Tag Archives: security

Microsoft Outlook blocks more extensions

Microsoft Outlook blocks more extensions – 38 extensions added

Microsoft Outlook Blocks

Electronic communication is an intergral part of an enterprise’s infrastructure.

Microsoft Outlook blocks more extensions that can no longer be attached as email attachments.  When communicating with others, files often need to be sent.  If they fall into this list, and the recipient is an Outlook user they will not be able to access these attachments.

The new ones to be added are are:

  • Java files: “.jar”, “.jnlp”
  • Python files: “.py”, “.pyc”, “.pyo”, “.pyw”, “.pyz”, “.pyzw”
  • PowerShell files: “.ps1”, “.ps1xml”, “.ps2”, “.ps2xml”, “.psc1”, “.psc2”, “.psd1”, “.psdm1”, “.psd1”, “.psdm1”
  • Digital certificates: “.cer”, “.crt”, “.der”
  • Files used to exploit vulnerabilities in third-party software: “.appcontent-ms”, “.settingcontent-ms”, “.cnt”, “.hpj”, “.website”, “.webpnp”, “.mcf”, “.printerexport”, “.pl”, “.theme”, “.vbp”, “.xbap”, “.xll”, “.xnk”, “.msu”, “.diagcab”, “.grp”

There currently 104 extensions that are blocked.  The new total of extenstions that will be blocked will be upped to 142.  The current list includes:

  • .ade – Access Project Extension (Microsoft)
  • .adp – Access Project (Microsoft)
  • .app – Executable Application
  • .asp – Active Server Page
  • .bas – BASIC Source Code
  • .bat – Batch Processing
  • .cer – Internet Security Certificate File
  • .chm – Compiled HTML Help
  • .cmd – DOS CP/M Command File –  Command File for Windows NT
  • .cnt – Microsoft Help Workshop Application
  • .com – Command
  • .cpl – Windows Control Panel Extension (Microsoft)
  • .crt – Certificate File
  • .csh – csh Script
  • .der – DER Encoded X509 Certificate File
  • .diagcab – Microsoft Support diagnostic tools
  • .exe – Executable File
  • .fxp – FoxPro Compiled Source (Microsoft)
  • .gadget – Windows Vista gadget
  • .grp – Microsoft program group
  • .hlp – Windows Help File
  • .hpj – AppWizard Help project
  • .hta – Hypertext Application
  • .inf – Information or Setup File
  • .ins – IIS Internet Communications Settings (Microsoft)
  • .isp – IIS Internet Service Provider Settings (Microsoft)
  • .its – “Internet Document Set –  Internet Translation”
  • .jar – Java Archive
  • .jnlp – Java Network Launch Protocol
  • .js – JavaScript Source Code
  • .jse – JScript Encoded Script File
  • .ksh – UNIX Shell Script
  • .lnk – Windows Shortcut File
  • .mad – Access Module Shortcut (Microsoft)
  • .maf – Access (Microsoft)
  • .mag – Access Diagram Shortcut (Microsoft)
  • .mam – Access Macro Shortcut (Microsoft)
  • .maq – Access Query Shortcut (Microsoft)
  • .mar – Access Report Shortcut (Microsoft)
  • .mas – Access Stored Procedures (Microsoft)
  • .mat – Access Table Shortcut (Microsoft)
  • .mau – Media Attachment Unit
  • .mav – Access View Shortcut (Microsoft)
  • .maw – Access Data Access Page (Microsoft)
  • .mcf – Media Container Format
  • .mda – “Access Add-in (Microsoft) –  MDA Access 2 Workgroup (Microsoft)”
  • .mdb – “Access Application (Microsoft) –  MDB Access Database (Microsoft)”
  • .mde – Access MDE Database File (Microsoft)
  • .mdt – Access Add-in Data (Microsoft)
  • .mdw – Access Workgroup Information (Microsoft)
  • .mdz – Access Wizard Template (Microsoft)
  • .msc – Microsoft Management Console Snap-in Control File (Microsoft)
  • .msh – Microsoft Shell
  • .msh1 – Microsoft Shell
  • .msh2 – Microsoft Shell
  • .mshxml – Microsoft Shell
  • .msh1xml – Microsoft Shell
  • .msh2xml – Microsoft Shell
  • .msi – Windows Installer File (Microsoft)
  • .msp – Windows Installer Update
  • .mst – Windows SDK Setup Transform Script
  • .msu – Windows Update file
  • .ops – Office Profile Settings File
  • .osd – Open Software Description
  • .pcd – Visual Test (Microsoft)
  • .pif – Windows Program Information File (Microsoft)
  • .pl – Perl script
  • .plg – Developer Studio Build Log
  • .prf – Windows System File
  • .prg – Program File
  • .printerexport – Printer backup file
  • .ps1 – Windows PowerShell
  • .ps1xml – Windows PowerShell
  • .ps2 – Windows PowerShell
  • .ps2xml – Windows PowerShell
  • .psc1 – Windows PowerShell
  • .psc2 – Windows PowerShell
  • .psd1 – Windows PowerShell
  • .psdm1 – Windows PowerShell
  • .pst – MS Exchange Address Book File – Outlook Personal Folder File (Microsoft)
  • .reg – Registration Information/Key for W95/98 – Registry Data File
  • .scf – Windows Explorer Command
  • .scr – Windows Screen Saver
  • .sct – “Windows Script Component –  Foxpro Screen (Microsoft)”
  • .shb – Windows Shortcut into a Document
  • .shs – Shell Scrap Object File
  • .theme – Desktop theme file settings
  • .tmp – Temporary File/Folder
  • .url – Internet Location
  • .vb – VBScript File or Any Visual Basic Source
  • .vbe – VBScript Encoded Script File
  • .vbp – Visual Basic project file
  • .vbs – VBScript Script File – Visual Basic for Applications Script
  • .vsmacros – Visual Studio .NET Binary-based Macro Project (Microsoft)
  • .vsw – Visio Workspace File (Microsoft)
  • .webpnp – Internet printing file
  • .website – Pinned site shortcut from Internet Explorer
  • .ws – Windows Script File
  • .wsc – Windows Script Component
  • .wsf – Windows Script File
  • .wsh – Windows Script Host Settings File
  • .xbap – Browser applications
  • .xll – Excel add-in
  • .xnk – Exchange Public Folder Shortcut

 

 

Please follow and like us
error

Depending on Goggle Risky

Depending on Goggle Risky

Depending on Goggle Risky

Independence is  a core requirement for IT Governance and Infrastructure definition.

Depending on Goggle Risky – Depending on Internet, hardware, and software companies is a mistake. Enterprises  are impacted as they drop product support, are purchased by other companies, and/or have security breaches and system failures of their own.

For example, Google – Customer who installed Haiku ceiling fans, which were supported  with the Nest thermostat device via the “Works with Nest” program were left out in the cold. This was driven by Google’s decision to end the program and go with the “Google Net”.  They said this was to focus on supporting its own hardware business.  As a result, there was a loss of support for any device on that program. Not a good omen for people who installed them in their homes.

Another similar situation occurred for Comcast email users. Users who had comcast.net email accounts were not made aware of the limitation of services that Comcast’s spam protection process effected. What happens is as an email is sent to a comcast user email account, if the email has multiple recipients, the email is placed on hold (based on the comcast user’s usage). The user is NOT notified that the email was held and not delivered. It is up to the sender to contact the user and re-send it with the email going to a single recipient.

The less that you depend on Internet companies for proprietary offerings, the more you can be assured that you can continue to operate when they change their corporate strategy.

How long will it be before a company like Goggle decides to charge for their free email services. Wait a minute they already do that with their offering G Suite.

Order IT Governance Infrastructure Strategy Download Selected Pages

Read on:

 

Please follow and like us
error

NETFLIX Breach

NETFLIX Breach – user account ID changed

Security Manual TemplateNETFLIX Breach on the user-id has occurred twice in one week, I have had an account with Netflix for several years. On Friday when I tried to log in to my account I could not.  I got a message that my account e-mail address had be CHANGED. Since that is the only way that I can access my account, I had no user ID to get in. I had to call and wait to be connected to an account rep. Once there, I asked how that could happen, and the answer I got was that someone had BREACHED my account and re-assigned my user-id (which was my account ID) with theirs.

Linked with that information was my credit card payment information. After the recent Citicorp breach, there is no assurance that my credit card information was not breached. The solution the account rep gave was to CANCEL my account. Which I did and created a new account with a DIFFERENT email address. I also added my mobile number for account verification.

That worked for a day and on Saturday evening someone else logged in to my NEW account, turned on the service for their account and changed the user-id again. The only thing that I got were two emails from Netflix. One saying that someone accessed my account and the second that told me my user id had been changed.

Nexflix breach

Poor design for changing the user ID. They only ask for a password NO 2nd level verification with the mobile phone number

When I talked to the agent at Netflix on the SECOND breach there was no sense of urgency.  I have my credit card associated with the account and now have a concern that the credit card information has been hacked.

NETFLIX Breach – Do they even care that they have a security issue?

In both cases with both email addresses, they were uniquie and the passwords were over 8 characters in length. In addition, they had one upper case letter, two numbers, and a special character.  Somehow they were able to get into the account, and change key information.  They also have the capability to change the seconday security mobile phone number.

The fact that the only concern they had was to get my account back on-line so I would pay is troubling. Netflix did not address the issue of managing the changing of my user-id. Nor did they address the core issue of how the account got breached and then not providing me with a soulution.  For example a solution could be, having a DOUBLE verification before they change key security and personal information or making it so the userid could not be changed. Either solution would work.

I forecast the Netflix will be the next major corporation that will have the public embarasement of a major security breach.

Read on Order Security Manual Template

See also;

 

 

 

 

Please follow and like us
error

10 Easy Steps to Stop Robocalls

10 Easy Steps to Stop Robocalls – or at least reduce the number

10 Easy Steps to Stop Robocalls

10 Easy Steps to Stop Robocalls -The policy that will improve the security of mobile devices and stop robocalls

10 Easy Steps to Stop Robocalls that every cell phone and text messaging user can follow to kill the call and stop calls and text messages from coming in the future.

  1. Put a do not disturb after normal work hours except for people already in your contact list
  2. Do not answer calls from blocked or unknown numbers.
  3. Do not answer calls identified as spam by your carrier
  4. Don’t answer calls from numbers you don’t recognize.
  5. For Text spams, forward them to 7726 (spells SPAM) and your carrier will be made aware of them and stop them
  6. If someone calls you and claims to be with XYZ company, hang up and call the company yourself. Use the company’s website to find an official number.
  7. If you answer a call an no one is on the line immediately hang up
  8. If you do answer a call and hear a recording such as “Hello, can you hear me?” just hang up.
  9. The same goes for a call where you’re asked to press a number before being connected to a representative.
  10. Do not engage as soon as you answer the call – i.e. Goggle’s Call Screening feature is cool but still identified you number a real person

In addition you shoul check with your carrier to see the services they provide – all of them soon will provice FREE services to support FCC requirements

See also:

Please follow and like us
error

HIPAA changes

HIPAA changes for 2019

HIPAA Compliance Management

Compliance Kit – head start on meeting all mandated requirements. Everything from an Industry-standard White Paper to a detail audit program.

HIPAA changes proposed for 2019 are getting closer. The Department of Health and Human Services’ (HHS) Office for Civil Rights (OCR) has favored issuing HIPAA guidelines to clear up misunderstandings with HIPAA compliance requirements, but we are now at a point when changes to HIPAA Rules are about to be made.

OCR asked 54 different questions in its RFI. Some of the main aspects being considered are in relation to:

  • Patients’ right to access and obtain copies of their protected health information and the timeframe for responding to those requests (Currently 30 days)
  • Removing the requirement to obtain written confirmation of receipt of an organization’s notice of privacy practices
  • Promotion of parent and caregiver roles in care
  • Easing of restrictions on disclosures of PHI without authorization
  • Possible exceptions to the minimum necessary standard for disclosures of PHI
  • Changes to HITECH Act requirements for the accounting of disclosures of PHI for treatment, payment and healthcare operations
  • Encouragement of information sharing for treatment and care coordination
  • Changing the Privacy Rule to make sharing PHI with other providers mandatory rather than permissible.
  • Expansion of healthcare clearinghouses’ access to PHI
  • Addressing the opioid crisis and serious mental illness

All if these are addressed in Janco’s Compliance Management toolkit.

Compliance Kit Options

Order Industry Standard Compliance Kit

See Also

Please follow and like us
error

Top 10 BYOD Security Best Practices

Top 10 BYOD Security Best Practices Implemented  by “World Class” CIOs

Top 10 BYOD Security Best PracticesTop 10 BYOD Security Best Practices have been implemented by almost all “World Class” CIOs and CTOs.  The importance of these is only magnified by the implementation of Blockchain and DLT applications.

The Best Practices are:

  1. Implement a formal written BYOD policy
  2. Set up a locking password on each device
  3. Implement a phone locater on all devices
  4. Protect the access point of your network
  5. Implement anti-virus – utilize VPNs
  6. Manage authorized applications.
  7. Utilized data encryption on e-mails and enterprise data
  8. Utilize the cloud as a back up source
  9. Be wary of applications like QR coder readers
  10. Monitor access and data usage by device and by user

Read  BYOD Security  Order BYOD Policy BYOD Policy Download Selected Pages

Top 10 Security Best Practices take effort to implement

Too many companies have found out the hard way that their most valuable assets are exposed and vulnerable to hacker attracts, theft and destruction. They now have learned a very expensive lesson, a company’s valuable information cannot be undone, and also often leads to significant damage to your company’s reputation.

See Also:

Please follow and like us
error

Cloud Security Vulnerabilities

Top 10 Cloud Security Vulnerabilities

Top 10 Cloud Security Vulnerabilities have been identified and ranks by level of importance and impact by a panel of 57  CIOs, CTOs, and CSOs.

Cloud Security Vulnerabilities

Top 10 Security Vulnerabilities have been identified by a 100 plus CIOs, CTOs, and CSOs from Fortune 500 companies

The top 10 are:

  1. Data breaches
  2. Weak Security
  3. Non-Secure Interfaces & API
  4. OS vulnerabilities
  5. Account hijacking
  6. Insider breach as System Administrator
  7. Parasitic code on server
  8. Data Destruction
  9. Denial of service (DoS).
  10. Ransomware

All of these are addressed in Janco’s How to Guide for Cloud Process and Outsourcing.

Order Cloud Outsourcing  Download Selected Pages

Top 10 best practices address Cloud Security Vulnerabilities

Top 10 best practices for cloud Security – The cloud is great technology that helps organizations to improved productivity, reduce costs, and simplify the user’s life. However it does raise significant security risks. Here are 10 best practices that if followed minimize those risks.

  1. Utilize a SDM (System Development Methodology) to design, test and implement changes in the both the source and object level code.
  2. Implement a disaster recovery and business continuity plan that includes a focus on security of the data and application assets that are cloud based.
  3. Implement metrics and cloud application monitoring which can help to detect potential security violations and breaches in the cloud based data and applications
  4. Utilize a secure access and change management system to manage revisions to the cloud application.
  5. Utilize a patch management approach to install revisions to the cloud data and application.
  6. Implement a log management system to have an accurate audit trail of what occurs on the cloud.
  7. Implement firm security policies via a formal security management system (see https://www.e-janco.com/Security.htm and https://www.e-janco.com/Cloud.htm).
  8. Review latest published cloud vulnerabilities and make appropriate changes to cloud applications and access rules
  9. Contract with independent 3rd parties to find security vulnerabilities in your cloud based applications
  10. At least annually, conduct a security compliance audit on the total cloud based application from development to user access.

See also:

Please follow and like us
error

Cyber Threats are on the rise

Cyber Threats are on the rise – cyber crime is here to stay

Cyber Threats are on the rise and cybercrime is here to stay

Cyber Threats are on the rise and cyber crime is here to stay

Cyber threats are on the rise, in 2017 there was over $600 billion globally of costs associated with cyber crime.  Other key facts:

  • The forecast for 2019 is that $11.5B billion in damage costs due to ransomware
  • 94% of all data breaches begin with a click on a link in an email
  • In 2017 consumers lost over $20 Billion due to cyber crime
  • In 2015 businesses lost over $20 billion due to email accounts being compromised

In 2016 over 20 billion people had records stolen or compromised

Things that consumers and business should do are:

  • Implement device monitoring and protection
  • Conduct frequent Dark web scans to identify breaches
  • Utilize VPNs and avoid public free Wi-Fi connections
  • Implement a secure password safe process
  • Harden devices to protect against cyber security
  • Implement bio metric and dual factor authentication
  • Scan connected IoT devices
  • Monitor credit reporting systems
  • Implement secure backups with a long retention cycle.

Security Manual Template – Cyber Threats are on the rise

Many organizations fail to realize the benefits of security information management due to the often exhaustive financial and human resource costs of implementing and maintaining the software. However, Janco’s’ Security Manual Template – the industry standard – provides the infrastructure tools to manage security, make smarter security decisions and respond faster to security incidents and compliance requests within days of implementation.

Read on Order Security Manual Template Download sample

See also:

Please follow and like us
error

Backup Policy Updated

Backup Policy Updated

Backup Policy

Backup Policy includes everthing that is need to be in full compliance with all mandated security requirement.

Backup Policy Updated as well as the CIO IT Infrastructure Policy Bundle. The policy has just been updated to take into account everything from GDPR to cloud storage and security implications.

The Backup Policy addresses the issues that you struggle with including:

  • How safe are your information assets in transit and at reset?
  • What protections are in place to prevent hacker access?
  • Does your backup and retention process meet all of your compliance requirements?
  • Who can gain access to your data?
  • What KPI metrics do you have in place?
  • Will the use of the data ensure successful recovery?

Managing backup and recovery in today’s environment is a multi-dimensional challenge with both near and long term business requirements. Recent technological developments in disk backup have had a positive impact on short term data retention requirements (see also BYOD policy). But these improvements do not replace the need to execute and deliver on a long term data retention strategy which includes:

  • Business and Regulatory Requirements Demand a Long-term Plan
  • Manage and Contain Your Total Cost of Ownership (TCO)
  • Encrypt Your Data for Secure Long-term Retention
  • Weigh the Environmental Impacts and Minimize Power and Cooling Costs
  • Simplify Management of the Entire Solution

Best of Breed solution

A “Best of Breed” backup policy and strategy considers how to:

  • Back up critical application data – across mixed operating systems and storage configurations
  • Restore desktops and mobile users quickly
  • Restore systems to dissimilar hardware or virtual systems
  • Back up data and system information to off site locations, so that you can quickly recover your business even from a total loss of your facility
  • Leverage new cloud based backup offerings to properly secure, back up,and archive critical data.

Order Backup Policy Backup Policy Download Selected Pages

See also:

Please follow and like us
error

Top 10 Reputation Management Rules

Top 10 Reputation Management Rules

Top 10 Security Management rules

Top 10 Security Management rules are defined in Janco’s Security Manual Template.

Top 10 Reputation Management Rules are defined in detail in Janco’s Security Manual Template.

Without constant vigilance, your company is vulnerable to attack. The first step to take is to assess your current security stance, then make a plan to increase security with proper best practices and technologies.

Top ten commandments of security management for CSOs, CIOs, and IT Managers

  1. Limit access to information to those who need to have it. People can’t misuse information that they don’t have.
  2. Conduct frequent and deep security audits. Identify who has access to what – and how their actions could weaken the protection of valuable data/information.
  3. Set limits to information access. Do not exclude all information from access – data exclusion locks down access. Limits set authorizations so specific people can do specific things under specific circumstances.
  4. Limit administrative rights to as few individuals as possible. Very few individuals need them to do their jobs.
  5. Ignore organizational hierarchy when setting access capabilities. Access and authorization should be based upon responsibilities, not position.
  6. Make Security Invisible. Minimize extra commands, screens, pop-ups for employees; if an action is allowed, just let it happen.
  7. Analyze Security End back doors. Compliance logs reveal threat patterns, and show how security steps are hurting productivity.
  8. Monitor information access and updates. User-initiated application information updates can invite vulnerabilities.
  9. Educate everyone on security policies and procedures. The more that people know about the rules the better
  10. Make security best practices the watch word for everyone. IT and the general workforce must address the constantly changing nature of security breaches.

Security Manual Template

Security Policies and Procedures Manual for the Internet and Information Technology is over over 230 pages in length. All versions of the Security Manual template include both the Business & IT Impact Questionnaire and the Threat & Vulnerability Assessment Tool (both were redesigned to address GDPR, CaCPA, ISO, Sarbanes Oxley and CobiT compliance).

Security Manual TemplateOrder Security ManualDownload Selected Security Manual Pages

See Also:

Please follow and like us
error