Our Blog

Nowadays, businesses rely heavily on email as their main communication tool between other businesses and their customers. With over 270 billion emails sent and received each day, email is an important form of communication that we all use daily for our work and in our personal lives. However, inboxes are constantly under attack. Phishing emails and malware are easily sent through email and can attack your system if it is not properly protected. According to Verizon 2018 Data Breach Investigations Report, 92.4% of malware is delivered via email. Therefore, email is the #1 method for hackers to send malware to a user. With email being such a high target for phishing attacks and malware, protecting your company’s email system is crucial.

ICC offers a product called Proofpoint Essentials that can help stop phishing emails from disrupting your email system. Compatible with Office 365, this additional SPAM filter will help catch phishers and email fraud. It can control all aspects of inbound and outbound email and adds an extra level of protection to your email system.

Proofpoint Essentials quarantines suspicious emails and then sends the user an email to let you preview, approve, or block emails. It is an added layer of protection for you and your email system. Realizing that SPAM filters cannot be 100% effective and an email or two may slip through the cracks, ICC can train you and your employees to identify and properly deal with potential threats.

More than 90% of targeted attacks begin with email, and an email attack can have significant effects on downtime, productivity, data loss, or even financial loss. For a few dollars a month, you can protect your business and employees from email threats, or you can have your emails encrypted to further protect the content from unintended eyes and to make sure it reaches the correct recipient.

Overall, 76% of organizations say they experienced phishing attacks in 2017, according to Wombat 2018 State of the Phish. By the end of 2017, the average user was receiving 16 malicious emails per month (Symantec 2018 ISTR). That’s almost 200 potential attacks to one email address per year!

The email SPAM filter is just one component of protecting your email and your organization. If you are looking for more information on the Proofpoint Essentials product or additional ways to protect your email system, reach out to Integrated Computer Consulting (ICC) today! 970.821.8592.

Disaster recovery is an important topic in the IT world. Companies rely on their IT systems to conduct business. What happens if critical systems go offline due to a hardware failure, a malware infection, an operating system crash or a natural disaster?

One hour of downtime can cost small companies as much as $8,000, midsize companies up to $74,000, and large enterprises up to $700,000. (2015 report from the IT Disaster Recovery Preparedness (CRP) council).

Will you be prepared to handle the situation and continue with daily business transactions?

Are you prepared to handle one of these likely scenarios?

65% of small and medium-size businesses don’t have a disaster recovery in place. 87% of companies that lose access to their corporate data for more than a week go out of business within a year. (Markel direct).

Disaster recovery focuses on all aspects of a business that allows it to keep functioning. That is why it is so important to have a plan in place to avoid downtime and losing money.

Work with your local IT professional such as ICC, to lay out the following steps and to create your own personalized disaster recovery plan. Some of the critical steps include:

• Starting with an overview and goals of your plan. Identify critical systems to the business.
• Determine recovery time and recovery point objectives.
• Document systems and inventory current equipment
• Document outside vendors and their response plan
• List actions to be taken once an event occurs
• Implement a 3-2-1 backup plan
• Create a client list and plan how you will notify them
• Document insurance and legal contacts
• Create a media outreach plan

Talk with ICC today about your business’ personalized disaster recovery plan and consider moving your system to the cloud. Cloud benefits include lower cost, boosting efficiency, and you can access it from anywhere If you have any questions, feel free to chat us at iccusa.net or give us a call at 970.419.060.

The philosophy, “If it ain’t broke, don’t fix it” can be very expensive when it comes to your IT. If you are relying on break-fix (as needed) IT services, you are probably wasting money and risking valuable downtime. The challenge is that it’s impossible to predict when something will break which could lead to downtime or, even worse, data loss. This leads to an unstable and truly unpredictable budget. That why an ICC IT professional can help you be more strategic about prevention and resolution for your services.

Our Catapult or Managed services (proactive support) offers 24/7 system monitoring, application updates, patch management, data security, and support to prevent problems from occurring in the first place. ICC holds quarterly business reviews to stay on top of any issues and manage the status of your services. Managed services not only provide a stable budget allocation but also detailed reporting of your network status. Paying a monthly fee for an ICC IT professional to handle your IT infrastructure not only minimizes productivity disruptions, but it also frees you to focus on doing what you do best: growing your business.

ICC has been serving the IT needs of Northern Colorado and Southern Wyoming for 20 years. Let us show you the ICC difference.

Simple Ways to Keep Your Information Safe

Cyber-attacks are more common now than ever, and we want to make sure you are prepared if it happens to you or your business. Here are a few helpful and simple ways to protect yourself from Cyber Security Threats.

1. Wi-Fi – Make sure your business and even your home has a segmented guest and internal wi-fi network. Your main network should always be separated from a guest network. Visitors to your business should log onto your guest network so there isn’t a chance for them to access any information being shared on your main network. As for kids at home, they should be using the guest network in case they download bad apps or files that could be harmful to your main network.
2. Data Backup – Is your data backed up? If someone at your company is a victim of a phishing email or has downloaded a corrupted file, hackers may steal your data and hold it ransom. This is a form of a cyber threat called ransomware. Oftentimes, a fee is requested from the cyber criminals in order to un-encrypt your data. Some hackers may return your data for a sum of money and others will keep it even though you paid the ransom. In this case, a cyber security insurance company is knowledgeable on hackers and can help assist you with the right plan of action.
3. Two Factor Authentication – Two Factor Authentication is an extra layer of security that requires a username, password, and a second type of verification for access. A unique code is usually sent to your email or through text to give you access to a system or files.
4. Strong Passwords – Creating unique and strong passwords is an easy way to help guard your personal information from intruders. The complex variety of characters, letters and numbers will help keep hackers at bay. If you keep your passwords in a notebook or on sticky notes, it is time for an upgrade! There are multiple cloud-based services that allow you to store all your passwords in once place instead of in an Excel file on your computer or on a piece of paper.
5. Antivirus and Malware Protection – Antivirus protection is a program that prevents, detects and removes viruses that are designed to replicate and spread. Malware protection helps stop malicious code and other unwanted viruses, spyware, trojans and more. Always make sure your software is up to date so that you are protected. If you have questions about which type or brand of software your company needs, ICC is here to help.
6. Human Error – The majority of cyber-attacks occur because of human error. Phishing emails are a popular form of cyber-attacks. Be sure to inspect the sender’s email address and company name in the email to ensure that it is not an imposter. Never respond or click a link in an email to provide financial or private information to anyone. Watch for files asked to be downloaded or links included in emails that may download a virus or malware to your system. Be alert, and if something doesn’t feel right about the email, do not take any action. Delete it immediately.

For more information on cyber security protection, reach out to our knowledgeable staff at ICC today! 970.373.4879.

With Device Guard, Credential Guard, and Application Guard, Windows uses virtualization to provide unprecedented protection from malware and advanced persistent threats.

Three years after its debut, Windows 10 is poised to overtake Windows 7 as the most popular version of the Windows operating system. Microsoft introduced virtualization-based security features – namely Device Guard and Credential Guard – in Windows 10, and in subsequent updates, has added other virtualization-based protections to the operating system.

Microsoft tackled the two biggest challenge for enterprises with Windows 10, password management and protecting the operating system from attackers. Windows Defender was renamed Windows Security in 2017 and now includes anti-malware and threat detection, firewall and network security, application and browser controls, device and account security, and device health. Windows Security shares status information between Microsoft 365 services and interoperates with Windows Defender Advanced Threat Protection, Microsoft’s cloud-based forensic analysis tool.

Device Guard and Credential Guard remain the two standout security features of Windows 10 – they protect the core kernel from malware and prevent attackers from remotely taking control of the machine. Microsoft has also grouped other virtualization-based protections such as Windows Defender Application Guard under the Windows Security umbrella. Windows Defender Advanced Threat Protection round out the analytics available to Windows 10 Enterprise customers.”Clearly, Microsoft thought a lot about the kind of attacks taking place against enterprise customers and is moving security forward by leaps and bounds,” said Ian Trump, a security lead at LogicNow.

Device Guard relies on Windows 10’s virtualization-based security to allow only trusted applications to run on devices. Credential Guard protects corporate identities by isolating them in a hardware-based virtual environment. Microsoft isolates critical Windows services in the virtual machine to block attackers from tampering with the kernel and other sensitive processes. With Application Guard, Microsoft Edge opens untrusted websites in an isolated Hyper-V enabled container, keeping the host operating system protected from potentially malicious sites. These features rely on the same hypervisor technology already used by Hyper-V.

Using hardware-based virtualization to extend whitelisting and protecting credentials was a “brilliant move” by Microsoft, said Chester Wisniewski, senior security strategist for Sophos Canada, an antivirus company.

Apps on lockdown

Device Guard relies on both hardware and software to lock down the machine so that it can run only trusted applications. Applications must have a valid cryptographic signature from specific software vendors — or from Microsoft if the application comes from the Windows Store. Device Guard assumes that all software is suspicious and relies on the enterprise to decide which is trusted.

Although there have been reports of malware code writers stealing certificates to sign malware, a significant majority of malware is unsigned code. The reliance of Device Guard on signed policies will block most malware attacks.

“It is a great way to protect against zero-day attacks that make it by anti-malware defenses,” Trump said.

Three years after its debut, Windows 10 is poised to overtake Windows 7 as the most popular version of the Windows operating system. Microsoft introduced virtualization-based security features – namely Device Guard and Credential Guard – in Windows 10, and in subsequent updates, has added other virtualization-based protections to the operating system.

Microsoft tackled the two biggest challenge for enterprises with Windows 10, password management and protecting the operating system from attackers. Windows Defender was renamed Windows Security in 2017 and now includes anti-malware and threat detection, firewall and network security, application and browser controls, device and account security, and device health. Windows Security shares status information between Microsoft 365 services and interoperates with Windows Defender Advanced Threat Protection, Microsoft’s cloud-based forensic analysis tool.

Device Guard and Credential Guard remain the two standout security features of Windows 10 – they protect the core kernel from malware and prevent attackers from remotely taking control of the machine. Microsoft has also grouped other virtualization-based protections such as Windows Defender Application Guard under the Windows Security umbrella. Windows Defender Advanced Threat Protection round out the analytics available to Windows 10 Enterprise customers.”Clearly, Microsoft thought a lot about the kind of attacks taking place against enterprise customers and is moving security forward by leaps and bounds,” said Ian Trump, a security lead at LogicNow.

Device Guard relies on Windows 10’s virtualization-based security to allow only trusted applications to run on devices. Credential Guard protects corporate identities by isolating them in a hardware-based virtual environment. Microsoft isolates critical Windows services in the virtual machine to block attackers from tampering with the kernel and other sensitive processes. With Application Guard, Microsoft Edge opens untrusted websites in an isolated Hyper-V enabled container, keeping the host operating system protected from potentially malicious sites. These features rely on the same hypervisor technology already used by Hyper-V.

Using hardware-based virtualization to extend whitelisting and protecting credentials was a “brilliant move” by Microsoft, said Chester Wisniewski, senior security strategist for Sophos Canada, an antivirus company.

Isolating secrets

Credential Guard may not be as exciting as Device Guard, but it addresses an important facet of enterprise security: It stores domain credentials within a virtual container, away from the kernel and user mode operating system. This way, even if the machine is compromised, the credentials are not available to the attacker.

Advanced persistent attacks rely on the ability to steal domain and user credentials to move around the network and access other computers. Typically, when users log into a computer, their hashed credentials are stored in the operating system’s memory. Previous versions of Windows stored credentials in the Local Security Authority, and the operating system accessed the information using remote procedure calls. Malware or attackers lurking on the network were able to steal these hashed credentials and use them in pass-the-hash attacks.

By isolating those credentials in a virtual container, Credential Guard prevents attackers from stealing the hash, restricting their ability to move around the network. Credential Guard protects NTLM password hashes, Kerberos Ticket Granting Tickets, and credentials stored by applications as domain credentials from attackers.

Run in containers

Windows Defender Application Guard gives enterprise administrators the ability to control how Microsoft’s Edge browser identifies and blocks dangerous websites. Edge opens untrusted sites in an isolated Hyper-V enabled container, keeping the host operating system protected from potentially malicious sites. The isolated container has no user data, so the attacker in that virtual environment can’t obtain the user’s credentials. Once enabled, Application Guard will let enterprises block outside websites, limit printing, restrict the use of the clipboard and isolate the browser to only use local network resources.

Originally available for Windows 10 Enterprise, Application Guard now also supports Internet Explorer for Windows 10 Pro versions, provided the hardware requirements are met.

“Microsoft’s Implementation may not be as easy as some vendors, and Microsoft may not have a fancy dashboard, but to include security features like these [Credential Guard, Device Guard, Microsoft Hello two-factor authentication, and BitLocker] you have an operating system worthy of the title ‘Enterprise’ and a very hard target to hack,” Trump said.

Windows 10 – Not yet for everyone

Exciting features aren’t enough to spur adoption. Many businesses have held off on upgrading to Windows 10. The reluctance stems from the substantial investment required upfront, from better hardware and new Group Policy settings. However, the latest shift to Windows 10 reflects the reality that Windows 7 will enter end-of-life in January 2020 and even with support windows being extended, organizations have to plan their hardware refresh to support Windows 10.

The combination of Device Guard and Credential Guard could go a long way toward locking down an environment and stopping APT attacks, but the hardware requirements are hefty. To enable Device Guard and Credential Guard, the machines need Secure Boot, support for 64-bit virtualization, Unified Extensible Firmware Interface (UEFI) firmware, and the Trusted Platform Module (TPM) 2.0 chip. The UEFI lock, which prevents attackers from disabling UEFI by modifying the registry, is also recommended. Enabling Credential Guard on virtual machines have additional requirements, including 64-bit CPU, CPU virtualization extensions plus Extended Page Tables, and Windows Hypervisor. Application Guard requires being on a 64-bit machine, with Extended Page Tables (also called Second Level Address Translation, SLAT), as well as Intel VT-x extensions or AMD-V.

Only enterprise hardware, not consumer PCs, includes such features. For example, business laptops such as Lenovo ThinkPad and Dell Latitude models typically have these specs, but consumer models such as the Lenovo Yoga 3 Pro do not. The hypervisor-level protections are available only if the machine has a processor with virtualization extensions, such as Intel VT-x and AMD-V.

Other Windows 10 security features have different hardware requirements. Windows Hello, which supports face and fingerprint recognition, would typically need additional hardware. Windows Hello now supports FIDO 2.0 authentication for Windows 10 devices that are managed by Azure Active Directory, and there is now the option to use Windows Hello Face, Fingerprint, or PIN options from the main log-in screen.

Employees regularly working in the field or traveling extensively throughout the year are more likely to opt for a lighter laptop — and most Ultrabooks do not have TPM inside. “The executives are the ones I worry about,” Wisniewski said, as they’re the ones most at risk of attack and more likely to be using consumer models.

The hardware isn’t the only barrier to getting started; most organizations will also need to make changes to infrastructure and processes. Many IT teams don’t currently use UEFI or Secure Boot because they impact existing workflows and there are some single sign-on platforms that don’t play well with UEFI. IT may be concerned about getting locked out of computers with Secure Boot; it’s easier to wipe a machine and load a stock corporate image when setting it up. Likewise, some machines may run critical applications with specific requirements that cannot be upgraded.

Fortunately, Device Guard and Credential Guard don’t require an all-or-nothing decision. IT can build a new domain with Device Guard and Credential Guard protections turned on and move users who meet the hardware requirements. The machines that can’t be upgraded can be left in the existing domain. This lets IT maintain a “clean” network with signed policy and protected credentials and focus their attention on the older, “dirty” domains. “Don’t hold the entire network back for just one thing,” Wisniewski said.

Microsoft also recognizes that many organizations have a hybrid environment with different Windows versions. Very few can claim to have moved their entire infrastructure to Windows 10. Windows Defender ATP was originally available only with a Windows E5 or Microsoft Office 365 E5 subscription, but now there is down-level support for Windows 7 SP1 and Windows 8.1. Heterogenous organizations can get access to the advanced forensics.

Few enterprises believe the current state of enterprise Windows security is acceptable. Device Guard and Credential Guard actually offer a way forward, albeit one that demands a substantial investment. With Windows 10, “Microsoft is telling enterprises, ‘If you want good technology you need to do security [our way],'” Wisniewski said.

Source: Computerworld (https://www.computerworld.com/article/2984449/security/why-windows-10-is-the-most-secure-windows-ever.html )

During the week of Black Hat and Defcon, tens of thousands of security experts and hackers flock to Las Vegas for the back-to-back conferences. They hold discussions on issues like smart cities getting hacked, two-factor authentication, and security issues with voice assistants.

It can all get a little technical. But with so much cybersecurity knowledge in one place, I decided to ask individual experts for a single useful cybersecurity tip for the average person.

One of these tips may end up making all the difference when a hacker comes after you. Learning a little about how to protect yourself is increasingly critical at a time when hacker attacks on companies like Equifax and Yahoo can expose your personal information. But cybersecurity advice tends to be technical or inconvenient, which is why a lot of people tend to ignore it.

Think about how many 32-character passwords you really have, or how often you reuse your passwords. It’s a Cybersecurity 101 practice, but might not be simple for everyone. As a parallel, think about how often dentists say you should floss twice every day, and how you lie every time by saying that you do.

“Security people are rarely the best people to advise about mass usability,” Parisa Tabriz, Google’s director of engineering, said in her keynote speech at the Black Hat cybersecurity conference Aug. 8.

So here’s our roundup of advice on cybersecurity from the experts at Black Hat and Defcon. See for yourselves which tips you think are actually usable.

Parisa Tabriz, director of engineering at Google

Use Chrome.

I’m obviously biased, but Chrome stays up-to-date, and there are a lot of things we build in to keep people from ever encountering a phishing site or a site that’s going to download malware. We definitely invest in making it the most secure browser from an exploitation standpoint.

Think about the software you’re using in the same way that you’d look at a safety report for a car you’re going to buy.

Marcela A. Denniston, vice president of field engineering at ShieldX Networks

Use dual-factor authentication and biometrics as often as possible to make gaining access to personal accounts, systems and data more difficult for hackers.

Mårten Mickos, CEO of HackerOne

Cybersecurity works only when everybody is concerned about it. Learn about it, ask your friends what they’re doing, and have a daily discipline of thinking, “What could go wrong?”

Craig Williams, director of outreach at Cisco Talos Intelligence Group

Set things to automatically patch. It would probably take care of 85 percent of your problems. That goes for your computers, your IoT devices — anything that has a button.

Stina Ehrensvärd, CEO and founder at Yubico

Two-factor authentication is my obvious answer, but just some basic simple learning around what not to do and what to do is important. Learn to watch for phishing, don’t download stupid things, just some hygiene.

If you start there, and then have two-factor authentication, you’re gonna be really good.

Jonathan Couch, senior vice president of strategy at ThreatQuotient

Don’t trust anything. Or trust, but verify. Most attacks these days come from email, or you’re getting phone calls all the time. Before you take any action to give any money, give any personal information, you should trust but verify.

Don’t take people at their word at who they are over email or over the phone. Get some information, go out, do your own research and make sure you actually verify who this person is before you ever give away any personal information — or especially money.

Haiyan Song, senior vice president of security markets at Splunk

Be super vigilant. I send my team to Defcon, and I tell them to just go there, even if they don’t understand some of the talks. I want them to listen to these stories because I want them to feel paranoid.

Mikko Hyppönen, chief research officer at F-Secure

Back up your phone, back up your computer, back up your tablet, then make a backup of your backup so you can restore them even if your house burns down.

Patrick Sullivan, director of security at Akamai

If you have to use a password, and you’re not using something like a multifactor solution, take a look at a password manager. That makes it pretty easy to log in to sites and have a variety of passwords.

Chris Wysopal, chief technology officer at CA Veracode

Be skeptical about any information that’s pushed to you, whether it’s a messaging system or an email system. Just always be skeptical and always find another way of figuring out how to validate that that stuff is real.

Daniel Crowley, research director at IBM X-Force Red

The weakest link is definitely passwords. Expecting someone to remember 200 passwords that are 30 characters, mixed with numbers and symbols, is impossible. While we’re still using passwords, use a password manager.

Hyrum Anderson, technical director of data science at Endgame

This is what I tell my mom: Hover before you click so you see the actual URL at the bottom. Be suspicious of email, install an antivirus, install a DNS filter so you don’t have porn accidentally served to you. You present the greatest point of vulnerability to your safety.

Frank Mir, former UFC heavyweight champion*

Keep your passwords diverse and don’t use the same one for everything. Once I did that, I don’t think I ever had any problems. Just making sure I didn’t pick any simple passwords, and not using the same ones multiple times over. At times it can be a pain in the ass, trying to remember 30 different ones or keeping them in a safe place, but in the long run, it’s given me a lot fewer headaches.

For my children, for every device, whether it’s a Microsoft account all the way to their PlayStation account, use different passwords.

* Yes, we know Frank Mir is not a cybersecurity expert. But he did give some pretty good advice.

Souce: CNet.com

Chrome 68 for Windows, macOS and Linux takes another step toward differentiating between secure and non-secure websites.

Google this week released Chrome 68 for Windows, macOS and Linux, patching 42 security flaws, adding new APIs for developers and marking sites relying on HTTP as “Not Secure.”

Chrome updates in the background, so users can usually just relaunch the browser to install the latest version. To manually update, select “About Google Chrome” from the Help menu under the vertical ellipsis at the upper right; the resulting tab either shows the browser has been updated or displays the download-and-upgrade process before presenting a “Relaunch” button. New-to-Chrome users can download it from this Google site.

The Mountain View, Calif. company updates Chrome every six or seven weeks. It last upgraded the browser on May 27.

Turns on ‘Not Secure’ warning

The biggest change to Chrome with the debut of version 68 was the new warning labels set into the address bar. While sites whose traffic is encrypted – marked by the HTTPS at the beginning of the URL – will be marked as “Secure,” those transmitting data via the unencrypted HTTP will be tagged as “Not Secure.”

This campaign of Google’s to call out HTTP websites as unsafe began four years ago, with incremental steps toward that goal since. In January 2017, for example, Chrome 56 shamed pages that didn’t encrypt password or credit card form fields with the “Not secure” label.

This latest move will not be the last, Google has promised. In early September, with Chrome 69, the browser will remove the “Secure” tag from sites using HTTPS so that encrypted traffic is considered the default. Google’s 180-degree turn from browsers’ decades-long signage – marking secure HTTPS sites, usually with a padlock icon, to indicate encryption and a digital certificate – to labeling only those pages that are insecure, will wrap up this year. In October, with the launch of Chrome 70, the browser will tag HTTP pages with a red “Not Secure” marker when users enter any kind of data.

As usual, Google adds APIs and plugs security holes

Chrome 68 sports some behind-the-scenes newness as well, which is standard for the browser’s updates.

Google highlighted several new APIs (application programming interfaces) in notes to developers, including the Page Lifecycle API and the Payment Handler API.

Kong.

The former API, Page Lifecycle, offers site and web app developers a way to restore a tab that, for performance reasons, had previously been “frozen” by the browser to conserve resources, including memory and processor load. When the user then returns to the tab, it can be resumed as if nothing had happened.

Payment Handler, on the other hand, lets web-based payment app makers tie into the already-available online checkout infrastructure built into Chrome.

Google also patched 42 security vulnerabilities in version 68, including five marked as “High,” the second-most serious ranking in the company’s four-step system. Google shelled out $21,500 to researchers for reporting 19 of the bugs, with several bounties still to be decided.

Chrome’s next upgrade, version 69, will start reaching users the week of Sept. 2-8.

Source: Computerworld.com

What is a social engineering attack?

In a social engineering attack, an attacker uses human interaction (social skills) to obtain or compromise information about an organization or its computer systems. An attacker may seem unassuming and respectable, possibly claiming to be a new employee, repair person, or researcher and even offering credentials to support that identity. However, by asking questions, he or she may be able to piece together enough information to infiltrate an organization’s network. If an attacker is not able to gather enough information from one source, he or she may contact another source within the same organization and rely on the information from the first source to add to his or her credibility.

What is a phishing attack?

Phishing is a form of social engineering. Phishing attacks use email or malicious websites to solicit personal information by posing as a trustworthy organization. For example, an attacker may send email seemingly from a reputable credit card company or financial institution that requests account information, often suggesting that there is a problem. When users respond with the requested information, attackers can use it to gain access to the accounts.

Phishing attacks may also appear to come from other types of organizations, such as charities. Attackers often take advantage of current events and certain times of the year, such as

• natural disasters (e.g., Hurricane Katrina, Indonesian tsunami)
• epidemics and health scares (e.g., H1N1)
• economic concerns (e.g., IRS scams)
• major political elections
• holidays

How do you avoid being a victim?

• Be suspicious of unsolicited phone calls, visits, or email messages from individuals asking about employees or other internal information. If an unknown individual claims to be from a legitimate organization, try to verify his or her identity directly with the company.
• Do not provide personal information or information about your organization, including its structure or networks, unless you are certain of a person’s authority to have the information.
• Do not reveal personal or financial information in email, and do not respond to email solicitations for this information. This includes following links sent in email.
• Don’t send sensitive information over the Internet before checking a website’s security. (See Protecting Your Privacy for more information.)
• Pay attention to the URL of a website. Malicious websites may look identical to a legitimate site, but the URL may use a variation in spelling or a different domain (e.g., .com vs. .net).
• If you are unsure whether an email request is legitimate, try to verify it by contacting the company directly. Do not use contact information provided on a website connected to the request; instead, check previous statements for contact information. Information about known phishing attacks is also available online from groups such as the Anti-Phishing Working Group.
• Install and maintain anti-virus software, firewalls, and email filters to reduce some of this traffic. (See Understanding Firewalls, Understanding Anti-Virus Software, and Reducing Spam for more information.)
• Take advantage of any anti-phishing features offered by your email client and web browser.

What do you do if you think you are a victim?

• If you believe you might have revealed sensitive information about your organization, report it to the appropriate people within the organization, including network administrators. They can be alert for any suspicious or unusual activity.
• If you believe your financial accounts may be compromised, contact your financial institution immediately and close any accounts that may have been compromised. Watch for any unexplainable charges to your account.
• Immediately change any passwords you might have revealed. If you used the same password for multiple resources, make sure to change it for each account, and do not use that password in the future.
• Watch for other signs of identity theft. (See Preventing and Responding to Identity Theft for more information.)
• Consider reporting the attack to the police, and file a report with the Federal Trade Commission.

Author

US-CERT Publications

Source: us-cert.gov

Microsoft and Walmart are teaming up for a strategic partnership that will take on rival Amazon in both technology and retail. Walmart is announcing today, at Microsoft’s Inspire partner conference, that it’s partnering with Microsoft to use the company’s cloud services. The five-year agreement will see Walmart use Azure and Microsoft 365 across the company, alongside new projects focused on machine learning, artificial intelligence, and data platforms.

Walmart is Amazon’s biggest retail competitor, and Microsoft is Amazon’s largest cloud services rival. That rivalry isn’t lost on Microsoft CEO Satya Nadella, who hinted in an interview with The Wall Street Journal that it’s “absolutely core to this” new partnership. “How do we get more leverage as two organizations that have depth and breadth and investment to be able to outrun our respective competition,” says Nadella.

While the tech partnership will obviously benefit both companies, it also comes just weeks after reports suggested Microsoft is working on rival Amazon Go technology for cashier-free stores. Microsoft is reportedly in talks with Walmart for this technology, and the software maker has hired a computer vision specialist from Amazon. Amazon’s Go store in Seattle uses multiple camera and sensors that use computer vision algorithms to detect what items you’re taking out of the store so you’re automatically charged. Microsoft is reportedly experimenting with attaching cameras to shopping carts to track items.

Both Walmart and Microsoft don’t reference too many of the future-facing parts of this strategic deal, and it’s mostly timed for Microsoft’s big partner conference in Las Vegas this week. However, this new deal could be a unique test ground for Microsoft’s bigger AI ambitions and any future plans it has to push other retailers to use its range of cloud services.

Source: Theverge.com

Intel wants its Low Power Display Technology to become nearly ubiquitous sometime next year.

Nearly lost in the flood of Intel announcements at Computex—Intel’s 28-core chip, the 8086K Anniversary Edition, and more—was something a bit more fundamental: the development of 1-watt display panels, which will have a profound impact on battery life.

Intel said it is working with Innolux and Sharp to develop what it calls its Low Power Display Technology, which optimizes the display technology, including the backlight and panel circuitry, to halve power from a typical power consumption of about two watts down to a single watt. They’ll be optimized for Intel’s U- and Y-series processors for ultrabooks and ultra-low-power devices.

In the real world, that could extend battery life by as much as four to eight hours, according to Josh Newman, the general manager of mobile innovation segments for Intel. For laptops whose batteries already last a dozen hours or more, it could push the laptop’s stamina to levels that approach 20 hours or more depending on the existing battery, Newman explained.

Fortunately, Intel’s Low Power Display Technology doesn’t appear to change the fundamental nature of the panel themselves. Intel showed off prototype laptops from Dell and HP with the LPDT panel technology already installed. It sounds like those laptops will still be able to project all the light output users need—350 nits or so. What’s unknown (and probably unlikely) is whether you’ll be able to run at full brightness and still achieve the longest battery life.

Newman said the first systems with the display technology installed would appear on store shelves this holiday season. It’s unclear whether LPDT panels will affect the prices of the laptops themselves—that’s up to notebook makers, Newman told PCWorld.

Intel’s been facing pressure from Qualcomm on the battery front, as its Snapdragon-powered Always Connected PCs emphasize connectivity and long battery life—specifically 20 hours or more, the same range Intel is targeting. With Intel beginning to push 5G-equipped PCs forward in conjunction with low-power technologies like LPDT, it’s going to be a close fight. That’s good news for consumers, who will ultimately benefit.

Source: PCWorld.com