security Archives

With cyber threats on the rise, your office could benefit from Managed IT Services

As cyberattacks continue to rise, businesses of all sizes and industries are scrambling to ensure their data is secure. IT departments can be overloaded at the best of times but throw a data breach into the mix and it may not be possible to reverse the damage before it’s too late. Just a single cyber-attack can permanently devastate a business.

More than half of IT decision-makers have seen an across-the-board increase in security threats, and about one-third acknowledge that their organization lacks the necessary level of on-premises and private cloud staff and skills, according to research by Enterprise Strategy Group (ESG).

IT Infrastructure is essential to a company’s ability to survive and thrive, but it requires vast amounts of resources to manage effectively. That’s where Managed IT Services come in.

Companies have shifted to outsourcing IT departments to gain access to tech experts through a service, so they don’t have to manage the task internally. Scalable solutions offer businesses options if they already have a trusted team in place. Managed IT Services can supplement existing teams who may be overloaded, or even monitor systems after-hours.

There are several important benefits for companies who decide to outsource their IT to a Managed Service Provider (MSP).

MSPs Help Cut Costs

Businesses don’t have to worry about taking the time and resources to vet and hire competent staff who they can trust to keep their data secure. Labor costs are drastically reduced because full-time employees won’t need compensation through salaries, benefits, insurance, and training. This is all provided by the MSP.

A recent survey by CompTIA noted that 50% of companies who hired an MSP saved 1-24% in annual IT costs, 33% saved 25-49%, and 13% reported savings of more than 50%.

Expertise is Important in Keeping Data Secure

Investing in Managed IT Services gives companies the ability to leverage the experience of highly trained technology professionals. Staff from businesses that provide Managed IT Services are more likely to have the extensive knowledge, skills, and resources needed to manage IT with optimal efficiency.

These experts are certified to deal with and thoroughly understand the latest technologies, threats, and solutions. Staying up to date on the newest ransomware targeting companies, hardware and software upgrades, and issue resolution techniques ensures businesses run smoothly.

Improving Processes Increases Efficiency

Most businesses think they are properly backing up their data but may not be running regular tests or even know the proper restoration process if data is stolen or lost.

Managed IT Services focus on improving processes with results-driven strategies to improve IT escalation processes, meet customer service standards, and proactively manage key technologies, ultimately increasing operational efficiency.

The best way to prevent data loss is to take a proactive approach. Managed IT Service teams navigate full life cycle support of operating systems. Through proactive IT service monitoring, technicians are available to continuously monitor systems and data. They can run external vulnerability scanning on a regular basis to stay on top of weak points within a system, breaking down reports with expertise, and implementing patches before it’s too late.

Managed Antivirus is another benefit MSPs provide, establishing proper installation, regular updates, firewall monitoring and implementation of a ticketing process to fix issues fast. In-house teams don’t always place high priorities on details of this process or may not have the bandwidth to do so. This can lead to weak points that quickly expose networks to breaches.

The implementation of additional security measures, like multi-factor authentication, can also be led by MSP teams. By placing a priority on cybersecurity across the entire organization, awareness of cyber threats will help keep data secure.

As threat actors continue to target businesses, the trend of outsourced Managed IT Services will only continue to grow. Business leaders should heavily consider how this service could benefit their own organizations.

Alan Estes, GDC IT Solutions Director of Business Development

Interested in learning more about how your business could utilize Managed IT Services? Please feel free to reach out with questions or to schedule a free consultation.

State increases security for payments made by Treasury Department

New state legislation will make payments by the Treasury Department more secure, according to Treasurer Stacy Garrity.

Act 54 of 2022 authorizes Treasury to require the implementation of new electronic payment security protocols known as AVS (“Account Verification System”) which will be a significant step forward in detecting and preventing the fraudulent expenditure of public funds.

The legislation was part of the Fiscal Year 2022-23 state budget.

“This is a powerful new tool in the never-ending fight against identity thieves and other criminals,” Garrity said. “States have been targeted by fraudsters throughout the pandemic. The Pennsylvania Treasury Department works around the clock to ensure that taxpayer money is spent appropriately and doesn’t fall into the hands of criminals. I want to thank the General Assembly and the Governor for including this language in the Fiscal Code to improve payment security statewide.

“Criminals trying to steal money from hardworking taxpayers never stop – and neither will we,” she said. “This is a great step forward to increase our already robust security measures.”

“Taxpayers deserve the peace of mind to know that every possible step is being taken to ensure the money they send to Harrisburg is protected against fraud and abuse,” said Senator President Pro Tempore Jake Corman, R-Belfonte.

“This new tool will provide a critical layer of protection to support our shared goal of safeguarding taxpayer dollars,” he said.”I appreciate Treasurer Garrity’s leadership in advocating for this new system to prevent financial crimes against our Commonwealth.”

House Appropriations Chairman Stan Saylor, R-York County, added, “Unfortunately, the number of criminals seeking to defraud taxpayers has been on the rise throughout the country. As leaders, our job is to protect taxpayer dollars and ensure that they are used for appropriate purposes.”

Treasury will develop a list of approved electronic payment security vendors which are qualified, experienced, and capable of providing such services. Within 18 months of the law taking effect, every agency, board or commission for which Treasury makes payments will choose one of the vendors to use for its payments, Garrity said. Treasury will update the list of approved vendors every two years.

AVS, which is almost instantaneous, uses the bank account information and other unique identity data fields to confirm a payee’s relationship with the bank account into which a payment is to be made.

In most cases, the payment request is immediately processed once the AVS review is complete. However, if an issue is identified – such as the payee having no connection to the bank account, or the unique data not matching – the AVS service responds with coded indicators to stop the payment or to confirm more information from the payee, she said.

Upon further review, the agency originating the payment may determine the payment is likely fraudulent or simply requires a corrected bank account number. In either case, the Commonwealth has safeguarded funds from being released.

Four state agencies have already implemented, or will soon implement, AVS: the Department of Revenue, the Office of Administration, the Liquor Control Board, and the Pennsylvania Housing Finance Agency. It is also used by the U.S. Department of the Treasury for accounts payable.

Lehigh Valley Health Network certified as Pa. eHealth Partnership Uniform Participant

Lehigh Valley Health Network (LVHN) received certification as a Pennsylvania eHealth Partnership Uniform Participant in the Pennsylvania Patient and Provider Network (P3N) on Feb. 1.

LVHN went live the same day as a certified health information organization (HIO). As a member of P3N, care providers can securely send and receive a patient’s complete and real-time health history from any other HIO on the Pennsylvania P3N network, joining more than 55 other Pennsylvania health organizations in the P3N network in over 124 locations, including HIOs coordinated by Geisinger, Main Line Health, Penn State Hershey, UPMC and others, LVHN said.

LVHN must be connected to one of the Pennsylvania HIOs, according to the Pennsylvania Department of Health, and some payer contracts will require LVHN to share data via the PA P3N. By adding this additional connection to share patient data with these organizations, LVHN is now in compliance.

“LVHN has been connected to multiple large national health information exchange networks for years and has shared over 39 million patient records with 3,400 other care providers to date,” said Michael Minear, senior vice president and chief information officer, LVHN.

“LVHN is excited to add this new connection to P3N as a certified HIO in the Commonwealth of Pennsylvania. The breadth of the six P3N partners and networks will support LVHN sharing patient data in a secure way with even more care providers in Pennsylvania, especially long-term care and smaller ambulatory practices,” he said.

Patient health information remains within the provider’s electronic medical record, and P3N is another way to exchange medical records with other health care organizations that request them for treatment.

With the secure Data exchange on the network, an emergency room (ER) provider can request electronic health record (EHR) information from a patient’s HIO-participating primary care provider, as long as the patient has not opted out of the service, and know the patient’s allergies, medications and other clinical data before administering care.

Discrete ER Admission, Discharge and Transfer (ADT) messages are shared across the entire P3N network of participating HIO’s through the Pennsylvania encounter notification service.

Patient information is protected by the latest cybersecurity tools and through applicable federal and state privacy laws including the federal Health Insurance Portability and Accountability Act (HIPAA) and the Health Information Technology for Economic and Clinical Health Act (HITECH).

Can’t connect to the internet? It might be because your device is too old

If you can’t click on this story, it might be time for a new device.

As of Thursday, older phones and computers that are no longer supported by their manufacturers may lose access to a number of websites and apps.

The problem stems from a popular digital certificate used by websites that tell a device logging into the site that it is safe to use. Older tech, such as Macs running macOS 10.12.0 or earlier, and iPhones and iPads running iOS 9 or earlier, were only programmed to read the certification on these sites up until Sept. 29, 2021, said John Fields, director of IT for Lehigh Valley Business’s parent company, Bridge Tower Media.

Those devices and others, such as computers running Windows XP and older Android devices, do not receive updates from their manufacturers anymore like their more modern counterparts. That means they can no longer access any app or website that uses that specific certificate after it expired.

A website’s certificate can be found by clicking on the small lock to the left of a website’s URL in a browser. For example, when reading this story on LVB.com, click on the lock next to the LVB.com URL, then on certificate and finally certification path. Doing so reveals the “chain of trust,” or a list of certifications that authorize one another, according to an article by Tomsguide.com. For LVB, the primary certification is ISRG Root X1, a certificate issued by Let’s Encrypt, a free, automated and open certificate authority founded in 2015.

Because of Let’s Encrypt’s recently new footing as a commonly used certificate authority, ISRG Root X1 relies on an older certificate, known as DST Root CA X3 to translate ISRG to older devices. This week, DST Root CA X3 expired, meaning that any site using that certification or ISRG can no longer appear on those devices.

A workaround for this problem is using the browser Mozilla Firefox while on the web, since Firefox does not use the same security certificates as other browsers. However, that method will not work for any apps that use the expired certificate.

“If I had to boil it down its mostly Apple devices — iPhones and some older mac devices,” said Fields. “The hope is that Apple gets this resolved for any devices that they can update. Some of these older devices that can’t run anything over iOS 9, I don’t believe Apple is patching those.”

Some devices may have workarounds, but most users facing this problem will most likely need to invest in a new device, said Fields. “Unfortunately this is one of those times where you might have to bite the bullet and buy a new device,” he said.

Windows 7 is no longer supported, what’s an un-updated business to do?

Windows is no longer providing tech support or security upgrades to its Windows 7.

If your business’ computers are still running on Windows 7, you no longer have technical support or security updates coming in from Windows.

As of Jan. 14 Windows stopped providing all support for Windows 7, which was released in 2009 and encouraged those still on the old system to upgrade to Windows 10, the latest version of Windows, which has been available since 2015.

Dave Dooley, president and CEO of EZ Micro Solutions in Whitehall, said those in the managed IT industry have known for some time that Windows was planning to disengage from Windows 7 in much the same way it did with Windows XP several years ago. So, most of his firm’s clients have already been upgraded to Windows 10.

He said it’s mostly smaller businesses or individual users that are left with the now unsupported Windows 7, but even there he said there’s still no reason to panic.

“Some people thought their computer would stop working on Jan. 14, but that obviously wasn’t true,” he said.

Others have been worried that without ongoing security updates they’ll be left wide-open and vulnerable to hackers.

While Dooley said it is possible that some hackers may have been holding off on attacks until Windows ended support for 7, at least in the short term he doesn’t expect those computers to be significantly more vulnerable to attack.

That doesn’t mean they’re safe, however.

“In general, Windows 10 is just significantly more secure than anything they had for Windows 7,” Dooley said. And, he thinks it would be worth it for companies to make the upgrade.

But therein lies the rub. Updating from Windows 7 to Windows 10 isn’t all that easy, and Dooley said for most companies it might be simpler, and maybe cheaper, to buy new computers.

There are options for people who want to continue a level of security support on their existing Windows 7 system – but it’s not cheap.

Businesses must go through a Windows Cloud Service Provider, like EZ Micro Solutions, to purchase an Extended Security Update at the cost of $61 per PC per year, with the price likely increasing in the second year.

A company can just update its systems to Windows 10, but if Windows 7 is running on an older computer, about four years or older, it likely won’t be compatible because it doesn’t meet the speed requirements.

If the computers are newer, updating to Windows 10 is still a bit more complicated than pressing a few buttons and waiting. Some applications many not be compatible and IT professionals will be needed to install it.

If going through an outside provider, the cost of the work hours to install Windows 10 may be close to what a business would pay for buying a couple of new computers that come pre-installed with Windows 10.

For some, making the change may not be a choice. Dooley noted that many industries, including the financial and medical fields, have strict regulations over companies having the latest security software to prevent data theft.

For those who haven’t already made the migration, Dooley said a company should be ready to spend a little time and money to upgrade to Windows 10. He believes most will ultimately find the investment worth it.

Select Region or Brand

Upcoming Event

Tag: security

With cyber threats on the rise, your office could benefit from Managed IT Services

Windows 7 is no longer supported, what’s an un-updated business to do?

CONNECT

DIGITAL EDITIONS