Feb 9, 2022 | General, IT News
Protect Your Organization from Threats and Hackers with a Security Baseline Assessment
When you look at your car’s side mirrors, the sticker on the mirror will say “Objects in the mirror are closer than they appear.” This warning message is used to help drivers operate cars safely. We trust these warnings to tell us that, although we have a clear view of the total threat, what we don’t see is how near it is just by checking our mirrors. In the world of Managed Service Providers (MSPs) and channel partners, threat proximity assessments are often a critical resource against threat actors who are trying to infiltrate an organization’s network.
Akin to the car mirror metaphor, an unprepared organization that neglects the proactive steps needed to mitigate security vulnerability will not see just now close these threats really are – simply, they won’t know what hit them.
Most organizations are reacting. Case in point, the 2022 Ponemon Institute’s Global Threat Report found that the #1 motivating factor for implementing an insider management threat plan is having a past security incident. What organizations can learn from this is clear: Threats are constant. Having a proactive plan will always be necessary.
Ponemon also reports that 38% of study respondents state that industry regulations and standards are a primary factor for changing security measures. Security threats come in many forms – internal leaks, external breaches, information mismanagement, etc. Having a security assessment offers rapid discovery and analysis of IT infrastructure that organizations have long sought from their MSPs and channel partners.
These types of assessments provide several key upgrades to understanding your threat landscape. A strong assessment provides a deep dive into an organization’s security policies to see if they are up to date. It also ensures that there is a remediation plan in place that’s tailored to an organizations business risk.
In addition to this, a security assessment aids with compliance issues and offers a comprehensive gap analysis of infrastructure to support any business continuity plans.
With this in mind, Jolera has developed a market-based approach to empowering MSPs and channel partners to reduce the daily security risks from these threat actors for their customers.
Jolera is a renowned, Toronto-based provider of fixed-cost ‘as-a-service’ solutions, and we are introducing Secure IT – Security Baseline Assessment (Secure IT – SBA). This new solution addresses all issues MSPs and channel partners have today regarding the vulnerability assessment of their customers’ IT infrastructure.
The Secure IT – SBA offering conducts an extensive analysis of the organization’s entire infrastructure, which includes security policies, best practices, and areas for improvement. Jolera has developed an innovative assessment approach that captures data-driven insights into all aspects of the security posture and reveals a three-tiered compliance grade.
This assessment also comes with a complete remediation plan built to protect an IT infrastructure while significantly increasing the resiliency of its systems against malicious attackers.
To highlight some of the innovative features developed by the Jolera team includes Security Whiteboarding, Perimeter Security and Device Configuration, and Private/Public Cloud Security and Configuration.
Consistent threats means that neglecting IT infrastructure security is quite costly in the long run. The Ponemon 2022 Global Threat report found that insider threat incidents rose by 44% since 2020. The cost per threat incident has also skyrocketed by more than a third during that time.
By not instituting a security assessment, MSPs and channel partners leave their customers open to mis-used security expenses, misalignment between security initiatives and a lack of overall security direction
The Jolera Secure IT – SBA can also help MSPs and channel partners with security improvement plans by understanding the strengths and weaknesses of their customer’s defense systems, while also reducing time and costs to stay up to date with new and emerging vulnerabilities.
Its time MSPs and channel partners offer a clear vision to their customers’ security posture so they can provide investment protection on their security spend, while also meeting organizational objectives. A security assessment such as Secure IT – SBA can provide clear and objective cybersecurity roadmap organizations are asking for today.
By Paolo Del Nibletto
Jan 19, 2022 | General, IT News
Tick. Tick. Tick. That’s the sound of your organization getting hit with a significant breach. The coming impact of the breach depends on how quickly your organization can mitigate damage and find a solution.
Acting within the first 48-hours after a breach is critical to minimizing harm to your company. Nowadays, most organizations are left trying to find out how to respond to this scenario properly and effectively. Sadly, most organizations do not have an adequate security breach response plan in place. Breaches are scary situations that lead to many unanswered questions for organizations today who simply don’t have the time, know-how, or resources to be protected from them.
This leaves organizations worldwide facing the potential worst-case scenarios such as ransomware, data loss, and outages that could shut down the organization.
As if that weren’t enough to deal with amongst the global pandemic, security incidents are only escalating in severity and frequency. According to research from Cybint, a global cybersecurity education provider, approximately 95% of all cybersecurity breaches are caused by human error. This doesn’t mean technology is perfect in any way – but technology reflects our efforts.
Adding to this compounding problem is the COVID-19 pandemic and lockdowns. This made remote work the new norm: operating the majority of your organization in the cloud. Since the beginning of the pandemic in 2020, remote employees have been the weakest link in an organization’s cybersecurity. Additionally, the recent national launch of 5G, means an increase in total connected devices than ever before, — and all this activity is well-known to the hacker community and cybercriminals around the world.
Therefore, Jolera is taking a market-leading approach to helping Managed Services Providers (MSP) and channel partners in dealing with potential breaches within organizations. The new Secure IT™ Cybersecurity Incident Response (CIR) has been crafted to empower MSPs in preparing all organizations to detect, respond, and recover from security breaches, all while enhancing malware protection, prevention of data theft and service outages.
The Secure IT™ Cybersecurity Incident Response (CIR) comes with its own global security team of experts that helps protect against the worst-case scenario. They act fast and respond to issues within hours, as the recovery phase is enacted within 48-hours from the start of the engagement. The team also works to prevent breaches with an ongoing threat analysis service.
“Most Service Providers today don’t necessarily have knowledge of the Incident Response framework, the specialized cybersecurity teams, or the tools required to adequately respond to breach situations,” said Jolera’s Global Cybersecurity VP Sagar Vyas, who specializes in Cybersecurity Incident Response.
Jolera’s Secure IT™ Cybersecurity Incident Response (CIR) includes 24/7 monitoring and integrations of EDR/XDR platforms. It also features non-stop threat hunting, security incident detection, and response. New to the service is a detailed forensics report that showcases all the findings and mitigations from the breach.
“If your organization isn’t prepared with a full incident response plan and have conducted table-top exercises looking at common scenarios, then it’s best to have a retainer in place such as Jolera’s Secure IT™ Cybersecurity Incident Response (CIR). When invoked, this new service can help navigate cybersecurity incidents of all sizes, including ransomware attacks,” says Vyas.
By working with Jolera, Vyas added that we can bring your organization the necessary experience to handle data exfiltration, privacy violations, and negotiating with threat actors while safely restoring systems, preserving critical forensic data, and diagnostics.
“Companies that fail to preserve evidence in an attack might limit their ability to file an insurance claim,” Vyas said.
Jolera’s four-step approach to cybersecurity incidents includes preparation, identification and containment, eradication and recovery, and forensics.
Cyber-attacks are becoming more prevalent. Without a comprehensive solution, it will only be a matter of time before the organization can no longer recover from the breach.
By Paolo Del Nibletto
Nov 19, 2021 | General, IT News
When you work inside of a Security Operations Center (or SOC for short), the day never ends. It’s demanding and often a seven-days-a-week job, according to Sagar Vyas, the Global Cybersecurity Evangelist for Jolera Inc.
Working inside a SOC is a fast-paced environment where SOC professionals handle events such as alert notifications, triages, security incident responses, and explore how to contain threats that may occur in the future (also called Threat Hunting).
“You are doing multiple things and you have to be able to pivot quickly through them. This is a complex job and finding people with the right skillset for it is has been a challenge, especially in Canada,” Vyas added.
Associate partner, cloud, and security for CrucialLogics’ Claudio Damaso joined Vyas on a panel discussion for the ChannelNext Central Conference in Toronto on the topic of MSP Security, echoing Vyas with his own experiences in SOC.
“We have a dedicated team at CrucialLogics and they eat, breathe, and sleep security.”
Damaso emphasizes that one cannot get by in a SOC with just a background in a few security courses.
“Many people are in the game because they are passionate about alerts, analyzing threats and their intelligence, and predicting future threats,” Damaso said.
Increasing importance in SOCs has been prevalent in both business and government organizations of all sizes. Fresh research from Statista, Canada, found that the total addressable market for SOCs is projected to reach $30 billion USD by the end of 2021.
Over the course of the past 19 months of the Covid-19 pandemic, the thread volumes for SOCs significantly increased, predominantly due to the shift to remote and online work-related security challenges.
Operating a SOC during the pandemic was anything but easy, as “the Internet [doesn’t] stop at the Canadian border,” Damaso explained.
“You need to [be] proactive and preemptive [about threats] before they reach your customer. It’s a constant battle!”
For Managed Services Providers (MSPs), operating without a strong SOC can be detrimental to cybersecurity. Partnering with a skilled SOC provider is the primary suggested strategy for mitigating the high risks of cyber-attacks before they affect customers.
Vyas cautioned that the blurred lines of responsibility of things like handling data and responding to security breaches requires the navigation and reliability of a well-vetted SOC partner. Well-trained SOCs reduce the costs associated with security and malware and can support MSPs in long-run with security intelligence reporting.
IBM recently published a report titled ‘Cost of a Data Breach Report 2021’, illuminating the average cost of a data breach this year: $4.24 million, an almost 10% increase from the previous year.
So where does this leave MSPs? Many are speculative of automation and machine learning as a way of both preventing and reducing the costs associated with cybersecurity. Both Jolera and CrucialLogics are SOCs committed to advancing the way the industry understands cybersecurity; Jolera recently released an AI-driven Endpoint Detection Response (EDR) solution targeting this exact area of developing technology.
Vyas said it simply: “The time for advanced and effective cybersecurity and SOCs is now.”
By Paolo Del Nibletto
Oct 29, 2021 | General, IT News
The ChannelNext Central conference recently concluded, leaving the industry buzzing with ways to boost their Managed Service Providers (MSP) security offerings and intelligences. Claudio Damaso, associate partner, cloud, and security for Hillsburgh, Ont. based CrucialLogics and Sagar Vyas, the Global Cybersecurity Evangelist for Jolera Inc. are two of the country’s leading cyber security experts who both agree that for MSPs to obtain and build the latest, state-of-the-art cybersecurity, it can’t simply be searched on Google!
Damaso referenced this summer’s massive ransomware attack in July that left close to 1,500 organizations stunned. This attack infiltrated specific remote management software from a company that produces it for the MSP market. ‘REvil’, a group of well-known, highly-trained hackers were able to successfully penetrate the security of close to 50 MSPs. This sort of attack was made easy for REvil, as they used the company in question’s products to gain access to almost 50 MSPs.
What this hack has revealed is that MSPs are largely not designed to handle the triage of the breach. Damaso’s direct advice for MSPs: “if you are going to play the security game, you can’t fake it until you make it.” The point both Damaso and Vyas convey to both the ChannelNext Central’s studio audience and live streamers of the event is that you need to be differentiated and unique in your approach in order to set yourself aside from other industry players who, when it comes to security protection, “Google it.”
Referencing a recent research study on global cyber security, Vyas said that in 2021 alone, cybercrime is up 600% – more than double the number of attacks the previous year. He added that at Jolera, his cyber security team sees this type of activity on a daily basis and ransomware attacks have rapidly evolved in the last five years. The sophistication of ransomware attacks has dramatically increased in today’s environment: Large groups of organized, established hackers who run their teams like a business.
Vyas firmly stated that any hack, breach, or ransomware attack is not a matter of ‘if’, but ‘when.’ The MSP community is best prepared when they enlist the right people, processes, and technology — all ensuring that the security of their service offering is as air-tight as possible. Vyas continues the discussion by explaining that MSPs with underdeveloped protection strategies should engage with a cyber security partner whose expertise can provide the right support. “Again, you cannot Google your cyber security partner.”
Vyas advised MSPs to specifically seek a security partner who understands the many securities policies organizations are looking to implement, along with the correct technology designed for endpoint detection and response in a fully monitored and managed solution.
With so much knowledge and understanding of this landscape, Vyas and his team have recently released a high-level, enhanced Endpoint Detection and Response (EDR) security offering. EDR is designed to predict, prevent, and recover all forms of malware from end-to-end, making it harder than ever to penetrate or to go undetected under their protection. Powered with advanced AI technology, this fully autonomous platform is currently available and can be modified to meet an array of individual needs.
Other technology areas MSPs should focus on are multi-factor authentication, security identification and event management systems, or SIEM, and incident response units that have action plans in place for any kind of security attack.
For Damaso, his advice to MSPs is to make it their duty to protect all their customers.
“There are fundamentals with security that can be implemented to better protect yourself and your customers’ business. But far too often, they push the boundaries of negligence when it comes to breach consequences. Nothing can be guaranteed because of all the factors out there, but can the MSP say [that] they have done enough?”
Other security strategies to consider for MSPs are assessing a risk tolerance level and then mapping out a strategy based on that. Damaso concluded that every organization will have a unique risk tolerance level and having a backup plan is necessary to ensure the damage to the pocketbook and the brand are minimized.
In the end, the two security experts conclude that their tenure and success in the industry can only further drive home the fact that you cannot Google your security needs. The most effective, cost-efficient, and headache-free method for MSPs to protect their offerings is to find a partner in the industry that both understands the climate of cybersecurity and has the right tools to mitigate the ever-present malware risk.
By Paolo Del Nibletto
Oct 15, 2021 | General, IT News
October is Cybersecurity Awareness Month, so it’s almost mandatory to explore one of the biggest cyber threats known to date. Phishing scams are amongst the greatest cyber security threats that businesses and organizations face today. 75% of organizations around the world experienced some kind of Phishing scam in 2020. According to the FBI, there were nearly 11 times more phishing complaints in 2020 than in 2016. Phishing attacks are only rising with the increase in remote work. The attacks are becoming popular because they are easy for hackers to conduct and can potentially lead to large payouts. Phishing scams can lead to devastating costs for many parties involved. Below we will examine some of the biggest and most costly phishing scams that have happened in the last decade.
1. FACC
In January of 2016, FACC, an Austrian Aerospace and Defense company lost around €50 million from an email phishing scam. The scam was believed to be a Business Email compromise scheme, in which the attackers impersonate a finance official in the company and attempt to trick the email receiver into transferring a large amount of money into the attackers’ account. After the loss, FACC decided to vote off their CEO as a consequence, and also fire their Chief Financial Officer. It is unclear what their roles were exactly in this scam, but it is evident that the consequences of falling for such a phishing scam can be very severe and detrimental – not only financially.
2. Sony Pictures
In November of 2014, Sony Pictures was hacked by a group called “The Guardians of Peace”. Numerous consequences occurred; one of them being that 100 Terabytes of unreleased data and pictures were leaked. CEO of Cylance, a large computer security firm, stated that the hacking group was able to infiltrate Sony’s system through phishing scams they planted months earlier. Employees of Sony Pictures, including the CEO, received ID Verification emails that appeared to be from Apple. Once Sony was hacked, the attackers also demanded Sony to withdraw their movie “The Interview” which was a comedy about a planned assassination of Kim Jong-un, the North Korean leader at the time. Many cinemas refused to screen the film as the group also threatened terrorist attacks at the openings. It is difficult to calculate the full scope of damages of this phishing attack, but the estimated costs to the company were over $100 million.
3. Facebook and Google
Between 2013 and 2015, over $100 million was stolen from Facebook and Google through another clever phishing scam. The hackers created fake email accounts which looked like they were sent by employees of Quanta, an infrastructure supplier in Taiwan that both Facebook and Google worked with. The hackers then sent phishing emails with fake invoices to financial officers at Facebook and Google who were used to conducting such large transactions. Once the scam was eventually discovered, both companies took legal action and the hacker was identified as Evaldas Rimasauskas, a Lithuanian man who was then sentenced to 5 years in prison.
4. Colonial Pipeline
The most recent and largest phishing scam occurred earlier this year, in May 2021 to Colonial Pipeline in the U.S. Although Colonia Pipeline was hit with ransomware, the attackers only gained access through an employee’s email which was most likely accessed through a phishing attack, as the U.S. government believes. The exact source of the attack is still being investigated. It is impossible to determine how costly the cyber-attack really was, as effects have been felt in many countries that dealt with Colonial Pipeline and are still being uncovered. The company has already paid $4.4 million to the hackers. As the organization provided half of the oil supply to the U.S.’ east coast, the effects were felt publicly when gas prices soared after Colonial Pipeline was shut down for two weeks.
Phishing scams are not going anywhere, and the best way to stop and detect them is through your front-line employees. Regular phishing training should be conducted to help employees become aware of the severity of the attacks, as well as to know what to look for in everyday emails.
By: Joanna Ambros, MBA
Oct 8, 2021 | General, IT News
By Paolo Del Nibletto
The ChannelNext East conference in Montreal was my first in-person event since January of 2020 and it hosted local channel partners and MSPs from the area as well as several more who live-streamed the show. The one-day event was held at the Riverside Event Venue in the city, and it provided the best backdrop for an in-person event under strict COVID-19 restrictions. Riverside is an indoor-outdoor facility that enabled the conference organizers TechnoPlanet to provide a safety-first, social distancing format for all attendees, speakers, and event staff.
TechnoPlanet president and show host Julian Lee said the IT industry needed to re-start in-person events after such a long layoff.
“The channel needs to get back to work and we see in-person conferences as an important part of a get back to work strategy. The main objective of the ChannelNext East event was to rethink the conference showcasing interesting areas that are more suited for the current situation,” he said.
This meant that a hotel, where most conferences usually take place, was out of the question. Hotels have plenty of moving staff going from event to event and the chances of cross-contamination would be high. For Lee and his team, they needed to adapt to a new situation that could best meet the new model, while having a hybrid approach so that it can interest a bigger audience. Another factor for Lee was his desire to support local businesses hard hit by the pandemic and subsequent lockdowns. This is why TechnoPlanet chose the Riverside indoor-outdoor event venue in the Saint Henri district of Montreal.
ChannelNext East featured a talk show format highlighted by opening keynote Q&A with Chris Fabes, the Canadian Channel Chief of Lenovo. Fabes talked about how Lenovo Canada would be helping channel partners and MSPs pivot from the pandemic, what investments they were making in the channel community and how they were scaling towards an as-a-service model.
This was followed up with a panel discussion on how to best approach the Digital First Economy which featured leadership consultant Glynis Devine and myself. I spoke about how MSPs can get a leg up on the digital economy with fixed cost, as-a-service solutions in security, backup, and cloud.
The show also featured an expo and a Lion’s Den competition with executives from Datto, Cyber Power, Net2Phone, SherWeb and ViewSonic squaring off in three-minute segments. Show attendees in-person and online could vote for who had the best pitch.
Finally, Randall Wark, the co-created of the Channel Partner Alliance took the stage to outline the benefits of the Mastermind programs along with bringing actionable strategies and insight on digital best practices to MSPs and channel partners.
Lee added the ChannelNext East hybrid event says there is help if the channel wants it.
“The struggle is real in the channel, but there is help out there either virtual or in-person.”
The ChannelNext East event may have been the first in-person show so far this year, but it will not be the last. Lee and his team are working on the next event that will be staged on Oct. 20th in Toronto.
