Security Archives - Page 2 of 5 - The Latest on Accounting Tech for SMEs

Cloud Software Still Worth Backing Up, says Forrester

March 17, 2014 by Aimy Chen

Businesses often believed they didn’t have to backup data stored in cloud programs. But there were still benefits to making an independent backup, a study by Forrester, a global IT analyst firm, has found.

Many SaaS providers didn’t restore lost data for users or charged an exorbitant fee to do so, said the report, Cloud-to-Cloud Backup Emerges as a Practical Option For Cloud Data Protection.

The report examined some of the largest SaaS vendors and found significant variations in their data restoration policies

IBM SmartCloud used full duplication and backup of its data centres in near real time to a remote site. IBM included a “configured trashcan retrieval” for up to 90 days to help customers recover lost data.

Salesforce automatically backed up all customer data on a nightly basis and cloned it to an off-site, fire-resistant facility for verification and storage. But Salesforce charged a minimum US$10,000 to recover data that had been permanently deleted or corrupted and which had to be recovered at a specific point in time.

Google Apps replicated data multiple times in the one data centre to prevent against hardware failure, and to a separate data centre in case the primary data centre went offline. However, Google permanently deleted any data that had been deleted by an administrator or user to comply with its privacy policies.

Microsoft Office 365 also used multiple backups to on-site and off-site locations. However, administrators were able to recover accidentally deleted information and deleted users.

“Cloud-to-cloud backup is an increasingly viable and preferred option, [it] will eventually become part of cloud management suites and cloud portals,” wrote Rachel Dines, Forrester’s senior analyst for infrastructure and operations professionals.

It was possible for SaaS providers to give users methods for backing up and restoring data to protect against data loss or disaster, the report said. But if the user was responsible for losing data and the vendor was able to recover data, the retrieval process was likely to incur delays, restrictions or hefty fees.

Companies could limit the risks of permanently losing data by having copies of information outside the primary SaaS provider. Fujitsu announced its intention to offer a cloud-to-cloud backup module as part of its new cloud integration platform, which will offer many cloud management features across SaaS, IaaS and PaaS platforms as part of a wider suite of services, Dines said.

“[Other strategies include] working with a cloud-to-cloud backup provider to automatically transfer data to another cloud on a periodic basis, talking to their SaaS provider about backups within their platform if they offer this service, or defining a manual process for exporting cloud data on a regular basis,” Dines added.

The report indicated six main reasons for data loss; migration errors or syncing inaccuracies between on-premise data and the cloud, accidental deletion or overwriting correct information with incorrect data, malicious employees, hacktivists of customer data and intellectual property, rogue applications accidentally deleting data and departing employees deleting their data accidentally.

The single leading cause of data loss in the cloud was user error, said Shaun Pinney from Backupify, a cloud-to-cloud backup service for Google Apps, Salesforce.com and other cloud pograms. Backupify has published an eBook outlining how to protect against data loss with cloud software.

Cloud-to-cloud backup services stored a copy of data contained in a cloud program or on a cloud server. This service was different to a cloud backup, which typically referred to a remote, online or managed backup service that allowed users to backup, store and recover files from their desktop PCs, laptops or in-office servers.

How You Can Beat The CryptoLocker Virus

November 8, 2013 by Sholto Macpherson

Three weeks ago I received an email from a close relative, forwarded on several times, warning about a terrible virus that would destroy your computer. Instinctively I thought it was a hoax, but I emailed the sender who turned out to be an IT engineer and the threat was legit.

From his email:

Yes, it’s a serious concern – devastating payload and high rate of infection. Possibly the most ‘evil’ virus I’ve seen in 23 years of IT.

The virus was named recently as the CryptoLocker virus. When an unwitting user opens an infected email the virus looks for documents, data files for accounting software, photos and applications on the computer and encrypts the files so that they’re impossible to open.

A pop-up window with a 100-hour countdown begins and you’re given details how to pay the ransom, which typically ranges between $100 and $700.

If the money is paid before the timer is up, a key is supplied to decrypt the files. If payment is not made, the key is destroyed and those files are lost forever, according to a security software blog.

Early signs suggest that this will be one of the big viruses that sweep across the world every couple of years. CryptoLocker is undetected by several brand-name anti-virus programs. Variants encrypt not just the files on your computer but mapped network drives including backups stored on external hard drives. And the virus is smart – it targets file types it knows are valuable, such as RAR disk images, EXE files for launching applications, JPG photo files and MYOB data files.

What does CryptoLocker look like?

Sydney based IT services company IT and C has been warning its clients for several weeks about CryptoLocker and has helped home users and businesses recover from the attack.

CryptoLocker often targets accounts departments by sending to accounts@xxx.com email accounts with a ZIP attachment. The attachment name has varied each time, but has so far been named in a way that would suggest it is a legitimate email for an accounts role, eg. “tax_invoice380.zip”, said Josh Leisk of IT and C in an email sent on October 12.

“The virus inside that zip file has so far at least partially evaded 5 different antivirus products over the last few days, including all of the Tier-1 products,” he said.

Other reports say that the virus arrives as an infected voicemail message attached to an email.

“So far in the (past) three days, we’ve had to restore entire servers/workstations for six clients from backups (I’m still in the process of restoring some now),” Leisk wrote.

“We’ve also had one sad instance where the server backups have been encrypted/damaged as well and another two individuals/home businesses that have not kept proper backups and lost nearly *every* document,” he added.

I spoke with IT and C support engineer Varant Kalloghlian today and confirmed that the company was still dealing with multiple infections. Clients that had working backups lost at least a day’s work as their systems were restored.

Unfortunately one home user lost everything because CryptoLocker had travelled from the desktop to the external hard drive.

How do you beat CryptoLocker?

The only foolproof way of getting around CryptoLocker is to have rotating backups that aren’t connected to your machine. If your attached backup is infected then you can pick the last most recent backup and restore that instead. The cloud options make it easier than plugging and unplugging external hard drives but you have to pick your services carefully. If you just use Google Apps, for example, CryptoLocker can encrypt your Google Drive on your desktop which will then sync to the cloud, encrypting that copy too.

Businesses need to also add a backup service for Google Apps such as Spanning or Backupify. These will let you recover an earlier, unencrypted version of Google Drive.

Dropbox is also underprotected. Although it has a function to recover files, it will only do it for each individual file. If you have 20,000 files it gets a little tedious.

A local backup program called ShadowProtect takes 15 minute snapshots of your machine and syncs them to a cloud server. No variants of CryptoLocker have encrypted ShadowProtect files to date.

It’s far safer to use an online email service such as Google Apps (Gmail) or Microsoft Office 365 (Exchange Online) to stop the virus before it reaches your computers. Companies that provide online email services such as Google and Microsoft have millions of emails moving in and out of their cloud data centres and can more easily track an email-borne virus and stop it from infecting users. Gmail will typically flag an email as suspicious or even remove an offending file if it’s identical to known malware.

The same goes for accounting software. It’s impossible to infect the data file for Xero or Saasu because they are sitting behind heavily protected data centres in the cloud. CryptoLocker has been programmed to look for data files of desktop accounting software, including those by MYOB, Kalloghlian claimed.

The most worrying aspect of CryptoLocker is that a current backup is the only way to restore your files without paying the ransom. But given that the virus can also encrypt backups on external drives could cause a lot of problems.

IT and C gave this advice to users with files stored on locally their computers:

1. Please be extremely careful not to open up zipped email attachments. Unless you know for certain it’s both a clean email and also from someone you were expecting to receive a zipped attachment from, don’t open it.

2. Backups. Backups. Backups.

3. Even the best antivirus is not always guaranteed to protect you in every instance. The human brain is always the best at identifying suspicious email attachments.

4. Backups, again.

Image credit: News.com.au

Hackers Crack Adobe’s Cloud Service: Lessons Learned

October 8, 2013 by Sholto Macpherson

Users of cloud services may have felt a little uneasy last week when Adobe, maker of graphic design software such as Photoshop and InDesign, reported that hackers had stolen information about 2.9 million customers. Included in the haul were Adobe customer IDs and encrypted passwords, many of which allegedly belonged to users of Adobe’s Creative Cloud service.

The attack highlighted again the opposing relationship between convenience and security. One of the greatest benefits of cloud software and services – that it can be accessed from a browser on any device with just a username and password – is also a weakness. If someone else gets hold of those details they can access your data too.

Luckily there are three easy steps you can take to limit the damage.

Unique Passwords

The most critical step is to use long, difficult and unique passwords for each service. This should be a mandatory requirement for employees in any business using cloud software. Committing to this policy is practically impossible without a password manager to assist you. I am a heavy user and fan of LastPass; there are others.

If a cloud service is hacked and your unique password stolen, the hackers will only be able to access that particular service. If you use the same password for other cloud software, internet banking or government services, you could find yourself in a pickle.

Two Factor

Some cloud services such as Dropbox, Google Apps and Office 365 offer two-factor authentication. This security measure uses a dedicated mobile phone app to generate a lengthy password that approves your computers and mobile devices for that cloud service. Users still must enter their own username and password to log into the cloud program.

A new two-factor password is generally required every 30 days and is not stored by the cloud service supplier. If a hacker stole your password and username, they would also need to steal your laptop or smartphone to access your data. This is another mandatory requirement for businesses wanting to keep a tight hold of their data.

Single Sign-On

The Google Apps Marketplace contains hundreds of useful, independent apps which work with Google’s cloud software. A Google Apps user can launch a Marketplace-linked app from a drop-down menu in the Gmail interface. Google has already identified the user and so automatically signs in the user to the third-party program.

This approach has two advantages. Third-party programs that use Google’s Single Sign-On service don’t need to store users’ passwords and usernames, so there’s nothing there for hackers to steal.

And of course there’s no password for the user to remember either, which is one less thing to worry about. Just make sure you don’t forget your Google Apps login…

Desktop Software More Secure Than the Cloud? Not Likely

August 27, 2013 by Sholto Macpherson

Cloud software, although easily accessed over the internet, was typically much more secure than desktop or server software, said security experts and software developers.

“The developer of a web app takes security seriously because they are exposed to everyone on the internet. Legacy software providers don’t take security seriously,” McLean said Richard McLean, a software developer behind the online payroll program KeyPay.

McLean pointed to an incident last year where a Gold Coast medical centre was held to ransom by Russian hackers. The hackers broke into the server remotely and encrypted the server software containing business and medical records as well as the backups. The business was told to pay $4,000 so the information would be decrypted and the medical centre could continue to operate.

Security issues with desktop accounting software included allowing logins without passwords and the widespread practice of sending data files with commercially sensitive information in unsecured email or mailing unencrypted CDs or USB keys.

Another security risk was running accounting and financial software on a laptop protected just by a system password.

“If they lose the laptop, an IT guy would take 60 seconds to reset that and have access to it,” McLean said.

An attack similar to the Gold Coast example was much less likely to happen in cloud software, McLean said. Usernames and passwords were encrypted in cloud software databases for a start.

“We all run bank-level security so any data that we perceive to be important we encrypt in our database,” McLean said. “We have an extra level of security which is the information sent between the browser to the web server is encrypted as well.”

Security experts say that because cloud software is more accessible, software developers must start with a much higher base level of security than desktop or server software.

“In the case of desktop software, it is assumed there is no protection of the data as it is just files on the local disk. The data and application are both essentially unprotected as they are directly accessible to the user,” said Adam Pointon, director of Sentinel Data Security. “There is essentially no protection to local attack.”

Once a person has control of a desktop computer – either sitting in front of it physically or by remote access over the internet – it was relatively easy to bypass password or licence controls to access the data file. Even if a person couldn’t open a desktop accounting application, for example, they could still copy the data file and examine the contents.

By comparison, cloud software sent only the data requested by the user through a remote process over which the user had no control.

“You can’t directly ask the database for data, or read the data file from disk and inspect the raw contents,” Pointon said. “Likewise you can’t control the application like you can on a locally-executing program nor access its memory space.”

Desktop applications used with remote access software such as Citrix Receiver were also more secure than desktop software alone, Pointon said. The user was prevented from tampering with the files running the application or the operating system.

The risks for online software were twofold, Pointon said. A user had to rely on the online software vendor’s security practices to be sufficiently high enough to protect user data. And poor development of cloud software could expose users to greater risks than the same mistakes in desktop software.

Three Tips to Secure your Android Phone or Tablet

August 14, 2013 by Sholto Macpherson

Want to make sure you hang onto your shiny new phone? Google recently posted several easy ways to secure your Android smartphone and tablet.

You can easily set up these tips and tools on an Android phone or tablet to keep your device – and the contents inside – safe and secure. Google has released a new service that makes it easy to locate a misplaced device (similar to the Find My iPhone app for iPhone users).

1. Lock your device screen

Whether you’re on a phone or a tablet, it’s easy to set up a screen lock. This is important to do in case your device gets left in the back of a car, or you’re worried about someone picking up your phone and scrolling through your stuff. You can lock your device with a pin, password, pattern (or even your face) by going to Settings > Personal > Security > Screen Lock.

2. Protect your phone from suspicious apps

Google automatically scans its app store Google Play to block and remove harmful apps. That makes Google Play the safest place to get Android apps. But Google Play can also help protect you even for apps you get elsewhere, like the web or a third-party app store. The first time you start to install an app from an unknown source, a message will pop up asking if you’d like Google to scan the file to make sure it’s not harmful. Tap “OK” to let Google help protect you from harmful apps.

3. Locate, ring and wipe a misplaced device

Have you ever lost your phone in between the couch cushions or left it in a restaurant? Later this month, you will be able to use a new service called Android Device Manager, which can quickly ring your phone at maximum volume so you can find it (even if it’s been silenced), or locate it on a map, in real time, using Android Device Manager.

If your phone can’t be recovered, or has been stolen, you can quickly and securely erase all of the data on your device to keep your data from ending up in the wrong hands. The Android Device Manager will be available for devices running Android 2.2 and above, as part of Google Play. You can read the full announcement on the Android blog.

For more advice on how to protect yourself online, visit Google’s Good to Know site.

A version of this post first appeared on the official Google blog.