Collaboration in Office 365–The Possibilities

Posted out on Microsoft’s TechNet blog I found an article discussing things that you can do to within the Office 365 environment that allows for different kinds of data sharing with both internal users (those users who are part of your Microsoft Office 365 tenant) and external users (those that belong to other Office 365 tenants).

What is an Office 365 tenant?

The term “tenant” is purely technical. In an ideal scenario, a single company would sign up for a single Office 365 tenant. Imagine a tenant as an equivalent of a closed on premise setup within which you have all your services running.

A single tenant will have all your users, groups, resources, data, subscriptions, licenses etc.

But we have also seen companies going for multiple tenants – especially if they have entities that are (or need to be) “separate” either from an IT or legal perspective.

Even then we would normally recommend having a single tenant for a single company, wherever possible. Why? Because tenant boundaries limit collaboration capabilities and bring in (IT) barriers between two users that you would normally expect to have between users in two separate companies (or organizations). Your global IT administrator’s credentials are effective only within the tenant boundaries. And, if you own a vanity domain name (like “Microsoft.com”) – you can only use it in a single tenant of Office 365, i.e. users in two separate tenants cannot have email addresses or login addresses ending with the same domain name.

The article provides a lot of insight and ideas on how to use your Office 365 account, and if you haven’t taken the leap yet, this may provide some ideas of why you should.

Ransomware that’s 100% pure JavaScript, no download required

SophosLabs just alerted us to an intriguing new ransomware sample dubbed RAA.

This one is blocked by Sophos as JS/Ransom-DDL, and even though it’s not widespread, it’s an interesting development in the ransomware scene.

Here’s why.

Ransomware, like any sort of malware, can get into your organisation in many different ways: buried inside email attachments, via poisoned websites, through exploit kits, on infected USB devices and occasionally even as part of a self-spreading network worm.

But email attachments seem to work best for the cybercrooks, with fake invoices and made-up court cases amongst the topics used by the criminals to make you think you’d better open the attachment, just in case.

In 2015, most ransomware arrived in Word documents containing what are known as macros: script programs that can be embedded in documents to adapt their content in real time, usually as part of your company’s workflow.

The problem with macros, however, is that they aren’t limited to adapting and modifying just the document that contains them.

Macros can be full-blown programs as powerful as any standalone application, and they can not only read and write files on your C: drive and your local network, but also download and run other files from the internet.

In other words, once you authorize a macro to run, you effectively authorize it to install and launch any other software it likes, including malware, without popping up any further warnings or download dialogs.

You can see why cybercrooks love macros!

Click here to read more…

How to stay protected against ransomware

Here is a Sophos Whitepaper describing ways to protect yourself and your organization against ransomware attacks.

This document explains how to react quickly and effectively to the threats posed by ransomware such as Cryptowall, TeslaCrypt and Locky.

It first details the mechanisms that these infections use to find their way into companies and why a large number of new infections continue to surface despite existing protective measures.

It then provides practical recommendations to protect against them, showing how these threats can be tackled using short-term and longterm technical
and organizational measures.

It also includes optimal configuration settings for Sophos solutions to protect against ransomware.

Get this Flash Update Now

Security update. Naked Security Published a flash update notification yesterday that you will want to update your computer with if you are using Flash. Here is a link to the article if you want more information…

SharePoint and OneDrive in the cloud

An important part of Office 365 is the ability to store, manage and share information from a central location in the cloud. Here is a brief video describing some of the enhancements Microsoft has made to these products recently.

SharePoint and Office 365

If you have subscribed to Office 365 with either Microsoft’s Small Business Essentials, Premium or any of their Enterprise Level products then you have SharePoint available to you. The following video gives you some insight into some of the things that you can use SharePoint for and make it another useful tool for your organization.

Have you thought about Cyber Insurance?

When putting together all of the pieces that you need to be able to recover from a security attack have you left anything out? It might be Cyber insurance.

When we are designing a system to mitigate the harm from a Cyber Attack we look at multiple factors. First you need a solid firewall that is being updated to keep its security functions as current as possible. Secondly you need protection on your workstations with malware/antivirus protection (endpoint protection). If you choose the right vendor and the right products from the right vendor you can have these two security points synchronizing their support. This provides an extra layer of protection that you don’t find in other vendor’s products. Sophos is the only company out their that has this kind of synchronized security and the integration of all the products providing this is just on the horizon.

Second, you need a backup solution that provides a full image of your network. This allows you to dial back time to be able to restore to a point that dates prior to your attack/infection. If you don’t have this some of the attacks can cause you to do a full restore of the system and to then have to recreate your data if you don’t have it backed up.

So how do you pay for all of this labor to get you back to normal after an attack. Along comes Cyber Insurance. What is Cyber Insurance? I was reading an article from TechCrunch that defined it as follows:

Cyber insurance is a sub-category within the general insurance industry, offering products and services designed to protect businesses from internet-based risks. Although forms of cyber insurance policies have been around for the past 10 years, market awareness has recently increased exponentially, in part because of the headline-grabbing cyber breaches that have hit almost every industry.

Asking your Insurance Company about Cyber Insurance may cause you to look into increasing you front line defenses before they will cover you. You will need to comply with their basic security requirements before they write the policy. This will be an additional expense to you to become compliant. So it is important to choose the right products and be doing the right procedures to ensure that you are providing yourself the best security that you can.

This is why security has become one of our main focal points. It is really getting scary out there.

For more information on Sophos Synchronized Security down these papers:

• How to Stay Protected against Ransomware
• Sophos Server Protection
• Next-Generation Endpoint Protection Explained
• Security Heartbeat
• Synchronized Security and Security Heartbeat
• Synchronized Security: A Revolution in Protection

How to keep up productivity with cloud computing.

While the article that I would appoint you to is actually “How to keep up productivity when freelancing, with cloud computing", I think we can all take bits and pieces of this and apply them to our daily work life as well. You don't have to be a freelance worker to see some of the benefits that you would have from leveraging cloud computing components. I think this is a great article to take note of to see how many of the new millennial members of our society probably be working in the future. They are more attuned to using the devices to be connected to each other and it is not a far reach make as part of their work life as well. This is a great lesson on how to be able to be working from anywhere, anytime that suits you. Something as I get older is part of my wish list. I'd love to hear what your thoughts are on this.

TechNet Blogs posts:Four ways to keep your kids safer online

It is in the news all the time it seems that someone is bullied or some tragedy has occurred because of online bullying and abuse.

With a significant number of young people using the internet compared to their adult counterparts, and over 80% of teens regularly using a cell phone, chances are your children are vulnerable to online dangers.

Whether it’s your child joining the more than 50% that have experienced cyber bullying, or falling victim to malware attacks, being online can be a risky place for children.

Take a look at their article.

If you want to subscribe to Sophos’s Blog’s

RSS Reader

You may also subscribe in your preferred RSS/Atom feed reader, using the links below.

UTM 9
RSS
ATOM

XG Firewall
RSS
ATOM

Sophos SFOS 15.01.0 MR-3 Released

Our own Matt Shafer just posted to us that Sophos has just pushed out a new maintenance release for the XG firewall, including a number of fixes for open issues.

Please direct your customers to the Sophos Community Blog for XG Firewall to review the release notes and share their feedback.

As a reminder, our communications plan for all maintenance releases like this is to publish notifications and release notes on the Sophos Community Blog, so we encourage everyone, such as yourselves and customers, to subscribe to the blog – you'll get immediate notifications via email whenever an XG Firewall or UTM firmware update is available. Complete instructions on how to subscribe are located in this blog article.

Download full release notes: Sophos XG Firewall V15.0.1.0 MR3 Release Notes.pdf

If you’re wondering how to do firmware updates or roll-backs on your XG Firewall, we’ve got a new video for you, covering everything you need to know to keep your firewall up to date.

New Lenovo Phones for anyone interested

Our own Michael Hunter posted two links about the new Lenovo Phone products offerings:

The Modular Moto Z Range Has Arrived

Project Tango Comes to Mobile With The Lenovo Phab 2 Range

Windows Store is a disaster

Windows Store is a "disaster?" That's what one source close to Microsoft says, dishing out a number of troubling comments about Microsoft's cross-platform play ambitions.

https://www.youtube.com/watch?v=kun6sXUCqRM

Another issue with WAZE

I had read an earlier article about how to prevent Snoops from stalking you in Waze with “ghost” drivers on Naked security that discussed an paper published by a team of researchers from the University of California at Santa Barbara claiming they can track a Waze driver’s exact route using thousands of simulated “ghost” vehicles in the app.

If you’re not familiar with Waze, it’s a Google-owned app that relies on crowdsourcing as people report accidents, traffic jams, and speed and police traps, while its online map editor gives drivers updates on roads, landmarks, house numbers, and the cheapest nearby fuel.

Naked Security has a take on another problem that has been reported with this Google Application. It appears a quiet neighborhood in Takoma Park, Maryland has been invaded by drivers trying to find a shortcut around a construction area. One of the residents then tried to turn the tide by posting bogus traffic data to trick the app into sending motorists away from his area.

He lasted about two weeks before Waze kicked him out for reporting bogus data. Take a look at the article it has a lot if interesting detail.

Good discussion on Password Security

Our own Carnegie Mellon’s Security and Privacy Institute tested a group of people to determine their understanding of what makes a strong password. Naked Security’s ArticleNaked Security’s Article posted yesterday discusses this and the main thing that I took from the article is the following:

CyLab’s respondents knew passwords are more secure when you:

• Capitalize the middle of words rather than the beginning
• Place digits and symbols in the middle rather than the end
• Use random digit sequences instead of obvious ones, like years
• Choose words other than common first names
• Avoid words that are personal to you, like your child’s name
• Avoid words that are obviously related to the site or account you’re trying to protect

So when you are creating a new password to secure a site you may want to take direction from above.

Here is a video from Naked Security on how to pick a proper password:

Has TeamViewer been compromised?

There is been a lot of discussion here at the office lately about whether or not TeamViewer has been hacked, so I have been keeping my eye out for any confirmation from some of the sources that I trust as to whether or not this actually has happened. One of the sources I trust is Sophos’s Naked Security Blog has finally come out with a an article discussing this.

The article discusses what TeamViewer does and how it's being compromised will affect you if you are using this application. Click on the link above to see the full article.

ArsTechnica three days ago posted a report that confirms there was a number of abused user accounts and that the number is significant as reported by TeamViewer themselves.

On Sunday, TeamViewer spokesman Axel Schmidt ack he nowledged to Ars that the number of takeovers was "significant," but he continued to maintain that the compromises are the result of user passwords that were compromised through a cluster of recently exposed megabreaches involving more than 642 million passwords belonging to users of LinkedIn, MySpace, and other services.

TeamViewer thinks that the compromise  that they use another applications  comes from individuals reusing passwords that have been compromised.They are suggesting that you use the two factor authentication to control any type of issue with the accounts that are using this program. This is a smart thing to do in any case with almost any application that you are using.Take a look at the ArsTechnica article to get the more in depth view conversation that they had with  the people at TeamViewer.

Newspaper Companies suing Adblocker Companies

Specifically, the NAA says in its complaint, adblocker companies mislead consumers by positioning their products as a way to block “bad ads” based on opaque rules for acceptable ads, when in fact adblocker companies like Adblock Plus allow some advertisements to be displayed if the advertiser pays Adblock Plus a fee.

Check out the Naked Security Article

Should You Take Advantage of Microsoft’s FREE Windows 10 Upgrade?

There are quite a few questions that you will have to ask yourself before you should pull the trigger. With the deadline coming up the end of July, 2016, You have just a short time to make your decision before it costs you money to do the upgrade instead of being free.

1. Can my hardware take advantage of Windows 10? If your hardware isn’t capable of taking advantage of Windows 10 then maybe you should do your upgrade by purchasing new hardware. It obviously will cost you money to do this but if your system was an entry level device when you purchased it, and it is 4+ years old then you may be in this category. Minimum requirements are not always acceptable performance levels. Here is what Microsoft says are for Windows 10 System Requirements.
2. Will my software work with Windows 10? This is a big issue especially in a business environment. Do you have legacy software that performs poorly or not at all in a Windows 10 machine? While you might want to jump onto this new operating software, your application software might not work. How will that affect your job and the things that you need to do? Obviously in the best of all worlds your software will be compatible but this might not be the case. Take for instance the number of “Cloud-Based Applications” that we now use that require a specific browser to be able to work correctly. You would think that with the application being online it would always be up-to-date and be able to take advantage of newest and greatest operating systems. Not the case, especially in the financial industry where things move at a slow crawl. So, you need to look at all of the applications that you are using before flipping the switch and make sure that they will work in Window 10.
3. What is it going to take to learn Windows 10? If you find yourself not adopting will to change, or your users are of the ilk, then this has to be a real consideration. If you are running in a WIndows 7 environment you have until 2020 before EOL sets in for you. That’s almost four years before you will forced to do something. If you are running Windows 8.0, I think that it is a “NO BRAINER”, jump and upgrade. You’ll be much happier especially with the how Microsoft has compromised between the Windows 7 interface and the Windows 8. But for a lot of people, change is hard. You want to keep what is familiar to you at hand. But, if everything else is pointing you to make the change, do so. It really isn’t that bad and there are some real advantages especially if you are running a laptop with a touchscreen.
4. Support? Do you have a support network to help you through the transition? Not everyone has a tech department to fall back on. While we do offer these services, they are not necessarily cheap. There are many online videos that can help you transition and learn the little nuances of the operating system and there are plenty of books available as well. If you have been around computers for awhile then you are not a stranger to change I’m sure.

With all of these things in mind and you want to make the leap, this is the time to do it. Make sure you have good backups before starting the process and follow the instructions exactly. Microsoft has a booklet that will help you through the process located right here.

Adobe Revel Closing EOL

If you were using Adobe’s Revel to save documents to the service is going to be gone after June 24th, 2016.  Adobe just sent out notification that you will lose any pictures that are still stored on the service after this date. So you will want to be sure that you download what you have there before it goes away. Click on the Download to my computer link here.

AVG EOL Support for some of their products

Important notice

We're ending support for our older security products

You are under attack from increasingly sophisticated malware and ransomware. AVG strives to offer the best protection. We're ending support for our older desktop security products and updating customers to our 2016 version for FREE for the remainder of their license term to provide them with our latest protection.
With baked-in AI Detection and Real-Time Outbreak Detection technology, our 2016 antivirus products earned a 6/6 Protection score from AV-Test.org and offer improved malware, spyware, and ransomware protection. They're also fully compatible with the newest version of Windows®.

Which products are affected? Support en ds for the following products on Oct. 31, 2016:

• AVG AntiVirus FREE (versions 9.0, 2011, & 2012)
• AVG AntiVirus (versions 9.0, 2011, & 2012)
• AVG Internet Security (versions 9.0, 2011, & 2012)
• AVG AntiVirus Business Edition versions 9.0, 2011, & 2012)
• AVG Internet Security Business Edition versions 9.0, 2011, & 2012)
• AVG Email Server Edition (versions 9.0, 2011, & 2012)
• AVG File Server Edition (versions 9.0, 2011, & 2012)

Support ends for the following products on Dec. 31, 2016:

• AVG AntiVirus FREE (versions 2013 & 2014)
• AVG AntiVirus (versions 2013 & 2014)
• AVG Internet Security (versions 2013 & 2014)
• AVG AntiVirus Business Edition (version 2013)
• AVG Internet Security Business Edition (version 2013)
• AVG Email Server Edition (version 2013)
• AVG File Server Edition (version 2013)
• AVG Remote Administration (versions 2013 & earlier)

What happens when support ends? After support has ended, the above products will no longer be available for download, and no further virus definition updates, bug fixes, maintenance, or technical support will be provided. Some security features may also stop working.

What should you do? Before support ends, we'll attempt to push a FREE UPDATE to all customers to automatically upgrade them to the newest version of their product. If you don't receive the update, or would prefer to update at your own convenience, you can also download our newest version here for free.