Home Routers are a Huge Risk

So a little while ago, I wrote about the risks that remote workers face while working from home.

A recent study of home routers does well to illustrate these vulnerabilities.

In a study entitled Home Router Security Report 2020 conducted by FKIE, it was found that 43/127 commercial routers hadn’t received security updates in the last year from the original equipment manufacturer (OEM), despite the fact that these devices are affected by hundreds of known vulnerabilities. In the worst cases, the devices hadn’t bee updated by the OEM in more than five years.

Over ninety percent of the evaluated routers run versions of the Linux operating system. Yet, the updates provided to the routers fall far behind the standards we’d expect for desktop or server machines running the same operating systems. These vendors could distribute security patches and updates several times a year, but often they do not.

FKIE’s study only complements a 2018 study conducted by American Consumer Institute demonstrating that 83-percent of sampled routers were found to have an average of 186 vulnerabilities to potential attacks in the router’s firmware.

Such evidence suggests:

1. Home router manufacturers aren’t preparing firmware updates in a timely fashion;

2. Users are not applying available updates in a timely fashion, or, may not understand how.

This is a severe problem, especially in the age of COVID as many millions of workers are conducting important commercial business on the backs of outdated router firmware with known bugs.

But you can do better. Hiring a computer consultant to investigate your router, update its firmware, or replace the router, can secure your small business. It’s a practical step in deterring potential aggressors and in safeguarding your information assets. Just ask us how it’s done.

R

Remote Workers are Significantly Vulnerable to Hacking

The COVID-19 pandemic has forced millions to work from home.

In the tech industry, we call home computers and home networks unmanaged endpoints - unmanaged because we don’t control those devices and we have no idea how they’re configured.

There’s a whole bunch of risk that comes with unmanaged endpoints:

1. The operating system of home computers are often neglected. They could be lesser versions of Microsoft Windows or MacOS and haven’t received critical updates or patches.

2. The software or settings that we introduce into corporate environments to safeguard our computers aren’t implemented with unmanaged endpoints.

3. Disaster recovery options on unmanaged endpoints is challenging because data may be stored on the local hard drive of these machines. There may not be any data backups.

4. Privacy and confidentiality of corporate data may also be at risk because, again, such data is stored on an unmanaged hard drive. Who knows if the local admin password on the PC is set to a reasonable level as to disallow root-level access.

5. The use case of home machines are very different from business machines. There’s likely to be more risky behaviors (browsing, downloading, installing by end users) associated with these endpoints taken on by teenagers and children.

6. The networking equipment - like the home router and wifi access point - likely hasn’t been patched, updated, or even its root password rotated from its default setting.

And all of this spells big trouble for the small business.

The challenge is to transform these unmanaged assets into managed ones, and, to inspect the networking environment for potential risks and, well, you know … do something about it!

We help small business use technology better. That includes three critical solutions to help protect small business while distance-working.

1. Ongoing Endpoint Monitoring and Protection.

2. Online Backups.

3. Remote Support.

Our Endpoint Monitoring and Protection software reports vulnerabilities back to us so we can take corrective action. It turns an unmanaged endpoint into a managed one. It helps identify areas where the operating system may be vulnerable, or, when somebody installs a risky program. It also includes an antivirus, anti-malware, safe browsing, and intrusion protection system that counters typical threats to a user’s machine.

Our Online Backup solution is all about recovering the company’s data in addition to the user’s data while they’re using their own PC for company business. In the event of failure or if their machine is hit by a ransomware, we can recover the user’s data to a restored machine.

Our Remote Support is part of what we offer. It’s a human eye to look at the user’s network and can make recommendations to improve their security posture. We can red-flag issues that are unmitigated risks so that they can be dealt with; otherwise, we can help safeguard the remote employee with a few simple changes. And of course, if the user gets in a jam with their tech, we’re there to help so they can get back to work.

In all, our approach is to mitigate risk to the small business and to the employee by taking preventative measures. Instead of just reacting to failure - hoping that everything is okay with an unmanaged asset - we help our clients move beyond hope. We help small businesses have confidence in their ability to function and serve their customers.

That’s how we add value.

R

Small Businesses At Increasing Risk of Cybercrime

This week, the US Office of Personnel Management admitted that over 5.6 million fingerprint records were stolen in a hack perpetrated earlier in the year; that's significantly larger than what they first imagined was 1.1 million compromised records.

If your head is reeling from the enormity of such a breech, and if you somehow figure that only large corporations or government systems are the target of serious hacks, think again. Recent reports show that small/micro businesses aren't doing enough to protect themselves, either.

Phishing attacks, credit card fraud, virus infections, data compromises; malware, espionage, password compromises, shareware exploits. Sage recently released a good infographic claiming that up to 90-percent of data breaches impact small firms, and that 30-percent of businesses under 250 employees are the intended targets of cyberattacks; 1 in 5 small businesses fall victim to cybercrime every year, and 60-percent of those affected businesses go out of business.

“Half way through 2015 and cyber risks continue at an alarming rate. The criminals continue to become more sophisticated and have quick ‘go to market’ capabilities ... ”

— Carolyn Schrader, Cyber Security Group, Inc.

The bottom line is that thinking about information system security isn't just for the enterprise: it's something every mom and pop shop should be doing, too. We can't fool ourselves. Larger corporations may provide a more inciting, data-rich environment, but the reality is that small businesses don't secure their systems in the way corporations would, which makes them easier targets. They don't have the talent or expertise to understand the safeguards they're implementing, let alone verify their suitability and functionality.

And if we somehow believe that free software downloaded from the Internet will solve our problems, we should probably think again. Every small business owner or manager should be finding a trusted cybersecurity partner. Mickler & Associates, Inc. - a computer security consultancy in Vancouver, WA - is uniquely positioned to help small businesses improve their security posture and audit their safeguards. Learn more about how we could help you today.

R