The Shocking Facts About The New FTC Safeguards Rule That Affect Nearly EVERY Small Business Operating Today

The Shocking Facts About The New FTC Safeguards Rule That Affect Nearly EVERY Small Business Operating Today

As former President Ronald Regan once said, the scariest words you’ll ever hear are “We’re from the government, and we’re here to help.”

In this case, the government is trying to help by forcing nearly all businesses to implement and maintain a strong cyber security program to protect the customer information these companies host – definitely not a bad thing, and all businesses should take this seriously without the government mandating it.

Sadly, the majority of small businesses don’t take cyber security seriously enough and believe they are doing enough to prevent a cyber-attack when they aren’t, which is why the government is having to step in and create laws (the GLBA Act) to enforce better security protocols.

What Is The New FTC Gramm-Leach-Bliley Act Safeguards Rule And Who Does It Apply To?

Back in April of 2022, the FTC issued a new publication entitled “FTC Safeguards Rule: What Your Business Needs to Know.” This was published as a “compliance guide” to ensure that all companies that fall under the Safeguards Rule maintain safeguards to protect the security of customer information.

While you might think your business is “too small” to need to comply or doesn’t hold any data “that a hacker would want,” you’ll be shocked to discover you are likely to be wrong on both fronts.

Hacking groups use automated bots to randomly carry out their attacks – and small businesses are their #1 target due to the gross negligence and inadequate protections they have. You are low-hanging fruit. That’s why it’s not only the obvious organizations, such as CPAs, financial institutions and credit unions, that need to comply. Here’s a short list of just a few of the organizations that fall under this new law. You should know that this is NOT a complete list:

  • Printers that print checks or other financial documents.
  • Automotive dealers who provide financing for car purchases.
  • Any organization that accepts credit or loans for the goods and services they sell, whether or not the credit is granted.
  • Companies that do tax preparation or credit counseling of any kind.
  • Real estate settlements, services or appraisals.
  • Career counselors that provide services to people employed by or recently displaced from a financial organization.

As you can see, the companies that must comply are growing rapidly. Bottom line, if you handle any kind of financial data or personally identifiable information, you need to make sure you are complying with these new standards.

What You Need To Do Now

The rule requires you to implement a “reasonable” information security program. But what does that mean? For starters, you need to designate a qualified individual to implement and supervise your IT security program – and you cannot outsource this. Yes, you can and should get a professional IT firm like us to guide you on the implementation, but the buck still stops with you.

The person you designate doesn’t have to have a background in IT or cyber security – but they will be the person responsible for ensuring your company is taking reasonable precautions to comply with the new security standards.

Second, the Safeguards Rule requires you to conduct a risk assessment to initiate an effective security program. From there, you would work with your IT company (us!) to roll out a plan to secure and protect the data you have by putting in place access controls, encryption, data backups, 2FA and a number of other protections.

Cyber security is not something you do once – it’s an ongoing effort of protection as new threats evolve. If you want to see where your organization stands on cyber security, click here to sign up for a quick, easy and completely free Cyber Security Risk Assessment. That is the first step toward complying and will give you the information you need to know about your own security stance.

Techspert’s Holiday Schedule

Techspert’s Holiday Schedule

Happy 4th! – Stay Alert 

In observance of our great July 4th national holiday, Techspert will be closing early on Monday, July 3rd at 2pm and returning to the Matrix on Wednesday July 5th for business as usual! 

Happy 4th of July! 

I’d love for that to be the end of this message, but, unfortunately, I am emailing you because there’s been an uptick in cybercrime, hacking and ransomware, which may have resulted from recent world events. 

Our security team is keeping an eye on the situation. 

But here’s the thing. Hackers know that people are going to be celebrating and vacationing over the holiday weekend. That means we all need to be extra vigilant. 

 

Here’s a few simple things that could make a huge difference: 

Please take care when checking email. 

Don’t click on links, or open attachments you do not expect. 

Made a mistake? 

We’re all human and it happens. If you think you’ve clicked a link by mistake, even if it appears that nothing happened, contact our service desk for assistance immediately.  

And as always, Think Before You Click! 

Thank you, and if there are any questions, please let us know, by forwarding this email to [email protected] or calling our office at (330) 441-4426. 

 

Have a great day and thank you for giving us the privilege of serving you! 

Building a Security Culture

Building a Security Culture

Creating a security culture in your organization should be part of the overall culture within your workplace. Having a security culture in your organization encourages everyone in the organization to take an active part in maintaining cyber security in the workplace.  

Techspert Data Services is the company with a mission to educate customers on the importance of security culture in the workplace. When you create a culture of security, everyone in the organization benefits from cyber security in the workplace.  

You can reduce cyber threats and risk to your organization by creating a security culture in your organization. Having an effect on the security culture of your company is no easy task but maintaining security precautions online can help your company avoid cybercrime and malicious attacks.  

Building a Security-Oriented Community  

Making sure to build a security-oriented community within your organization is one of the initial steps to building a security culture in your organization. When you build a security culture within your organization, you boost the impact of that culture across the entire organization. The top organizations in a country encourage security practices in the workplace. They also have attributes of the business culture that enable employees to actively participate in creating a security culture within your organization.  

Our cyber security services are in line with the broader business culture as they work to build a security-oriented community within your organization. At the highest level of an organization, building a security culture within your organization enables everyone in the organization to benefit. Promoting cyber security in the workplace builds the kind of security culture that provides an additional layer of security for your organization.  

A Blame Culture Encourages Poor Security  

Letting a culture of blame fester within your organization enables poor security to impact your organization. Part of the overall culture of any organization involves aspects of the security culture. Having a blame culture within your organization negatively impacts everyone in the organization. However, when you work to reverse blame with a culture of security, your organization benefits from aspects of the security culture that reduce operational costs and keep everyone in your organization safe.  

Having a blame culture within your organization goes against the attributes of the business culture that protect your company’s assets. Aiding and abetting a blame culture poses a real risk to your organization. A blame culture has a negative effect on your security and is out of line with the broader business culture surrounding security practices. However, promoting cyber security in the workplace has a positive effect on your security culture in the organization.  

Training Staff to Be Security Deputies  

You can train your staff to be security deputies in order to further promote the creation of a security culture in the organization. This can have a positive effect on your security and the security culture you aim to promote in your organization. Training your staff to become security deputies for your organization reduces the security risk to your organization from malicious attacks and a lack of security precautions.  

Promoting cyber security in the workplace can help train your staff to become security deputies who aim to promote security culture across the entire organization. Training employees to become security deputies should be a part of the overall culture within your organization. Training your staff to become security deputies is the perfect fit for enterprise-sized organizations looking to reduce operational costs and increase workplace security precautions.  

By promoting the creation of a security-oriented culture across the entire organization, your company benefits from a culture of security and a positive effect on the existing security culture in the organization. When you create a culture of security, your organization is impacted by the positive effect on the culture across the entire organization. Techspert Data Services aims to promote cyber security in the workplace to benefit your company.  

The Importance of Security Culture  

The importance of a security culture within your organization cannot be overstated. When security is a part of the overall culture encompassing your organization, everyone in the organization benefits. When you create the kind of security culture that promotes cyber security in the workplace, it has a positive effect on the security culture in the organization. The top organizations in a country promote cyber security in the workplace.  

Failing to build a security culture within your organization poses risk to your organization. Don’t let blame culture, which is out of line with the broader business culture, have an effect on your security. When you’re asking how to create a culture of security awareness within your organization, you need to have examples of a strong security culture to base your definition of security on.  

The top organizations of a country all have strong levels of security awareness, and their organization is positively impacted by the resulting effect on the security in the organization. Providing a security culture within your organization is fairly simple and easy to do. Promoting cyber security in the workplace is one of the initial steps for successfully creating a security culture within your organization.  

Final Thoughts 

Techspert Data Services aims to provide a positive effect on the security culture in your organization. We offer cyber security in the workplace to keep your company safe online, and everyone in the organization benefits when your company’s personal information is kept secure. Our services create the kind of security culture that is in line with attributes of the business culture surrounding cyber security and risk elimination. 
When you have a culture of security, your organization is less prone to malicious attacks and online threats. Our company’s cyber security services are the perfect fit for enterprise-sized organizations, and our services create a security culture across the entire organization by having an effect on the security culture. Everyone in the organization benefits when security precautions are taken seriously. Call now! 

 

Don’t Be Fooled!

*** TDS Newsflash ***

Don’t Be Fooled ! 

I want to give a prime example of a specific type of phishing email that may have you pondering, “There’s no link in the email so probably not phishing, and I don’t want to be charged for something I don’t use so I should give them a call since I don’t exactly know what this is about.” Or something like that.  Take a look:

Dear Client,
We’re delighted that you’ve chosen to work with Geek Solutions once more.
Your Geek Solutions Computer Annual Maintenance Services (Account Id: 79648348) will expire on August 11, 2021, as a reminder. We processed the contract for automatic renewal on August 12, 2021, as specified in the contract. As a result, your approved bank account has been charged $199.99. These charges will reflect in your bank account within 24 hours.

You can reach us by phone at +1(626) 489-2521 between the hours of 10 a.m. and 6 p.m., as well as 6 p.m. Please contact us if you need to change or cancel your subscription.

Best wishes,
Team Geek Solutions
+1(626) 489-2521 

Well this is what you’d classify as a pre-vishing email!  Vishing is when a bad actor will use a phone conversation (“V” for voice) to attempt to steal information from you.  If you were to call the number, they’d start by asking for your name and number, then the account ID (to make it all sound official), then they’ll tell you your account was charged.  When you mention you don’t know what it’s about, they’ll ask for your bank account number—or possibly the FIRST so-many numbers if they’ve come upon stolen information that already contained the last so-many digits—and after you mistakenly give it to them and other information you’ve already surrendered…you can guess what could happen next.  Don’t’ be fooled!

And as always, Think Before You Click or Call!

Thank you, and if there are any questions, please let us know, by forwarding this email to [email protected] or calling our office at (330) 441-4426.

Have a great day and thank you for giving us the privilege of serving you!

Adam Siemienski

CEO, Techspert Data Services

Main: 330-441-4426

Support Email: [email protected]

websiteportal

 

Scam of the Week: Text Phishing !

Scam of the Week: Text Phishing !

*** TDS Newsflash ***

Scam of the Week: Text Phishing !

<<from our friends at SANS ISC InfoSEC, by Johannes B. Ullrich, Ph.D. , Dean of Research, SANS.edu:

Many companies have extensive security tools to monitor employee computers.  But these precautions often fail for “out of band” access that uses cellular networks instead of Ethernet/WiFi networks. Our reader Isabella sent us this phishing email that they received:

Dear User,
This is to let you know that our web-mail server will be upgraded and maint=
ained soon.

If you don't want your e-mail account to be terminated during the upgrade,

Send "[redacted]" to 6-0-5-5-5-5-1-1-1-1. [altered]

You will receive instructions on how to upgrade your account via text messa=
ge.

If you do not comply with the above, your email access will be disabled.
Please accept our apologies for any inconvenience this may cause.

Regards
System Administrator
[redacted]

Note that the phone number is somewhat obfuscated, likely to protect it from tools inspecting email or network traffic.  The user is asked to send an SMS.  While SMSs may travel across WiFi networks in some cases, they are usually not accessible to network protection devices.   In this case, the user received a link next:

Text Phishing example

The user is not likely going to click on the link using a mobile device, lessening the risk of discovery to the attacker.  The target URL is no longer available, but Isabella reported that the link leads to a phishing page.

The attack was somewhat targeted in that the attacker used consistent branding for the code to be sent.  It included the short-form of the organizations name which is why I redacted it above. Even the target domain used (which is no longer reachable to me), “http://micro365upgrade.com” was plausible for an Office 365 upgrade.

And as always, Think Before You Click!


Thank you, and if there are any questions, please let us know, by forwarding this email to [email protected] or calling our office at (330) 441-4426.

Have a great day and thank you for giving us the privilege of serving you!

Adam Siemienski

CEO, Techspert Data Services

Main: 330-441-4426

Support Email: [email protected]

websiteportal