Authenticating your email helps reduce spoofing attempts and protects your brand and customers.

Why backups are important

In many cases of ransomware, even if the ransom is paid, an average 10% of data is not recoverable. This can add significant costs to an incident through both having to recreate data as well as the lost business and billable hours. Ransomware isn't the only threat that could result in data loss either. Attackers will often maliciously wipe data to cover their tracks, or software can be deleted by an unhappy exiting employee!

Backups and replication of all your data can significantly reduce your costs of an incident and the downtime from ransomware or other forms of data loss.

Recommendations

1. It is important to understand the limitations of "do it yourself" back up programs as well. First, these usually create what are called file backups. So all your Word and Excel documents will be backed up, but the database of your client case management system probably is not. Those programs should have their own back up system in place and you should understand how often they back up.
2. Sign up for a modern backup service that guides you through backing up both documents and critical application files like your client management system. We've included a few reputable ones below.
3. Sign up for the backup service with a work-owned central email address used for this purpose, like [email protected] We have often seen a receptionist or paralegal sign up for the service and leave the company. The notification of failed backups never went to remaining staff, and attorneys lost important files after finding backups had been failing for months, and notifications were going to a deleted email address.
4. While weekly backups are acceptable, we have discovered that most law firms backup daily because losing a week's worth of data can be devastating. You need to determine the optimum backup schedule for your law firm.

A few recommended backup service providers

• https://www.backblaze.com/business-backup.html
• https://www.idrive.com/online-backup-security
• https://www.carbonite.com/products/carbonite-safe-for-small-business

Havoc Shield includes automated business level encrypted and secure offsite backups as part of the service

Encryption: What & Why

Encryption is a great way to protect sensitive client data, especially data that resides under attorney client privilege. Given the sensitive nature of an attorneys role, encryption is one way to reduce the risk of data exposure and your liability. If encrypted files end up in a bad actor's hands ...and that can happen in a lot of unfortunate ways... then it'll make it much harder for them to extract any value out of the data.

Recommendations

1. Enable disk-level encryption on your computers. This will make it hard to extract useful information if a PC is lost or stolen. For Windows 10, enable BitLocker encryption. For Mac, enable FileVault. Either you or your IT administrator can turn these protections on.
2. To send encrypted email, if this is something you would like, you could procure a service such as Paubox. This service makes it possible to ensure sensitive information sent via email can't be easily accessed if the email is intercepted by a malicious actor without requiring advanced configuration or out-of-email actions by your recipients.

Sign up for Havoc Shield, and get disk encryption as well as email encryption done for you through one Platform.

What & Why

Software and hardware providers regularly find security flaws in their products that need to be updated. Ideally, updates would be installed automatically on the same day and many do, but that's not always the case. Outdated software or firmware containing security flaws can be easily exploited by attackers with devastating consequences.

Malicious actors will often build scanning software that look for unpatched software to take advantage of, and which can be deployed at scale and executed automatically, making your computers and networking hardware susceptible even if not specifically targeted. With the advent of increased work from home arrangements, patching both company-owned and personal devices has become even more important. In the office, you may have certain firewalls and security software running that is not available or diminished for remote workers.

Recommendations

1. If you either outsource your IT management to an outside firm, or have a dedicated IT professional on staff, they may have a “patching procedure”. Ask them about this procedure and ensure it's being followed. Minimally, you want to ensure all operating systems are updated at least monthly, and critical software like Microsoft Office, Adobe, and accounting software are on the list as well. Many of these will NOT automatically update themselves.
2. If you don't already have a patching procedure, committed to installing updates on a regular day every month, say the first Friday of each. Send yourself and others a calendar invite and list of software to update that repeats each month.
3. Check with your internet service provider to see what updates they provide on your modem and router. If you own those pieces of equipment, make sure to login to administrative interfaces on those devices and update them on the same cadence. This can be a more technically difficult task, so you may need to get help.

Havoc Shield's cybersecurity program includes a patching procedure and an automated patching "agent" that scans your computers and servers for out of date operating systems and software. The agent then updates software in the background as soon as reliable patches become available from the manufacturer. You simply receive a report at the end of each month showing you what was updated.

Keeping your operating system and critical software updated regularly helps defeat a huge category of attacks.

The What & Why

"Phishing" refers to the practice of attackers sending emails pretending to be from reputable companies that try and get you to either reveal sensitive information, click a link or download a file.

Most malware finds its way into your business by email. Unfortunately it's often difficult to identify malicious emails, as attackers are growing more sophisticated with how they mask attempts to steal your information or get you to install nefarious programs.

Recommendations

You can reduce the risk of falling victim to phishing or other malicious attacks over email by taking a few actions:

1. Use a modern cloud-hosted email service such as Microsoft Office 365 or Google Workspace. These services include several protections such as automatic attachment scanning and phishing protection. On premise or other lesser-known email hosting services often don't include these benefits. Check with your IT team or provider of your service includes attachment scanning and phishing email identification.
2. Train your staff! Attackers depend on your staff not being able to identify the signs of a phishing email such as a suspicious looking link, grammatical mistakes, or the actual email address behind a message appearing to be from someone you know. Havoc Shield provides engaging virtual courses that train your staff on identifying malicious emails. You can also procure or provide your own training.
3. Use antivirus and antimalware protection. Ensure your computer is running a reputable antivirus and antimalware program. Programs included on your operating system are okay for consumers, but we recommend purchasing a business-grade solution like Webroot SMB or Bitdefender. Havoc Shield includes Webroot SMB should you choose to use them.

When you sign up for Havoc Shield, many of these services and products are included in your monthly fee including Business Grade Antivirus with Webroot SMB, virtual courses and even phishing testing to see if your employees get caught.

Anti-Virus

Anti-virus software is designed to protect your computers from viruses. Most operate by using known “threat signatures”, which must be regularly updated so the software can recognize constantly changing threats. It’s important to utilize an anti-virus solution that keeps itself updated and scans your computer regularly to ensure your team’s devices stay protected against new viruses. If you’re running the Windows operating system, we recommend ensuring Windows Defender is enabled and check to ensure your signature definitions are up to date. If you’re on a Mac, we recommend purchasing and installing Webroot’s endpoint protection solution on all company-owned computers. We do not recommend consumer-grade solutions such as those provided by Norton or Kaspersky as they are not easily managed across your fleet. Havoc Shield provides an award-winning, business-grade antivirus solution powered by Webroot that’s easily installed on any major operating system that is fully managed for you. When installed, it's kept updated, correctly configured, and monitored for reliability on your behalf across all company-owned computers. It also protects against advanced attacks from malicious websites.

Firewall

Network traffic flows through devices via what we call “ports”. A firewall is what controls what is and isn't - allowed to pass through those ports. For most computers and small office networks, a firewall should allow very little, if any, inbound traffic. There's usually not a good reason for other devices to need to connect to your device or access your network. If you’re running the Windows operating system, make sure the Firewall component of Windows Defender is active. If you’re on a Mac: You’ll see prompts from your computer asking for your permission to connect through the firewall every so often. Be careful about which applications you allow through, and if you don’t know the application requesting access, don’t allow it!

Great! Regularly updated antivirus software and active firewalls help prevent intrusions.

Anyone involved with the processing, transmission, or storage of card data must comply with the Payment Card Industry Data Security Standards (PCI DSS). When accepting payments, you must do so in a PCI compliant manner. You must determine which level of PCI compliance you are subject to in order to know which cybersecurity program components you need to put in place. Most users can do this with a Self-Assessment Questionnaire (SAQ). Using that questionnaire, you will need to ensure all requirements are met, and you may need to send an attestation letter to the service that supplies your merchant account and/or credit card brands. Havoc Shield supplies all the necessary components for the vast majority of firms subject to PCI compliance. If you need help with them, reach out and Havoc Shield’s Client Success team will help you determine, understand, and complete these requirements.

Great! Remember that you should validate your PCI compliance annually. Most users can do this with a Self-Assessment Questionnaire (SAQ) provided by the PCI Security Standards Council.

Endpoint Detection and Response (EDR) solutions help in detecting and investigating suspicious activities across your company’s devices and digital perimeter. While EDR shares similarities with antivirus, they are not the same. EDR focuses on the “behavior” or various events and actors across your whole network and its devices, whereas antivirus is normally just looking for specific malicious “signatures” it can block on a particular device. EDR ensures you can better detect and remediate attacks as they occur by monitoring for suspicious patterns and then allowing either a human team or the EDR software itself to take protective actions like disconnecting infected devices from the rest of the network to prevent further infection. There are many EDR solutions available, both managed by a security team, as well as unmanaged software. If you’re going to purchase an EDR solution yourself, we highly suggest it being a plan that is managed by your provider. The alerts requiring attention and the analysis that needs to be performed on suspicious events requires trained professionals, and even with that, you must have the bandwidth to deal with security events the EDR highlights.

Nice. Maintaining an EDR is key to keeping threats, new and old, off your devices.

No problem! You’ll want to start helping your team spot malicious phishing messages. Why? Emails are the #1 threat vector of initial access by attackers because sending an email is so cheap and easy, and untrained employees can often be fooled into thinking the message is legitimate, releasing sensitive login or other information. Teaching your team how to spot a phishing email, and also testing their knowledge by running phishing “campaigns” where you send innocuous but realistic phishing messages gives your team the skills they need to keep a watchful eye. Havoc Shield supplies several tips on how to train your team and run phishing simulations as well as a list of example phishing messages your team might run into. There are several providers that provide training on how to spot phishing messages as well as run phishing campaigns to help your team build their muscle memory. We recommend Curricula, and it’s free for your first several users! Havoc Shield includes full phishing training and simulations as well as a novel feature called Mail Armor that reviews suspicious messages that make it through spam filters for your team. You can see a quick demo of Mail Armor here

Nice! Keeping your staff’s training on how to spot phishing emails fresh helps keep your accounts and data safe by ensuring the #1 threat vector, email, is well-protected.