ReportWire

Tag: data security

  • Either regulate Big Tech’s entry into finance now, or regret it later

    Either regulate Big Tech’s entry into finance now, or regret it later

    [ad_1]

    After the collapse of Silicon Valley Bank, the public discourse has been brimming with hindsight advice on what regulators and lawmakers have missed. Yet nobody is talking about a major trend that is injecting future risk into the financial system: Big Tech’s entry into banking. Dangers are growing exponentially with the rise of decentralized finance (DeFi), but defining what tech titans should be allowed to do is tricky.

    Over the last years tech giants have been racing toward financial services. Apple, Alphabet (Google’s parent company), Amazon and Meta (Facebook’s parent company) have all leaped into the payments market. Some partner with licensed banks to offer credit, while Amazon has even entered the corporate lending business. In perhaps the most ambitious initiative yet, Facebook led a group of corporations that attempted to issue a global super-currency far away from the reach of central banks. And though it eventually failed, there are already new plans to run money in the metaverse.

    If you wonder how deep Big Tech can get into banking look to China. WeChat Pay and Alipay have long since dethroned credit card schemes and other incumbents. Alibaba’s interest-bearing micro-savings tool Yu’e Bao became the world’s largest money market fund in 2019. Tencent runs a licensed virtual bank together with traditional finance players. Examples abound.

    Most of these forays went hand in hand with crucial innovation such as mobile payments or the proliferation of open banking. They slashed costs for consumers, boosted financial inclusion and enhanced usability. Yet these advances are also fraught with dangers.

    Data privacy is a big one. Monopolistic tendencies are another. These are issues hotly debated by politicians across the globe, but what often goes unnoticed is the systemic risk Big Tech’s entry injects into the financial system.

    The International Monetary Fund, the Financial Stability Board and the Bank for International Settlements have all warned of the ensuing cross-sectoral, cross-border risks. Laws are not yet ready to let tech tycoons control the arteries of the global economy. And as the age of decentralized finance unfurls, the dangers are put under a magnifying glass.

    While projects such as Apple or Google Pay were confined to one layer, the triumphal march of blockchain technology and digital assets lets Big Tech compete on the level of assets, settlements, gateways and applications. Facebook’s aforementioned digital currency, called Libra, is a case in point. Had it been successful, Facebook would have had a say in the issuance of the asset, the blockchain on which settlement occurred and the wallet by which users manage their money.

    Digital assets are no isolated space anymore. Increasingly, real-life assets are merging with on-chain ones. This interconnectedness means that contagion can easily spread from the unregulated DeFi space to the traditional financial system.

    Tech titans are already at the brink of turning into shadow banks. And if they are honest about achieving their visions, say of building the metaverse, then they will inevitably have to put their weight behind DeFi as well.

    So how does all this trickle down to concrete policies? The first thing is to put competition on an equal footing, allowing technology giants, banks and fintechs to compete fairly in all areas of tomorrow’s world of finance. Laws cannot block one group from tinkering with crypto assets while giving another free rein. On- and off-chain assets will melt together, whether regulators like it or not. It is better to pen the rules early on than to sleepwalk into an inevitable future.

    Unfortunately, some lawmakers are sprinting in the opposite direction. Rather than bringing the increasing DeFi activity onto regulated turf, they want to bar banks from even touching digital assets, hence leaving it to unregulated entities including Big Tech. But there is more to do.

    Breaking up tech titans, as some politicians suggest, is not a viable option. Neither is banning them from financial services. Legislation such as the Keep Big Tech out of Finance Act would rob the banking sector of much-welcome innovation and competition. Yet while data giants are innovation powerhouses, they must not enjoy preferential treatment and they must not pile up risks unnoticed. The balancing act can only succeed if today’s approach of activity-based regulation yields to an entity-based one. It is not sufficient that tech titans must solely abide by isolated rules that govern, for example, payments or selling insurance. Due to their clout, tech goliaths must be designated as critical infrastructure providers and as such be regulated on the corporate level just like traditional banks, who have to abide by rules on capital requirements, corporate governance and reporting, as well as numerous restrictions on activities and exposures.

    Furthermore, entity-based regulation impacts a company’s risk calculation. If regulated entities break the rules, they face losing
    the license to operate, not simply fines. “We’re sorry and we’re working on a solution” should not be an acceptable answer for companies dealing with data security and most certainly not for those managing money. Hence, activity-based rules can only be a supplement, not a substitute, for regulating systemically important organizations.

    There will be those who argue that technology giants still make up a comparably small fraction of the financial system, yet we have seen that Big Tech is silent about its ambitions all the way up to a big bang announcement. Think Libra or Apple Pay. Due to their unparalleled consumer access, financial resources and technological know-how, these forays can upend a market overnight. And due to Big Tech’s nature of global and cross-industry operations this risk could spread through the world economy like a wildfire. Regulators and lawmakers would do well to act before another crisis ensues.

    [ad_2]

    Igor Pejic

    Source link

  • The $8 Trillion Risk: Why Investing in Cybersecurity Will Save You Future Pain and Risk | Entrepreneur

    The $8 Trillion Risk: Why Investing in Cybersecurity Will Save You Future Pain and Risk | Entrepreneur

    [ad_1]

    Opinions expressed by Entrepreneur contributors are their own.

    Today’s cyber threat landscape is elaborate, fast-paced and continuously evolving. The complexity of such threats has raised the predictions that the total cost of cybercrime will exceed $8 trillion by the end of 2023. It includes, for example, the money stolen by cybercriminals, the subsequent investments in security tools and services, and the money spent on ancillary activities such as staffing, remediation, legal fees, fines and more.

    So, why do many organizations still fail to see cyber hygiene or even cybersecurity as a boardroom priority, even in 2023? Many business leaders, especially small to medium-business leaders, fail to perceive themselves as targets. From their perspective, spending more on cybersecurity is a wasted effort, and those resources can be used elsewhere.

    On average, companies worldwide only allocate around 12% of their IT budget to IT security! Thus, persuading the boardroom to invest in cyber hygiene can be challenging. However, while it is hard to implement and even harder to maintain, these habits, security practices and solutions help make the world safer. And that is where every organization needs to start.

    Related: Why Is Cybersecurity Important for Your Business? Neglecting It Could Be Your Downfall.

    Reviewing the numbers

    Looking back at just a year, cyberattacks worldwide have shown a 38% increase in 2022 compared to 2021. The attack on the Australian health insurance provider Medibank, the data breach on the Los Angeles Unified School District (LAUSD) or even the social engineering hack on games company Rockstar are just a few of the thousands of data breaches happening all over the world.

    Interestingly, these breaches, like most, could have been prevented with good cyber hygiene. Furthermore, the examples I chose demonstrate that attackers seem unconcerned with a company’s size, location or industry. Yet, even with cyber threats like data breaches, phishing scams and ransomware, cybersecurity investments fall short.

    Over the last few years, we’ve made great strides in security, especially following the global pandemic. Still, a study conducted by Foundry shows that 9 out of 10 security experts still believe their organizations are not prepared to address the risks of a cyber-attack.

    Related: 5 Ways to Protect Your Company From Cybercrime

    Investing in cyber hygiene: a checklist

    So, what can we do? Establishing a strong and resilient cybersecurity architecture demands deploying security measures on multiple fronts such as data, devices, employees and network. Any elementary security architecture must include solutions to enforce strong password policies, protect data in transit and at rest, identify and protect against attacks and regularly back-up mission-critical data. This seems excessive, especially considering how limited the budget is. Yet, acquiring as many tools as possible within your financial limits shouldn’t be your final objective. The most effective strategy results from selecting the appropriate collection of tools after carefully assessing one’s demands and the current level of security precautions. The solutions I’d suggest include the following:

    • Identity and access management (IAM) solutions to ensure the right user is linked to the right resources
    • Unified endpoint management (UEM) solutions for securing endpoints and managing, patching and updating operating systems and applications
    • Extended detection and response (XDR) or Endpoint detection and response (EDR) solutions to detect and mitigate new and existing vulnerabilities
    • Remote browser isolation (RBI) for a safer browsing experience
    • Firewall as a service (FWaaS) to protect the perimeter less network border
    • Additionally, a combined implementation of Zero Trust Network Access (ZTNA) or Software Defined–WAN (SD-WAN) can provide faster connections, improve latency and secure your remote workers.

    Also, it would be wise to select solutions that already have established interconnections among them. This would offer more centralized and seamless access, thereby reducing the workload on your IT administrators and saving you from recruiting larger teams.

    Alternatively, some vendors offer multiple tools in a combined package. For example, Cisco Umbrella offers RBI, SD-WAN, and much more, Hexnode provides IAM and UEM capabilities, and Okta gives you both ZTNA and IAM. Make sure to carefully examine such vendors and the integrations between them before finalizing your architecture. In my experience, customers have always preferred a consolidated approach because, economically or due to staffing, they can’t handle the complexity of multiple solutions.

    Related: The Correlation Between Covid-19 and Cybercrime

    Roadblocks along the way

    We are all aware that the financial facet of any venture will inevitably be difficult. Assuming that the aspects mentioned above identify with your company’s objectives, the following query would most likely be regarding the return on investment. It might be challenging to locate the facts and data needed to identify the advantages of cybersecurity hygiene. I would suggest reviewing the financial implications of previous data breaches and comparing those numbers against the investment cost. You will discover that the latter dwarfs the former sum.

    Another hurdle is the monotony associated with good security hygiene. A robust security architecture requires periodic observation, maintenance and upgrades. This is often a bit boring, especially for non-tech-savvy investors, entrepreneurs and leaders. Additionally, the repetitious nature might cause inaccuracy and personnel exhaustion. The only solution is to clearly communicate the necessities of cyber hygiene and make them understand that security is an ongoing process rather than a one-time stop. Also, using tools to automate tasks and setting reminders can help employees stay on track without it being a bother.

    The recession bound to happen this year will surely put an even tighter hold on the already stretched budget. However, being the victim of a cyberassault during such trying times would be a far scarier reality. As business leaders, we must pay close attention to the hazards and repercussions of a cyberassault in our organization. Thankfully, many businesses are unwilling to face the risks associated with losing client data and having production or operations halted due to a system breach. If they do, it is either out of ignorance or a lack of a thorough understanding of the entire process.

    [ad_2]

    Apu Pavithran

    Source link

  • Save Your Essential Files on a 500GB External Hard Drive | Entrepreneur

    Save Your Essential Files on a 500GB External Hard Drive | Entrepreneur

    [ad_1]

    Disclosure: Our goal is to feature products and services that we think you’ll find interesting and useful. If you purchase them, Entrepreneur may get a small share of the revenue from the sale from our commerce partners.

    Some files, you just can’t afford to lose. A study by Invenio IT found that businesses can lose millions in moments due to lost data, and it’s not just a loss of information. Productivity struggles to progress if you don’t have your essential information, even if it’s safe online but you don’t have internet access.

    If you want to make sure you have consistent access to your most essential data, keep it safe on an external hard drive. This 500GB Ultra-Slim Portable External Hard Drive is on sale for just $32.99 (reg. 39), and it could be a valuable asset in preventing lost data.

    Protect your business’s files.

    This compact, portable hard drive is easy to use and could have a major impact on how you work. Just connect a compatible USB 3.0 cable and start uploading or downloading your files as needed. Connect Mac or Windows computers, mobile devices, and more. Some older devices may require reformatting, but that still leaves you with considerable room for storage. You can expect read and write speeds up to 100MB/s.

    Though this hard drive is listed as 500GB, it may appear as 465GB when you open it on your computer. That is because the notation computers use to measure available space differs from hard drive manufacturer notation. It is still a considerable amount of room in which you can store the files your business cannot risk losing.

    The only way to lose the data on this hard drive is to lose or destroy the drive itself. Hackers can’t access what isn’t plugged in, so it may even be safer than many cloud storage options. Plus, you don’t need an internet connection to access your files. Take your work home with you with a hard drive that may be even smaller than your smartphone.

    Save on a 500GB portable hard drive

    For a limited time, get the 500GB Ultra-Slim Portable External Hard Drive on sale for $32.99 (reg. $39).

    Prices subject to change.

    [ad_2]

    Entrepreneur Store

    Source link

  • Cybersecurity researcher finds 1 million invoices in public, unencrypted database

    Cybersecurity researcher finds 1 million invoices in public, unencrypted database

    [ad_1]

    A cybersecurity researcher says he discovered a public, unencrypted database earlier this year associated with a business banking fintech that contained more than 1 million names, physical addresses and phone numbers of consumers and business owners who used a certain invoice-creator app.

    The database is said to have been secured in January, and where the fault for any vulnerability lies is murky. But the incident highlights the widespread problem of unprotected online databases — which sometimes are linked with seemingly innocuous, free apps — that present risk management challenges for players from digital startups to large banks.

    The security researcher, Jeremiah Fowler, announced the disclosure Wednesday and said the database belonged to NorthOne, a Toronto-based fintech offering mobile-first banking to small businesses, because the invoices he found in the database say “powered by NorthOne.”

    NorthOne CEO Eytan Bensoussan told American Banker that, despite appearances, the vulnerability actually stems from an app called InvoiceMaker that is not connected to NorthOne. He acknowledged that some of the people who helped build the app now work for NorthOne and that the company marketed itself with the app, but the app has “no product, technology or corporate connection” to his fintech.

    “NorthOne is a completely separate entity from InvoiceMaker,” Bensoussan said.

    Yet NorthOne launched a free invoice creation tool in 2018, according to multiple news reports. The app, which prominently featured NorthOne’s old logo and branding, used both the names Invoice Maker and Free Invoice. As of June 2022, the app had 4,900 ratings on the Apple app store.

    Invoices in the database, which was not password-protected, included names, physical addresses, email addresses, phone numbers and details about the services provided.

    Jeremiah Fowler

    Despite the invoice app using NorthOne’s old logo, “there is no crossover between databases,” Bensoussan said in an email. In explaining why NorthOne’s old logo appeared in the app, he said NorthOne once “leveraged Invoice Maker for awareness purposes, but as you can see from the outdated logo, that was a long time ago.”

    Bensoussan said his team terminated the invoice creation service after Fowler told them about the vulnerability in January, and NorthOne’s invoice creation app is no longer available on the app store. Fowler said the database he found is also now secured, thanks to his disclosure.

    In his comments, Bensoussan played down the importance of the vulnerability, saying the invoicing app had “no payment capabilities and did not involve any payment data.” Rather, the app was “a free PDF generator for invoices,” he said, adding it had “as many as 20,000 users at its most popular but was due to be sunsetted later this year because it had run its course.”

    Security researcher Brett Callow said he could not comment on the specifics of this invoice data vulnerability but noted that it is often difficult to determine the significance of exposed databases. Often, it is not necessarily clear even to the company that manages the data whether anybody other than the researcher who discovered it accessed the data, he said.

    northone1-850x638.jpg
    Invoices found in the database also feature NorthOne branding. The fintech’s CEO maintains the company affected a now-defunct invoice creation tool, not NorthOne.

    Jeremiam Fowler

    “Still, even if it was only a researcher who accessed a database, that means an unauthorized third party had access to information — and that’s a data breach,” Callow said.

    Ali Allage, CEO at Bluesteel Cybersecurity, offered a different take, saying a data breach occurs when data is taken without the knowledge or authorization of the system’s owner. That does not appear to be the case here, she said, for which NorthOne should consider itself lucky.

    “This organization got extremely lucky that this didn’t snowball into something worse and having to deal with much larger consequences,” Allage said.

    Bensoussan said “no breach or leak occurred,” adding “we have confirmed no data was ever compromised or made public.”

    As of Friday, no state attorneys general had reported any data breaches from NorthOne, Free Invoice or Invoice Maker, suggesting the responsible party has not reported the breach pursuant to any of the state laws governing data breach disclosures.

    According to Fowler, his interaction with Bensoussan — an email in which the CEO let the researcher know the vulnerability had been taken care of — provided no indication that he had misidentified the responsible party. Had he messaged the wrong company saying he found their exposed database, “they would have been very eager to tell me that it does not belong to them,” he said.

    Bensoussan said he is “thankful that the issue has been addressed” and said Fowler called his team’s attention to the vulnerability before it escalated into a breach.

    “In this case, the system worked as intended with a security researcher helping to address a problem before it became an issue,” Bensoussan said. 

    Invoices are a “goldmine for criminals,” according to Fowler, because they can target victims using both the contact information they glean from the documents and the details of private transactions.

    “The criminal could reference the real invoice number and transaction details, making it difficult for the victim to doubt the scammer’s legitimacy as a representative of the company or service provider,” Fowler said.

    The database was so easy enough to find, Fowler said, that it would have required little expertise for a criminal to get to it — and no password to decrypt the files once found.

    Fowler monitors multiple IoT search engines to find the data, including the exposed database of invoices. IoT search engines scour the web for internet-connected devices like webcams and smart home appliances. Shodan is a popular example; others include Censys, GreyNoise and ZoomEye.

    According to Fowler, the incident is an example of why companies need to establish good processes for and relationships with security researchers, since the analysts work to protect data and plug security vulnerabilities. In many cases, including this one, they do so free of charge.

    “The biggest thing is that companies need to take that extra step and realize that, if you collect data, it’s valuable to somebody other than you,” Fowler said.

    [ad_2]

    Carter Pape

    Source link

  • How to Protect Your Business Through Secure Digital Experiences | Entrepreneur

    How to Protect Your Business Through Secure Digital Experiences | Entrepreneur

    [ad_1]

    Opinions expressed by Entrepreneur contributors are their own.

    Passwords were once seen as a credible way to improve security, but with the advancing threat landscape and the increase of bad actors using easy-to-crack passwords as an entry point for far-reaching crimes, passwords have outlived their usefulness in providing the necessary level of security. From social engineering to phishing and brute-force attacks, passwords can be one piece of the security puzzle, but a multi-layered approach is now best for ultimate cyber resilience.

    A major inhibitor to password effectiveness is the inconvenience, which promotes the reuse of the same weak password across multiple accounts. A recent survey of consumers worldwide found that 61% will choose a competitor offering an easier login experience, and 59% admitted they abandoned an online experience because the login experience was too frustrating.

    In a convenience-wins world, one way to earn customer loyalty is to provide a passwordless experience where individuals aren’t burdened by the headaches of changing, managing and constantly inputting passwords while still feeling confident that their data is secure.

    Related: Passwords Are Scarily Insecure. Here Are a Few Safer Alternatives.

    Understanding passwordless

    Passwordless authentication can be delivered using multiple digital experiences, each with its own advantages, which can serve different types of users. For example:

    • Biometrics: physical characteristics captured by your device, like fingerprints or facial recognition, to verify a user’s identity.
    • Security keys: physical devices that generate one-time codes used for authentication.
    • Email magic link: sends a secure login link to your email address for seamless access.
    • QR codes: highly secure authentication that doesn’t require entering a username or password.

    The highly personal and multi-step nature of these authentication methods makes them more secure and more difficult to compromise. They’re also easier and more convenient and eliminate the need to remember multiple passwords or be tempted to reuse the same one across multiple accounts. Many of these methods can be implemented to support high-security requirements by using phishing-resistant standards (including FIDO and WebAuthN).

    Related: Passwords Are Now a Weakness — Here’s Why It’s Time to Eliminate Them.

    Tailoring authentication needs to the industry

    Retail, finance and insurance industries all have different requirements for authentication, and experiences need to be tailored to fit a range of security and consumer needs. The key is always ensuring that the online identity represents the real human it claims. This diligence is necessary for protecting against fraudulent activity and ensuring the security of sensitive information.

    Retail websites often require less complex methods, such as an email magic link. In contrast, insurance and financial websites may require more rigorous methods, such as document verification from a driver’s license or passport and biometric authentication to comply with regulatory requirements.

    Using machine learning in passwordless authentication

    One benefit of passwordless is that it can be simplified by using artificial intelligence to analyze user behavior, identify patterns, and assess risk. Using machine learning algorithms to analyze user activity and log typical (or flag atypical) behavior patterns is a good example. These patterns – such as how a user types on a keyboard, the websites they prefer to visit, or what time of day they log in – could then be used to authenticate the user without the need for a password.

    This intelligence also identifies potential threats and vulnerabilities by monitoring user activity and analyzing data. Organizations can identify patterns that may indicate a security threat or vulnerability and take action to mitigate the risk. Implementing the correct tools here can help prevent Bot and Account Take Over (ATO) attacks.

    Related: Why Physical Security For Your Business Is Just as Critical as Online Security

    Steps to creating a passwordless experience

    If you see the benefits of creating a passwordless experience for employees and customers, here is how you get there:

    1. Design a strategy that maps your customer journeys for their first visit and return visits, including which types of devices, computers, and browsers they will likely be using and how often they will be on the site. Ensure that your passwordless authentication methods are compatible with your customers’ devices and platforms.
    2. Assess the amount of identity assurance needed against the friction customers are willing to endure. Regardless of the type of website, choosing the right method is crucial. Organizations must select an authentication method that aligns with their customers’ needs and their platform’s requirements. For instance, facial recognition is a convenient option for mobile devices, while security keys are more suitable for desktop environments.
    3. Give a passwordless option, even if some customers keep passwords because they’re more comfortable with them. This allows a company to cater to a broader range of user preferences and needs. Include education on passwordless such as how it works and how to use it. Many users are accustomed to using passwords and may be hesitant to try a new authentication method. Providing clear and concise information on passwordless authentication and its security advantages can help steer customers toward this option.
    4. Use intelligence to reduce friction for a seamless user experience. Authentication should be simple and intuitive for users without requiring additional steps or creating unnecessary friction. Placing risk and context awareness toolsets in your authentication flow ensures friction is low and security remains strong.
    5. Extensively test with people who represent your user population. The people at your company are likely not the targets of your service, so be sure to test the right individuals to ensure its efficacy, compatibility and ease of use. Testing should be done with different devices, browsers, and operating systems.

    Achieving a passwordless future

    The security of a website isn’t solely dependent on the presence or absence of passwords. Other security methods, including encryption, access controls, and security protocols, also play a valuable role in website security. Still, passwordless authentication and verification are important aspects of a comprehensive security strategy.

    With the increasing security risks associated with passwords, the shift toward a passwordless future can provide significant benefits for both businesses and customers. With the right approach, passwordless authentication can become the norm for all customers as they access online accounts and services, making seamless and secure digital experiences commonplace.

    [ad_2]

    Jason Oeltjen

    Source link

  • This $26 App Bundle Could Protect Your Business Against File Loss | Entrepreneur

    This $26 App Bundle Could Protect Your Business Against File Loss | Entrepreneur

    [ad_1]

    Disclosure: Our goal is to feature products and services that we think you’ll find interesting and useful. If you purchase them, Entrepreneur may get a small share of the revenue from the sale from our commerce partners.

    On average, even small-scale data loss can cost a business up to $35,000. While upgrading your company computers may be good news, leaving behind essential files is not.

    This PC Transfer Kit Bundle gives you three tools to help you move, back up, and securely delete important files from your devices before upgrading. And right now, you can get the bundle, which includes PCmover Professional, DiskImage, and SafeErase, for $25.49.

    Use PCmover Pro to automate the transfer of applications, files, settings, and user profiles from one computer or operating system to a new one. It will streamline the upgrade process between devices so you don’t have to manually re-download all your essential software.

    If something doesn’t switch over, just send it again. Nothing is deleted. One user said: “Pick the files that you want and start the transfer…Doesn’t get much easier.”

    File backup services are helpful, but they don’t always protect everything. DiskImage creates a perfect copy of all your applications, files, and settings. Create copies on a schedule or manually. You can store your copy on a Boot CD, external storage that boots up when you plug it in. This license doesn’t come with a separate Boot CD, but you can use this app to make one. If you ever need to restore your computer, just plug it in and wait.

    Until April 11 at 11:59 p.m. PT, get the PC Transfer Kit Bundle for $25.49 (reg. $129) with code TRANSFER30.

    Prices subject to change.

    [ad_2]

    Entrepreneur Store

    Source link

  • Does Your Company Need Identity Security Training? Here’s How To Keep Everyone’s Data Safe. | Entrepreneur

    Does Your Company Need Identity Security Training? Here’s How To Keep Everyone’s Data Safe. | Entrepreneur

    [ad_1]

    Opinions expressed by Entrepreneur contributors are their own.

    Customer identity security is crucial, especially in this day and age.

    With an increasing number of cyber-attacks and data breaches, businesses must be vigilant in protecting the identities of their customers.

    Let’s discuss why customer identity security awareness is crucial for businesses and what they can do to ensure their customers’ information stays safe.

    Related: How to Identity Proof in an Increasingly Virtualized World

    Importance of protecting personal information

    Identity theft can have severe and long-lasting consequences for individuals, including financial losses, damage to their credit score and even legal issues.

    Individuals must protect their personal information and be aware of the risks of online sharing. This includes being cautious of phishing scams, using strong and unique passwords, and regularly monitoring their credit reports.

    Related: What Is Phishing? Here’s How to Protect Against Attacks.

    Organizations are also responsible for protecting their customers’ information and implementing strong security measures to prevent data breaches.

    This includes investing in cybersecurity solutions, regularly training employees on best practices, and conducting regular security audits to identify and address vulnerabilities.

    Organizations must also be transparent with their customers about data breaches and the steps they take to protect their information. Here’s why customer security awareness is crucial:

    1. Protecting customer information

    The number one reason customer identity security awareness is important is to protect the customers’ personal information. Info like names, addresses, phone numbers, email addresses, and payment information are valuable assets for cybercriminals.

    Related: 5 Ways to Protect Your Company From Cybercrime

    If this information falls into the wrong hands, it can lead to severe consequences, including identity theft, financial fraud, and reputational damage to the business.

    2. Maintaining trust and confidence

    Companies should be responsible for their customers’ data. If a company experiences a data breach, customer trust and confidence in the business can be severely damaged. This can result in long-term consequences for the business and harm to the company’s reputation.

    3. Complying with regulations

    Businesses must comply with various regulations and laws governing personal information handling.

    For example, the European Union’s General Data Protection Regulation (GDPR) requires businesses to protect personal data and report any data breaches to the relevant authorities. Failure to comply with these regulations can result in substantial fines and legal penalties.

    4. Preventing cyber attacks

    Cyberattacks are becoming increasingly common and sophisticated, and businesses must be prepared to defend against them. Cybercriminals can use various methods to access sensitive information, including phishing scams, malware, and social engineering attacks.

    5. Improving customer experience

    Customer identity security awareness can also improve the customer experience. When customers know that their personal information is being protected, they can have peace of mind when conducting transactions with the platform and would love to stay with the brand for longer.

    Tips to Improve Customers’ Identity Security Awareness

    1. Stay educated and informed

    It’s crucial to stay up-to-date on the latest threats and trends in cybersecurity, as well as regularly educate your customers and employees on best practices for protecting their information. You can read industry news and articles, attend webinars and training sessions, and stay informed about new security technologies.

    As an enterprise, it’s your responsibility to ensure your customers constantly learn about the latest threats and vulnerabilities and are shielded against them.

    2. The use of strong passwords and enabling multi-factor authentication (MFA)

    These steps can significantly enhance the security of your accounts and help prevent unauthorized access to your information and identity theft. With MFA, enterprises can stay assured that even if one aspect of authentication, like passwords, is compromised, there’s another stringent mechanism to reinforce customer account security.

    Related: What You Need to Know About Multifactor Authentication

    Educating your customers regarding strong passwords and your enterprise’s security posture and offering frequent training sessions to utilize the identity management tools efficiently can eventually be a game-changer in reinforcing your customers’ identity security awareness.

    3. Educate your customers to review security policies

    When it comes to identity security, the threat landscape is quite broad. And a single mistake from your customers’ end could lead to severe consequences that may even hamper your brand reputation. It’s a great idea to educate your customers about the potential threats they may encounter while browsing other platforms.

    Here’s what needs to be done from your end to ensure robust customer identity security:

    • Educate yourself about the importance of regularly reviewing privacy settings: Ask your customers to regularly review privacy settings on social media and other online accounts that can help prevent sensitive information from being shared with unauthorized individuals. This can include checking who can see personal information.
    • Understand what sensitive information is: Ensure your customers are well aware of sensitive information, which includes their social security numbers, credit card numbers, health records, passwords, and even their mother’s maiden name. It is essential to keep this information safe because it can be used for identity theft or fraud.
    • Identity protection: Identity protection involves keeping an eye out for suspicious activity in their name or an attempt to gain access to accounts that belong to them. This could include someone applying for credit cards in their name or attempting to access bank accounts linked to their social security number.

    In a nutshell, identity security is and will be an important aspect of business and client relations. Neglecting identity security can lead to significant consequences for both individuals and businesses. Businesses must educate their customers about the importance of identity security and provide them with the necessary tools and resources to protect themselves.

    [ad_2]

    ReadWrite.com

    Source link

  • Protect Your Business with a Professional-Quality VPN | Entrepreneur

    Protect Your Business with a Professional-Quality VPN | Entrepreneur

    [ad_1]

    Disclosure: Our goal is to feature products and services that we think you’ll find interesting and useful. If you purchase them, Entrepreneur may get a small share of the revenue from the sale from our commerce partners.

    Even small businesses can be the target of cybercrime. A recent report found that the average data breach cost for businesses with fewer than 500 employees was nearly $3 million. Your business may not have millions to spare, but investing in comprehensive cybersecurity software could help you reduce the risk of cybercrime.

    Windscribe VPN Pro could help you guard your privacy and protect an unlimited number of devices on your account. Windscribe VPN has one-, two-, and three-year subscriptions on sale for $39, $59, and $69, respectively — but that price drop will only last until April 22 at 11:59 p.m. PT.

    This VPN service gives you unrestricted and private access to entertainment, news sites, and blocked content in over 69 different countries and 112 cities. Start browsing privately and enjoying extra network protection. You can even choose to spoof your location and timezone so your computer can appear in another location.

    If you don’t have time to master coding and computer science, a good VPN could still help protect your network and devices. As one reviewer wrote, “I had experience with Nord VPN in the past, and its servers, while DNS leak-proof, were showing that I was in a different location than the selected server’s location. That resulted in me not being able to use location-specific services. With Windscribe, that never happens.”

    Windscribe featiures split tunneling and a firewall that blocks all connectivity outside of your tunnels, which means your devices could be safer from hackers who might try to pull information from your browsing or your computers.

    Until April 22 at 11:59 p.m. PT, choose from the following best-online prices for Windscribe:

    One-Year Subscription: $39
    Two-Year Subscription: $59
    Three-Year Subscription: $69

    Prices subject to change.

    [ad_2]

    Entrepreneur Store

    Source link

  • TitleMax hack exposes 4.8 million customers’ data

    TitleMax hack exposes 4.8 million customers’ data

    [ad_1]

    TMX Financial, which operates title loan brand TitleMax and other services, publicly disclosed on Thursday that it suffered a data breach exposing the personal information of 4.8 million people, including their Social Security numbers.

    The company said in a letter to affected consumers that it detected suspicious activity on Feb. 13 and concluded on March 1 that there had been a breach starting in December. Hackers stole the data between Feb. 3 and Feb. 14, according to the letter.

    The specific information involved in the breach, according to TMX, “may have” included names, dates of birth, passport numbers, driver’s license numbers, federal or state identification card numbers, tax identification numbers, Social Security numbers, financial account information, phone numbers, street addresses and email addresses.

    One measure financial companies can take to protect personally identifiable information (PII) on consumers is to collect less of it, according to James McQuiggan, a security awareness advocate for cybersecurity awareness training platform KnowBe4.

    “One of the most critical steps companies can take to protect PII is collecting only the data necessary to conduct business and storing it securely so unauthorized parties cannot access it,” said McQuiggan. “Organizations should also ensure that any third-party vendors or partners they work with are implementing strong cybersecurity measures.”

    Among financial companies, the breach is the largest so far this year to be reported to the Maine attorney general’s office, which publishes reports about data breaches affecting any Maine resident.

    The data breach is not the only trouble TMX has faced this year. The Consumer Financial Protection Bureau announced on February 23 that it would fine TitleMax $10 million for violating the Military Lending Act. TitleMax allegedly provided title loans to military families illegally and, oftentimes, by charging nearly three times the 36% annual interest rate cap, according to the CFPB — a practice that it has allegedly engaged in since 2016.

    Debt collector NCB Management Services also reported a large data breach earlier this month. On March 24, the company told the Maine attorney general that hackers stole data from 490,000 consumers, specifically information about their ID cards and Bank of America credit card accounts. That breach did not impact Bank of America’s systems, NCB emphasized in a letter to affected consumers.

    So far this year, 10 other financial companies have reported data breaches affecting more than 500 people. The bank or credit union with the largest breach so far this year is Hatch Bank, which had 140,000 consumers’ data stolen. In that case, hackers exploited a zero-day vulnerability in file-transfer software known as GoAnywhere, according to a letter the bank sent to affected customers.

    [ad_2]

    Carter Pape

    Source link

  • Cybersecurity Expansion Doesn’t Have to Be an Uphill Battle. Here’s Why | Entrepreneur

    Cybersecurity Expansion Doesn’t Have to Be an Uphill Battle. Here’s Why | Entrepreneur

    [ad_1]

    Opinions expressed by Entrepreneur contributors are their own.

    How much cybersecurity does a person actually need?

    Well, it depends on who you ask. Cyberattack damage will rise to $10.5 trillion by 2025, and security advocates say you can never be too careful when fortifying your data and devices. Of course, cybersecurity on both home and office devices is essential to navigating any digital space, and it’s vital to keep one’s information and sensitive data protected. But in day-to-day life, trying to keep your devices secured can quickly get convoluted.

    That’s partially because of the disparate state of the cybersecurity industry. Users are spoiled with protection options from multi-factor authentication (MFA) to VPNs, password managers and good old antivirus programs. But the issue doesn’t come from the selection available. Rather, it’s that most of these cybersecurity tools are not in conversation with each other.

    Yes, having your cybersecurity products connected can put them at risk to some extent should one of them become compromised. However, when an individual exclusively uses a password manager, a Google-generated “difficult” password, or MFA on one single account, are they really any safer?

    Related: Amazon Ring Is the Latest Target of Notorious Ransomware Gang

    Likewise, if a cybersecurity feature a consumer uses gets compromised or hacked, it could discourage them from exploring other security products while they cope with being burned by a clever hacker. Of the millions of accounts exposed in the LastPass breach, many of the consumers using the program probably assumed they were properly fortifying their devices and sensitive information.

    Although it’s likely not the best idea to merge every cybersecurity measure under one umbrella, entrepreneurs should see the value in trying to connect the industry’s loose threads.

    Making cybersecurity more seamless could end up keeping more people safe in the long run. Building bridges to improve user experience and creating solutions that cover multiple bases also spreads out the long-term viability of a cybersecurity company by expanding its security reach.

    If an entire security company’s business rests on the stability and success of one product, it will undoubtedly lose revenue and consumer trust should that one product get breached. And they would need plenty of luck to build up that goodwill without the PR artillery that Big Tech companies have.

    Another factor to consider in helping unify cybersecurity lies in its cost. While many programs operate through donations or are free to use in exchange for user data, most serious cybersecurity products come with a price tag.

    Around 61% of users in the U.S. rely on free antivirus software, according to an annual report from Security.org. No surprise there, but the same report states roughly 33 million households pay for some type of security software, albeit with no distinction as to how that is spread across VPNs, secure browsers, and other features. This indicates users are willing to pay for personal protection, but only for certain kinds of products.

    Likewise, while an individual might pay for an antivirus program or a VPN, it can be hard to convince users to pay for multiple security products unless the individual is a business owner or regularly deals with highly sensitive information.

    Related: A Successful Cybersecurity Company Isn’t About Fancy Technology

    Outside of home-bound device security, mobile devices have also pushed privacy and security issues to the forefront of tech conversations as they reach near-universal use. Consumers, in general, have become much wearier about their data privacy and how to secure smartphones from malware and attacks, given how much personal information these devices now hold.

    But most people don’t read the permissions they allow apps and programs to access on devices, and many don’t go the extra mile to secure their phones outside of the built-in safeguards developed by Apple or Android. As more users search for ways to “declutter” their mobile experience, this shows another clear gap in cybersecurity interoperability.

    Companies such as privacy-preserving mobile developer Unplugged are already banking on the need for cybersecurity convergence, offering a multi-pronged app suite to boost mobile and desktop privacy and security. The project operates through a subscription-based model, which creates a new pathway to access high-level security products without having to pay exorbitant fees for each new program.

    Despite the siloing of cybersecurity, changes are clearly on the horizon from both a developer and regulatory level. In March 2023 alone, the U.S. government unveiled a beefed-up National Cybersecurity Strategy to set new regulatory standards and corporate responsibilities surrounding cybersecurity. The extensively-updated strategy outlines key pillars, including support for critical infrastructure, addressing the cybersecurity skills gap, setting regulatory baselines and fostering collaboration between the public and private sectors.

    Although we have yet to see how these new frameworks will affect consumer-level cybersecurity, the U.S. government, echoing collaboration and connection, shows its necessity in building a resilient cybersecurity future.

    Security should be a tenet of any tech product, given how sophisticated attacks can get. As more facets of our daily lives move to the digital realm, there is an imperative to improve security processes before it turns catastrophic. Entrepreneurs should be considering projects in this sector that are working to build common ground and security seamlessness to cut through the general malaise that users might have around protecting their devices.

    [ad_2]

    Ariel Shapira

    Source link

  • Listen: How embedded banking can reduce fraud | Bank Automation News

    Listen: How embedded banking can reduce fraud | Bank Automation News

    [ad_1]

    Adoption of embedded banking by both businesses and customers is on the rise, and it is helping to reduce the risk of payment fraud along the way.  For consumers, tokenizing user credentials for their protection is a benefit; meanwhile, businesses gain security by using integrated systems to accept payments safely, Bennie Pennington, vice president of […]

    [ad_2]

    Brian Stone

    Source link

  • Entrepreneur | Redefining Customer Engagement in a World Where Data Privacy Reigns

    Entrepreneur | Redefining Customer Engagement in a World Where Data Privacy Reigns

    [ad_1]

    Opinions expressed by Entrepreneur contributors are their own.

    With customer data having gone back underground, the magical genie is back in the bottle. That means now is the time to prove that as advertisers and marketers, you can juggle both engagement and privacy.

    Just about a year ago, consumer data was everywhere and readily accessible. But following data restrictions by Apple, countless consumers have clawed back their privacy. Indeed, not only do consumers doubt the security of their personal data, they feel as though their daily lives are subject to being tracked by companies, according to a recent study by Pew Research.

    After the data floodgates began to close, a major problem was revealed: Many marketers and many companies had gotten quite lazy. We had the gift of easy data, which helped identify consumer behavior with a pretty high degree of confidence. As it turns out, that adjustment may have been just a modest first step: Google plans to discontinue third-party cookies in Chrome sometime in 2024.

    Related: Importance of Customer Engagement in This Day and Age

    The future of digital advertising

    While the Apple changes were one of the first dominos to fall, the proposed Google changes also have the entire digital advertising industry nervous, since Chrome has the majority of global browser market share. Google’s move could represent a drastic departure from the current methods of targeted advertising. Indeed, I foresee a cookieless future for digital advertising that looks a lot less appetizing.

    That means the battle for authentic customer interaction has to adapt and come of age. Advertisers and marketers often find themselves at a loss for what to do to get authentic consumer engagement. This move away from high confidence, data-driven sales scenarios means that inroads for engagement need to happen as early and often as possible by working to make digital feel more personal.

    We all know that clicks do not necessarily convert to sales or loyalty, but the era of gaining insight into what makes a consumer tick based on behavioral data like keyword searches and previous page views is behind us. A consumer’s initial search for a microwave oven, a car or a soccer ball might have meant reminders showing up in a social media feed later on as a nudge of sorts. These days, the same search brings up dozens of examples that don’t necessarily inform or educate or sell.

    As a result, we are in a very confusing time for digital advertising, where the old, programmatic best practices — to optimize cost, scale and personalized accuracy — are becoming extinct, but new ways of trying to optimize digital advertising with personalization aren’t clear. Amid that uncertainty, the best approach to redefining customer engagement is a back-to-basics approach that, at its best, can be a differentiator for brands by helping to build customer trust and loyalty.

    Related: Now Is the Time to Get a Grip Around New Data-Privacy Realities

    Redefining customer engagement

    For certain purchases, potential customers will always want some sort of engagement that feels more personalized. This means any company hoping to make a sale without that built-in ability to get organic insight about a customer’s needs and preferences is now faced with creating a three-dimensional relationship in a one-dimensional environment. With less data to go around, purchase decisions rely more heavily on creating a sense of value exchange by going back to some of the basics, starting with creating a more human connection.

    One age-old solution to this modern problem is a return to insight sales. Many brands moved away from human-enabled sales to 100% digital because, at the time, the move was more cost-effective. But now is the time to rethink this move. In a world where there’s less “easy data,” companies risk spending a lot of money on engagements or clicks that don’t become engagements that convert.

    A personal, human element can potentially transform those clicks into an engagement or a sales conversion, creating a sense of value exchange that drives not only engagement but a confident purchase decision and even better consumer loyalty.

    Brand owners will need to work harder to truly know their customers. That is where a meaningful, strategic customer engagement strategy will be decisive. Consumers have lost their appetite for cookies, but they are hungrier than ever for meaningful connections.

    [ad_2]

    Nick Cerise

    Source link

  • Save 94% on a 10TB Cloud Backup Plan That Could Save Your Business From Data Loss

    Save 94% on a 10TB Cloud Backup Plan That Could Save Your Business From Data Loss

    [ad_1]

    Disclosure: Our goal is to feature products and services that we think you’ll find interesting and useful. If you purchase them, Entrepreneur may get a small share of the revenue from the sale from our commerce partners.

    Insurance may help you secure your business against a disaster, but it can’t replace digital files lost in a flood or email records from a stolen hard drive. Data loss can cost companies thousands of dollars, but you may be able to prevent it from happening. Degoo Premium is a 10TB backup plan that automatically saves your important files on a secure cloud drive, and you can get a lifetime subscription for $199.99.

    Hardware can be replaced, but lost data may just be gone. Degoo lets you send files to a secure online storage where you can still access and share them. Send files to your team via email or link, or you can use popular apps like Facebook and Twitter. Using the Android App, you can even select folders that Degoo will monitor autonomously. If Degoo detects any change, it will automatically upload a copy.

    Uploading a file doesn’t remove it from your computer. Degoo replicates your files, so you always have a backup copy. There is a 1GB file size limit, but that can be upgraded in the app. Access your cloud storage from an unlimited number of devices. That means your entire team can upload their work online. For remote workers, that makes it even easier to check in on ongoing projects.

    Boasting 4.5/5 stars online, Degoo gives you more storage space than Dropbox, OneDrive, and Google Drive combined. Consolidate your cloud storage solutions into one easily accessible file hub protected behind a 256-bit AES encryption that’s nearly impossible for hackers to break into.

    Keep your files safe with a backup plan your entire team can access. For a limited time, get a lifetime subscription to Degoo Premium 10TB Backup Plan for $199.99 (reg. $3,600).

    Prices subject to change.

    [ad_2]

    Entrepreneur Store

    Source link

  • 3 Enterprise Security Trends to Watch Out For in 2023

    3 Enterprise Security Trends to Watch Out For in 2023

    [ad_1]

    Opinions expressed by Entrepreneur contributors are their own.

    As our planet completes yet another lap around the sun, we find ourselves looking ahead to the new challenges and opportunities of 2023. It is always exciting to peer into the unknown and predict what this new solar orbit brings.

    But if the recent years have taught us anything, it’s that such a task is, in fact, a difficult endeavor. I’m sure that none of the predictions we made at the start of 2020 could’ve prepared us for what was coming in the years that followed. So, this ritual of soothsaying we practice every year is not about focusing on the finer details, but instead, it seeks to provide an insight into the general direction the world seems to be cruising towards.

    Gartner used the phrase “seize uncertainty” as the theme for their strategic roadmap report for the coming years. It is truly an apt phrase to define 2023. The ripples caused by the boiling geopolitical tensions caused by the Russia-Ukraine issue, the brewing cybersecurity concerns and the global recession looming over the horizon point toward the uncertainties that await us.

    Because of this, enterprise security has risen to be one of the top priorities for businesses in the coming year, so here’s a take on the upcoming trends of 2023 that companies need to watch out for.

    Related: 5 Fundamental Best Practices for Enterprise Security

    1. Adaptable protection and enhanced visibility for endpoints

    Endpoints continue to be a top target for sophisticated hackers. Adversaries are now leveraging endpoints as a launching pad to conduct more lucrative assaults, such as ransomware and business email compromise, rather than simply taking sensitive data from them. Furthermore, businesses must deal with a growing number of devices, including employee-owned devices outside of corporate networks and IoT devices like virtual personal assistants that need access to company networks, services or databases. Consequently, endpoint protection platforms and endpoint management suits remain a high priority.

    The cybersecurity landscape is fluid and constantly changing. The last few years have shown a significant rise in industry-specific attacks focused on healthcare, supply chains, education, etc. This trend will likely proceed to the following year, and the industries on the weaker end of digital transformation are easy targets for cyber-attacks. In such a paradigm, solutions to detect such threats, platforms to secure and manage corporate devices and other SaaS offerings can provide visibility, protection and a streamlined management platform to take care of the myriad of endpoints being deployed.

    Related: Web3, Crypto, Cybersecurity, Rural Fintech: Trends To Look Out For In 2023

    2. Integrations, collaborations and partnerships

    The onset of the cloud and the subsequent migration towards it enabled organizations to set fluid boundaries to give customers a more inclusive solution. Every SaaS vendor is moving towards this approach to combine the strengths of multiple tools and provide a unified console for seamless management.

    An example of such a collaboration is the prominence and proliferation of SASE (Secure Access Service Edge). Introduced by Gartner in 2019, SASE is a cybersecurity concept that converges multiple network connectivity and network security solutions into a unified service delivered via the cloud. Global spending on SASE is predicted to grow $8 billion by 2023 – a clear indication of its importance and value.

    2023 will also see security and management solutions integrating Artificial Intelligence into their existing toolset. Over the past years, AI has been a significant enabler of automation in security systems. For example, intelligent threat detection systems like endpoint detection and response solutions use AI and ML to detect and respond to zero-day vulnerabilities that can harm your business. The coming year will find many solutions integrating AI technology to strengthen their security posture further.

    3. Fostering a culture of security awareness

    Developing and creating a culture of awareness around cybersecurity risks is the most crucial action to take at any firm. Employers and the workforce can no longer consider cybersecurity to be a problem that the IT department should handle. In reality, everyone’s work description in 2023 should include understanding the dangers and taking simple security measures!

    Many IT security strategies follow a reactive rather than proactive approach, which involves pumping money to recover from the attack and rebuild brand reputation. Attackers take advantage of this and target the weak links to cause damage. Phishing attacks utilize “social engineering” techniques to deceive victims into disclosing sensitive data or downloading malware onto their computers.

    Related: How to Prioritize Online Security While Working From Home

    Anyone can learn to recognize these assaults and take simple safety measures to protect themselves without needing technological expertise. In the same way, fundamental security abilities like secure password usage and learning about two-factor authentication (2FA) ought to be taught to everyone and regularly updated. If an organization wants to ensure resilience and preparation over the next 12 months, taking simple safeguards like these to promote a culture of cybersecurity awareness should be a significant aspect of their security strategy.

    Moreover, with the global economy predicting a global recession, enterprises of all sizes can expect budget cuts throughout the year. In such a situation training your employees and ensuring they have a solid understanding of cybersecurity practices can provide a strong security posture that can act as the first line of defense, protecting your business.

    As we take our first steps into 2023, every enterprise and industry should prepare for the new year and the challenges it brings with it. While predictions and trends serve as guidelines that help us navigate the coming ordeals, the history of the digital world has shown us to always prepare for the worst and expect the unexpected.

    [ad_2]

    Apu Pavithran

    Source link

  • 78% of Employers Are Using Remote Work Tools to Spy on You

    78% of Employers Are Using Remote Work Tools to Spy on You

    [ad_1]

    Opinions expressed by Entrepreneur contributors are their own.

    78% of employers use software to spy on employees. But the research — and common sense — shows that this tempting practice does far more harm than good. And 83% of employers acknowledge that it’s ethically questionable. When you spy on your people, you trade trust, culture and morale for sketchy data and productivity theater.

    Work-from-home and hybrid models are here to stay. Companies everywhere are investing millions in digital employee experience (DEX), which reduces IT friction and makes employees happier and more productive. Separately, the same remote and hybrid shift has encouraged companies to deploy so-called productivity surveillance technologies. These have the opposite effect and even punish those who allegedly waste company time.

    DEX and productivity surveillance are very different. DEX helps employees and their companies, while surveillance harms both. What’s more, data from productivity surveillance is, ironically, a terrible measure of productivity. Many companies have good justifications for specific, security and compliance monitoring practices. But we shouldn’t let productivity surveillance hide in the shadow of necessary measures that prevent disasters like data breaches.

    What’s productivity surveillance, and what does it measure?

    Leaders are worried about productivity. 85% blame hybrid work for obscuring whether employees are being productive, even though 87% of employees report they’re more productive working from home.

    Productivity surveillance includes things like taking screenshots throughout the day, logging keystrokes and clicks, analyzing message frequency and length and tracking website usage. All in order to measure, safeguard and (managers hope) increase worker productivity.

    Companies implement productivity surveillance to police how employees are spending their time. But, the proxy measures they use are extremely problematic. Screenshots, keyloggers, mouse trackers and message frequency logs don’t capture the important work that takes place away from company devices. Social workers, for example, have been penalized for visiting clients. Companies have docked pay for routine bathroom breaks. And none of these intrusions measure true productivity, like outcomes, work quality or goal attainment.

    This technology is doing real harm to people who don’t deserve it. And for what?

    Related: Can Employee Monitoring Be Done Ethically?

    The not-so-hidden harm and unbearable cost of surveillance

    Productivity surveillance damages the relationship between workers and companies and makes employees more likely to lie, cheat, steal, pretend to work and quit.

    43% of remote workers feel employee surveillance violates their trust; 59% feel anxiety; 26% feel resentment, and 28% feel underappreciated when subjected to such technologies. Tracked employees are nearly two times more likely to fake work and they spend over an hour extra online every day on average just to be seen by colleagues and managers.

    The authors of two 2021 studies discovered many paradoxical effects of employee surveillance. Monitored workers are “substantially more likely” to engage in myriad negative behaviors, including damaging and stealing workplace property, taking unapproved breaks, disregarding instructions and cheating, working at a purposefully slow pace and blaming others for their actions.

    During the pandemic, people took stock of their priorities. Millions have quit jobs because of poor working conditions and bad work-life balance and productivity surveillance decays both. Nearly 60% of tech workers said they would reject a job offer if they were surveilled by audio or video to enforce productivity. Roughly half would leave a job if their employers used audio and/or video surveillance, facial recognition, keystroke tracking or screenshots.

    Related: Your Boss is Watching You. Here’s Why Monitoring Workers Can Be …

    DEX vs. productivity surveillance

    DEX, on the other hand, is a category of technology and strategies to empower — not punish — workers. DEX tools find and fix IT issues before they cause delays and frustration, and track employee sentiment about IT experiences to continuously improve them behind the scenes.

    DEX is distinct from productivity surveillance because it scrutinizes things, not people: device performance, network speed, application crashes and the like. Companies use this data to enhance the technology experience for workers, not to evaluate productivity or punish them. This is precisely what employees want: 90% say their company’s digital experience has room for improvement, 82% say the delayed resolution of IT issues slows employees down and 68% say DEX has a high or critical level of influence on revenue.

    Related: How to Effectively Measure and Track Employee Productivity

    The contrast couldn’t be clearer. DEX makes workers more productive, makes the workday more enjoyable and makes companies more money. Policing productivity with surveillance makes your employees feel demoralized, untrusted and eager to find a better job. For leaders, it’s time to take a hard look at your so-called productivity surveillance technologies, practices and data. It’s also a moment for introspection. Let’s end this misguided trend before it goes any further.

    [ad_2]

    Mark Banfield

    Source link

  • Are Your Business Partners Exposing You to Cyber Threats?

    Are Your Business Partners Exposing You to Cyber Threats?

    [ad_1]

    Opinions expressed by Entrepreneur contributors are their own.

    The cybersecurity business has become everyone’s business. It only takes one viral data breach to destroy a company’s social proof and send its clients running to rival organizations in search of safer conditions. IBM estimates that the average data breach this year costs affected businesses $4.35 million, a near 13% increase since 2020. That figure doesn’t include the sometimes irreversible harm to a company’s reputation.

    Headline-grabbing data leaks aren’t limited to credit card or identity information, however. These incidents encompass anything and everything having to do with private and personal details. If you submit a car loan application, you trust the prospective lender to be a good steward of your information. When your business does business with another company, you similarly expect the same level of security.

    Related: 3 Reasons Why Privacy Matters to Your Business, Your Brand and Your Future

    In the financial services world, we’re held to high standards of security where even the smallest misstep must be reported to several entities. Ours certainly isn’t the only industry facing tremendous expectations when it comes to prioritizing the importance of cybersecurity in business, either. It’s become mission-critical across the board.

    There can be a surprising upside to so much rigidity and concern, though. If you’re doing a great job and implementing the strongest, most reliable cybersecurity solutions for businesses, you have the opportunity to make your protocols a differentiator. When customers see “social proof” of something, they tend to trust what they see. Yet, you can’t tap into this social proof if you don’t control all your cybersecurity business elements, and that includes how proactive and protective your partners act with your shared data.

    Lowering risk exposure starts from the inside

    As mentioned above, we’re in the financial services world. To maintain our license, we must use advanced data encryption tools and technologies. Encryption is essential during the process of buying currency online because so much personal information moves back and forth, including a high degree of money-related data like bank routing numbers.

    We also must follow BSA/AML compliance guidelines to the letter, just like any financial institution. Therefore, we have a BSA compliance officer who handles all compliance coordination, monitoring and oversight. The BSA compliance officer serves as a critical player in assuring regulatory entities, board members, customers and the public that we’re doing what needs to be done when it comes to lowering our risk exposure.

    Opening a money service business like ours is difficult. After taking so many steps and performing intense due diligence, we’re understandably careful about the partners we choose. You should be, too, as one bad apple can ruin the entire bunch.

    Related: Five Ways to Protect Your Company Against Cyber Attacks

    Know exactly who you’re doing business with

    All companies — especially MSBs, or money service businesses — need to be vigilant and put strategies in play to reduce the chances of a breach. A lot goes into building such a comprehensive, cohesive protection plan. Running online business transactions on a private server and implementing data encryption processes are the minimum requirements to get off the ground, but that’s just the start.

    Beyond those necessary action items, companies of all sizes should consider leveraging the following methods to make certain that anyone with access to even a sliver of your data believes in safety as strongly as you do:

    1. Vet each partner on basic compliance

    Foundational elements to review thoroughly include having up-to-date security certificates, performing detailed security audits, using a VPN to fully protect browsing data and getting federal agency approval when necessary. If a potential partner is cutting compliance corners — intentionally or otherwise — you’d be better off continuing the search until all of your concerns are alleviated. Don’t settle for less than the best.

    It’s important to treat each potential partner with the same level of due diligence, as threats and attacks can come from small startups and big corporations alike. The Verizon Business 2022 Data Breach Investigations Report found that 62% of “system intrusion” incidents originated with an organization’s partner. And the Ponemon Institute reported that 54% of organizations were “not monitoring the security and privacy practices of third parties that they share sensitive or confidential information with on an ongoing basis.”

    That’s hugely concerning. Opportunistic cybercriminals are always looking for the weakest link in the supply chain, after all.

    2. Check for third-party verification

    In the complicated digital reality we all live in, honesty can be at a premium. This can be especially true when verifying the real identity of a person — or the motives of a potential vendor. Enter third-party providers who use a variety of tactics to drill down to the actual, accurate identities of customers who might attempt to make a financial transaction or businesses that want to join forces. These third-party testers do the thankless work of monitoring platform security and infiltration.

    My company, Xchange of America, uses a third-party verification service to authenticate customer identities by specific inputs. A series of four random verification questions that only the true person would know are asked, such as the make and model of previous vehicle(s) owned, street names where the customer previously lived and previous employer(s). Confirming these unique details keeps nefarious actors at bay and prevents sales fraud.

    Different industries will perform third-party verifications differently than ours, but the importance is the same for every company. Do your partners employ thorough third-party verification tactics? Stipulate that they do.

    Related: Authentication Technology is Shaping Vendor Partner Verification and Onboarding

    3. Demand full transparency

    What happens if you start to ask questions of your partners and run into brick walls? This may be an indication that they’re not being forthright. You want partners who welcome questions because they have nothing to hide. For example, all money service businesses like ours must be registered and licensed in the states we operate in. If a potential partner is required to have certain registrations, licenses or permits and doesn’t, that’s a major red flag.

    Be persistent when it comes to getting the compliance answers you seek. Don’t be hesitant to ask pointed follow-up questions, such as how data encryption works at a partner’s company. Data breaches can be thwarted if information is always encrypted, whether it’s in motion or in storage.

    Dropbox is an example of a company that takes data encryption (and protection) seriously. According to Dropbox’s help center, files at rest are encrypted using 256-bit Advanced Encryption Standard (AES). The company also uses Secure Sockets Layer (SSL)/Transport Layer Security (TLS) to protect data in transit between Dropbox apps and its servers, among many other layers of protection.

    Related: Cybersecurity Trends and Drivers in 2022

    You deserve to know the level of data encryption of any associated organization, not just that they have “some kind of encryption.” Dropbox’s transparency in that regard should serve as the rule, not the exception.

    As long as cybercriminals are willing to hack into systems, corporate leaders and their teams must find and remove their cybersecurity vulnerabilities. Just make sure that you’re not just looking at ways to improve your own cybersecurity. Insist that all companies you do business with also treat it as a pressing priority.

    [ad_2]

    Robert Hoffman

    Source link

  • Planning Center Demonstrates Data Security as the First Major Church Management Software Company to Achieve SOC 2 Compliance

    Planning Center Demonstrates Data Security as the First Major Church Management Software Company to Achieve SOC 2 Compliance

    [ad_1]

    Press Release
    –

    Nov 15, 2022 07:00 EST


    CARLSBAD, Calif., November 15, 2022 (Newswire.com)
    –
    Planning Center, a leading company in church management software, has officially completed a Service Organization Control (SOC 2) audit of their systems, processes, and policies to confirm the safety and security of their customers’ data.

    SOC 2 is the standard in information security, and Planning Center is the only major church management system to comply. With this compliance, churches can confidently trust Planning Center to keep their highly personal and sensitive data as protected as possible—children’s check-in locations, financial data, prayer requests, and more.

    Planning Center demonstrated their protection of churches’ data through stringent testing by a third party. The SOC 2 audit included a review of Planning Center’s policies, backup and disaster recovery, incident response, firewall configurations, and other critical areas of their business such as confidentiality and privacy. To maintain their status, they will continue to monitor internal systems and meet security benchmarks year after year. 

    SOC 2 compliance is part of Planning Center’s ongoing dedication to data security. This summer, they announced the release of two-step verification login for their products and they continue to pursue the strongest data security measures possible. 

    Learn more about SOC 2 and Planning Center’s commitment to best security practices from the blog announcement, and request a copy of their completed SOC 2, Type 2 report on their security page. 

    About Planning Center: Planning Center provides over 76,000 churches with an all-in-one church management system—tools to help them get organized by processing donations, coordinating events, scheduling volunteers, checking children in, and much more. They also offer a custom mobile app for congregations to connect through group chat, a digital directory, live-streamed service, and other custom content. Their flagship product, Planning Center Services, is the leading production tool for volunteer scheduling, worship planning, and rehearsing. For more information, visit planningcenter.com.

    Source: Planning Center

    [ad_2]

    Source link

  • Your Documents Aren’t Safe. Here Are the Best Practices for Document Security

    Your Documents Aren’t Safe. Here Are the Best Practices for Document Security

    [ad_1]

    Opinions expressed by Entrepreneur contributors are their own.

    With the advent of 5G technology and Industry 4.0 putting more pressure on businesses to fast-track their digital transformations, the demand for document-management solutions has exploded. The worldwide market for document-management software is projected to reach $10.17 billion by 2025. Along with this revolution comes inherent concerns about properly securing all this information. Documents often contain sensitive and private information that, if compromised, could be detrimental to individuals, businesses or governments. That is why companies need to incorporate the highest levels of document-management security.

    Related: Keep Your Information Moving At The Speed Of Your Business

    Don’t wait to secure digital documents

    With the continued release of new vulnerabilities regularly and the ease at which a digital document can be compromised — compared to a physical piece of paper — ensuring the security of those documents has become more important than ever to keep private information from being exposed.

    It is common to read the news and learn about a new security breach. Impacting small and large companies, nearly 2000 data breaches occurred in the first half of 2022 alone. To many companies, their data is among their most valuable assets, so it must be protected.

    Ransomeware, a form of malware designed to encrypt files and deny users access to them until a demand ransom is paid, is one clear threat. Phishing attacks, where hackers try to get account credentials (username and password), represent an ongoing and ever-evolving danger. Hackers typically lay low for a time, then eventually start logging in as that user so as not to draw suspicions. Then they download documents that the user can access or, if sophisticated enough, attack network administrator privileges.

    Just who is trying to hack into systems to get documents? Anyone who can find value in the type of data a company possesses. Hackers typically don’t know the type of data a company possesses until they get their hands on corporate documents or know enough about a company to recognize the types of information that might be available, such as financials or employee personally identifiable information (PII). It’s really any documents that they can use for profit.

    What to look for in a document-management partner

    Numerous outsourced document-management vendors exist in the marketplace today, and not all are created equal when it comes to offering the highest levels of security. Below are four necessary security features to look for from a document-management partner:

    1. End-to-end chain of custody and tracking: It’s important to know who has had access to both physical and digital documents. Chain of custody is crucial throughout a document’s life cycle. Any access should be logged so that you can see who opened a particular document, when and what their reason was. Partners should be able to show audit and chain-of-custody logs. This also helps ensure that only people with the proper privileges can access particular documents — and no one else.
    2. Disaster recovery, failover, redundancy, and guaranteed access: With a reduction in paper documents, systems and processes need to be in place to ensure that your digital documents are accessible in the event of a single point of failure. At the partner’s data center, if the internet goes down, you still should have a backup, redundant way to access those docs. Partners should be able to provide written reports that show testing on an ongoing basis along with results, so you feel confident that if disaster strikes, you know the failover will work properly.
    3. Compliance with industry standards: Compliance standards, such as PCI for credit card information, HIPAA for health information and SOC 2 Type II for policies and processes, ensure complete accountability for the security and related processes around any document. Compliance usually involves an independent third-party assessment to ensure that partners are following industry guidelines, performing the necessary tasks and have the appropriate controls in place to ensure the highest levels of security. Partners should be able to provide evidence of certifications, indicating they meet the necessary compliance standards for the types of documents that you’re storing.
    4. Utilization of a “continuous ongoing compliance” model: One of the drawbacks of compliance is that it’s an annual assessment, so sometimes companies get lax throughout the year — then get ready just at compliance time. Partners should be able to demonstrate compliance not only at assessment time but also throughout the year.

    Related: How To Develop Security Policy For Your Company

    Best practices companies can implement

    In addition to wanting the best technology solutions to help facilitate the digitization of documents, companies should also make security a top priority. Whether you have a Chief Security Officer, Chief Technology Officer, Head of IT or are working with a third-party service provider, there are several best practices that companies themselves should implement to ensure they’re doing their part to secure their digital documents:

    • Make security a primary, proactive focus and not an afterthought;
    • Perform a complete audit of all access to and actions taken on each digital document;
    • Ensure proper data classification, retention, and destruction protocols are established and followed;
    • Test and document disaster-recovery and business-continuity solutions;
    • Run regular vulnerability scans of the environment and remediation of all critical vulnerabilities found;
    • Hold recurring security-awareness training with 100% required staff participation; and
    • Conduct regular chain-of-custody and security audits to ensure best practices are being followed and documented.

    To obtain the highest levels of security for digital documents, collaboration on strategy should involve all stakeholders — including document-management providers, IT, security and operations.

    [ad_2]

    David Winkler

    Source link

  • Save 25 Percent on This Keychain-Sized Flash Drive and Keep Your Files Safe

    Save 25 Percent on This Keychain-Sized Flash Drive and Keep Your Files Safe

    [ad_1]

    Disclosure: Our goal is to feature products and services that we think you’ll find interesting and useful. If you purchase them, Entrepreneur may get a small share of the revenue from the sale from our commerce partners.

    Any entrepreneur who has been around a while knows the importance of getting organized. (New entrepreneurs: get organized!) But organization is more than just knowing where things are on your desk or what file cabinet you put last year’s tax return in. It’s about getting your digital life organized, as well, so you can always access files when you need them.


    Tech Essential

    Your devices don’t have the storage space you need to keep all of your important files. Cloud services are a great asset, but when you need to quickly move files between devices, you need them handy in an instant — without having to reset logins or passwords. You need a high-quality external drive, and the miniature Slim Profile Flash Drive fits the bill.

    This cute little drive weighs in at just six grams, fitting elegantly on your keychain while adding barely any weight to your everyday carry. But don’t be fooled by its size, it still packs an impressive 64GB of storage space, allowing you to save photos, videos, and files on a handy little device that you can bring with you everywhere. You never know when you might need it, after all!

    The stylish gunmetal drive blends in nicely with everything else on your keychain and is USB 2.0-compatible, so it will work on virtually any Mac, music players, and more. It offers high-speed transfer rates so you can easily and quickly move files between devices whenever you need to.

    Being an entrepreneur is all about organization, but don’t limit that idea to just your home office or desk space. You need to organize your digital life, as well, and the Slim Profile Flash Drive can help. For a limited time, you can get this 64GB drive for 25 percent off $19 at just $14.99.

    Prices subject to change.

    [ad_2]

    Entrepreneur Store

    Source link

  • Planning Center Increases Data Security by Releasing Two-Step Verification Login

    Planning Center Increases Data Security by Releasing Two-Step Verification Login

    [ad_1]

    Press Release
    –

    Jul 28, 2022


    CARLSBAD, Calif., July 28, 2022 (Newswire.com)
    –
    Planning Center, a leading company in church management software, announced this week the release of two-step verification login for its products. 

    Churches store sensitive, personal, and valuable information about their congregation in their Planning Center accounts — from contact information and financial data to children’s locations, medical notes, prayer requests, and much more.

    Two-step verification enables churches to add an extra layer of security to protect the data in their Planning Center account by requiring administrators to enter a case-sensitive password and a security code to log in. 

    Anyone who can log in to Planning Center has some level of access to this extremely private information, and thus shares some of the power and responsibility of protecting that data. Planning Center’s role is to ensure its software is built, maintained, and supported as securely as possible. Two-step verification login is a tool churches can use to further participate in keeping their accounts secure.

    This news comes shortly after Planning Center’s recent announcement that the company is SOC 2 Type I compliant. “At Planning Center, we’re committed to equipping our churches with tools to protect their congregations’ data from those who would use it for harm. We’ll continue to push forward every product feature, policy, process, and procedure to keep our churches on the cutting edge of what’s possible in data privacy and security,” said Jeff Berg, founder and CEO of Planning Center. 

    Learn more about Planning Center’s security practices on its security page, and read the announcement of two-step verification on the company’s blog. 

    About Planning Center: Planning Center provides over 73,000 churches with an all-in-one church management system — tools to help them get organized by processing donations, coordinating events, scheduling volunteers, checking children in, and much more. The company also offers a custom mobile app for congregations to connect through group chat, a digital directory, live-streamed service, and other custom content. Its flagship product Planning Center Services is the leading production tool for volunteer scheduling, worship planning, and rehearsing. For more information, visit planningcenter.com.

    Source: Planning Center

    [ad_2]

    Source link