Seras News

U.S. Warns that Cyber Attacks may be Imminent: What can you do to Protect your Business?

Seras is committed to ensuring that our customers are protected and ready to handle any cyber-related threat that comes their way.  We help businesses all over Columbia, Lexington, and Irmo install and configure their computer networks, but we also work hard to keep them efficient and protected in the future using a variety of tools and scheduled activities that ensure their success. 

With the current turmoil ensuing in Eastern Europe regarding the Russian invasion of Ukraine, there has been a shift in focus in the technology industry towards securing all weak points to prevent Russian interference of U.S. public and private communications networks.  The White House alongside the F.B.I. and CISA (the cybersecurity and infrastructure security agency), have therefore issued several warning notices for American business owners to be mindful of while they fortify their networks against potential Russian state-sponsored black hat cyber actors.

The FBI and CISA recommend organizations remain cognizant of the threat of state-sponsored cyber actors exploiting default MFA protocols and exfiltrating sensitive information. Organizations should:

• Enforce MFA for all users, without exception. Before implementing, organizations should review configuration policies to protect against “fail open” and re-enrollment scenarios.
• Implement time-out and lock-out features in response to repeated failed login attempts.
• Ensure inactive accounts are disabled uniformly across the Active Directory, MFA systems etc.
• Update software, including operating systems, applications, and firmware on IT network assets in a timely manner. Prioritize patching known exploited vulnerabilities, especially critical and high vulnerabilities that allow for remote code execution or denial-of-service on internet-facing equipment.
• Require all accounts with password logins (e.g., service account, admin accounts, and domain admin accounts) to have strong, unique passwords. Passwords should not be reused across multiple accounts or stored on the system where an adversary may have access.
• Continuously monitor network logs for suspicious activity and unauthorized or unusual login attempts.
• Implement security alerting policies for all changes to security-enabled accounts/groups, and alert on suspicious process creation events (ntdsutil, rar, regedit, etc.).
— https://www.cisa.gov/uscert/ncas/alerts/aa22-074a

CISA goes on later in the article to include a list of best practices and recommendations for business owners to implement to further reduce the risk of malicious cyber attacks.

Security Best Practices

• Deploy Local Administrator Password Solution (LAPS), enforce Server Message Block (SMB) Signing, restrict Administrative privileges (local admin users, groups, etc.), and review sensitive materials on domain controller’s SYSVOL share.
• Enable increased logging policies, enforce PowerShell logging, and ensure antivirus/endpoint detection and response (EDR) are deployed to all endpoints and enabled.
• Routinely verify no unauthorized system modifications, such as additional accounts and Secure Shell (SSH) keys, have occurred to help detect a compromise. To detect these modifications, administrators can use file integrity monitoring software that alerts an administrator or blocks unauthorized changes on the system.

Network Best Practices

• Monitor remote access/ RDP logs and disable unused remote access/RDP ports.
• Deny atypical inbound activity from known anonymization services, to include commercial VPN services and The Onion Router (TOR).
• Implement listing policies for applications and remote access that only allow systems to execute known and permitted programs under an established security policy.
• Regularly audit administrative user accounts and configure access control under the concept of least privilege.
• Regularly audit logs to ensure new accounts are legitimate users.
• Scan networks for open and listening ports and mediate those that are unnecessary.
• Maintain historical network activity logs for at least 180 days, in case of a suspected compromise.
• Identify and create offline backups for critical assets.
• Implement network segmentation.
• Automatically update anti-virus and anti-malware solutions and conduct regular virus and malware scans.

Remote Work Environment Best Practices

With an increase in remote work environments and the use of VPN services, the FBI and CISA encourage organizations to implement the following best practices to improve network security:
• Regularly update VPNs, network infrastructure devices, and devices used for remote work environments with the latest software patches and security configurations.
• When possible, implement multi-factor authentication on all VPN connections. Physical security tokens are the most secure form of MFA, followed by authenticator applications. When MFA is unavailable, require employees engaging in remote work to use strong passwords.
• Monitor network traffic for unapproved and unexpected protocols.
• Reduce potential attack surfaces by discontinuing unused VPN servers that may be used as a point of entry for attackers.

User Awareness Best Practices

Cyber actors frequently use unsophisticated methods to gain initial access, which can often be mitigated by stronger employee awareness of indicators of malicious activity. The FBI and CISA recommend the following best practices to improve employee operations security when conducting business:
• Provide end-user awareness and training. To help prevent targeted social engineering and spearphishing scams, ensure that employees and stakeholders are aware of potential cyber threats and delivery methods. Also, provide users with training on information security principles and techniques.
• Inform employees of the risks associated with posting detailed career information to social or professional networking sites.
• Ensure that employees are aware of what to do and whom to contact when they see suspicious activity or suspect a cyberattack, to help quickly and efficiently identify threats and employ mitigation strategies.
— https://www.cisa.gov/uscert/ncas/alerts/aa22-074a

These items are quite complex and can be overwhelming to most businesses. Seras is here to help navigate these suggestions and figure out how to incorporate them into your IT infrastructure. Our team of knowledgeable, friendly technicians works hard to make changes as painless as possible and work in alignment with your goals for success. To request more information or a free assessment, email us at ithelpdesk@serasIT.com or click here.

Hundreds of Documented Service Requests Resolved Free of Charge in 2020!

Many new hires often remark, “Seras doesn’t sell a product, we fix computers.” This could not be farther from the truth. While our vendors, such as Dell, sell computers or servers, the unique features that make up your experience with Seras encompass “our product”. We are more than just computer repair and support services in Columbia SC…

Unique Classroom Creation from your Computer Guys

How many computer guys have you seen stomping around in the mud on a big horse farm? Our team helps customers with all types of computer, network, server, and cloud-based projects every day; and we always love the opportunity to give back to our community at least a couple of times per year! Although much of our services are provided around Columbia, West Columbia, Lexington, and other greater-Columbia markets, this particular project took place in Chester County. Our favorite part was probably hearing the success stories from staff: from veterans with PTSD that began to sleep through the night to non-verbal autistic children that began speaking after only a few short sessions! Don’t forget to check out the before and after pictures…

As Offices Return to Normal Operations, Are Your IT Systems Configured for Optimal Productivity?

Seras IT provides IT services to clients all over the great state of South Carolina. We provide services such as network management to troubleshooting connectivity issues to folks from Northeast to Newberry, and to Charleston and everywhere in between

Working From Home: The Six Morning Habits of High Performers

Seras provides IT services and solutions to folks from Northeast, Irmo, Lexington, Downtown, and many other places across South Carolina. We at Seras have been exploring a variety of topics related to working from home during the COVID-19 pandemic. Topics ranging from security practices when working remotely to firewall and VPN tutorials.

Best Security Practices For Working From Home

Due to the Covid-19 pandemic businesses have had to be pro-active in ensuring the safety and health of their employees and their customers. Many businesses have been forced to shut down. Many have had to be creative in finding a workaround enabling their employees to be productive even if they’re quarantined. To do so many have been pushed towards working from home. But a company can’t just do this without taking proper security measures and planning. If they don’t they leave themselves vulnerable to the threats to their network.