We recommend implementing an external “e-mail gateway” that scans all e-mail prior to being delivered to your e-mail system. Our “SG1” gateway is a highly customised version of the award winning Alt-N SecurityGateway software, and for a small cost provides the best protection available against e-mail threats.

Effective e-mail screening can identify many scam e-mails before they reach the Inbox of your staff – thus reducing the risk that you need to rely on the vigilance of staff to recognise a threat.

Our email spam firewall: SG1, provides affordable email security with a powerful spam filter that serves as an SMTP firewall (compatible with: Microsoft 365, Gmail or your on-premise e-mail server).

SG1 protects against viruses, phishing, spoofing, and other forms of malware that present an ongoing threat to the legitimate email communications of your business.
SG1 has multiple analysis tools for identifying and quarantining threats from legitimate e-mail.

Security Features

Anti-Spam

Multiple testing methods allow administrators to adjust spam prevention techniques to detect and block the majority of incoming spam.

• Heuristic and Bayesian Engines. SG1 utilises a high performance, customized version of the popular open source SpamAssassin project for heuristic rules and Bayesian classification.
• DNS and URI Blocklists use numerous third-party servers to determine spam
• Message Certification allows for a third-party to validate a sending server, to establish whether it is considered friendly. Message Certification relies on SPF or DKIM.
• Message Scoring can be customized to fit each domain’s needs. SG1 maintains a score for each message based on the results of its exhaustive collection of message tests. Individual tests may add to or subtract from the message score. The message score allows the decision to quarantine or reject a message to be based on the results of multiple tests.

Anti-Virus

Flexible configuration to perform automatic updates at regular intervals, ensuring the greatest protection. Messages with viruses may be refused or quarantined for later review on a per-domain basis.

Anti-Spoofing

Multiple techniques are used to verify a sender’s address to prevent spammers from forging the origin of the message.

• Reverse Lookups can tag or refuse messages if the sending mail server or email address is forged
• Call Back Verify allows SG1 to verify that the sending email address is valid before accepting the message

Email Authentication

Incorporates current authentication techniques used to validate and sign messages to minimize the receipt of possible spam messages.

• DomainKeys Identified Mail (DKIM) associates domain names to represent a sender’s identity. Messages are sent with a digital “fingerprint,” which is then validated upon receipt to confirm the signer’s identity and to ensure the message was not tampered with during transit over the Internet
• Sender Policy Framework (SPF) The Sender Policy Framework (SPF) is an open standard specifying a technical method to prevent sender address forgery.

Anti-Abuse

Multiple techniques to allow legitimate mail in while preventing unauthorized access — all configurable on a per-domain basis.

• Relay Control prohibits messages from being accepted or delivered if they are not to or from a SG1 user.
• SMTP Authentication can force users to authenticate with a username and password when sending mail, if desired.
• IP Shielding allows SG1 to only accept mail from a domain if it matches a pre—defined domain/IP pair.

Filtering

Minimize incoming and outgoing threats by blocking or quarantining messages based on content or types of file attachments.

• Message Content Filter allows the administrator to look for content within a message and take action based on the results.
• Preset File Types allows the administrator to tell SG1 to block all attached video files, images, or executable files with one click.
• Blacklists – Block threats from known email abusers.
  • Addresses — match addresses by domain or email address.
  • Hosts — match by the host name given during the SMTP session.
  • IP — match by connecting IP address
  • Blacklist Actions – allow the administrator to refuse or quarantine a message if a blacklist match occurs
• Whitelists – Speed up message processing through the identification of friendly senders.
  • Addresses — exempt email from addresses by domain or email address.
  • Hosts — exempt email by the host name given during the email session.
  • IP — exempt email by connecting IP address.

SIEVE Scripts

We use the powerful industry standard SIEVE mail filtering language to augment the built-in security features of SG1 to implement custom rules to quarantine (and in some cases reject) suspicious messages based on analysis of e-mails by our security team.

We provide e-mail screening for $4 ex-GST per mailbox, per month. No installation or other charges.

If you have any questions about SG1 or would like to deploy SG1, please contact us

Questions are welcome!

* This article first appeared on our sister site: https://disaster-recovery.com.au/email-screening-protecting-staff-from-malicious-threats/

The solution: OpenVPN server.

Opensource software is FREE.

• We setup your OpenVPN server on a VM or physical machine.
• We configure OpenVPN server for your environment.
• We setup the first 5 OpenVPN clients / users.
• We provide you with a step-by-step guide so that you can setup additional users OR you can engage us on Per-Call or Support Plan agreement to setup additional users when needed.

One-time setup of your OpenVPN server: $400 ex-GST.

If you have any questions, please contact us and we can arrange a quick chat.

There were nearly 94,000 cybercrime reports, an increase of 23% on 2022.

Average cost of cybercrime per report:

– small business  $46K

– medium business $97K

One of the key cyber-security counter measures that organisations should be implementing to reduce their security risk is: Patch Management.

Patch Management is the process of applying updates to software.

Patch management fixes vulnerabilities in your software and applications that are susceptible to cyber-attack.

Patching software corrects known issues in your software, and this reduces your organisation’s security risk.

The software that we use to perform Patch Management in Microsoft Windows environments is: Action1

Action1 is FREE for the first 100 endpoints and reasonably priced for endpoints above the 100-endpoint limit.

The offer:

• We setup Action1 for your organisation.
• We provide a step-by-step guide so that you can manage Action1 going forward OR you can engage us on Per-Call or Support Plan agreement to manage Action1 for you.

One-time setup of Action1: $400 ex-GST.

If you have any questions, just contact us and we can arrange a quick chat.

In particular we are talking about OneDrive and SharePoint. Both products have built-in versioning, which in my experience works well. So if your files are all encrypted but OneDrive keeps old versions of your documents, why would I need a third-party backup?

There are two main issues:

Firstly, while the versioning restore works very well when restoring a single file or folder, but not so much for restoring 10’s or 100’s of thousands of files. In fact it’s difficult to actually work out how to do this and (from experience) it doesn’t work very well. The last time I had to attempt this process for a client I ended up having to manually recover the files and the process was a nightmare.

Secondly, not all ransomware attacks (or other reasons to restore) are immediately discovered. If the issue that creates the need to perform a restore isn’t discovered for weeks or even months, the recovery process will be far worse, if not impossible.

But I hear you say, won’t OneDrive alert and query me if I have a lot of files encrypted? Sometimes. And only if it passes certain thresholds. And only if you haven’t got annoyed with these messages and turned off that option.

And that’s only if you’re using your computer and the ransomware attack is automated.

If there is a RAT (Remote Access Terminal) type attack on your system, the Black-Hats will disable all these warnings and remove all copies of your data from the 365 servers as well as on your computer. Remember if you can access your data and old versions, so can the Black-Hats and then they can (and will) remove or encrypt all versions.

Let’s have a closer look at the built-in Microsoft options to protect our SharePoint data:

Versioning

Versioning is the first step when it comes to preventing data loss in SharePoint. New versions of files are automatically created when a file is modified or re-uploaded. This allows you to go back to an older version of the file at any time you want.

SharePoint Recycle Bins

SharePoint comes with two recycle bins. When a file is deleted in SharePoint or OneDrive, it goes to the (first-stage) recycle bin. It’s kept for 93 days total in the recycle bin unless it is manually deleted from the recycle bin.

Files that are deleted from the first-stage Recycle Bin are moved to the second-stage recycle bin. Only site administrators have access to the second stage, preventing users from accidentally emptying the second stage as well.

Files are kept for the remaining 93 days in the second-stage Recycle Bin. So, all files are always retained 93 days in total from the moment that they are deleted.

Retention Policies

Retention policies are designed to determine which data can be deleted and when. Policy rules allow you to target specific content based on conditions such as keywords and determine how long you want to preserve that data.

The biggest advantage of retention policies is that they create an immutable copy of the data when an item is created or modified (a copy of the file that cannot be changed). This allows you to always be able to restore the original version of the file.

Retention policies can even be configured in such a way that once they are turned on, they can’t be changed or turned off anymore.

Keep in mind though that retained data counts towards your SharePoint storage quota.

Microsoft Support – restore request.

Microsoft does perform backups of your data. They create a backup every 12 hours and keep it for 14 days. In this way, in case of data loss, the global administrator can contact Microsoft with a restore request.

But there is one major catch here: you can’t request an individual file or folder restore. Microsoft only restores the complete site collection to its original location.

Why shouldn’t you rely on the built-in SharePoint backup options?

The built-in Microsoft options might at first glance appear to be sufficient to recover from any issue, but in my opinion, they are not.

The biggest problem with the built-in solutions is the ease of restoring data.

Recycle bins are fine when you need to restore a couple of files. But have you ever tried restoring a complete document library because someone forgot to turn off synchronization before deleting the synced files?

You can’t simply select a folder or document library in the recycle bin. The only option is to select all files per page and restore them. Or you might have to use a PowerShell script to select the correct files from the recycle bin and then restore them.

And what are your options after 93 days? As I mentioned before, it’s not guaranteed that lost or damaged data will be noticed within this timespan.

You could create a retention policy and preserve all data forever. This approach will cost you some SharePoint storage, but that isn’t really the issue. Again, it’s ease-of-use.

Have you ever tried restoring data with content search or eDiscovery?

You will need to collect all the data based on date, location, or keywords, then export it, and then import it manually back to SharePoint.

I can tell you from experience that the built-in Microsoft options are not convenient or easy to use if you need to recover more than a handful of files.

CyberX Backup System

So is the CyberX backup system compatible with Office 365? 

The good news is that it is, and with minimal additional work to implement. We can even support Mac users who are using Office 365.

Note, that the above comments regarding SharePoint, also apply to other Cloud file-sharing / collaboration solutions (like Dropbox); so unless you have a ransomware secure backup system (such as the CyberX Backup System) you are at risk of losing your valuable business data if something “major” goes wrong.

This article first appeared on our sister site: https://disaster-recovery.com.au/do-i-need-backups-if-i-have-microsoft-office-365/

And of course it can only search the time period you have configured to download offline. It won’t find an e-mail from years ago – to do that you’ll need to go online – and hope it finds it.

We recommend and use MailStore as a replacement for Outlook’s sub-par searching. MailStore automatically archives copies of all e-mails and creates an index to ensure super-fast searching.

Furthermore, MailStore serves as an offline backup of your precious e-mail. In many cases this can also save you licensing costs. For example, in the event of an employee leaving there will be no need to retain an Office 365 mailbox for purely archival purposes. MailStore can also be configured to delete old e-mail (after successfully archiving it of course) reducing the need to purchase increased e-mail storage from Microsoft.

For information on how to implement MailStore in your organisation please contact us – we’ll be happy to help.

This article first appeared on our sister site: https://disaster-recovery.com.au/mailstore-best-email-search-with-backup-as-a-bonus/

You need a good password in instances where you can’t use a password manager (such as Lastpass). Obviously you can’t type in a 43 character monstrosity every time.  A good password has three qualities:

1. Difficult to crack
2. Easy(ish) to remember
3. Easy(ish) to type

Number 1 is obviously crucial, but if 2 isn’t met you will end up writing it down. And some passwords are so hard to type (3) that you just hate them after a while.

Dos and don’ts for passwords

• Do not use a pattern. If it’s easy for you, hackers will think of it. E.g.
  • qwerty123456
  • qazwsx12

• Do not make substitutions such as 0 for o and 3 for e. It just makes it harder to type (and remember) and won’t slow a computer down. And for good passwords they are just painful to remember. Don’t bother with them. Use a longer password instead.

• Never use simple phrases such as “iloveyou” as cracking software will only take seconds

• Never use dates or names relating to you or your family

• Do use long passwords. The longer the better. Ideally 20 or more characters.

• Do use long phrases that mean something to you (and not others), including spaces. The password “I love my Friday football with a beer” is a much more secure password than “&v3*JLCFf&Gt^499”. And by an incredible factor of 10⁴⁰. And which would you rather remember!

A good site to test your password on is:  https://www.grc.com/haystack.htm 

ZEN are always happy to give you advice on all security matters, including but not limited to the choice of good passwords and implementation of password managers.

I favour two approaches for other accounts.

1. MFA if available, and implemented well and not too intrusive; and
2. Loooong passwords with a password manager

In a lot of cases option 2 is easier to implement and has no downsides if used with a reliable password manager such as Lastpass.

I personally use and recommend Lastpass in particular, as they have recently upgraded the free account to be accessible on all devices. Meaning a secure password on your computer is also accessible on your phone.

What do I mean by a long password?

Ideally 43 characters. Very very long but with a password manager what does it matter as you will never have to type it. And Lastpass will even help you generate the password:

Using a password checking program gave this result for this password:

Note that I cannot stress enough that it is crucial that your Lastpass account has a secure password that is easy to remember, and that further you have MFA enabled.

ZEN is always happy to help you setup Lastpass or give other security advice, or more detailed information on this article.

Without going into detail, more than 43 characters will not help in most circumstances and as seen in my example there is definitely no need to go further.

What you may not have is Multi Factor Authentication “MFA” enabled.

MFA is basically a secondary means of confirming your login. In most cases it is only used on an “unknown” device to save being bugged a lot, hence why a strong password is still essential. They go “hand in hand”.

So why do I say MFA is “essential” to e-mail?

Primarily because if a data breach happens to your e-mail provider, or your e-mail password is hacked (even if you think it’s secure), then you have basically opened the door to your entire identity.

The next time you go on a site and see the “forgot password” link under the login, think what would happen if a hacker had your e-mail account details?

Easy: he would be able to reset your password and gain access. And it is likely you wouldn’t ever know as he would hide his tracks. At most you’d think it strange that the password you thought didn’t work, and click the “forgot password” button yourself at a later date.

Just think of the sites a hacker could gain access to and what could be done by him…..

So enough of the melodrama, albeit potentially real melodrama; what can be done?

All major mail services now offer the option to enable MFA. It can range from a simple SMS to a USB token. For most users I recommend an app, and in particular “Authy”.  When you attempt to login to a new device in addition to entering your password you will need to enter a code from Authy on your phone. And Authy requires a pin or fingerprint to access. Not foolproof, but very close to.

If you need help setting this up on your e-mail system, ZEN are always happy to assist with advice and/or remote help.

We’re also happy to discuss and/or provide more detail on the above, as this is by necessity only an introductory article.

The Domain Name System (DNS) is a central part of the Internet, providing a way to match names (for instance a web site that you’re seeking) to numbers (the IP address of the web site). Anything connected to the Internet – laptops, tablets, mobile phones, websites – has an Internet Protocol (IP) address made up of numbers.

Our web site has an IP address of 146.66.91.189, but this is obviously not easy to remember. However, our web site’s domain name (or address) https://zen.net.au is something that people can recognise and remember.

You can think of DNS as a ‘phone book’ for the Internet. DNS resolves (or translates) domain names to IP addresses, enabling humans to use memorable domain names while computers on the Internet use IP addresses to communicate.

What is DNS used for?

• Resolving names of web sites
• Routing messages to e-mail servers and webmail services
• Connecting app servers, databases and middleware within a web application
• Virtual Private Networks (VPN)
• Peer-to-peer sharing programs
• Multi-player games
• Instant messaging and online meeting services
• Communication between IoT devices, gateways and servers

Most consumers and many organisations just use the DNS servers provided by their Internet Service Provider (ISP). The issues with this approach are:

Your ISP will provide almost no content filtering via their DNS servers:

1. Sites that are known to contain malware will not be blocked
2. Sites that contain non-business use content will not be blocked
3. There is no reporting of sites that your staff have visited

Managed DNS – security and reporting

The benefits of using a Managed DNS Service are:

Pricing

Managed DNS is available from $30ex per month (up to 50 users).

If you have questions or would like to implement Managed DNS, please contact us for further details.

In the meantime, users and businesses are compromised every day because of weak and breached passwords. You hear about password breaches all the time. You can find out if your credentials have been affected by a password breach by checking: https://haveibeenpwned.com/

‘Have I been pwned’ is a site that collects the data from such breaches to allow users to find out if they are affected. At the end of 2019, the total number of compromised accounts in the HIBP database was more than 9 billion, 5,081,613,319 of them in the 10 largest breaches.

Attackers will take the credentials stolen from one service and then use them to attempt to log into other services. This is called credential stuffing, and the consequences can be severe. Do you reuse the same username (probably your email address) and password on more than one site?

Better security measures than passwords are becoming available, like two-factor authentication (2FA), but these approaches have their own problems and they currently don’t work with every site that users may need to log into. So, as a practical matter, most organizations, will be stuck with passwords for some time.

The question then, is what is the most secure—or least insecure, if you prefer—way to use passwords? The answer is to follow best practices, and the only practical way to follow best practices is to use a password manager.

Password best practice

• Choose passwords that would be difficult for others to guess and then don’t update them regularly. A strong password should contain a mix of upper- and lower-case letters, numbers and symbols.

• If users choose strong passwords, then so long as they’re not compromised there is no need to change them. This approach works best when used with a password manager.

• Making password management a chore is a guaranteed way to encourage staff to take shortcuts with passwords and potentially use the same password over and over or write them down. Don’t make password management any more of a hassle than it needs to be.

• Use a password manager like LastPass or RoboForm to simplify the management and administration of passwords. Both LastPass and Roboform have a free product offering which is quite capable.

• Passwords should not relate to a family member or some other personal fact even if you think no one would know it.

• Secure passwords don’t have to be something like “aldskfj83n*^)##”. This password isn’t as secure to brute-force attack as the much easier to remember “roof14skyred*car”.
  • Check the strength of passwords at https://www.experte.com/password-check A secure password that can be remembered is particularly important if it’s a “key” password, such as the master password for LastPass, or your windows logon.

• Use a different password for every account/profile – that way if a password is compromised only one account / profile / service is affected – not all.

• Don’t share your passwords with anyone

Password Manager – Multi-user licensing

Password managers began as and still are largely a one-user purchase. But if you are responsible for the security of multiple users within an organisation, you should consider an option that offers some management capability and a volume discount. Many password manager providers have versions for teams and enterprises.

The main team feature these products provide is the ability to share login information with other users. They probably also allow an administrator to manage users. The administrator may be able to onboard new users, centrally manage shared items and who gets access to them, authorize and deauthorize devices, control access to features in the password manager, and more.

Failed Login Attempt Monitoring

Many Windows applications are susceptible to brute-force password hacking attempts (i.e. trying to identify the user’s password by repeatedly attempting to authenticate with different passwords).

However applications that use a Web portal for authentication frequently do not lock out a user account after a certain number of failed login attempts.

For your on-premise servers, implement failed login attempt monitoring to address this security risk.