Home
About
Contact Us

Home>blog
Tue, 03 May 2022/

Protecting Your Business – Data Security FAQ

As one of Southern Africa's leading managed IT service providers, we hear a lot of questions and concerns about data security – and rightfully so. Data security is critical to business operations, but many business owners overlook this potentially dangerous facet of their business. What happens if your security is breached? What if disaster strikes and you can’t access important data? How much will it cost your business to be out of service for an hour, half a day, or 24 hours? If these questions raised red flags, don’t panic. You’re not alone, and Multi IT & Telephony Solutions is here to help. Below are some of the most frequently asked questions we hear regarding business IT security, and some next steps you can take to protect your business. So, what are we protecting against, exactly? Various events can lead to an interruption in your IT environment, from natural disasters to exfiltration of your systems. If your systems are physically damaged and unusable, the offsite backup solution will make you whole again once new hardware is installed. Better yet, use a provider that can spin up your systems offsite, OS and all. Ransomware is perhaps the greatest risk today, even if you have a layered security solution. With this type of threat, it’s generally not IF but WHEN you’re impacted, and one of the best ways to protect against ransomware is by having an offsite cloud backup. While I’m writing this, we’re seeing another large-scale, global ransomware attack unfold. It cannot be stressed enough that every company should implement and maintain patch management, backups, disaster recovery, and incident response procedures to protect from ransomware threats. When should I test our backup? Answer: Not when you need it. If you regularly test your backup solution, you’re better than most CIOs that only know there’s a problem when it’s too late. Various solutions can provide soft-testing and reporting on the integrity of your backup, to ensure it will work when you most need it. Better yet, get a monitored solution that kicks off alarms when the job fails. It’s not a set-it and forget-it type of thing. What does a restore look like? Depending on the event, a restore can be extremely easy and fast with the right solution. You want to understand what a restore looks like, from file or object restores to bare-metal restores. You want to know that you can restore to multiple and dissimilar hardware. Your solutions provider should be able to walk you through what to expect in a restore and provide assurance that there won’t be surprise costs or unnecessary delays. In fact, that should be written in the agreement, so you know your rights. By the way, a good provider does the restore as a part of the monthly service cost. What are my next steps? Businesses should review the Service-Level-Agreement and the provider’s ability to deliver support for the solution. They should request details on monitoring and alerting, recovery methods and timeframes and compliance for regulated industries. They should know where their data backups are physically located and if they’re encrypted/encapsulated, and what happens to their data backups if the service is terminated. They should understand their compliance requirements and be sure the solution meets/exceeds those requirements. What can I do to protect my systems today? Ensure your systems are patched, or let us patch them for you, and please don’t use an unsupported version of XP, Windows 8 or Windows Server 2003.Back up regularly or let us back up your data and keep a recent backup copy off-site. There are dozens of ways other than ransomware that files can suddenly vanish, such as fire, flood, theft, a dropped laptop, or even an accidental delete. Encrypt your backup and you won’t have to worry about the backup device falling into the wrong hands.Avoid opening attachments in emails from recipients you don’t know, even if you work in HR or the accounting department and you use attachments a lot.Contact us today to ensure you are properly prepared and have taken the steps necessary to deploy a layered security approach to meet your IT security needs. Protecting your data is critical to business operations and backup solutions can be tailored to your specific needs – contact Multi IT & Telephony Solutions today to find the right solution for your business. Johannesburg – +27(0)11 435 0450, sales@multi.co.zaCape Town – +27(0)21 879 1950, sales@multi.co.zaDurban – +27(0)31 331 0735, sales@multi.co.za Namibia – +264(0)84 000 8310, sales@multi.com.na
VIEW MORE
Fri, 29 Apr 2022/

How To Lead An IT Emergency Room

“Align yourself with the client, because truly you are on the same team.” Jamie is the Service Manager here at MULTi IT & Telephony Solutions. He is an experienced IT Manager with a demonstrated history of working in the information technology and services industry. Skilled in technology management, Helpdesk operations, operational planning, IT service management and IT talent management. An IT emergency room.   Jamie: “What we call it is a triage process. When a ticket comes in, we’re triaging it. No different than a patient walking into an emergency room. The guy with the gaping hole in his chest is going to get seen before the person who’s like ‘hey, I have pain in my knee right now.’ You go have a seat, we’re going to get to you. You’re still important but it’s not critical that I get to you right now. This guy’s losing blood. He needs to be seen by a doctor stat. It’s a similar process.” Jamie: “Somebody calls in and says, ‘hey, my printer at my desk isn’t working, but I can print to the network printer fine.’ Okay, cool. You have a workaround, the ticket is in the queue, we’re going to get to that. Versus, ‘hey, nobody in the company has gotten email in the last nine minutes’. Okay, we’re going to go ahead and expedite that, move that to the front of the line because now you’re talking real consequences. How much money do you lose per minute being down?” Jamie: “To keep on the medical analogies, a vCIO is a general practitioner. I’m the guy that you’re going to for the last 20 years; knows you inside and out, what to do. When you go to the service desk, that really is ER. It’s a transaction. I don’t know your medical history. I don’t know anything about you. It’s an in and out transaction process. Maybe I’ll see you again. Maybe I won’t. You’re not taking that deep dive into the environment or their background.” Service desk dispatch. Jamie: “I will say that dispatch, which is the team that’s taking the tickets via email or phone call, have the toughest job on the service desk, because they’re the front-line. They’re the face and the voice for that first interaction of the ticket. Generally when you’re having IT problems, you’re not getting happy and smiling on the other end. Somebody is frustrated. They can’t do what they need to be doing right now, because of some technology malfunction. So naturally they’re maybe a little agitated.” Jamie: “What I tell them to do is get on the same side of the table as them. If they’re having problems with Comcast or the Internet’s bouncing, get on the side of the table with the client. Be like, ‘man, not that internet service provider, they’re killing us. Let me get on the phone with them. I’m going to take care of this for us right now’. Something along those lines. Align yourself with the client, because truly you are on the same team. So you should verbalize that, and not make it seem like they’re calling Walmart, whom they have no relationship with. We have that relationship.” vCIO versus Service Desk Manager Jamie: “It’s extremely different. They require different skill-sets. As a CIO, you really need to be the guy that can see the entire picture at one time, and figure out where all the pieces need to go. Versus service desk where you’re managing a puzzle with a hundred different pieces at once, and you’re just trying to find the corners and start building from there.” Jamie: “You’re also managing more of a process on the service side. Without a process, service desk would fail. Who’s triaging? What order should this be going in? Where does all this kind of fit?. CIO is challenging in different ways, because you’re going up and speaking to the C-suite, and you’re having really consequential conversations. ‘What is the future of my business this year, next year, five years from now? How much do we need to budget for next year? My budget got reduced by 40%, but I know we need new infrastructure. Where do we go from here?” Jamie: “Both are challenging, but present very different challenges. I enjoy both. I can’t say that I enjoy one more than the other.” Service desk team characteristics. Jamie: “Grit is number one. I can teach someone IT. Grit is one of those things that is ingrained in you. You have it or you don’t. The reason I say grit is because you’re going to come across a problem that just stumps you, and you’re going to say, ‘I have no idea’. You just have to keep plugging away and going. There’s help there for you. There’s resources. But you have to have that determination, intestinal fortitude, to keep moving the ball forward. So that’s the first thing I look for.” Jamie: “Number two, I want somebody that I’m comfortable having a conversation with. If I’m not comfortable having a conversation with you and we have a relationship, how’s the person on the phone going to feel?” Celebrate victories. Jamie: “There’s days where it doesn’t feel like success, where you feel like you’ve just churned, but you’ve made progress. We have all the KPIs that we use to measure how we’re doing overall as a service desk. On TVs and Dashboards, around where the entire team can see. How many tickets came in today? How many tickets were closed today?” Jamie: “I can look up and go, ‘wow, we’re really moving the needle today.’ Celebrate the small victories. We’re big on rewarding C-SAT, shout outs from clients. Just walk around; give everyone a little fist bump, “hey, you guys are killing it today.’ I measure my team’s success by my team’s happiness. If everybody out there looks dejected and like they want to be somewhere else, I’m not doing a good job managing my department.” Here at MULTi IT & Telephony Solutions, we truly are proud of all the compliments our service desk team receives. If you would like to join our world class Managed IT Services, get in touch with us online or on the details below: Johannesburg – +27(0)11 435 0450, sales@multi.co.zaCape Town – +27(0)21 879 1950, sales@multi.co.zaDurban – +27(0)31 331 0735, sales@multi.co.za Namibia – +264(0)84 000 8310, sales@multi.com.na
VIEW MORE
Mon, 25 Apr 2022/

How to Secure and Protect Your Website

Your website is the centre stage for your company online and tells people what you do, who you are and why they should use your product or service. However, once a website is complete, most companies will just think of it as a finished project once it is live online. Since most people don’t realize this, that is where they get themselves into trouble. To help you understand the importance of website security, we have put together a list of questions you should ask yourself to see if yours is secure. Who hosts your website? (Where does it live?) Bluehost, HostGator, GoDaddy – you may be familiar with these companies but not every hosting provider is the same. Before choosing one, it is important to do research to make sure that your website will be in good hands. For example, GoDaddy does not have the same level of security that a provider like WP Engine or MULTi Hosting has. At MULTi IT & Telephony Solutions, we have chosen a provider very carefully based upon our security posture. WP Engine has the full level of security: daily backups, firewall management as well as the response time to ensure that if something does happen, they will have your site up and running again. Caveat: WP Engine only hosts WordPress websites. However, WordPress is the best content management system for small- to medium-sized businesses in terms of customization and security. You need to make sure that your hosting provider has enough security measures in place so that in case something happens to your website, they can be a resource to assist you in recovering it. Who has access to your website? (Who can get in?) Internally, an employee who thinks that they know what they can and cannot touch within the website can easily make an update on the domain or the DNS (Name Server). In doing so completely take down your company email and website, so that nobody can access any of it. With the DNS, if you make a change to it, it takes time for that change to propagate. So you’re looking at 24 to 48 hours of downtime. Externally, on the marketing side, we see so many more providers in there. An SEO provider, a developer, a designer – all who have access to your site. You don’t always know how their employees feel about your company. You have no idea what’s going on in their side. So if they have access and then they have a disgruntled employee, you could be affected by that. It could be absolutely nothing to do with your own employees. What layers of security are in place? (Is it protected from hackers?) The first thing you should definitely have in place on your website is an SSL certificate. It’s the lock you see in the search bar next to the website name. An SSL certificate is basically encrypting any information that is submitted through that website. If you’re collecting contact information, payment information, or private data for your clients or prospects, you need to have one of those. And this is another example of where they’re not all the same. There are ones that have certain levels of encryption, very basic level of encryption, which if you’re not really collecting private information on your website, that’s fine. But if you’re collecting payment information or private data, then you need to have a better SSL certificate on your website. That’s one of those things that Google favours, and so people have figured out an easy way to do it which is the basic level. But if you have more information on your website, then you should probably be thinking about a higher level than just that basic level to protect the information that is being collected. Besides an SSL certificate, setting up 2FA (two-factor authentication) is also an important security protocol. Everybody knows that the WordPress login page is www.yourwebsite.com/WP-admin. You can change that, but it can make things more difficult for users. The easier and more secure thing to do (because a hacker can still figure out what that other site is) is to set up 2FA. There are different forms of it, but the best one is to have a token on your phone, which we use a service called DUO. DUO is managed by an outside party. So let’s say you have an employee or a third party, like an SEO firm, who needs access to your website. They would log into the WP admin page, and then with that token set up from DUO, they’d get notified on their phone and confirm it. Then let’s say that you don’t want them to have it anymore, as a third party token, you can then remove it from their phone. Google Authenticator and some of these freebie ones, that’s not possible. So you put that on 2FA on your website and they had a disgruntled employee or you fire that SEO firm, there’s nothing you can do really to remove that 2FA from their phones if you’re not using a service like DUO. 2FA applications are more secure to use than 2FA texts. We have seen cases where people’s text messages have been hacked and the hackers bypassed the 2FA by getting the code from there. If your website is vulnerable or you haven’t thought of any of these things, definitely reach out and get ahead of this. Get in touch with us online or on the details below: Johannesburg – +27(0)11 435 0450, sales@multi.co.zaCape Town – +27(0)21 879 1950, sales@multi.co.zaDurban – +27(0)31 331 0735, sales@multi.co.za Namibia – +264(0)84 000 8310, sales@multi.com.na
VIEW MORE
Thu, 14 Apr 2022/

Moving to the Cloud and What That ACTUALLY Means

Everybody is talking about the cloud, but the average business owner doesn’t really understand what that means. It’s the new and exciting thing, supposed to be super easy to use and inexpensive. However, it isn’t the answer to everyone’s problems, but that can be hard to understand when it comes so neatly packaged. After all, besides the cloud, how else can I access my data everywhere? In order to understand what all of the options are, we need to go back to the basics. Let’s start with your IT environment. Depending on the size of your company, it can be incredibly complex or quite simple, but they all have similar pieces. In the past, all of these pieces had to live in your location. It was easy (or at least easier) to understand how it was all connected. You installed software using a CD on your desktop computer. Your desktop computer was not mobile and you couldn’t sign onto anyone else’s computer in the office. It connected to other computers and the internet through a wired network and wired access in your office. Your data was stored on either your own desktop computer or the physical server in your office that you connected to through the wired network. That server was backed up onto a separate hard drive, again in your office. Everything was contained in your office and you could only access it from that one location. As the internet has developed in power and speed, how we accomplish all of those same tasks has changed, purely because we are connected. We don’t need CDs to download software, you can download it from the company’s website. In fact, for most software programs now, you can’t even download the program to your computer or your server. You access it all directly from your internet browser. The software company keeps it on their servers. You also don’t need wires to connect you to the internet or your network. You don’t need your server to be located in your office. It can be in a data center halfway across the world. The same goes for your backup. Even your desktop can now be available to you on any computer because it is actually stored in the cloud. The cloud is the limit! But really, what is the cloud? When people think of “the cloud,” they often just picture their data floating somewhere. In a way, that is true, but what it doesn’t highlight is the physical infrastructure that still lives somewhere, just not in your office. Cloud computing is a network of physical servers located somewhere in the world connected to the Internet that manages your data, instead of a local server or computer. Your data, software, and even desktop can be stored somewhere other than your office and you can access it anywhere that you have internet. That’s the cloud. But what people don’t often realise is now with the power of the internet you can also access the server in your office from anywhere too with the right technology. It is essentially your office’s own private cloud. What does that mean then? The conversation simply becomes about where is the most cost effective place for me to store my data. Cloud storage is like leasing a car and an on-premise server is like purchasing a car. Depending on the number of employees, the programs your business uses, and your budget, any number of cloud or on-premise solutions could make sense. What’s best for my business? Let’s say you’re a start-up just getting your feet wet. With the power of Office365 (a cloud solution for both software and storage), you can get up and running with all the basic tools you need for business – email, file storage and sharing, and the Microsoft Suite- with minimal upfront costs and a reasonable monthly fee. You can scale quickly, adding users as needed. On the other hand, a large professional services firm requires serious horsepower because of their programs and number of employees. When it comes time to replace their infrastructure, it might be tempting to scrap it all and go to the cloud. There will be costs to make the transition to the cloud but nothing compared to the price tag on reinvesting in physical infrastructure. However, a cost analysis might show that the monthly costs of cloud storage end up being more than the cost of physical infrastructure spread out over the life of that equipment, especially if you end up using more cloud resources than you originally planned, overages can add up quickly. Again, it’s just like leasing a car versus buying one. Yes, if you buy a vehicle, you are responsible for the maintenance and upkeep but if taken well care of, the investment can save you money in the long run. But if you don’t want to make an upfront investment or you don’t want to be responsible for the upkeep, then leasing a car is the right option for you. Ultimately, every business falls somewhere in between. Some pieces of your IT environment are better off in the cloud and some are better off on-premise. What you won’t find very often is an IT provider who is comfortable handling both. They are either cloud only, selling their particular solution with no real interest in finding what is best for your business or they only support your physical infrastructure. Here at Multi IT & Telephony Solutions, we’re comfortable with all of it. We understand the pros and cons and the associated costs so you can make the decision that is best for your business now and the future. Want more from your IT provider? We know change is hard. A conversation is a great place to start. Contact us to set up a call. Get in touch with us online or on the details below: Johannesburg – +27(0)11 435 0450, sales@multi.co.zaCape Town – +27(0)21 879 1950, sales@multi.co.zaDurban – +27(0)31 331 0735, sales@multi.co.za Namibia – +264(0)84 000 8310, sales@multi.com.na
VIEW MORE
Mon, 04 Apr 2022/

Cybersecurity training: creating a more holistic business security plan

Did you know employee error accounts for more than a quarter of all company security breaches? Or that the average expense of a data breach is R36 million, globally? Experts say ransomware is expected to cost businesses R120 billion this year and that nearly 2 billion records were leaked in January 2022 alone. Hackers are improving as technology continues to advance every day. We want to make sure your staff has the knowledge necessary to prevent a cyberattack so your business won’t be so susceptible. Once you read our post you will have learned how to put together an effective cybersecurity training program for your employees. This is absolutely crucial to a holistic security plan for your organisation. What is a cybersecurity training program and why is it important? What is a cybersecurity training program, anyway? A cybersecurity training program is a series of sessions aimed at providing workers a baseline understanding of the fundamental principles of cybersafety practices. The most effective training programs are usually ongoing, mandatory and led by an experienced IT professional. These classes teach employees what to look out for when they’re online because traps are unfortunately becoming more challenging to spot. Make training sessions a regular part of your processes and protocols. Consider bringing in experts that specialize in cybersecurity training, even if you have your own internal IT team. Managed services providers (MSPs) have a wealth of knowledge and more years of experience between their team members. They have seen many more security cases, Multi IT & Telephony Solutions, in particular, offers a comprehensive cybersecurity bundle for Johannesburg, Cape Town, Durban and Windhoek areas. Plus, a managed services provider is used to acting proactively rather than reactively when it comes to business IT. Many MSPs—ourselves included—would happily provide a consultation or come onsite to conduct trainings if you don’t have a dedicated IT leader. Whatever method you choose, make sure the leader of the sessions has a plan and goes over the basics, at a minimum. With today’s threats, cybersecurity training is absolutely critical Whether they’re infamous, lesser-known or brand new, there are too many scams for each employee to keep track of. Cyberattackers try anything they can think of to get into your company’s systems. Some tactics have been tried many times on businesses before, while some are still being devised. The criminal acts that attackers everywhere are plotting can be categorized into three main categories: phishing, hacking and ransomware. Phishing is when fraudulent emails sent to your network users claim to be from reputable companies but are actually from skilled cybercriminals working on getting valuable information. Hacking can happen via weak passwords and not being careful on platforms where you share information, such as social media. In 2021, a hack was found to have been compromising data on Marriott hotel guests for several years. The hackers gained access to names, contact information, passport numbers and even credit card numbers. Ransomware is just what it sounds like: it is a type of malware that, when accidentally downloaded, is programmed to block access to your important systems until a sum of money is paid. Between recovery efforts and penalties, once your company is compromised, it’s extremely costly to bounce back. Fees can be imposed for record loss depending on your industry, especially for medical, financial and government. In 2020, Google was fined $57 million for violating the General Data Protection Regulation (GDPR). These fees don’t include costs for the downtime and resources your employees might spend trying to fix things on their own or harm to company reputation. These categories are the “threat landscape” to keep in mind during your cybersecurity training sessions. How to create and implement a highly effective cybersecurity training program Organizations from SMB’s to larger enterprises are finding it costs much less to implement security awareness programs and training than it does to pay the consequences of not having them. Recognizing its value, experts predict that businesses around the world will spend up to R100 billion on cybersecurity awareness by 2027. Corporations and consumers alike are slowly beginning to come together to take a stance against cybercrime. Your employees are on the front lines, so prepare them to act as a human firewall rather than fall victim to things like identity theft. Equip your organization with the tools to be preventative instead of reactive by implementing cybercrime prevention tactics and arming team members with proper knowledge. How to make sure your cybersecurity training sessions are effective Cybersecurity training should be a requirement for all team members. If someone is using your networks, they could be a risk to the company, no matter the department. Everyone should be made clear on the fact that it is a company-wide risk management necessity and should not be taken lightly. If even one person decides it’s optional for them and doesn’t show up, there’s a hole in your security. It’s ineffective, and you could be compromised. Schedule your cybersecurity training sessions frequently. Hackers are continually creating new scams and technology is always evolving. Hosting training every other year is not enough; your teams’ knowledge base could fall behind and become outdated. You also want to hold these trainings regularly because repetition is one of the most effective ways of teaching. No one takes just one class and remembers everything, forever. The sessions should be serious yet digestible and engaging so that everyone pays attention. Personalise it and make it applicable to all levels—the knowledge base and specialisation of each attendee will differ. Understand the different positions that will be there and customize the experience as best you can. All types of employees at all departments of the organization, from management to interns, will need to understand the topics and how they apply to their personal roles within the company. Major shareholders, partners, external legal counsel and any vendors you’re letting into your system should all attend cybersecurity training. Everyone will be using your systems to a varying degree. Define the scope and plan your cybersecurity training program Each company is different, so each has different needs. Your organization should conduct a business impact assessment as well as a risk assessment to kick off the cybersecurity training process. At that point, the training sessions are designed around your business’s highest risk areas and focus on aspects tailored to your company. Generally, a cybersecurity training facilitator teaches prevention through smart passwords, dual approval, email filtering and understanding what red flags might look like. Some examples of red flags are an email address that looks fishy because an email was never requested from the sender in the first place, seemingly random links thrown in an email with no context or an email from a supposed “professional” that has a lot of errors. Social engineering and scams from callers pretending to be tech support and other services should also be on the agenda. An incredible amount of information is constantly shared that could get into the wrong hands in mere seconds. Consider including a review on the following as well: Company equipment inventory—especially laptops, phones and tabletsEstablishing guidelines for when accessing public wifi networks during remote workUsing company technology to store personal files, images and other dataDangers surrounding saving work-related files on an external driveAccess for departments that contain sensitive equipment and data if you use ID badges, etc. To reduce the risks and potential threats, add new scams to the curriculum as they arise to keep your team’s cybersecurity training as up to date as possible. Create a set plan so everyone knows what to expect. If you do not go into this training with an idea of the goal, you will not know which areas to cover and will inevitably leave gaps. Think of this just as you would an employee safety training program. Cybersecurity training is about safety as well—that of your company, employees and customers. Therefore, ensure everyone can dedicate the proper time to each session. If you have a larger company, you can segment. Hold a main cybersecurity training session for a large group and then individual sessions breaking out into programs that speak more to their responsibilities and area of expertise. Not every topic covered in each training session will apply in the same way to every department, but everyone needs to know the high-level material to be on the same page. Implement, monitor and optimise your cybersecurity training program As mentioned, it’s often a good idea to have a security expert in attendance who can answer questions immediately and describe real-life examples. For those who are more visual types, consider adding videos that they can access on their own time. With video training, ensure there is a method to verify video watch completion. Don’t let anything slip through the cracks or it’ll leave one more window into your company for expert hackers. If you only have set training once or twice a year, your company intranet, newsletters or emails can be used in between major sessions for quick, regular reminders of the basics. Don’t forget, you may have new staff coming onboard during that time that will need to be caught up to speed if they have missed an official session. After a few weeks or months post-implementation of your cybersecurity training programming, see what is working and what is not. Analyse and measure to gauge progress—if something is not successful, you’ll know exactly how to make a change for the future. Are people following the standard procedures on which they were instructed? If not, was the point not made clear enough, or do ramifications need to be made for breaches of the process in order to prevent breaches by attackers? Where you can learn more before getting started Remember that although these attacks are sometimes obvious, traps are becoming sneakily well-dressed. They’re digital Trojan horses waiting to infiltrate, so companies are finally starting to take notice of the importance of cybersecurity. Aside from the cybersecurity training, you can of course consider extra layers of preventative measures by investing in solutions like anti-virus software or off-site backups. Keep in mind, your goal is to create a comprehensive business security solution. We’re just zeroing in on one of the biggest dangers that we’ve come to know through our vast experience. The end user is the downfall of companies we see most often. In other words, more often than not, employees cause that trouble unintentionally. If you did not provide your team members with proper cybersecurity training, they are not at fault.  The best thing to do is have an outsourced team of experts manage everything for you so that you don’t have to worry about whether you, your trainer or your employees missed a critical component. Don’t forget, it’s largely about human error, so the more people you have that truly, thoroughly know what they’re doing, the more of a safety net you’ve made for your organization—and the less likely you are to risk the invaluable trust of your clients.  Get in touch with us online or on the details below: Johannesburg – +27(0)11 435 0450, sales@multi.co.zaCape Town – +27(0)21 879 1950, sales@multi.co.zaDurban – +27(0)31 331 0735, sales@multi.co.za Namibia – +264(0)84 000 8310, sales@multi.com.na
VIEW MORE
Tue, 29 Mar 2022/

12 ways to enhance your small business email

Learn how to determine the most effective ways for your employees to enhance the security of their email environment at work. What is email security, and why is it so crucial? To answer that, you must know that an overwhelming majority of company security breaches start with a phishing email. Phishing emails are just what they sound like: virtual bait “dangled” in front of your staff by cybercriminals to “catch” something they want from your company. Specifically, hackers are trying to capture your most sensitive information. As we move further into the future and as technology advances, so do hackers’ skills. This is why email security is so imperative. A cyberattack can lead to significant consequences for your business. It can cost a substantial amount of money in attempted recovery, as well as potential legal fees and other penalty charges. Not to mention company downtime, which can deplete resources. There can even be non-monetary consequences—not as expensive on paper, but equally costly. Your customers’ trust in your brand could be tarnished, and as many companies have had to learn the hard way, trust can be nearly impossible to earn back. When it comes to creating a well-rounded cybersecurity plan for your business, we know the best tips and tricks to get you started on your journey. Our expert tips to improve email security Our team at Multi IT & Telephony Solutions have years of experience in this area, so we’ve seen it all. These are our best bits of advice that you’ll want to follow sooner rather than later. Because hackers’ abilities are improving every day, the quality and strength of your business cybersecurity should be too. Expert email security tip #1: regular education As cybercriminals continue to evolve, so does the knowledge it takes to protect your company. Make security training a regular occurrence so your team’s knowledge base on this subject is never outdated. Ensure new team members also get caught up to speed if they are hired in between cybersecurity training sessions. By making cybersecurity a part of new employee onboarding, you lessen the chance that they unwittingly become a weakness in your system by not being appropriately trained in time. We have advice in another article on how to implement an effective cybersecurity training program for your team that we suggest reading as well. Expert email security tip #2: password protection Many people use obvious passwords to make logins easier on themselves. Unfortunately, this also makes logins easier for hackers who are trying to get into your accounts. If you tend to forget your passwords, you need to find a digital method for helping yourself to remember. Don’t write them down on a piece of paper where someone can easily find them. Office guests and, yes, even co-workers, can accidentally compromise your accounts—so don’t let your passwords be shared with anyone. But which digital tools can you trust? Don’t just try saving your passwords in browsers. Utilize applications that offer the right protections. For example, you can safely store passwords digitally by taking advantage of apps like LastPass. That way you won’t have to worry about remembering so many different passwords for all the different websites you use daily. And when you create your passwords, make them strong. Come up with a truly unique combination of length, letters, numbers, special characters, and other traits. While it should be obvious not to, it’s surprising how many people still think they can use their name, “123456” or the actual word “password” as their password. These are not adequate options. We want to spell this out for you so that your staff doesn’t accidentally spell out danger for the whole network. If you can’t think of one on your own, try a random password generator such as Dashlane or even passwordgenerator.net Expert email security tip #3: encrypt your emails If you want to protect your emails, we urge you to consider encrypting them as an added layer of security. There are several types of encryption, but data-centric tends to be less risky than point-to-point. If a hacker intercepts sensitive data that is encrypted, they won’t be able to read it. This significantly lowers the odds of successful attacks. Encryption keeps emails between a sender and the intended recipient private because the person trying to break in won’t have an approved email encryption key. Expert email security tip #4: multi-factor authentication Cyberattackers may find that it’s simply not worth their time trying to breach your email security when other businesses have emails that are less difficult to break into. Thus, you should know how to make use of multi-factor authentication. If they want your information, make them jump through hoops. It’s not just about making more “hoops” for hackers either though—this is quickly becoming an extremely standardised security measure that also covers lost physical equipment. For instance, if a staff member leaves a work laptop in a restaurant and someone with ill intent steals it, no one can get into it if it has all the right security measures. And laptops are only one example. We all access work emails from our personal mobile devices and tablets as well, which means we need to cover all devices. With this extra layer added for amplified security, you will be able to easily verify whether the person trying to log in was you or someone who is not authorised to have account access. This is done via a one-time password (OTP) that is automatically generated, typically a rotating six-digit code. Through this avenue, a stranger who somehow manages to get their hands on your username or password will be faced with additional hurdles that shut them out. Expert email security tip #5: delete any unused accounts Your company might have old accounts that have gone inactive due to an employee having a name change, forgetting to consolidate emails, or a departure from the company. These accounts should not sit around and collect virtual dust. The accounts that go untouched for long periods because they are forgotten about, and thus are unmonitored, can pose a weak link in your cybersecurity chain. If you’re not paying attention to an account then you’re not being careful to keep identity thieves and financial fraudsters at bay. You cannot afford to leave holes in your business security plan, so get rid of them immediately—before the cost of making amends for a particularly nasty breach compromises your company. Expert email security tip #6: keep your software up to date It is crucial to keep everything up to date—not just your knowledge base and employee training sessions, but the technology itself as well. Cybercriminals are growing their skills all the time. You need to ensure your tech is keeping up. Always update company software and hardware as soon as updates are announced by the developer, or when your advisors suggest. Old technology is a sure weakness into your private networks and precious data. Expert email security tip #7: secure your network Take a step back and look at the bigger picture when considering ways of bolstering your email security and your overall business cybersecurity strategy. Emails are just one part of a comprehensive security plan. Don’t forget your network as a whole. Higher-level awareness can improve protection in other areas of your business’s internet security and email security. After all, no one is perfect—even with proper training. By casting a wider net, you improve your chances of catching the email blunders that employees may be making. Network security is especially important with the rise of smartphones and other mobile devices. Logging into work systems from personal tech makes security an issue. Malware and keyloggers are always possible attack vectors when it comes to accessing credentials. Leaving more virtual doors open makes it even trickier to keep track and fend off unwanted “guests.” Expert email security tip #8: sender policy framework Cyberattackers sometimes strategically disguise the origin of their message in an attempt otherwise known as email spoofing. To prevent these fake emails from getting through to your inbox, anti-spam Sender Policy Framework (SPF) authenticates an email sender’s internet domain. However, be careful in setting this up, as incorrectly configured SPF records can cause your own domain to be easily spoofed. Otherwise, it can be very useful because the SPF protocol will allow the owner of a domain to specify which mail servers they typically use when sending mail. A brand sending an email will publish SPF records in their Domain Name System, or DNS. These records list precisely which IP addresses are authorized to send messages on behalf of their domains, thereby signalling anything outside of it may be suspicious. Expert email security tip #9: DomainKeys Identified Mail DomainKeys Identified Mail (DKIM) is another email authentication method designed to detect forged sender email addresses. This protects against spoofing—a technique often used in phishing and email spamming. DKIM is mainly about the sender taking responsibility for signing their emails. This way, the receiver can know whether an email claiming it came from a particular domain was indeed authorized by the domain owner. Without features like DKIM, how can people really know who to trust? Making sure there is an authentic sign-off is a great way to stay safe in virtual spaces. Expert email security tip #10: use business-grade email providers IMAP and POP are “legacy” within Office 365, but should be disabled if possible. You should also consider a third-party or layered anti-spam solution. If one computer at the office becomes compromised by getting hacked or gets affected by malware, it’s best if you can isolate the issue rather than let it spread. If you can minimise the damage, you can of course expect an easier fix and assert more control over your devices and network. If a problem is left to infect everyone else’s system, you’re going to find yourself in a bit more of a mess. So stop it before it happens and always plan ahead when it comes to internet safety. Expert email security tip #11: domain-based message authentication, reporting, and conformance Also known as DMARC, the advantage here is that email senders and receivers alike know how to cooperate to enhance the security of email communications. The receiver would be alerted about key policies in the mail flow and get feedback to the sender about the emails that are rejected. With a bit of code, DMARC will mainly function to help filter fraudulent mail that could otherwise overflow your inbox and become a trap at your company. You will also have the opportunity to see what is going on at your business and get a real-time window into the inner workings. Thanks to helpful reporting, you’ll be among the first to know if something goes wrong—and fast. When you have all the right details and you review them carefully, you are less at risk of anything slipping past you. This tactic will be another crucial part of any company’s holistic email security strategy. Be sure your staff is complying with any regulations or protocols set for the safety of the organization. Help them—and others not even working for your company, but who do business with it—understand why this is so important. Every connection, thus every email, poses a potential risk to those who don’t know better. Expert email security tip #12: use a managed IT service To ensure all of these measures are in place, implemented effectively, done regularly, and always up to date, you may need some help. Company IT security is not a one-person job, but that of an experienced team. Experts with decades of real-world experience between them in the area of business cybersecurity will be most adept at making sure nothing is missed. It can be easy to assume you have your bases covered with internet safety, especially if you keep up with reading cybersecurity resources. But there is a lot to keep track of and you shouldn’t have to go it alone. Email security is a niche area of expertise. Having specialists to work with you and oversee essential protection steps is the assurance you’ll need to not constantly worry about a devastating breach. Most traps are easy to avoid with the right tools and professionals that a managed services provider (MSP) provides, but much harder to recover from. Take every preventative measure possible to protect your business from cybercriminals. Get in touch with us online or on the details below: Johannesburg – +27(0)11 435 0450, sales@multi.co.zaCape Town – +27(0)21 879 1950, sales@multi.co.zaDurban – +27(0)31 331 0735, sales@multi.co.za Namibia – +264(0)81 353 9702, sales@multi.com.na
VIEW MORE