Playing It Safe

A DISTRIBUTOR  ASKS: With so many email scams hitting my inbox regularly and reports of computer viruses holding data hostage for payment, I’m concerned that I’m not doing enough to protect myself and my company’s data. What steps are other small businesses taking to ensure they don’t become victims of an email scam or virus?

 

Two years ago, I fell victim to a ransomware virus and was completely taken by surprise. The IT researchers I contacted didn’t have a resolution, my backup data was rendered useless and every week the ransom would double. It was not a very good situation to be in when your business depends on the data.

I consider myself to be very tech savvy and always conscientious about what websites I visit and the links that I click on. For the life of me, I have no idea where I picked up that virus. Needless to say, I dedicated some serious time to researching that particular virus to find out if there was a workaround. I was fortunate to have friends who have friends in the thick of the cybersecurity field. I asked them what I should do and most of the responses I received advised me to restore my data from my backup. It was an excellent suggestion, but one that was negated by this virus.

The virus encrypted my USB-connected backup drive and my cloud-based Google Drive. So here I was, diligent about backing up my data—one of those actions most people fail to do—yet the virus got those drives as well. Let’s just say I was not a happy camper.

In addition to the fact that I could not access my data, nothing—not a single file of value—was readable. I’m taking about all of my customer files, my family photos and videos, every art file that I have created over years of being in business. I think it may have gotten my QuickBooks data file, too.

The thugs who created the virus were very smart. They use the best-known encryption technology available. Then they take a very apologetic approach to the fact that all of your vital data has been encrypted and that for $500 in bitcoins they would be happy to send the key to decrypt all the files. Oh, and every week, for up to four weeks, the ransom will double. And if I don’t pay by the end of the four-week period the key that I need to access my files will be destroyed. 

I sat in amazement as I read their words and realized that they had me either way. I either had to pay the ransom and hope they send me the key, or not pay the ransom and lose access to all of my files. By the way, have you ever thought about how to buy bitcoins? Me neither—another lesson I had to learn real fast.

So, I explain all of this to you to hopefully make you aware that the stuff that is floating out there in cyberspace is real and can be deadly to a business. I know as a small-business owner that I learned a very expensive lesson. So, I would suggest the following actions in an attempt to make your data as secure as possible:

Back up your data in two different places regularly. Get a nice USB drive and also back up your data to the cloud. When the backup process on your USB is complete, immediately disconnect it from your computer or network.

Stay up to date with your operating system. I use a PC and find the regular updates annoying but essential to keep my computer patched to the new flaws that are found.

Install antivirus software on your computer. Do an internet search for the best virus-protection program, read the reviews and buy one.

Use email software that filters out the spam. I prefer G-Suite for my email program, and it is hard to beat Google.

Stay away from the questionable emails with jokes, and the websites that offer news stories with interesting headlines and eye-candy images. If you want to read them, go to another computer.

This stuff is not going away anytime soon so the better prepared you are for the attack, the faster you’ll recover and keep moving forward. Our livelihood and customers depend on it.

MICHAEL MILLER
Owner
ProImage Apparel, LLC
PPAI 624469

 

True computer security requires a multilevel approach—what the industry calls “defense in depth.” You should take a holistic approach, starting at the business internet connection, and with every device within your organization.

For example, install up-to-date antivirus software and firewall protection on all workstations. If a program like Google Chrome, Firefox or SAGE gets an update, your firewall should treat that updated program as a new program. Your firewall rules should include an Implicit Deny function, meaning the user has to take specific action to allow a program they recognize, otherwise the program gets no network access (this is what a firewall does).

For email, you can hover over any link to see where it goes before clicking it. So, for example, if you get an email from an industry supplier, the links should go back to a recognized site, such as that company’s domain name. Any email attachment should be automatically treated as suspect, until you, as the user, do the following:

1 Recognize the sender (or their domain, such as @boblevittcompany. com) as someone with whom you have a business relationship.

2 Recognize the overall content (i.e. during your last email/phone call, you requested a credit card authorization form, and now the party is sending it to you.) 

3 Any document that contains a macro is a virus. The Microsoft Office suite by default will block macros, which are like miniature programs that run inside Word, Excel, etc. files. They are a huge security risk, but for the most part, the promotional product industry does not use these.

4 Any email, attachment or phone call received from a source unfamiliar to you, such as a price request for 4,000 4GB flash drives, should automatically be considered a scam and should not be acted upon, but deleted immediately.

The final leg of true computer security is having a doomsday plan that has been carefully thought through. An example I give to clients is to ask what would happen if I walk into your business and kick a size 9 hole through your computer. What are steps one, two and three to get your business back online? That’s your disaster recovery plan. It will draw upon your hardware availability (do you need to go buy a new computer?) and will draw on your backup plan (the minimum backup needs to be two onsite backups and one located offsite).

The onsite backups are most vulnerable but most accessible. The offsite backup is most secure but the slowest to recover from. Having both backup locations gives you options in a recovery situation, instead of waiting for something to download, etc. The main goal is to treat your business data as what it is: the most important asset in your business. 

RYAN PAULES
CompTIA A+, Network+ & Security+ Certified
Director of Operations
The Bob Levitt Company
PPAI 500797

 

Do You Have An Answer?
A Distributor Asks: How do others handle the issue of overs on orders? Is there an industry standard for the percentage of overs—plastic bags seem to be the highest. Do you charge your customers for the overs and deliver them along with the order or keep them as samples? How do I best manage this?

What’s Your Answer?
Email answers along with your name, title and company name by September 12 to Question@ppai.org for possible inclusion in an upcoming issue of PPB magazine.