954-866-1600    Get SUPPORT

Evolution Networks Blog

Evolution Networks has been serving the South Florida area since 2003, providing IT Support such as technical helpdesk support, computer support, and consulting to small and medium-sized businesses.

TOP 4 HOA Cyber Liabilities and 7 Steps to Reduce your HOAs Cyber Attack Risk

evolution-networks-pembroke-pines-managed-IT-Cyber-security-HOA-computer-security

The battle against cyber assault is ongoing. The technological capabilities of cybercriminals are growing at an accelerated pace. The scenario of almost unlimited threat capabilities, coupled with exploitable vulnerabilities, makes cyber insurance essential for community associations.”

Top 4 HOA Cyber Liabilities

  • A community association that stores “personally identifiable information” (PII; e.g., owner addresses, social security numbers, credit card or banking information).
  • Disruption of normal operations during a cyber attack.
  • Downtime and recovery resulting from a cyber attack, malware, or ransomware.
  • Board members using their personal contact systems to send email & maintain email lists.

Top 4 HOA Cyber Liabilities

  • Develop a response plan.
  • Obtain security software that is end-point and has constant malware definition updates.
  • Limit access to sensitive information.
  • Protect personal identifiable information.
  • Learn about social media privacy risks.
  • Use strong complex passwords.
  • Have at least 3 different sources of data recovery points

If you believe because you are a small management firm or community association you’ll fly under the radar, you are sadly mistaken. Cybercriminals particularly enjoy going after small entities because the small management firms & community associations are ripe for the picking. The cybercriminal’s risk of being caught is very small. 

Cyber Crime Is Not Going Away

When choosing a way to manage this ongoing problem, you should look to outsource your IT services to  a Managed Services provider or IT Solutions provider who has the resources and technology in place to protect your community association and your homeowners.

If you feel that your HOA could use a little more attention when it comes to Cyber Security, we're here to help.  Let's schedule some time to discuss.  Evolution Networks

0 Comments
Continue reading

How Prepared is your HOA to Protect Sensitive Information?

evolution-networks-stay-safe-from-cyber-attackers

All homeowner associations have access to sensitive owners' data. From social security numbers and driver license information to credit card numbers, you are responsible for keeping them out of the wrong hands by boosting your cyber security efforts.

According to RiskBased Security, in the first half of 2019, over 3,800 breaches were reported, exposing over 4.1 billion records. How prepared are you to protect sensitive information? As technology advances and HOA relies on digital services and products, the risks of data theft increase every day.

Let's talk about ways to improve cybersecurity for your community and protect sensitive association data from hackers in 2020.

1. Clarify Security Procedures

Each homeowner association should have certain security procedures. Limit access to sensitive information to people, who can't avoid working with it.

Document rules about access clearance. There shouldn't be any misunderstandings about the procedure.

Make it clear to the board members that data access restrictions aren't set up due to a lack of trust but to enforce cybersecurity measures.

2. Employ Strict Password Protection

All applications and documents must be protected by passwords. Uploading documents to a cloud is a convenient storage method. However, sharing access without a password makes it a risky one.  

You have to create strong passwords that contain symbols and numbers. Never use the same combination for several purposes. If you are having a tough time creating and remembering numerous strong passwords, you can take advantage of password managers.   

3. Limit BYOD (Bring Your Own Device)

When HOA members are using personal devices to access sensitive information, they are putting the data at risk. Large companies work out complex BYOD (Bring Your Own Device) policies to ensure all their information stays safe.

If you aren't ready to invest time and money in such a policy, access all the data from properly protected office computers.

4. Consider Cyber Liability Insurance

Cyber liability insurance protects you in case there is a data breach. Depending on the policy type, it can cover immediate financial losses related to the breach as well as claims that may occur because of cyber-attacks. For example, if a homeowner sues the association for problems encountered due to data loss, the insurance covers the expenses.

If you decide to pay for such insurance, make sure to discuss it in detail. Such policies aren't standardized and may contain unique terminology. They can also be based on a retention/deductible, an amount you have to pay before the insurance company makes its payment.  

5. Destroy Old Files

As soon as you don't need the information anymore, destroy it. Keeping old files just because you don't have time to deal with them increases your vulnerability.

Make sure to erase files fully. Clicking "delete" simply sends them to the trash bin. Clearing the trash bin won't do it either. You need to remove the information without the possibility of recovery, which would require using a third-party shredding tool.

6. Update Your Software

According to a survey done by Voke Media, about 80% of companies that experienced breaches could have prevented them with a software update.

The key reason to update any software you use on HOA computers is to improve cybersecurity. Don't miss or ignore updates.

By the way, if you are still working with Windows 7, it's time for an upgrade since Microsoft has stopped supporting it recently.    

7. Consult an IT Expert

If you don't have a staff IT expert, you should outsource IT-related tasks. This specialist should consult you on cybersecurity measures and offer solutions for HOA data protection. 

Cyber security is quickly becoming the top concern for the majority of companies all over the world. Implementing the above security measures today can help you avoid serious consequences in the future. 

Evolution Networks has the measures and solutions for protection of your HOA data.  Get in touch with us and we will guide you through the steps to get and stay compliant and secure. Contact us here.

0 Comments
Continue reading

Why do HOAs need to know about Cyber Security?

Evolution-Networks-HOA-Cyber-Liability

Because everything is digitized, sensitive online information is subject to a cyberattack. Cyberattacks are “an attempt by hackers to damage or destroy a computer network or system,” according to Google.

This warrants serious concern for homeowners associations that digitally systemize resident information, including full names, current and former addresses, social security numbers, credit history, and contact information.

On top of sensitive resident information, most homeowners associations keep important HOA financial documentation on an digital system. From HOA fees to contractor paychecks to annual taxes, HOA finances would be a big loss.

What information do cyberattackers want?

Hackers are looking for personally identifiable information (PII) to sell on the “dark web.” The dark web is a digital black hole for stolen identities, fake passports, and other illegal activities. This means that resident information is in-demand currency.

If a cyberattack occurs in your HOA community, PII of former and current residents is at risk. This puts your community at a liability, and you in a courtroom.

What are common cyberattack methods?

The most common method of a cyberattack is an email scam like phishing. This is “the fraudulent practice of sending emails purporting to be from reputable companies in order to induce individuals to reveal personal information, such as passwords and credit card numbers,” according to Google.

With the help of All Property Management, here’s a recap list and a few new tips for the best cybersecurity for HOAs:

Email Cybersecurity

  • Set up a spam filter.
  • Don’t open an email if you don’t know the email address.
  • Don’t digitally share sensitive information with any contact that you don’t recognize.
  • Don’t open zip files, download attachments, or click links from untrusted emails.
  • Set up a Google Alert for big data breaches and ransomware attacks.

Password Protection

  • Create strong password for any digital system in an HOA. A lengthy password that consists of a short, memorable sentence (also known as a passphrase) is better than a single word.
  • Incorporate as many letters, numbers, and symbols as each system allows.
  • Don’t use any dictionary words or names unless they’re part of a passphrase.
  • Use a mix of capital and lowercase letters.
  • Avoid using a common password.
  • Don’t reuse passwords or use a master password for multiple systems. If a hacker finds out the master password, all sensitive information is compromised.
  • Use a password management software like 1Password to create and store secure passwords for use across all systems. 1Password also stores usernames, account numbers, and other pertinent information.
  • Change the default password on the router. Anyone who tests the router has access to the entire digital community otherwise.

HOA Board Member Training

  • Limit who has the WiFi password. Visitors should be on a separate network.
  • Train all HOA board members on the importance of password protection, potential of cyberattacks, and best cybersecurity measures.
  • Decide which board members can access sensitive information. This minimizes who knows master passwords.

Software & Data Measures

 

  • Update all system software as soon as possible. An update creates a stronger version of the software. By choosing to update later, you’re using a weaker, more susceptible version.
  • Invest in an antivirus software to scan for potential Trojan horses, ransomware, and other cyberattacks.
  • Don’t hold onto records longer than required. This minimizes what could be stolen in a cyberattack.
  • Back up any data onto an offsite location. If you back it up to a cloud solution, talk to the provider about cloud security.
  •  

    Source: IKCommunity

    If you feel that your HOA could use a little more attention when it comes to Cyber Security, we're here to help.  Let's schedule some time to discuss.  Evolution Networks

    0 Comments
    Continue reading

    Cyber Security Protection and Compliance for HOAs is a Must Have

    hoa-cyber-security

    Community associations and board members can land themselves in hot water and find themselves liable if a cyber attack occurs. In addition to the loss to the association if funds are stolen, there may be compensation to owners if thieves steal their funds or personal information.

    Board Members Can Be Liable

    Community associations and board members can land themselves in hot water and find themselves liable if a cyber attack occurs. In addition to the loss to the association if funds are stolen, there may be compensation to owners if thieves steal their funds or personal information. There is also the expense to defend a potential lawsuit and resulting reputational damage to the association. Penalties may also be assessed if the targeted association failed to comply with state data-protection statutes. These statutes vary, which is why it’s important for an association to understand its obligations under the law.

    The Importance of Cyber Security

    To help mitigate risk, it’s important for the association to have a cyber security policy in place. This includes:

    • Review governing documents and local laws. These official documents will set up a foundation for adding a new cyber security policy.  
    • Determine which individuals will handle the data and which individuals will ultimately manage cyber security. Keep close tabs on who gets access to sensitive data and who gets administrative privileges.
    • Outline a plan of action if security breaches or criminal hacking occur.
    • Set up a list of rules for using association mobile devices or computers to ensure that unauthorized people will not be able to access confidential information.
    • Establish a data breach plan. To prepare for a potential data breach, there are several resources from trusted authorities like the Federal Trade Commission (FTC). The Online Trust Alliance has an online guide about data breach preparation and the FTC offers resources that explain the process of securing association data and protecting customer data.
    • Provide board members with a set of guidelines. These cyber security principles can help community associations better understand new policies and see how to respond to potential cyber attacks and data breaches. They are key to bringing everyone onto the same page regarding cyber security policies and procedures.
    • Teach residents about cyber security. Educating residents about cyber security should be a priority for the association. This can be done via the community’s newsletter, emails or letters directly to residents, along with tips posted on the community website.
    • Ensure that the association software is secure, with features that defend against malware and protect sensitive and confidential information.  This includes creating strong passwords, updating software regularly, investing in an anti-virus solution, encrypting all data, and ensuring regular back-ups are being made, among other measures. Make sure the management company will not be sharing the association’s private data with third parties or storing data on servers that are shared with other businesses or clients of the data host.

    Secure Cyber Liability Insurance

    In addition to having a cyber security plan in place to help mitigate the risk of a breach, it’s also critical for an association to carry Cyber insurance. Note that General Liability insurance does not cover the impact of a data breach on the association. A Cyber policy includes first-party and third-party coverages. First-party coverage is for losses and damage to the business, while third-party coverage is for losses that an outside entity incurs due to a cyber event. A policy can be designed to pay for first-party expenses that include:

    • Legal and forensic services to determine whether a breach occurred and assist with regulatory compliance if a breach is verified
    • The costs involved to notify affected customers (homeowners, condo owners) and employees
    • Customer credit monitoring
    • Regulatory defense & penalties – coverage for defense costs and fines or penalties for violations of privacy regulations
    • Crisis management and public relations to educate customers about the breach and rebuild a company’s reputation
    • Business interruption expenses as a result of the breach
    • Cyber extortion reimbursement for perils including credible threats to introduce malicious code; pharm and phish customer systems; or corrupt, damage, or destroy your computer system

    A Cyber policy can also be designed to pay for the following third-party expenses:

    • Judgments, civil awards, or settlements a client is legally obligated to pay after a data breach
    • Electronic media liability, including infringement of copyright, domain name, trade name, service mark, or slogan on an intranet or Internet site

    Policies, including the scope of coverage, terms, sub-limits, deductibles and other important factors, vary from one carrier to the next and it’s important to work with an experienced insurance professional in designing a Cyber insurance solution that meets the needs of the association.

    Source: NI

    0 Comments
    Continue reading

    Has your browser been targeted by recent Malware attack?

    web-browser-800x600

    Chrome, Firefox, Edge, and Yandex are all affected in widespread ad-injection campaign.

     

    Adrozek, as the software maker has dubbed the malware family, relies on a sprawling distribution network comprising 159 unique domains with each one hosting an average of 17,300 unique URLs. The URLs, in turn, host an average of 15,300 unique malware samples. The campaign began no later than May and hit a peak in August, when the malware was observed on 30,000 devices per day.

    Not your father’s affiliate scam

    The attack works against the Chrome, Firefox, Edge, and Yandex browsers, and it remains ongoing. The end goal for now is to inject ads into search results so the attackers can collect fees from affiliates. While these types of campaigns are common and represent less of a threat than many types of malware, Adrozek stands out because of malicious modifications it makes to security settings and other malicious actions it performs.

    “Cybercriminals abusing affiliate programs is not new—browser modifiers are some of the oldest types of threats,” researchers from the Microsoft 365 Defender Research Team wrote in a blog post. “However, the fact that this campaign utilizes a piece of malware that affects multiple browsers is an indication of how this threat type continues to be increasingly sophisticated. In addition, the malware maintains persistence and exfiltrates website credentials, exposing affected devices to additional risks.”

    The post said that Adrozek is installed “through drive-by download.” Installer file names use the format of setup__.exe. Attackers drop a file in the Windows temporary folder, and this file in turn drops the main payload in the program files directory. This payload uses a file name that makes the malware appear to be legitimate audio-related software, with names such as Audiolava.exe, QuickAudio.exe, and converter.exe. The malware is installed the way legitimate software is and can be accessed through Settings>Apps & Features and is registered as a Windows service with the same file name.

    The graphic below shows the Adrozek attack chain:

     

     

    Once installed, Adrozek makes several changes to the browser and the system it runs on. On Chrome, for instance, the malware often makes changes to the Chrome Media Router service. The purpose is to install extensions that masquerade as legitimate ones by using IDs such as “Radioplayer.”

    Bad extensions!

    The extensions connect to the attacker’s server to fetch additional code that injects ads into search results. The extensions also send the attackers information about the infected computer, and on Firefox, it also attempts to steal credentials. The malware goes on to tamper with certain DLL files. On Edge, for instance, the malware modifies MsEdge.dll so that it turns off security controls that help detect unauthorized changes to the Secure Preferences file.

    This technique, and similar ones for other affected browsers, has potentially serious consequences. Among other things, the Preferences File checks the integrity of values of various files and settings. By nullifying this check, Adrozek opens browsers up to other attacks. The malware also adds new permissions to the file.

    Below is a screenshot showing those added to Edge:

     

    The malware then makes changes to the system settings to ensure it runs each time the browser is restarted or the computer is rebooted. From that point on, Adrozek will inject ads that either accompany ads served by a search engine or are placed on top of them.

    Thursday’s post doesn’t explicitly say what, if any, user interaction is required for infections to occur. It’s also not clear what effect defenses like User Account Control have. Microsoft makes no mention of the attack hitting browsers running macOS or Linux, so it's likely this campaign affects only Windows users. Microsoft representatives didn’t respond to an email asking for details.

    The campaign uses a technique called polymorphism to blast out hundreds of thousands of unique samples. That makes signature-based antivirus protection ineffective. Many AV offerings—Microsoft Defender included—have behavior-based, machine-learning-powered detections that are more effective against such malware.

    Source: ARS Technica

    0 Comments
    Continue reading

    By accepting you will be accessing a service provided by a third-party external to https://evo-networks.com/