
Backup all your files in the event an attack does occur
What Parts of Your Business to Protect
Here are some key areas of your business to ensure you are protected and how cybersecurity service providers like Ostra can help keep your data safe.
Keep Emails Safe
Email is one of the key mediums that cybercriminals use to commit their crimes. Ensure all your employees use a secure email service and don’t send work emails from their personal accounts. In addition, educate your employees about the importance of being vigilant while using their emails.
Ensure Mobile Devices Are Secure
Eighty-five percent of people use their smartphones to access their emails. That means it’s likely many of your employees do the same. Working with a qualified, experienced cybersecurity team is the best way to prevent mobile devices from being compromised, as they can leverage the latest mobile security solutions to keep your data safe.
Identify and Secure All Endpoints
Map out your network endpoints and use cybersecurity solutions to protect them. As we mentioned earlier, there are a multitude of avenues that cybercriminals can attempt to gain access into your system. Endpoints that businesses need to keep secure include desktops, laptops, smartphones, tablets, servers, workstations, internet-of-things devices, etc.
Utilize Cloud Security Solutions
Cloud security is a solution that every business should consider. In addition to being scalable, housing all your data in the cloud can be more secure than storing it on-premise. When looking for a cloud service provider, validate that they are investing heavily in security. By partnering with a cloud security provider like Ostra, you can ensure that as your business moves to the cloud your data is secure.
How Ostra Can Help Keep Your Data Secure and Safe
Are you feeling overwhelmed about the prospects of keeping all your data safe? Don’t worry, we’ve got your back.
Ostra offers a comprehensive cybersecurity solution that can be customized to fit your needs.
Our 360° Protection covers:
Email Threat Protection
Elite endpoint
Malware and Ransomware
Mobile Device
Cloud Application Security Broker
Firewall
SIEM
Security Operations Center (SOC)
While our solutions are thorough, the ease-of-use on your end is impressive. Ostra will seamlessly integrate with your business, and it dynamically updates so there is no need for you to monitor it. Ostra’s solutions will be hard at work in the background of your system, 24/7.
We’ve made enterprise-grade cybersecurity accessible for all businesses—small or large. By merging our proprietary technology and our strategic partnerships with top cybersecurity solutions out there, we’ve created a unique, cost-effective cybersecurity solution available to businesses of all sizes for the first time.
To get started on incorporating Ostra into your cybersecurity plan,reach out to us today!
As Your Trusted Cybersecurity Team, Ostra makes cybersecurity simple and accessible to businesses of all sizes. Ostra provides its partners and their clients with a multi-layered, comprehensive and fully managed Security as a Service.
https://www.ostra.net/wp-content/uploads/2020/12/AdobeStock_113916218-scaled.jpeg18152560Ostra Cybersecurityhttps://www.ostra.net/wp-content/uploads/2023/08/Ostra-logo-2023.pngOstra Cybersecurity2020-12-05 10:48:582020-12-11 15:58:48Cybersecurity 101: The Basics Of Keeping Your Business Secure (2021 Guide)
Many small businesses are currently struggling because of the pandemic. The last thing any small business needs now is a cyberattack, which could easily put a company out of business. So now more than ever there is a need for strong cybersecurity practices, especially in smaller businesses with less cybersecurity devoted resources.
60 percent of companies that are victims of a cyber-attack go out of business within six months. -NCSA
The average loss of a cyberattack in 2019 was around $200,000, which is a lot of money for a small business to pay. This helps to understand why so many companies struggle to succeed after a cyberattack.
These are some helpful tips to help improve cybersecurity in small business
Train your staff
Employee training is the first and one of the most important steps in maintaining quality cybersecurity. Your employees are the main entry point that hackers try to exploit. Hackers try to gain access through employees by tricking them with phishing and social engineering attacks. They also target employees who are working from home on unsecured personal internet networks. Business owners should train their employees to back up data regularly, avoid any suspicious links, and to report any possible phishing scams. Trained employees will reduce the risk of an attack and should be wary of any future attack.
A 2019 Accenture study found that 43 percent of cyber-attacks are aimed at small businesses but only 14 percent are prepared to defend themselves. This is alarming news especially since small businesses are a top-tier target for most cybercriminals. Shows just how many small businesses lack preparedness and how many need to quickly improve their security.
Find a cybersecurity solution
Perhaps one of the best ways to defend your business against cyber threats is to find and install a solid cybersecurity solution. Small businesses usually are short on cybersecurity resources, to begin with, and usually do not have dedicated IT/Cybersecurity experts. Which is why small businesses need a low-cost solution that is extremely effective.
Your business technology should be protected with anti-virus and anti-malware software, this will find and identify any threats to your business. These have security features that will make it harder for any information to be stolen. Every business should have a virtual private network (VPN) that hides your IP address, making it almost impossible for hackers to track you. VPNs are very useful and a necessity if you have employees working from home on unsecured networks. Email protection and maintaining a firewall are also highly recommended in the cybersecurity community.
Ostra offers an affordable and quality cybersecurity solution for your business, that incorporates the very best security tools to protect small/medium-sized businesses. We operate behind the scenes to protect businesses and their most valuable asset, their data.
We leverage known platforms such as FireEye and Palo Alto, to create a sphere of protection for your business and employees, no matter where they are located or what machine they are on.
As Your Trusted Cybersecurity Team, Ostra makes cybersecurity simple and accessible to businesses of all sizes. Ostra provides its partners and their clients with a multi-layered, comprehensive and fully managed Security as a Service.
https://www.ostra.net/wp-content/uploads/2021/01/Ostra-small-business-security-tips-998x681px.jpg681998Ostra Cybersecurityhttps://www.ostra.net/wp-content/uploads/2023/08/Ostra-logo-2023.pngOstra Cybersecurity2020-10-21 12:56:522022-03-30 09:11:30Small Business Cybersecurity Tips
October is Cybersecurity Awareness Month and a time to spread the importance of understanding cybersecurity and cybercrime. As cybersecurity evolves, so do the threats that come with it. To stay safe in today’s cyber world it’s important to understand all the different types of threats that could harm you and your business. Everyone is vulnerable to a cyberattack, not just businesses and computers, your personal devices like your phone, watch, and tablet can all be hacked. This is a shortlist of the many different cybersecurity terms that are important to know to increase your cybersecurity awareness.
Cybersecurity
Cybersecurity is the practice of protecting computer systems and networks from the theft of hardware, software, and data. Cybersecurity works in many ways to defend against all types through hardware, software, and even internal threats. Cybersecurity works as an immediate defense against all types of ways that cybercriminals try to attack.
Hacker
A hacker is someone who gains access to devices or networks by breaching defenses and exploiting weaknesses. Hackers are usually motivated by personal gain or just because they know how to, for fun.
Malware
Malware, short for malicious software, is any type of software that is designed to cause damage and gain access to a computer, network, or database. Examples of malware are computer viruses, ransomware, spyware, adware, and more.
Ransomware
Ransomware is a new and very popular form of malware that locks the users out of their devices and prohibits access to files. After locking the user out, the hackers behind the ransomware then demand an anonymous online payment (ransom) to get their data and device access back.
Spyware
Spyware is a form of malware that hides on a device or network and steals information discreetly without the user’s knowledge. Spyware is used to steal things like bank details and personal information.
Adware
Adware is a form of malware that also hides on your device and annoyingly makes advertisements pop up, usually on web browsers. The adware is meant to gain revenue for the adware developer by monitoring online behavior and spamming the user with targeted ads.
Phishing
Phishing is the practice of sending malicious emails that appear to be from a reputable company to trick victims into the opening and sharing their sensitive personal information. Usernames/passwords, bank account, and credit card details are the main targets for phishing scams. The elderly are one of the most targeted groups for phishing scams. Educate your parents/grandparents on how to avoid phishing scams!
Data Breach
A data breach is an incident that exposes sensitive and protected information, intentionally or unintentionally. A data breach is usually the result of a successful cyberattack, where the hacker then steals information to sell back for a ransom, sell on the dark web, or any other personal gain. Data breaches can force business operations to completely stop, which can cost a lot of money and lost profits.
As Your Trusted Cybersecurity Team, Ostra makes cybersecurity simple and accessible to businesses of all sizes. Ostra provides its partners and their clients with a multi-layered, comprehensive and fully managed Security as a Service.
Ransomware attacks are increasing, and not just for consumers.
Businesses have become a more valuable target for cybercriminals who are looking for a bigger payout. Cybersecurity experts say that ransomware attacks will only become a larger threat in the future.
As cybercriminal groups become more skilled in exploiting and bypassing network security defenses, they can start to target more sophisticated programs. By targeting more important businesses and their assets, like file servers, entire databases, and cloud services. These groups can demand a much higher ransom, with a much higher probability of being paid the ransom as well.
Recently a cybersecurity company has identified a cluster of attacks against multiple U.S. companies, including 8 Fortune 500 companies. These attacks were well planned out with the intent to deploy ransomware on the company networks. By using ransomware, the goal was to encrypt computer networks and servers, then demand a multi million-dollar ransom. The attackers were identified by the security company and disrupted before the companies had to pay millions, and lose valuable operating time.
Attacks like these are well coordinated and usually begin taking place weeks before anyone notices.
“Cyber criminals often spend weeks poking around in a network before they make their attack, which means they have time to understand key digital assets, like the CEO’s emails for example, allowing them to put even more pressure on their victims”.
Protect yourself from Ransomware
It is more important today then ever before to keep your business protected from the high possibility of a ransomware attack. Especially as ransomware becomes more sophisticated. You could be caught having your data encrypted before even realizing it’s happening.
Ostra Cybersecurity offers a Fortune 100 caliber solution, that is simple to deploy and use whether your business is 20 people or 2000. Ostra provides active defense protection for your businesses’ data and acts immediately instead of monitoring and alerting like many antiviruses do.
As Your Trusted Cybersecurity Team, Ostra makes cybersecurity simple and accessible to businesses of all sizes. Ostra provides its partners and their clients with a multi-layered, comprehensive and fully managed Security as a Service.
https://www.ostra.net/wp-content/uploads/2019/09/safe-3125637_1920.jpg12801920Ostra Cybersecurityhttps://www.ostra.net/wp-content/uploads/2023/08/Ostra-logo-2023.pngOstra Cybersecurity2020-07-02 10:49:012024-01-18 13:27:00Ransomware is Getting Worse
We may request cookies to be set on your device. We use cookies to let us know when you visit our websites, how you interact with us, to enrich your user experience, and to customize your relationship with our website.
Click on the different category headings to find out more. You can also change some of your preferences. Note that blocking some types of cookies may impact your experience on our websites and the services we are able to offer.
Essential Website Cookies
These cookies are strictly necessary to provide you with services available through our website and to use some of its features.
Because these cookies are strictly necessary to deliver the website, refusing them will have impact how our site functions. You always can block or delete cookies by changing your browser settings and force blocking all cookies on this website. But this will always prompt you to accept/refuse cookies when revisiting our site.
We fully respect if you want to refuse cookies but to avoid asking you again and again kindly allow us to store a cookie for that. You are free to opt out any time or opt in for other cookies to get a better experience. If you refuse cookies we will remove all set cookies in our domain.
We provide you with a list of stored cookies on your computer in our domain so you can check what we stored. Due to security reasons we are not able to show or modify cookies from other domains. You can check these in your browser security settings.
Other external services
We also use different external services like Google Webfonts, Google Maps, and external Video providers. Since these providers may collect personal data like your IP address we allow you to block them here. Please be aware that this might heavily reduce the functionality and appearance of our site. Changes will take effect once you reload the page.
Google Webfont Settings:
Google Map Settings:
Google reCaptcha Settings:
Vimeo and Youtube video embeds:
Privacy Policy
You can read about our cookies and privacy settings in detail on our Privacy Policy Page.
Ostra Cybersecurity, a leading provider of world-class cybersecurity solutions for small and medium-sized businesses, recently named 
How to Become a Cybersecurity Reseller
Cybersecurity has become an essential aspect of business operations. With the increasing complexity of cyber threats and the value of sensitive data, organizations must adopt robust strategies to protect their assets.
In the IT world, cybersecurity is a niche that can be incredibly overwhelming and stressful. Consider the following statistics:
Another reason every business owner needs to make cybersecurity a priority is because of business liability issues. Laws are expanding on a daily basis in terms of the data that businesses are legally expected to protect.
