home office report - whitehawk office... · we enable identification of your key online risks,...

WHITEHAWK CEC, INC

WhiteHawk Home Office Report

2018

HOW TO SECURE YOUR HOME OFFICE OR SMALL BUSINESS A NON-TECHNICAL HOW-TO GUIDE FOR CYBERSECURITY

Home Office Report WHITEHAWK

2

TABLE OF CONTENTS

TABLE OF CONTENTS 2

INTRODUCTION 3

DO YOU... 3

BACKGROUND 4

BUT HOW? 4

THE WHITEHAWK CYBERSECURITY SCALE: WHERE DO YOU STAND? 5

BASELINE SECURE (1-2, BASIC) 5 BEST PRACTICE SECURE (3, BALANCED) 5 ADVANCED SECURE (4-5, ADVANCED) 6

WHITEHAWK GUIDELINES TO HOME OFFICE SECURITY 7

SECURE YOUR ROUTER (1, BASELINE SECURE) 7 IMPLEMENT FIREWALL PROTECTIONS (1, BASELINE SECURE) 7 IMPLEMENT AN ENDPOINT PROTECTION PLATFORM (INCLUDES ANTI-MALWARE) (2, BASELINE SECURE) 7 AUTOMATICALLY UPDATE SOFTWARE (2, BASELINE SECURE) 8 IMPLEMENT PASSWORD MANAGEMENT (2, BASELINE SECURE) 8 USE A VPN FOR REMOTE WORK (3, BEST PRACTICE SECURE) 9 AUTOMATICALLY BACKUP YOUR DATA (3, BEST PRACTICE SECURE) 9 ENCRYPT YOUR EMAIL (4, ADVANCED SECURE) 10 SECURE YOUR MOBILE DEVICE (5, ADVANCED SECURE) 10

GLOSSARY OF HOVER DEFINITIONS 11

(IN ORDER OF APPEARANCE) 11


3

INTRODUCTION

We know that preventing online crime and fraud hurts all of our heads. But here at WhiteHawk, we are focused on enabling everyone to take measured, impactful action to prevent online crime and fraud against small and mid-sized businesses. And we believe starting with our home offices is a key to greater protection for all.

DO YOU...

Work from a family office? Work from the occasional coffee shop?

Have personal, financial, or proprietary data on your family office IT?

Unsure how to mitigate or manage a Ransomware or email attack?

Find Cybersecurity related technical jargon difficult to understand or intimidating?

Find researching security best practices tedious or never-ending

If you checked at least one box on this list, read on.

At WhiteHawk, we are dedicated to you, the everyday technology user and customer.

We are taking the Guesswork out of Cybersecurity, preventing or mitigating the disruption and losses from online crime and fraud. We bring you insight, perspective and confidence in your Cybersecurity related decisions and purchases.

All of us deserve to know best practices, best solutions and to be safe online.


4

BACKGROUND

In an age where we are continuously interconnected, we must realize that we’re dependent upon our devices and as a result are all potential targets of online crime and fraud.

No matter how large or small your business or where you physically operate your business, you may be the next victim of cyber mischief or attack. This problem is compounded in a small business and home office environment where lack of protection is the status quo.

What if we told you that you don’t need a large budget to protect yourself? You don’t even need to be an IT guru.

BUT HOW?

WhiteHawk is dedicated to addressing the Cybersecurity needs of mid-sized and small businesses. Our mission is to support and foster a global community of business risk and Cybersecurity savvy Internet users, especially including “the great unprotected IT frontier” of individual home office users (full or part time) and LLCs that operate out of home offices or co-worker space. In this report, we’ve assembled a non-technical, easy to use guide for securing your home office environment immediately.

Using the processes from our patent pending Decision Engine (Cyber Path), we collected online information from across the web for data to provide solutions sets that are impactful options for securing a home office network.

Most available Cybersecurity guides provide high-level recommendations on how to secure your network, but many don't provide context (the business or personal risk) and specific solutions (like anti-malware software) to take your security to the next level. Our approach is straight forward and constantly being updated. Each of our guidelines will show you:

1 - Basic security tips to protect your digital activity 2 - Quick background on why this tip is important 3 - A brief how-to guide for implementing the tip 4 - Additional security solutions to take your security to the next level


5

THE WHITEHAWK CYBERSECURITY SCALE: WHERE DO YOU STAND?

We enable identification of your key online risks, self-education and protection when it comes to Cybersecurity for everyday users.

Our WhiteHawk 5-point Cybersecurity scale (from 1 -> 5), developed by WhiteHawk’s in-house cyber experts, represents categories of easy guidelines you can follow to secure your home office or home business from Baseline -> Best Practice -> Advanced.

*Cybersecurity is an ever-evolving field and with that comes changes in common security practices. At the time of this report’s publication, the following represent the latest methods for protecting your home office or small business. We will update this report as the online criminal trends evolve so that our customers can keep up and often be ahead with their level of security.

BASELINE SECURE (1-2, BASIC)

BECOMING BASELINE SECURE IS A MUST FOR ALL HOME OFFICE AND SMALL BUSINESS USERS.

Baseline or “The Basics” in Security is near and dear to our hearts at WhiteHawk. We enable everyday Internet users to understand what is most important and to use foundational and proven security protections while interacting online –which

immediately raise your level of crime and fraud prevention and mitigation. The solutions in Baseline allow you to “lock your doors and windows, making it just difficult enough for most“run-of-the-mill” cyber criminals to be deterred or prevented from accessing your personal or business data.

BASELINE SECURITY FOCUS AREAS INCLUDE:

• Determining what data needs to be manually backed up daily, weekly or monthly. • Ensuring your software, network hardware and devices are protected • That effective access and authentication to your systems and data is in place.

BEST PRACTICE SECURE (3, BALANCED)

Dubbed “Best Practice,” because these solutions are recommended and used by Cybersecurity experts across the board. In addition to Baseline Security, Best Practice solutions take your home office

protection to the next level.

If you ever travel for work and/or work remotely in public places such as a café, library, hotel or common area – anywhere you connect to a public network - you should be Best

Practice Secure. It is easy for a determined criminal to access your data through a public network (take the questionnaire or read more to see how). Implementing these Best Practice Security guidelines will protect your information and devices when you are on the road.

Best Practice Security focus areas include:


6

Extra protection of your online business communications and transactions via a Virtual Private Network (VPN). Daily duplication of your data via Auto-Backups to an assured cloud based provider.

ADVANCED SECURE (4-5, ADVANCED)

Our “Advanced Security” level builds on Baseline and Best Practice security. If you have solutions implemented through Advanced Security Level, you are protected from common cyber crime, fraud and disruption threats as well as advanced, targeted cyber attacks such as Advanced Persistent Threats (APTs).

If you work with confidential/sensitive data like business proprietary, intellectual property, or client/customer information or financial data, then Advanced Security is for you.

Advanced Security focus areas include:

• Highest level of protection of your business email via Email Encryption. • Extending protection to all your companys’ wireless devices via Mobile Device Management.


7

WHITEHAWK GUIDELINES TO HOME OFFICE SECURITY

SECURE YOUR ROUTER (1, BASELINE SECURE)

Your router’s security = Prevents easy access to your data. When you secure your router, you take away an easy route from criminals to your private interactions and data exchange online.

Your router is all of your home devices’ connection to the outside internet and therefore the door to your online communications and data. When a router is initially set up, it typically has default passwords in place. These default passwords must be changed, because they can almost all be found readily online per provider. This information is available because it can be used legitimately by technicians and adminstrators. However, if you haven’t changed your default settings, criminals can easily access your home network, just by running a search for what type of router you have and filling in the necessary information. Additional steps can be taken to encrypt your router, and deactivate other routes of access to further protect your work and communications from your home office or business.

IMPLEMENT FIREWALL PROTECTIONS (1, BASELINE SECURE)

A Firewall protects your network and/or your device from malicious internet traffic. Just as securing your router prevents low-level cyber crime to you and your data, so does putting a Firewall in place. Luckily, in many cases, it’s as easy as turning your devices’ Firewall settings “ON”.

If you are a small company with a mix of office and remote workers, it is imperative you deploy a Firewall. The next decision you make is to determine if you have a Network-Based Firewall as well as Host-Based Firewall. Ideally, you should have both. Network-Based firewalls protect your network from potentially damaging online interactions. Host-Based firewalls protect your devices (with the firewall software installed) from potentially damaging online interactions.

Some Firewall options are available in the native settings of a device. Depending on what level of security you and your home office or business require, these built-in protections may or may not be enough, but it is necessary to have at least some level of firewall to protect you and your business operation.

IMPLEMENT AN ENDPOINT PROTECTION PLATFORM (INCLUDES ANTI-MALWARE) (2, BASELINE SECURE)

An Endpoint Protection Platform pairs with your Firewall and identifies and removes harmful programs or applications on your network or device. If you think you have a virus or malware on your computer or want to protect against being victim to malware, you should enable an Endpoint Protection solution.*


8

If you're wondering what an Endpoint Protection Platform is, you're in good company. Endpoint Protection Platforms are the newest generation solution for protecting your device from bad applications/software programs by finding them, blocking them when possible, and removing them. An Endpoint Protection Platform includes anti-malware and anti-virus technology, but goes beyond these more traditional and focused solutions. As Cybersecurity professionals say, "It's not if you have been hacked, it's if you know you've been hacked."

Like with Firewalls, some devices come with some sort of endpoint protection already in place. These may not be enough to secure your specific type of business or proprietary data, so we recommend looking into the options to determine how to make yourself the most secure.

AUTOMATICALLY UPDATE SOFTWARE (2, BASELINE SECURE)

Setting up Auto-Updates for your Operating System and computer software is the best way to ensure your software is as secure as possible, by addressing new known ways that criminals are conducting online disruption or attacks.

When your device asks you to update your operating system or application, ALWAYS click yes. It is worth the time to reset or restart your device. These updates include "patches" from the manufacturer to vulnerable holes that have been discovered. If you don’t, malicious actors can use these holes to steal your information. If you struggle to remember to update your software, turn on or install auto-update software.

IMPLEMENT PASSWORD MANAGEMENT (2, BASELINE SECURE)

Your data is only as secure as your password management. Although we hate Passwords as much as you do, most systems have not advanced to biometrics, blockchain or other next generation technologies and we have to use them for now. Use strong passwords, and Multi-Factor Authentication to make it harder for a criminal to access your important data, financial transactions, or confidential communications.

The Password can be as much an enemy to security as an ally. The security of your devices, data, and interactions online rely, in large part, on the password you use to access them. Unfortunately, passwords are typically not very secure because of their potential to be found out. First and foremost, it is important to regularly change your passwords, and make them difficult for a criminal to deduce just from knowing facts about your life (i.e. don’t use your own or your children/pets/family members’ names). The more complicated the password, times changed, and varied across applications: the better. Establish an irregular approach that you can vary (words, symbol, number), use device key lockers which are more secure than easy passwords, and do write them down and store in a private place in your home as a back-up.

Multi-factor Authentication (MFA) is scientifically proven to be more secure than just a password because it defends against commonly used methods to hack passwords. Many times, criminals will use “Brute Force” attacks, in which they run a computer program to try as many letter/number combinations as possible to figure out your password. If you have MFA enacted for that password,


9

even if your password is found out by a malicious actor, another step is needed (most typically a randomly generated number via authenticator or code sent to your phone) before they have access to the data your password is set to protect.

When MFA is not an option for you, or you have trouble remembering your varied and complicated passwords**, you can use a password manager.

USE A VPN FOR REMOTE WORK (3, BEST PRACTICE SECURE)

Public Wi-Fi is one of the easiest ways for an online criminal to get access to your device and its contents. If you work remotely and/or use public wi-fi for your personal or business interactions online, you should invest in a Virtual Private Network (VPN).

When you connect to public Wi-Fi, you open yourself up to others who are also on the same network, especially if there is no password (security is very shaky at best if there is a publicly available password). The number of tools widely available for scanning your activity or even every word you type on your computer through a shared network is mind-boggling. That means, it is very important to put layers of security between yourself and others when on a shared network. The best and easiest way to do this is to use a Virtual Private Network (VPN).

There are many Virtual Private Network (VPN) offerings on the market that are completely free. If you are seriously cost conscious, or just want to try a VPN, this could be a good option. However, if a VPN has a free tier, it is important to go with providers that also have paid tiers. If you’re not paying with money for a VPN (or any service really), you may be paying with your personal data instead (despite protection of your personal data and online interactions being the main goal of a VPN!).

WhiteHawk strongly recommends upping to at least the basic paid version of these VPNs to have a true private connection. A true VPN (mostly only available as a paid VPN) is one that enables a Peer to Peer (P2P) connection. Very simply, when using a VPN with P2P connection, your router has an encrypted connection to a server. This prevents even your Internet Service Provider (ISP) from being able to openly see or log your activity when connected to the Internet. If a P2P connection is not enabled, your activity may be encrypted once on the proper server, but the connection is not (so your ISP can openly see content exchanged and activity and true privacy is not achieved).

AUTOMATICALLY BACKUP YOUR DATA (3, BEST PRACTICE SECURE)

Backing up your data is a best practice that protects you from data loss, and threats like ransomware. If the data is not sensitive or proprietary, this may be all you need to do to protect your data.

You have probably heard the term "Ransomware" when people talk about a Cybersecurity event. This is exactly the type of criminal threat that can impact you if you do not backup your data to a secure location that you can access regularly. Ransomware, is when an online criminal encrypts your data and holds it "ransom" until you pay a fee to release it. If you have a recently stored backup copy of all the data the hacker has, you're in the clear!


10

Backing up to an easy to use external hard drive is a no-brainer and should be done by everyone. Backing up to the cloud as a small one-person shop, or small business, is another important decision to consider. In a lot of cases, there are excellent secure cloud storage providers that may work better than an on premise solution. Majority of reputable cloud based services are more secure than what a small business or individual can provide.

ENCRYPT YOUR EMAIL (4, ADVANCED SECURE)

Adding on a solution to encrypt your email is vital for protecting your communications especially when they are business confidential or customer sensitive.

Today, for most businesses of any size, email is how a majority of business gets done. For communications that contain sensitive information or documentation, it is a business best practice to implement email encryption so that the content or data are not

openly visible to external players. Encryption is the use of digitally generated keys to hide the contents of a message so that only those with the correct keys can view the plain text message.

SECURE YOUR MOBILE DEVICE (5, ADVANCED SECURE)

Mobile Device Management (MDM), is the next wave of wireless security. For those of us who regularly interact with and put personal data on our mobile phones (as most everyone these days), it’s important to figure out how to secure your mobile device, in order to avoid the same crime and fraud threats that pertain to your home office computer.

Most of the guidelines in this report pertain to Personal Computers or laptops. For more complete protection, WhiteHawk recommends implementing Mobile Device Management, or MDM, to secure your mobile device(s). Tune in later for our next in-depth Roberts Report on MDM and how to secure your mobile device.


11

GLOSSARY OF HOVER DEFINITIONS (IN ORDER OF APPEARANCE)

Router: A router controls activity between the Internet and your devices. It is the link between the external "wild" of the Internet and your home or small business network.

Network: Simply, a network is any connection between two or more computer systems. This can be your computer to router, other computers or your phone.

Firewall: A Firewall blocks bad traffic from reaching your device through your network.

Network-Based Firewall: A physical appliance or software that is set up between your network and the external Internet. The firewall allows identified “Good” traffic and denies by default all other unknown traffic to protect devices connected to a given network from outside online traffic.

Host-Based Firewall: An application installed on each computer or device to provide the same level of protection as a network based firewall with additional protection for your specific device. This solution is recommended particularly for environments that have multiple devices and the need to restrict communication between those devices (network segmentation).

Anti-Malware: Software that can actively detect, cleanse, and remove malicious files from installing on your computer. For many computers and operating systems, this product will come as a free trial or is free natively.

Anti-Virus: Software created to identify and get rid of computer viruses.

Operating System: Software that allows for basic functionality of your computer or device, including running other software or applications.

Multi-Factor Authentication: Using a system of multiple factors of credentials to log-in to an application or online transaction.

Brute Force Attack: Software used to try an exponential number of password combinations in order to “force” an entry by eventually determining a users password.

Virtual Private Network (VPN): Network of computer systems that creates a secure, encrypted connection between your computer and the server it is accessing when you browse the Internet.

Server: A device or program that serves as a platform for computers or other devices to perform further functionality (such as go to a website).

Ransomware: An attack in which a bad actor gains access to your data, database, or communications, encrypts them, and holds them ransom. (if you have a backup, you don’t have to pay to get the data back!)

Email Encryption: Encryption applied to basic email in order to conceal the content or attached materials in the message.


12

* What is the difference between a virus and malware? A virus is a malicious computer program designed to replicate and spread on your computer and to others. Malware is a larger category to include viruses, but also other malicious programs such as ransomware (WannaCry, 2017) or spyware - software that spies on your activity on your computer or online, that do not necessarily replicate and spread like a virus.

home office report - whitehawk office... · we enable identification of your key online risks,...

Documents