How to protect company mobile devices

/in /by

How to protect company mobile devices

Cybersecurity has long been paramount for businesses that utilize digital solutions, but it’s even more necessary for today’s distributed workforces. As cloud and mobile technologies continue to prove their value amid a public health crisis, it’s important that you take proactive steps to manage and protect company mobile devices. Here’s what you should do.

Ensure mobile OS is up to date

The updates on Apple and Android operating systems (OS) improve overall user experience, but their most important function is to fix security vulnerabilities. Reduce your business’s exposure to threats by installing updates for all devices as soon as they become available. Don’t wait for a few weeks or months to update, as this gives cybercriminals ample time to exploit vulnerabilities on devices that run on an outdated OS.

Install business applications only

Downloading apps seems harmless. But lenient policies on what should and shouldn’t be downloaded on company mobile devices could lead to staff downloading and installing non-business-related apps from third-party stores, most of which are notorious for malicious advertising codes and other threats. It’s imperative that employees download and install only business applications necessary for their work on their company mobile devices.

Be careful when connecting to public Wi-Fi networks

Emergencies may compel you to use password-free Wi-Fi networks in hotels, airports, cafes, and other public places. Connecting to an open network can expose your confidential information and sensitive company data to cybercriminals connected to the same network.

You can avoid this by providing a practical internet data plan, preferably one that includes roaming services, for remote workers. And if you really have to connect to a public Wi-Fi network, don’t use the connection for transferring sensitive data.

Enable phone tracking tools

Losing a company-issued mobile device is unfortunate but inevitable. Devices can be misplaced or stolen, but enabling Find My iPhone for iOS devices, GPS Phone Tracker for Android, or any device-tracking app helps users locate lost phones. Some also have the option to delete data on stolen devices. Downloading and setting up such an app only takes a few minutes, and it will give you peace of mind knowing that even if your phone is lost or stolen, its contents will not be compromised.

Screen SMS carefully

SMS phishing can be used to trick you into clicking malicious links. Cybercriminals send messages purporting to be from someone you know, asking you to urgently disclose confidential information. Should you encounter such an SMS, you can either delete it or alert your IT department. You can also block unknown senders without even opening their message.

Mobile devices are becoming more critical to operations. And with more devices open to attacks, businesses must bolster their cybersecurity efforts. Malicious actors will exploit every possible vulnerability, and that includes those in unsecured smartphones and tablets. Get in touch with us if you need comprehensive security solutions for your business.

Published with permission from TechAdvisory.org. Source.


Source: Pronto

7 Easy ways to prevent data loss in Microsoft 365

/in /by

7 Easy ways to prevent data loss in Microsoft 365

Microsoft understands the value of business data and the costly repercussions of losing it. That’s why they’ve released a slew of security and compliance tools for Microsoft 365 subscribers. But given the increasing sophistication and frequency of data breaches, these cloud security solutions aren’t enough to protect your files. You’ll need to follow these seven security tips to prevent data loss in Microsoft 365.

Take advantage of policy alerts

Establishing policy notifications in Microsoft 365’s Compliance Center can help you meet your company’s data security obligations. For instance, policy tips can pop up to warn employees about sending confidential information anytime they’re about to send messages to contacts who aren’t listed in the company network. These preemptive warnings can prevent data leaks and also educate users on safer data sharing practices.

Secure mobile devices

Since personal smartphones and tablets are often used to access work email, calendar, contacts, and documents, securing them should be a critical part of protecting your organization’s data. Installing mobile device management features for Microsoft 365 enables you to manage security policies and access permissions/restrictions, and remotely wipe sensitive data from mobile devices if they’re lost or stolen.

Use multifactor authentication

Don’t rely on a single password to safeguard your Microsoft 365 accounts. To reduce the risk of account hijacking, you must enable multifactor authentication. This feature makes it difficult for hackers to access your account since they not only have to guess user passwords, but also provide a second authentication factor like a temporary SMS code.

Apply session timeouts

Many employees usually forget to log out of their Microsoft 365 accounts and keep their computers or mobile devices unlocked. This could give unauthorized users unfettered access to company accounts, allowing them to steal sensitive data. By applying session timeouts to Microsoft 365, email accounts, and internal networks, the system will automatically log users out after 10 minutes, preventing hackers from opening company workstations and accessing private information.

Avoid public calendar sharing

Microsoft 365’s calendar sharing features allow employees to share and sync their schedules with their colleagues’. However, publicly sharing this information is a bad idea because it helps attackers understand how your company works, determine who’s away, and identify vulnerable users. For instance, if security administrators are publicly listed as “Away on vacation,” an attacker may see this as an opportunity to unleash malware on unattended computers.

Employ role-based access controls

Another Microsoft 365 feature that will limit the flow of sensitive data across your company is access management. This lets you determine which user (or users) have access to specific files in your company. For example, front-of-house staff won’t be able to read or edit executive-level documents, minimizing data leaks.

Encrypt emails

Encrypting classified information is your last line of defense against data breaches. If hackers intercept your emails, encryption tools will make files unreadable to unauthorized recipients. This is a must-have for Microsoft 365, where files and emails are shared on a regular basis.

While Microsoft 365 offers users the ability to share data and collaborate, you must be aware of potential data security risks at all times. When you partner with us, we will make sure your Microsoft 365 is secure. If you need help keeping up with ever-changing data security and compliance obligations, we can assist you there, too! Contact us today for details.

Published with permission from TechAdvisory.org. Source.


Source: Pronto

Does private browsing secure your data?

/in /by

Does private browsing secure your data?

If you’re getting targeted with surprisingly relevant ads, there’s a chance your internet activity is being tracked and analyzed by market researchers. While this doesn’t bother most people, private browsing mode can offer you some protection against online marketers and data thieves.

What is private browsing?

Your web browser — whether it be Chrome, Edge, Firefox, Safari, or Opera — remembers the URLs of the sites you visit, cookies that track your activity, passwords you’ve used, and temporary files you’ve downloaded.

This can be convenient if you frequently visit certain pages, can’t remember your login details, or if you’re trying to recall a website you visited a few days ago. But if someone else uses or gains access to your computer, your most private (and embarrassing) internet activities are exposed for anyone to see.

With private browsing — also called Incognito Mode in Chrome and InPrivate Browsing in Edge — all the information listed above does not get recorded. In fact, all the websites and information you accessed in the private browsing session are immediately discarded without a trace as soon as you close the browser. This can come in handy when you’re using a public computer because you’re instantly logged out of all the accounts you accessed after closing the window.

Your cookies also won’t be tracked. In a normal browsing session, sites like Facebook will display highly targeted ads based on the sites and pages you’ve visited. But in private browsing mode, your internet activity can’t be tracked by marketing companies.

Another benefit of private browsing is that you can use it to log in to several accounts on the same site, which is useful if you need to log in to two different online accounts at the same time.

What are the limitations of private browsing?

Although private browsing does prevent your web browser from storing your data, it doesn’t stop anyone from snooping on your online activities in real time. If your computer is connected to the company network, system administrators can still track what you’re browsing, even if you’re in Incognito Mode.

Also, if spyware or keylogger malware is installed on your computer, hackers will still be able to see what you’re doing online. Even though private browsing has quite a few benefits, you shouldn’t solely depend on it for online privacy. Instead, you should use a virtual private network (VPN) when you go online. These encrypt your internet connection and prevent anyone from intercepting your data. And don’t forget to use a strong anti-malware program to scan your computer and keep spyware and other malicious web monitoring software at bay.

If you want to know where you can get these solutions or learn more about web browser security, call us today. We have the tools and expert advice you need to prevent anyone from snooping on your internet browsing.

Published with permission from TechAdvisory.org. Source.


Source: Pronto

Top tips for making your website look awesome

/in /by

Top tips for making your website look awesome

Like people, websites also need to be dressed for success. Here’s how you can make yours look impressive and have visitors eager to do business with you.

Make a statement with professional photographs

Before site visitors read what’s on your website, they assess it by checking out your images. A picture is indeed worth a thousand words, but are those words truly what you want to convey to your audience?

Blurry, outdated, or irrelevant pictures tell your site visitors that you don’t care about their browsing experience. In-house photos are the best option, but stock images shouldn’t cause any problems as long as they are optimized for mobile viewing and relevant to your content.

Help visitors find what they want with search tools

If your set of offerings is not expansive, a simple navigation menu ought to help visitors find what they need. However, the deeper your catalog gets, the more you’ll need additional tools. One way is to affix a search bar in your header so that people can use keywords to scour your site. Another way is to engage visitors via chat. You can preprogram a chatbot to ask questions that narrow down a visitor’s intention, or you can have a live agent address a visitor’s concerns in real time.

The more helpful your website is, the more it will foster trust in your brand and make visitors more likely to do business with you.

Extra tip:
Reduce the number of clicks a visitor has to make to achieve their objectives. For instance, eschew using the “Read more” link on product descriptions on product details pages. Visitors dive into a product page because they’re interested in fully learning more about the product, and the “Read more” link just hinders them from doing so.

Present your case clearly with good copywriting

The last thing you want to do is to confuse and frustrate your customers, so it’s important to keep all of your product or service descriptions as straightforward and simple as possible. If what you’re selling has detailed information, such as dimensions or technical requirements, make sure that they’re easy to read and are typed out.

Don’t use screenshots of information tables because web visitors compare offerings by collating information from different sellers. If your information is displayed in the form of an image, you’ll force users to type the info themselves. You’ll immediately lose the ones who don’t want that sort of hassle.

Let visitors get to know your company better in the About Us page

Your brand needs a story behind it that customers can relate to. Every company website should have an About Us page that describes your team, your company culture, and what sets you apart from the competition. Whatever your story is, make sure it’s accessible from any page on your site.

Hire a professional web designer

If your budget is tight, there are DIY site builders specifically geared toward small businesses. Or for a relatively low monthly fee, you can hire a managed website provider. A website provider will take care of:

  • Form – They’ll make your site look impressive on any screen size.
  • Function – The provider will ensure that your site is easy to use and works as expected, whether you’re using a keypad and mouse or just your finger or stylus.
  • Fixes – If something in your site is broken or you want to make changes to it (such as integrating an appointment scheduling app), they will handle it for you.

With more revenue originating online, small- and medium-sized business owners can’t afford to overlook the importance of creating a fully functional website. For more information on building a modern website, call us today!

Published with permission from TechAdvisory.org. Source.


Source: Pronto

Should you monitor your employees’ online activities?

/in /by

Should you monitor your employees’ online activities?

To monitor or not to monitor — that is the question. Employee monitoring is a touchy subject. If you’ve ever considered it, then you may ask yourself if it is a good idea for an employer to check on their staff’s online activities. Below are the pros and cons of employee monitoring, and some helpful tips should you push through with it.

The case for monitoring

Here are several reasons why monitoring your employees’ activities on company devices is a good idea. It can help you:

  • Protect your organization from data theft or harm – because careless or disgruntled employees may leak or steal your data.
  • Ensure you have a harassment-free workplace – because cyberharassment (sexual or otherwise) happens among employees.
  • Ensure members of your staff comply with policies – such as not downloading illegal programs or spending time on websites with illegal or hostile content.
  • Provide evidence in case of a lawsuit – should an employee participate in illegal activities using your business’s computers (heaven forbid!), monitoring their device can provide evidence of their involvement.

Sadly, many business owners who monitor their employees often discover that their staff members aren’t focused solely on the company’s success.

Arguments against employee monitoring

Of course, you should also be aware of the potential downsides to monitoring. These include:

  • Productivity loss – monitoring can put a damper on employee morale, and you may see the distrust leading to productivity losses.
  • Lost privacy and lawsuits – you’ll likely learn personal details about your employees that you would’ve never known about had you not monitored them. You may discover their political or religious views, sexual orientation, or medical problems. This subjects your business to potential privacy or discrimination issues if you or your management team acts negatively based on any of this information.

Monitoring guidelines to follow

If you decide to monitor your employees, here are a few tips you should follow.

1. Create written policies
When you monitor your employees, ask yourself: “Am I doing this for security purposes? Is it to ensure my employees aren’t wasting time on games or social media?” If your monitoring policies are too strict, you could create an atmosphere of distrust.

Set guidelines for acceptable use of email and social media, web browsing, instant messaging, and downloading software and apps. Also, make sure to include how monitoring will be carried out and how data will be used, secured, and destroyed.

2. Tell your employees
It’s important to inform your employees about the scope of your monitoring policies. If they find out you’re doing it secretly, you could face legal issues. By being transparent, you may actually see a boost in productivity by deterring employees from wasting time on the web.

When you tell your employees, explain why you’re doing it and the risks your business faces from misuse of digital assets. Reassure them you’re not doing it to spy on their personal life, but to create a compliant and law-abiding workplace. Because their activities will now be less private, encourage your staff to use their smartphones for personal matters. Also, provide your employees a copy of your written policy for them to read and sign.

3. Get the right technology tools
You don’t need to know each and every employee activity, so look for apps and software that alert you of the most relevant problems, so you can focus on more important tasks.

If implemented correctly, employee monitoring makes your business more secure and productive. For more information about security and other IT support tools, get in touch with us today.

Published with permission from TechAdvisory.org. Source.


Source: Pronto

Cutting IT hardware costs with thin and zero clients

/in /by

Cutting IT hardware costs with thin and zero clients

If you want to cut costs on IT hardware, don’t settle for cheap but old or low-quality machines. They’ll likely offer subpar performance, which will hurt your team’s productivity. What’s worse, they’ll likely break down often, too, which means the money you initially saved will go to repairs and upgrades. Instead of buying low-end machines, you should consider buying thin or zero clients.

What are thin and zero clients?

Thin clients are stripped-down computers with minimum processing power and memory. They rely on a basic operating system (OS) and a network connection to access a more powerful system where almost all computing processes take place.

Zero clients work the same way. The only difference is that there’s no local storage or OS installed on the device; all the software, storage, and processing power sits on a server until you need it. This setup makes a zero client ideal for cutting costs.

What are the benefits of using thin and zero clients?

Reduced hardware costs
If you want computers with low upfront costs, choose thin and zero clients. Conventional desktops start at $600 per user, while thin clients can go as low as $250 per user. And since they have no hard drive or other moving parts, lean devices tend to be more durable and have a longer life span than their traditional counterparts.

Simplified IT management
Another benefit of thin and zero clients is that they can be managed from a server. Suppose a new software update is released. Instead of manually downloading the patch on each computer, you can simply install the update on your server and roll it out to all thin and zero clients.
Apart from installing updates, you can also make backups, security configurations, and application deployments in the data center. This quickens setup, reduces downtime, and increases employee productivity.

Minimized security risks
Thin and zero clients also help you prevent costly malware attacks and data breach incidents. Your employees and poorly managed endpoints are the biggest vulnerabilities with traditional desktops. Thin and zero clients reduce these problems by limiting direct access to the OS. This prevents employees from copying sensitive data to removable media and installing software, malicious or otherwise.

If your thin or zero client is damaged or corrupted, you don’t have to worry about your data, as it’s originally stored in an impenetrable server.

Decreased energy consumption
Because processing is done locally, traditional desktops generate a lot of heat and require more power, resulting in huge power and cooling bills. In contrast, thin and zero clients consume only 4 to 6.5 watts of power, almost 1/50th of thick client requirements. What’s more, they require little to no cooling, allowing you to enjoy significant cost savings.

Do not overlook thin and zero clients if you’re searching for ways to cut costs without compromising outcomes. The reduced hardware costs, power bills, and security risks are just too good to pass up.

If you’re still unsure about this technology, give us a call. We’ll assess your tech needs and determine whether or not thin or zero clients can help you succeed.

Published with permission from TechAdvisory.org. Source.


Source: Pronto

Microsoft 365 signals a new era of productivity for SMBs

/in /by

Microsoft 365 signals a new era of productivity for SMBs

In April 2020, Microsoft launched Microsoft 365, the successor to its popular Office 365. But it’s not a mere name change. The tech giant is also introducing improvements to its productivity software that will enhance how your business deals with cyberthreats every day.

Name change

Microsoft has time and again shown that they are willing to make drastic changes to their products and services in the name of development. Their Windows 10 operating system (OS), for instance, is a far cry from its predecessor Windows 8. Microsoft made the jump from what they thought would be a revolutionary tile-based design in Windows 8 to a classic, ergonomically designed Windows 10.

The tech giant has once again made drastic changes, this time to their award-winning line of productivity apps Microsoft Office 365. O365, as it was lovingly referred to for nearly a decade, is now the sleeker, more powerful, Microsoft 365 Business.

Microsoft 365 Business is available to small- to mid-sized businesses (SMBs) on three different subscription plans: Business Basic, Business Standard, and Business Premium.

Available plans

Microsoft 365 Business Basic

Microsoft 365 Business Basic comes with many standard features, including web and mobile app access, full email and calendaring tools, secure file storage, collaboration tools, and support. Rest easy knowing that you have a powerful enterprise-grade software for a fraction of the cost such as:

  • Web and mobile app versions of Office apps
  • Real-time coauthoring
  • Email hosting with 50 GB capacity
  • 1 TB of OneDrive storage
  • Automatic syncs regardless of work platform choice (between OneDrive and SharePoint).
  • Teleconferencing and unified communications via Microsoft Teams for up to 250 users
  • Automatic threat defense via Exchange Online Protection
  • A complete array of cybersecurity tools and protocols, such as automated password policy tools

Microsoft 365 Business Standard

With the Microsoft 365 Business Standard plan, you’ll get everything Business Basic offers plus:

  • Desktop versions of Office apps for up to five PCs or Macs per user
  • Easy and smart appointments management with Microsoft Bookings
  • Real-time mileage tracking and reporting with MileIQ

Microsoft 365 Business Premium

Microsoft 365 Business Premium is the brand’s flagship plan, a great tool for businesses ready to take their operations to the next level. It comes with everything Business Standard offers plus:

  • Advanced security tools to protect from zero-day threats and ransomware, via Office 365 Advanced Threat Protection
  • Remote wiping tools for stolen or lost devices, via Selective Wipe from Intune
  • Restricted copying or saving options for unauthorized apps and locations
  • Complete control of company data, via Information Rights Management
  • Pre-breach threat resistance policy options, via Windows Defender Exploit Guard
  • Malware protection, via Windows Defender
  • Unlimited cloud archiving of emails, via Exchange Online Archiving
  • Setup wizards for Windows 10, iOS, and Android
  • Total security policy deployment — even for mobile apps — via Mobile Device Management from Intune

Microsoft 365 Business will change the way your staff powers your business. Contact us today to discuss how you can avail of a subscription.

Published with permission from TechAdvisory.org. Source.


Source: Pronto

Why does HTTPS matter?

/in /by

Why does HTTPS matter?

Almost everyone in the world browses the internet every day. People look up information, shop, chat with friends, or just pass the time by surfing the web. Internet browsing has become second nature to us that we often forget one thing: checking our address bar for an “S” after the “HTTP” prefix.

HTTPS encryption

The “s” in HTTPS stands for “secured”. It was introduced in 1995, so older websites that have been left on its own without regular maintenance usually don’t have it. But even to this day, unsecure websites exist, and fraudsters can easily take advantage of them.

When you visit a site with an HTTP connection, everything you type or click on that website is sent without encryption. This means that anyone who intercepts the data transferred between the website and your computer can readily view them. Cybercriminals can exploit this fact to gain access to your personal data, Social Security number, credit card information, and the like. This puts you at risk of identity theft and other fraudulent activities.

HTTPS certificates

When you visit a website, your computer uses an online directory to translate its alphanumeric name into a numerical address. It then saves that information on your computer, so that it doesn’t have to check the online directory every time you visit the same website.

In the event that your computer gets compromised, it could be tricked into directing a perfectly safe web address like www.google.com to a malicious website. Most of the time, users are sent to sites that look exactly like the legitimate site, but are actually fake copies designed to trick them into divulging their credentials.

To prevent such things from happening, the online directories mentioned earlier issue an ecosystem of certificates that turn HTTP into HTTPS, making it impossible for anyone to be redirected to a fraudulent website.

How does this affect our daily browsing habits?

We often visit a multitude of websites in a short period of time without checking each one for padlocks and certificates. Unfortunately, we can’t ignore the importance of HTTPS, so here are a few things to consider the next time you browse the internet:

  • If your browser marks a website as “unsafe,” think twice about clicking “Proceed anyway.” Only click the prompt if you are absolutely certain nothing will be transmitted.
  • Add web browser extensions such as HTTPS Everywhere that create encrypted connections to unencrypted websites. These extensions encrypt your communication with websites, and are compatible with Chrome, Firefox, and Edge browsers.
  • Always be vigilant. Some sites may have HTTPS but it doesn’t mean they’re safe. For example, goog1e.com (with the “l” replaced with a one) could have a certificate, but the misspelling indicates it to be an untrustworthy site. Cybercriminals use similar spellings of authentic websites to fool people into thinking that they’re in a secure site. This is called typosquatting or URL hijacking.
  • And perhaps, just follow the easiest step of all: avoid sites that don’t use the HTTPS protocol.

If you want to learn more about safer browsing habits and endpoint security, give our office a call.

Published with permission from TechAdvisory.org. Source.


Source: Pronto

How MSPs are supporting clients during the COVID-19 pandemic

/in /by

How MSPs are supporting clients during the COVID-19 pandemic

The COVID-19 pandemic and the sweeping shutdowns to contain the spread of the virus brought about significant impacts on businesses. Many small companies realized they lacked the resources to rapidly adopt a remote work setup and tapped their IT partners to help address their technology demands. Here’s how managed IT services providers (MSPs) are rising to the challenge.

Providing infrastructure and service desk capabilities

In today’s digital work landscape, MSPs are keeping their noses to the grindstone to fulfill customer demands and help keep businesses running. While many small companies have taken the first step of transitioning to remote work, they still need help managing the logistics.

Right now, MSPs are providing customers with IT infrastructures and taking on a host of network tasks, including configuring hardware, establishing remote connections, and managing backup and storage options, among other activities. These all help to ensure that company networks are reliable enough to facilitate a remote workforce.

MSPs are also offering service desk capabilities, providing companies with a centralized resource for employees, customers, and business partners to answer questions, troubleshoot problems, and facilitate solutions. Appropriate and timely support is crucial, especially in times of great uncertainty.

Simplifying cloud adoption

Cloud solutions are ideal if IT environments must be quickly modified to meet changing demands or difficulties, which is why MSPs are now helping businesses leverage a variety of cloud technologies and even move their data and applications online.

And because cloud migration can get complex, many MSPs are also offering managed migration plans that help companies transition key workflows and processes to the cloud safely and efficiently.

Offering remote support where possible

The current travel restrictions and social distancing measures make work-related travel difficult and risky. And with highly distributed workforces, many companies would rather source local service technicians for break/fix assistance, cabling, and other IT solutions.

Partnering with MSPs ensures that systems and networks are protected all the time and critical support is provided within 24 hours. What’s even better is that some providers have technicians in different locations, making it easy to provide tools, resources, and support even in hard-to-reach areas.

Delivering flexible solutions

As business needs continue to shift, MSPs must move in lockstep and provide support wherever they can. Here are some other ways MSPs are helping their clients navigate these trying times:

Assisting with IT projects
Because of how broad and challenging IT projects can be, it’s not uncommon for companies to lack the right skills and resources to handle them. MSPs are helping them by providing the expertise and technologies needed to pursue these projects, allowing companies to keep moving forward.

Foregoing long-term contracts
Some companies need IT support and services but can’t afford to commit to long-term contracts. Similarly, some want to augment their IT only for the duration of the COVID-19 pandemic. What’s great is many MSPs are providing flexible IT solutions, giving customers all the services and support they need, when they need them.

Offering faster response times
Especially now that downtime could likely spell the end of a business, companies seek quick turnaround times. Since MSPs typically offer 24/7 support and tout specialists with a wide range of experience and knowledge, they can proactively address issues and ensure that IT infrastructures are working as efficiently as possible.

Providing better customer service

As many businesses are still adjusting to the new normal, providing positive customer experiences will go a long way to earning trust and ensuring customer loyalty post-crisis. By being compassionate and empathetic to the situations of their customers, MSPs are showing companies that they’re navigating these trying times together.

Call our IT experts today to help configure the perfect remote work setup for your business.

Published with permission from TechAdvisory.org. Source.


Source: Pronto

Watch out for this Android malware

/in /by

Watch out for this Android malware

Security researchers have discovered a new Android malware called DEFENSOR ID that snuck its way into the Google Play Store. Forensic analysis shows that the malware takes advantage of an Android device’s Accessibility Services to infiltrate the system and cause damage without being detected. To help you avoid this dangerous strain of malware, we’ve compiled everything you need to know in this blog entry.

What is DEFENSOR ID?

DEFENSOR ID is a banking Trojan that minimizes its malicious capabilities to sneak past security checks and infiltrate the Google Play Store. The malware’s primary function is to request access to an Android device’s Accessibility Service, which would allow hackers to execute a variety of commands.

For starters, if unwitting users grant access to DEFENSOR ID, the malware can observe any launched apps and send sensitive information back to hackers. This means hackers can steal anything from passwords and private emails to banking information and one-time SMS activation codes for two-step verification processes.

DEFENSOR ID also allows hackers to remotely uninstall apps, launch programs, and perform gestures (e.g., tap, swipe, click) within the launched program. In theory, this feature can enable hackers to empty a victim’s bank account with minimal effort.

What’s more, the Trojan extends the lock screen timeout to 10 minutes so that cybercriminals have enough time to perform their malicious operations.

Beware of apps leveraging Accessibility Services

According to researchers, DEFENSOR ID targeted Brazilian users and was downloaded over a dozen times. But despite its small success rate, it’s possible that more malware will leverage these techniques to steal sensitive information and control user devices. In fact, earlier in 2020, McAfee researchers discovered Android/LeifAccess malware that exploited Accessibility Services to leave fake reviews on the Google Play Store.

Plus, a common Android issue is that many independent software developers can upload their apps to the Google Play Store and easily circumvent security checks. So, if users aren’t thoroughly vetting the apps they download onto their devices, attacks similar to DEFENSOR ID will become more widespread.

Malware that can abuse Accessibility Services may even give rise to more deceptive online scams or massive-scale data breaches that can shut down businesses.

How to defend against DEFENSOR ID

Developing a healthy skepticism of apps in the Google Play Store is the best way to prevent malware attacks like DEFENSOR ID. This involves training your staff to get in the habit of evaluating an app before downloading it. More specifically, they should be verifying whether user reviews seem authentic, checking the total ratings and downloads, and consulting with security experts whether an app is safe.

Businesses should also use endpoint security software to control what apps users can install on their company-registered devices. By limiting downloads to a few, fully verified apps, you can minimize your company’s exposure to mobile malware.

If you want to keep your business safe from malware and other cyberthreats, it’s in your best interest to call cybersecurity experts like us. Not only do we provide top-notch security solutions, but we also offer proactive maintenance services to protect your IT at all times.

Published with permission from TechAdvisory.org. Source.


Source: Pronto