Business + Partners

Girl Scouts and OpenText empower future leaders of tomorrow with cyber resilience

The transition to a digital-first world enables us to connect, work and live in a realm where information is available at our fingertips. The children of today will be working in an environment of tomorrow that is shaped by hyperconnectivity. Operating in this...

World Backup Day reminds us all just how precious our data is

Think of all the important files sitting on your computer right now. If your computer crashed tomorrow, would you be able to retrieve your important files? Would your business suffer as a result? As more and more of our daily activities incorporate digital and online...

3 Reasons We Forget Small & Midsized Businesses are Major Targets for Ransomware

The ransomware attacks that make headlines and steer conversations among cybersecurity professionals usually involve major ransoms, huge corporations and notorious hacking groups. Kia Motors, Accenture, Acer, JBS…these companies were some of the largest to be...

How Ransomware Sneaks In

Ransomware has officially made the mainstream. Dramatic headlines announce the latest attacks and news outlets highlight the staggeringly high ransoms businesses pay to retrieve their stolen data. And it’s no wonder why – ransomware attacks are on the rise and the...

An MSP and SMB guide to disaster preparation, recovery and remediation

Introduction It’s important for a business to be prepared with an exercised business continuity and disaster recovery (BC/DR) plan plan before its hit with ransomware so that it can resume operations as quickly as possible. Key steps and solutions should be followed...

Podcast: Cyber resilience in a remote work world

The global pandemic that began to send us packing from our offices in March of last year upended our established way of working overnight. We’re still feeling the effects. Many office workers have yet to return to the office in the volumes they worked in pre-pandemic....

5 Tips to get Better Efficacy out of Your IT Security Stack

If you’re an admin, service provider, security executive, or are otherwise affiliated with the world of IT solutions, then you know that one of the biggest challenges to overcome is efficacy. Especially in terms of cybersecurity, efficacy is something of an amorphous...

How Cryptocurrency and Cybercrime Trends Influence One Another

Typically, when cryptocurrency values change, one would expect to see changes in crypto-related cybercrime. In particular, trends in Bitcoin values tend to be the bellwether you can use to predict how other currencies’ values will shift, and there are usually...

OpenText Security solutions 2022 Global SMB Ransomware Survey: Fighting more… with Less

Nov 7, 2022 | Business + Partners, SMBs

Small and medium-size business (SMB) leaders have a lot on their minds. The looming recession and inflation have created financial uncertainty. Meanwhile, the global rise in sophisticated ransomware threats and geo-political tensions are escalating cyber threats.

With so many factors and pressures at play, how are SMBs navigating this challenging business landscape while fighting back against cybercriminals?

Insight from OpenText Security Solutions’ 2022 Global Ransomware SMB Survey sheds light on security priorities, concerns and posture. Feedback from SMBs across multiple industries and countries confirm security teams and the C-suite are worried about increasingly sophisticated and relentless attacks.

Ransomware is a top concern for SMBs:

An overwhelming majority (88%) of SMBs indicated they are concerned or extremely concerned about an attack impacting their businesses. This worry is heightened by increasing geopolitical tensions. In fact, more than half (52%) of respondents now feel more at risk of suffering a ransomware attack due to these unfolding events.

SMBs’ ransomware concerns are already becoming a reality. Nearly half (46%) of SMBs have experienced a ransomware attack. Meanwhile, 66% of respondents are not confident or only somewhat confident that they can fend off a ransomware attack. Budget constraints and small security teams were cited as the primary roadblocks.

Despite concern, security awareness training is infrequent:

The vast majority of SMBs believe a successful ransom attack is the result of someone clicking on a malicious link or opening an email attachment. Yet despite this knowledge of users as the preferred attack surface, many SMBs (based on action) don’t view their employees as a first line of defense.

Sixty-seven percent of SMBs conduct security awareness training twice a year or less. Of these SMBs, 31% conduct security awareness trainings only once a year; 10% only if an employee fails a phishing test.

Fear of small security budgets getting smaller:

Sixty-seven percent of SMBs spend less than $50,000 annually on cybersecurity. While 59% reported plans to increase their security budget in 2023, 57% fear inflation will lead to a change in plans resulting in budget cuts.

SMB security teams are spread thin; MSPs are an appealing option:

The majority (68%) of SMBs have fewer than five people on their security team. To help alleviate resource constraints, more than half (58%) of respondents use external security management support. In the future, 65% of SMBs that don’t currently use a managed services provider (MSP) for their security needs would consider doing so.

Fighting more, with less

Adversaries have become increasingly sophisticated and relentless as the surface area of attacks only grows. Meanwhile, fear of looming budget cuts impacting already over-stretched security teams put SMBs in a vulnerable position.

Ongoing education and awareness of new attack vectors and defense against common channels such as email are critical for achieving a cyber resilience posture. Monthly phishing simulations are a great way to keep users current and accountable. A multi-layered approach that includes email security, DNS filtering, endpoint protection, and backup and recovery is essential to mitigating risk and exposure from attacks.

To learn more, go to: https://www.opentext.com/products/security-cloud

How to stop social engineering tactics

Aug 24, 2022 | Business + Partners, SMBs

With social engineering now the #1 cause of cyberattacks, it’s imperative for you to learn how to stop social engineering attacks against your business.

Your first step in stopping them is to learn what they are and how they work. After that, you need to learn how combining security layers like Endpoint Protection and Email Security makes the best defense.

Read on and we’ll walk you through every step of the way.

What is social engineering and how does it work?

Social engineering tactics are based on a simple truth: it’s easier to hack a human than it is to hack a computer. That means social engineering attackers use deception and tricks to get their victims to willingly give up private information like logins, passwords and even bank info.

Phishing is the most common type of social engineering attack, and it works by disguising emails as someone or something you trust. We would never click on an email with the subject line “Click here to get hacked,” but we might click on an email titled “Your Amazon purchase refund – claim now.”

Why does combining security layers prevent social engineering?

Forrester unleashed their researchers to find the best defense against social engineering. They recommend layered defenses for preventing social engineering strategies like phishing.

Because social engineering attacks prey on the human element of cybersecurity, they’re very good at getting around single layers of protection. After all, locked doors only work when the bad guys don’t have a copy of the key.

But if your business is protected by both Email Security and Endpoint Protection, attackers can trick their way into an employee’s email password and still be foiled by Endpoint Protection. Or they might gain access to your network with an illicitly gained password, but Email Security stops their attack from spreading.

Stop social engineering

Now that you know how social engineering works and the best defense against this type of cyberattack, you’re well on your way to stopping social engineering.

The next step is making sure you have the right tools to stop cybercriminals in their tracks. Review your cybersecurity strategy to make sure you have multiple layers of protection like Email Security and Endpoint Protection.

Interested in achieving cyber resilience and gaining a partner to help stop cyberattacks? Explore Webroot Endpoint Protection and Webroot Email Security powered by Zix.

Top 5 Security Trends this Summer: RSA Conference & Black Hat 2022

Jul 25, 2022 | Business + Partners, Threat Intelligence

The RSA Conference 2022 – one of the world’s premier IT security conferences – was held June 6th-9th in San Francisco. The first in-person event for RSA since the global pandemic had a slightly lower turnout than in years past (26,000 compared to 36,000 attendees). But attendees and presenters alike made up for it with their eagerness to explore emerging IT security trends that have developed over the past year – a venue like RSA Conference 2022 delivered on tenfold.

Following the remote work pivot we saw in 2020, IT security has had to evolve quickly to remain effective, flexible and resilient in today’s dynamic hybrid/remote work environments. This year’s RSA Conference and the upcoming Black Hat USA 2022 in August are providing vital venues for IT security pros and business leaders to address challenges in today’s rapidly evolving security landscape.

Here are some of the key trends which we observed at this year’s first marquee cybersecurity event post-pandemic:

1. Market landscape for XDR grows more crowded

RSAC was abuzz with numerous security providers – large vendors and small start-ups alike – promoting capabilities and options offering new flavors of EDR and MDR. Based on the customer and analyst interactions, it was evident that the definition of XDR is still evolving, and that customers are still trying to determine what is the best solution for their specific use case.

Most customers alluded to the cybersecurity skills shortage; one of the key market drivers remains a “managed” component tailored to organizations’ response capabilities. As the sophistication of malicious actors is growing rapidly, fundamentals such as initial compromise detection and lateral movement prevention still seem to define customers’ preferences.

2. Threat intelligence becomes key to addressing workforce gap

With new threats emerging daily, the industrywide shortage of skilled professionals is placing additional stress on security teams. Threat intelligence solutions using AI/ ML technologies can prevent false positives and reduce alert fatigue – helping cybersecurity professionals focus on strategic priorities instead of spending all their time reacting to security alerts and potential incidents.

We have seen this trend building over the years as increasing numbers of security appliance vendors have come to rely on our BrightCloud^® Threat Intelligence for its accuracy, depth and contextual intelligence in order to stay a step ahead of a rapidly evolving threat landscape.

3. Cyber insurance becomes mainstream discussion

As cyberattacks have become more costly and more challenging to track, cyber insurance has gained prominence across the industry. Unfortunately, as cyber risks mount, insurers are raising prices for coverage, requiring customers to answer lengthy questionnaires and limiting who they provide cyber insurance coverage to.

The cyber insurance market is expected to reach around $20B by 2025. However, as MSPs and customers look to cyber insurance to manage their risk exposure, more emphasis is expected on the fine print of the coverage – in particular, on exclusions and limits around brand reputation and restoring normal operations.[NL1]

4. Business Email Compromise gains prominence

Although there is a mounting body of evidence that shows ransomware is and will continue to be a concern for businesses, there’s also an argument to be made for an eventual slowdown in ransomware attacks. As discussed at this year’s RSA conference, many preventative measures such as law enforcement crackdowns, tighter cryptocurrency regulations and ransomware-as-a-service (RaaS) operator shutdowns are putting pressure on ransomware perpetrators.

Phishing has now become the most popular avenue of attack for hackers because it’s relatively easy to trick people into clicking on malicious links. 96% of phishing attacks are sent via email – and 74% of US businesses have fallen victim to phishing attacks. This is what prompted the FBI to issue a warning about the $43B impact of Business Email Compromise (BEC) scams.

5. Cyber Resilience planning puts focus on recovery readiness

The growth in digital attack surfaces has added a new dimension to traditional data protection approaches in terms of compliance with emerging regulations. This theme was validated in the day-two keynote, where panelists reiterated the importance of data protection and governance in the context of privacy.

This year, ransomware events have increased by more than 10%, and the average cost of a data breach to organizations has risen to $4.2 million. Customers are increasingly taking steps to protect their data, with an emphasis on recovery and minimizing downtime. This growing focus on becoming cyber resilient is a wise course of action in a threat landscape in which malicious actors only need to get lucky once!

Can your business stop social engineering attacks?

Jul 6, 2022 | Business + Partners, SMBs

Social engineering attacks like phishing, baiting and scareware have skyrocketed to take the top spot as the #1 cause of cybersecurity breaches.

So what makes social engineering so effective? When cybercriminals use social engineering tactics, they prey on our natural instinct to help one another. And as it turns out, those instincts are so strong that they can override our sixth sense about cybercrime.

But our urge to help people isn’t the only thing driving social engineering. Criminals are using new methods that target the vulnerabilities of hybrid workforces. These new tactics circumvent single layers of security and are so successful, cybercriminals are using them to target office workers.

Read on to learn how social engineering works, how to spot social engineering and how to stop social engineering.

How does social engineering work?

Social engineering is a type of cyberattack where criminals use deception to trick their victims into voluntarily giving up confidential information.

Here are some common social engineering tactics:

Using social media to find personal information. Criminals are heading to social media sites liked LinkedIn to find their next victim – and they’re using any personal information they find to craft convincing phishing emails.
Impersonation. Cybercriminals are taking advantage of the anonymity that comes with hybrid work arrangements to impersonate people. If you’ve never met anyone in your IT department it’s hard to know when someone is impersonating them.
Targeting personal devices used for work. With the hybrid work boom here to stay, the lines between work and home life are blurring. Employees are now using work devices for personal matters and personal devices to connect to work. The problem? Personal devices often lack robust security.

How to spot social engineering

So how do you spot social engineering scams? Here are some of the tell-take signs you’re being targeted:

Asking for log-in information. If you get a message asking you for log-in credentials – even if it’s from a trusted source – you’re probably the target of a social engineering attack. There’s no reason why someone else needs your login info, even if it’s your boss or your IT department.
Urgently asking for money. Along the same lines, there’s almost never a reason why someone – even someone you know – would urgently need money.
Asking to verify your information. This type of social engineering asks victims to verify their info to win a prize or a windfall. But even if the message is coming from a legitimate organization doesn’t mean it isn’t a scam with criminals spoofing an email or impersonating a business.

How to stop social engineering attacks

Now that you’ve learned the newest tactics and how to spot social engineering, all you need is to learn how to stop it.

Forrester recommends layered defenses for preventing social engineering strategies like phishing.* That’s because most social engineering attacks are so good at getting past single layers of cyber protection.

You and your business can stay safe from social engineering scams by combining Endpoint Protection and Email Security. You gain even more protection if you are able to add on Security Awareness Trainings and DNS Protection.

Each layer you add gives you a better chance of stopping social engineering tactics.

Want to learn more about social engineering and how to stop it?

Read the infographic

Webroot managed detection and response (MDR) purpose-built for MSPs

Jun 2, 2022 | Business + Partners, Managed Service Providers

The cyber threat landscape keeps evolving at lightning-speed. According to the latest 2022 BrightCloud® Threat Report, small to medium-sized businesses (SMBs) are particularly vulnerable to becoming a victim of a ransomware attack. Cybercriminals also are becoming more selective of the organizations they target. Without human security experts and solutions at their disposable, these businesses remain susceptible to attacks.

As an MSP, there’s never been a better time to partner with a leading MDR provider to help protect your SMBs against cyberattacks. Minimize business operational disruption, maximize ongoing business continuity and bolster customer confidence with Webroot MDR.

What is MDR?

MDR is an approach to proactively manage threats and malicious activity that empowers organizations to become more cyber resilient. MDR services offer threat detection and response capabilities by augmenting cybersecurity tools with human security intelligence. Leveraging this human security expertise, MDR integrates, synthesizes and contextualizes security and other event information to hunt for, understand and respond to security incidents. This allows MSPs to offer the best combination of human expertise and a robust technology stack to help small businesses defend against future attacks.

Since MDR helps to close the gap between detection and response to threats, SMBs greatly benefit from this solution. As an MSP, you are the trusted advisor to provide your SMBs with an MDR solution to help boost their overall security stack and embrace cyber resilience.

Why should MSPs choose Webroot MDR?

SMBs are often attractive targets for bad actors looking to steal valuable data, extort money from their victims and more. We know there are many MDR solution providers on the market. However, Webroot MDR powered by Blackpoint provides a unique offering in the marketplace.

Here’s what separates Webroot MDR powered by Blackpoint from the competition:

The fastest time in the industry from threat detection to response in 9 minutes
A patented SNAP-Defense platform recognized by Gartner
Best-in-class AI augmented by NSA security experts
A competitively priced offering with unique threat detection and response capabilities

As an MSP, making the choice to purchase Blackpoint MDR through Webroot gives you:

Seamless integration between Webroot and Blackpoint agents for quicker event investigation
Accurate and timely insights from the BrightCloud® Threat Intelligence platform
One-stop shop for cyber resilience that includes MDR
Potential to obtain and lower cyber insurance costs

Ransomware, malware and phishing threats keep evolving. Your SMB customers likely don’t have the necessary security staff and tools to protect and respond to these threats. Help your customers avoid becoming a victim of data theft and extortion with industry-leading, reliable threat detection and response from Webroot. Our MDR solution can help reduce the impact of successful attacks.

Ready to discover what Webroot MDR can do for you and customers? Tune into our latest webinar.

Learn More

Improved functionality and new features to help enhance the user experience

May 19, 2022 | Business + Partners, Managed Service Providers, SMBs

Webroot Console 6.5 is here

To help get us closer to retiring the Endpoint Protection Console, we’ve introduced three new functionality features with Webroot Console 6.5.

Friendly name support

To improve overall user functionality within the existing Endpoint Console, we have introduced a naming convention feature that allows users to assign a device a ‘Friendly Name’ that will replace the original Hostname associated with a device. All devices renamed within the Endpoint Console will see this naming convention reflected in the Management Console, allowing users to manage devices without having to navigate down to the Endpoint Console.

Persistent states

To further improve the user experience, the sites and entities pages has been improved with the introduction of persistent states. This introduction allows filters and searches to persist across a user’s session. Admins can seamlessly navigate away from a page and return to the view they were previously working with. This type of functionality will be introduced across other areas of the console in future releases.

Site only Admin view

This release brings forth a new look and feel for Site Only Admins to help align with the rest of the Webroot Management Console. This view represents the beginning for Site Only Admins. Admins will still have access to the Endpoint Protection Console during the uplift process in upcoming releases.

The release of Webroot’s latest console provides users with a simplified and centralized management system, intuitive user experience and enhanced visibility.

Visit our portal to get the latest Webroot updates in real-time.

Browse the status of product updates and enable delivery notifications.

Soaring ransomware payments, consistent infections, deceptive URLs and more in this year’s 2022 BrightCloud® Threat Report

Apr 4, 2022 | Business + Partners, SMBs, Threat Intelligence

Cyber threats are becoming increasingly difficult to detect. Cybercriminals are also becoming experts in deception. What does this mean for your business? How can you keep your family members safe online and reassure your customers you are protecting their data?

Our threat research analysts have complied the latest threat intelligence data to bring you the most cutting-edge and insightful information about the most recent cyber threats and what they mean for you.

Below is a summary and sneak peek from the full report.

Malware

Whether you operate a business or spend time online surfing the web, malware remains a concern. In the last year, 86% of malware remained unique to a PC, which has been consistent for the past few years. This implies attackers are obtaining a level of consistency in what they do to avoid being caught.

While the goal of spreading infection is top of mind for a bad actor, infection rates are not equal. When we examined the trends between businesses and consumers, there are some marked differences:

53% of consumer PCs were infected more than once, but businesses lag behind migrating from Windows 7, leaving them more suspectable to infection.
For medium-sized organizations (21 to 100 licensed PCs) infection rates are just over one-third (34%), infecting nine PCs on average.
The manufacturing, public administration and information sectors experienced higher-than-average infection rates.

If your business falls within these industries or if you’re concerned your personal PC could be prone to infection, read the complete section on malware in the 2022 BrightCloud® Threat Report. It’s chock full of insights into the differences in infection rates by type of PC, region and industry.

Skyrocketing ransomware payments will cost more than just your revenue

If you’re a small business owner, you don’t need to be told that you’ve suffered immensely throughout the pandemic. Exposure to ransomware is just another element you’ve had to consider. Ransomware continues to plague small to medium-sized businesses (SMBs). While this is not a new revelation, the smallest organizations, those with 100 employees or less, accounted for 44% of ransomware victims last year.

That’s nearly half.

Why do cybercriminals focus on SMBs? Attacks on larger enterprises and state-owned entities bring a level of publicity and attention that makes it harder for bad actors to achieve their goal of a financial payout. SMBs, given the lack of resources to respond, are more likely to pay and pay a lot. The year-end average for 2021 more than doubled the 2020 average, reaching $322,168. With limited resources at their disposal, the smallest of organizations are faced with tough decisions ahead when it comes to making ransomware payments and disclosing their decision to do so.

Law enforcement agencies are starting to gain headway on ransomware gangs. To learn how countries are banding together to shutdown notorious groups like REvil and DarkSide, check out the ransomware section of the full report.

High-risk URLs are phishing for your data in the most benign of locations

We discovered four million new high-risk URLs were in existence in 2021. To make matters worse, almost 66% of them involved phishing. Cybercriminals look to certain times of the year to execute their attacks. They are also keen to impersonate well-known brands to lure you into clicking on malicious links. Our complete list of top brands that are most impersonated is available in the phishing section of our full report.

Thwarting cyber threats through cyber resilience

“Businesses’ ability to prepare for and recover from threats will increase as they integrate cyber resilience into their technologies, processes, and people,” said Mark J. Barrenechea, OpenText CEO & CTO. “With security risks escalating worldwide and a persistent state of ‘unprecedented’ threats, compromises are inevitable. This year’s findings reiterate the need for organizations to deploy strong multi-layered security defenses to help them remain at the heart of cyber resilience and circumvent even the most creative cybercriminals.”

Our full report helps you uncover the latest cyber trends powered by our BrightCloud® Threat Intelligence platform.

To learn more and empower your cyber know-how, download the 2022 BrightCloud® Threat Report.

World Backup Day reminds us all just how precious our data is

Mar 25, 2022 | Business + Partners, Featured Posts, SMBs

What is backup?

Simply put, backup is a copy of your files. Think of your family photos, home videos, tax information and other important documents. Typically we compile these files on our computer. Without backing these files up, they can get lost or stolen.

Why backup?

Backup enables you to keep your data accessible and secure. There are so many ways your personal files or business documents could experience data loss. It could simply be a result of human error. Data loss can also occur as a result of falling victim to ransomware, malware or phishing. According to the 2022 BrightCloud® Threat Report, medium-sized organizations (21 to 100 licensed PCs) experienced malware infection rates that affected nine PCs on average last year. To make matters worse, BrightCloud® Threat Intelligence also revealed four million new high-risk URLs were in existence in 2021 and almost 66% of them involved phishing. Whether you have important files stored on your personal or business computers, your data remains at risk.

“The possibility of data loss and theft should be top of mind for individuals and businesses. Our increased reliance on digital files, the rise in cyber attacks, human error and natural disasters are just a few examples of how your data remains highly vulnerable,” says Tyler Moffitt, senior security analyst at Carbonite + Webroot, OpenText Security Solutions.

Take control of your data through backup

Beginning the backup process can be daunting. Whether you’re looking to back up your family’s documents or your mission-critical business files, it’s important to consider:

Where will you back up your data? There are a number of backup options. From external hard drive to the cloud, there are many ways to prevent loss. It’s important to find a solution that fits your needs.
What is your retention policy? A retention policy allows you to keep certain backups for a longer period of time. For instance, a business may decide it’s necessary to keep daily backups for a total of 30 days, but a family may choose to hold onto all their family photos for months before archiving.

Say goodbye to data loss with Carbonite

Even though there are many ways to back up your data, not all options are created equal. For instance, storing your personal files on an external drive can backfire if the drive becomes corrupt or lost. As more of our data exists online, it’s important to consider cloud-based options.

Many vendors in the market offer cloud backup solutions for your home or business. But it’s important to find a reliable and trusted provider. Carbonite is an award-winning, industry leader with reliable backup solutions. Over one million people trust Carbonite to protect their digital lives. Carbonite offers automatic, dependable and convenient backup for all of your devices and hard drive files.

Make data backup a priority

World Backup Day is an important reminder to preserve our data. As the threat landscape continues to evolve, backing up your files becomes part of a larger cyber resilience strategy. Cyber resilience is a defense in depth strategy that helps ensure continuous access to your personal and business data no matter what happens.

Carbonite offers solutions for consumers and businesses. Discover which of our plans is right for you.

Own a small business and need data backup? Discover Carbonite Safe® for professionals.

Kick start your backup journey today. To understand your backup needs, begin with our quick assessment. We’ll help you pinpoint the level of backup you need. We’ll also give you an opportunity to experience it without commitment.

Start a free trial today and discover for yourself how simple it is to back up your data with Carbonite.

Protect From Cyberattacks With These 6 Steps For Cyber Resilience

Feb 24, 2022 | Business + Partners, SMBs

Making the case

The pros behind Carbonite + Webroot joined forces with industry leading researchers at IDC to develop an easy-to-understand framework for fighting back against cybercrime. The results? A 6-step plan for adopting a cyber resilience strategy meant to keep businesses safe.

IDC looked into the data and past the alarming headlines with million-dollar ransom payments and crippling supply chain attacks.

The facts they found are eye-opening and underline why cyber resilience is the best strategy:

less than 2% of full-time staff at SMBs are dedicated to tech
30% of companies that paid a ransom forked over between $100,000 and $1 million
56% of ransomware victims suffered at least a few days or a week of downtime

Of course, the best strategies can’t help anyone who doesn’t adopt them. So IDC also compiled tips for communicating with businesses. Whether you’re an MSP, an IT pro or just a friend, you can use these tips to help convince the underprepared that they need a cyber resilience strategy.

The 4 reasons why cyber resilience makes sense

IDC researchers make an iron-clad case for cyber resilience by looking at the current state of cybercrime. The found 4 main reasons why businesses need a cyber resilience framework:

Crippling cyberattacks are on the rise. Evolving methods and sophisticated tactics make cybercrime a booming business for criminals.
A distributed IT footprint brings greater risk. The onset of hybrid work opens new pathways ready to be exploited. And let’s face it, the average home WiFi doesn’t have the right kind of security.
IT departments are stretched thin. Less than 2% of SMBs’ total employee base is dedicated to full-time IT staff.*
Consequences of an attack remain dire. Attacks continue to reverberate past the day of a breach, with 55% of ransomware victims suffering a few days to a week of costly downtime.**

The right tools can fight back

But it’s not all bad news. Adopting the right strategy and the right tools sets you on the road to protecting your business. The headlines are scary and the stats are alarming, but they’re not prophecy. Businesses don’t have to live in fear of falling victim to cyberattacks.

From framework to action

IDC goes in depth for the steps businesses can take to adopt cyber resilience. Here’s a quick preview of the framework:

Identify. You can’t protect what you haven’t first identified.
Protect. Employees and their devices are cybercriminals’ first targets. Protect them and start a systematic file and backup system.
Detect. Threat intelligence and experience-based detection can thwart even the most sophisticated attackers.
Respond. It’s imperative to stop attackers’ advances before real harm occurs.
Recover. Clean up infected devices, close backdoors and have a plan to recover damaged or out-of-commission assets.
Educate. Empower your employees to form a citizen army of cybersecurity checkpoints.

Combining powers to form the best defense

IDC also suggests the best ways that businesses can take action to protect themselves. By combining the powers of outside help with in-house know how, businesses benefit from the best of two worlds.

Ready to start protecting yourself and your business? Explore how Carbonite + Webroot provide a full range of cyber resilience solutions.

Download the IDC report.

* IDC’s Worldwide Small and Medium Business Survey, 2020

** IDC, Future Enterprise Resiliency & Spending Survey Wave 6, July 2021, IDC’s 2021 Ransomware Study: Where You Are Matters!

Security awareness training: An educational asset you can’t be without

Jan 19, 2022 | Managed Service Providers

The onset of COVID-19 accelerated growth of the digital nomad. No longer just for bloggers and influencers, the global workforce is increasingly becoming more highly connected and widely dispersed. As workforces become more globally linked, businesses large and small need to protect themselves from evolving threats. Employees represent the first line of defense from malicious vectors that attempt to compromise your organization’s information technology infrastructure through common access points.

With approximately 1 in 10 malicious sites hosted on a benign domain, could you spot the difference? Being aware is the first step towards protecting your business. Security awareness training (SAT) can help.

What is Security Awareness Training?

Security awareness training is a proven, knowledge-based approach to empowering employees to recognize and avoid security compromises while using business devices. Through a series of effective delivery modules, SAT provides employees with relevant information and knowledge on topics like social engineering, malware, compliance and information security.

Effective security awareness training can significantly boost your organization’s security posture. Simply put, this type of training empowers your team to remain vigilant against cyber scams or attacks that prey on human error.

Why Webroot?

Webroot® Security Awareness Training offers your business an easy to implement training program that helps to reduce the risk of security breaches. Through a series of simulations based on real-world attacks, employees gain the know-how to spot common scams, including phishing attempts that could wreak havoc on your IT infrastructure. Webroot’s training has been recognized as a Strong Performer in The Forrester Wave™: Security Awareness and Training Solutions category. Our industry-first, global management features allow you to spend less time deploying our solution and more time reaping the benefits for your business.

Here’s why Webroot® Security Awareness Training adds value:

Proven efficacy. With computer-based training, your employees will be able to drastically reduce the odds of clicking on a malicious link within a short period of time.

Relevant and current effective training. Experience over 120 courses at one inclusive rate. Course topics include cybersecurity, phishing and General Data Protection Regulation (GDPR). Webroot has 85 micro learning modules that can be completed in 10 minutes or less. With multiple media formats, extend your reach with infographics, videos and posters.

Fully customizable phishing simulator. Over 200 real-world templates for everyday scenarios, including shipping alerts, vendor invoices, missed delivery, human resource policy changes, account lockout, critical software updates and more.

Trackable campaigns. Successfully monitor and track your employees’ success within a built-in learning management system (LMS). LMS automatically keeps track of participation, sends reminders and schedules reports for review. Reports can be shared with management to show progress and accountability.

Give your employees the know-how to combat cyber threats

To reduce infections, cut downtime and ensure your business remains resilient against evolving cyberattacks, security awareness training is a must. From compliance training to spotting phishing attacks, training is a critical element of developing and maintaining a robust cyber resilience posture.

Maximize your ability to protect your business with security awareness training. Whether you’re an enterprise, SMB or MSP, make security awareness training part of your regular cyber education routine.

Prevent costly security breaches with Webroot® Security Awareness Training.

To get started with a free trial, please visit, https://www.webroot.com/ca/en/business/trials/security-awareness

Pro tips for backing up large datasets

Jan 19, 2022 | Business + Partners, SMBs

Successfully recovering from disruption or disaster is one of an IT administrator’s most critical duties. Whether it’s restoring servers or rescuing lost data, failure to complete a successful recovery can spell doom for a company.

But mastering the recovery process happens before disaster strikes. This is especially true for large datasets. Our breakdown is here to help you along the way. We also have an even more detailed walkthrough for how to back up large datasets.

Large datasets have lots of variables to consider when figuring out the ‘how’ of recovery. After all, recovery doesn’t happen with the flip of a switch. Success is measured by retrieving mission critical files in the right order so your business can get back to business.

5 essential questions to ask before backing up large datasets

IT pros know that a successful recovery takes trial and error, and even a bit of finesse. And with many things in life, a bit of preparation can save a lot of downtime. So before you start, ask yourself these questions:

What’s my company’s document retention policy? (And don’t forget regulatory requirements like GDPR)

First, you need to ensure you satisfy your company’s retention policy and that you’re in compliance with any regulatory requirements when choosing what to backup. Before sifting through your data and making hard decisions about what to protect, you need to take this important step to make sure you don’t run afoul of legislation or regulations.

Which data is mission critical to the business?

Once in full compliance with company policies and regulations, it’s time to highlight any data that affects the operations or the financial health of the business. Identifying mission critical data allows you to prioritize backup tasks based on desired recovery options.

You can also exclude data that isn’t mission critical and isn’t covered by regulations from regular backup scheduling. Any bandwidth you save now will give you added flexibility when you make it to the last step.

What types of data do I have (and can I compress it)?

Data is more than 1s and 0s. Some datasets have more redundancy than others, making them easier to compress while images, audio and video tend to have less redundancy. Your company might have a lot of incompressible images leading you to utilize snapshot or image backup. This allows you to move large datasets over a network more efficiently without interrupting critical workflows.

How frequently do my data change?

The rate of change for your data will determine the size of your backups and help you figure out how long it will take to recover. That’s because once you have an initial backup and complete the dedupe process, backups only need to record the changes to your data.

Anything that doesn’t change will be recoverable from the initial backup. Even with a very large dataset, if most of your data stays static then you can recover from a small disruption very quickly. But no matter the rate of change, anticipating how long it will take to recover critical data informs your business continuity plans.

What size backup will my network support?

Bandwidth capacity is a common denominator for successful recoveries. It’s important to remember that you can only protect as much data as your network will allow. Using all your bandwidth to make daily backups can grind business to a halt. This is where your preparation can help the most.

Once you’ve answered the first four questions, you should know which data need to be accessible at any hour of the day. You can protect this data onsite with a dedicated backup appliance to give you the fastest recovery times. Of course, you’ll still have this data backed up offsite in case a localized disaster strikes.

Explore Carbonite plans

Money matters

IT assets cost money and often represent large investments for businesses. New technologies bring advancements in business continuity but can also add complications. And to top it all off, IT ecosystems increasingly must support both legacy technology and new systems.

Some vendors are slow to adapt new pricing models that fit with emerging technologies. They add on excessive overage charges and ‘per instance’ fees. This adds costs as businesses scale up their environments – more servers, databases and applications increasingly escalate prices.

Finding the right partner

That’s why it’s so important to work with a vendor that offers unlimited licensing. You’re empowered to protect what you need and grow your business without worrying about an extra cost. Most importantly, businesses shouldn’t have to skimp on protection because of an increase in price.

Time to get started

Protecting large datasets goes beyond just flipping a switch. Preparation and careful consideration of your data will help you land on a strategy that works for your business.

Interested in learning more about Carbonite backup plans?

Explore our industry leading solutions and start a free trial to see them in action.

2022: The threat landscape is paved with faster and more complex attacks with no signs of stopping

Jan 7, 2022 | Business + Partners, Threat Intelligence

2020 may have been the year of establishing remote connectivity and addressing the cybersecurity skills gap, but 2021 presented security experts, government officials and businesses with a series of unprecedented challenges. The increased reliance on decentralized connection and the continued rapid expansion of digital transformation by enterprises, small to medium-sized businesses (SMBs) and individuals, provided cybercriminals with many opportunities to exploit and capitalize on unsuspecting businesses and individuals. With nothing short of a major financial windfall waiting in the midst, numerous organizations and individuals fell victim to the mischievous efforts of malicious actors.

Threats abound in 2021

In 2021, we witnessed so many competing shifts, many of which we detailed early on in our 2021 BrightCloud® Threat Report. In particular, we witnessed an increase in distributed denial of service (DDoS) attacks and a surge in the usage of the internet of things (IoT). For enterprises, SMBs and individuals that entrust IoT devices for work and entertainment, this opens up vulnerabilities to malicious vectors that take advantage of unprotected blind spots and wreak havoc.

The cybercrime marketplace also continued to get more robust while the barrier to entry for malicious actors continued to drop. This has created a perfect breeding ground for aspiring cybercriminals and organized cybercrime groups that support newcomers with venture capitalist-style funding.

Suffice to say, a lot has been happening at once.

Below, our security experts forecast where the main areas of concern lie in the year ahead.

Malware

Malware made leaps and bounds in 2021. In particular, six key threats made our list. These dark contenders include LemonDuck, REvil, Trickbot, Dridex, Conti and Cobalt Strike.

“In 2022, the widespread growth of mobile access will increase the prevalence of mobile malware, given all of the behavior tracking capabilities,” says Grayson Milbourne, security intelligence director, Carbonite + Webroot, OpenText companies. Malicious actors will continue to improve their social engineering tactics, making it more difficult to recognize deception and make it increasingly easier to become a victim, predicts Milbourne.

Ransomware

Earlier in 2021, we detailed the hidden costs of ransomware in our eBook. Many organizations when faced with an attack, gave into the demands of threat actors, paying hundreds of thousands of dollars on average. Since mid-October 2021, there have been more than 25 active strains of ransomware circulating. The evolution of ransomware as a service (RaaS) has vastly proliferated. Conti, in particular, continues to be the more prevalent ransomware affecting SMBs.

“As the year progresses, we will likely see faster times to network-wide deployment of ransomware after an initial compromise, even in as little as 24 hours,” says Milbourne.

“Stealth ransomware attacks, which would deploy all the necessary elements to control, exfiltrate and encrypt key assets of an organization but do not execute until there is no alternative, will likely continue to proliferate,” says Matt Aldridge, principal solutions consultant at Carbonite + Webroot. “This approach will be used to get around restrictions on reporting and on ransomware payments. Criminals can extort their targets based on the impending threat of ransomware without ever having to encrypt or exfiltrate the data. This could lead to quicker financial gains for criminals, as organizations will be more willing to pay to avoid generating awareness, experiencing major downtime or incurring data protection fines,” forecasts Aldridge.

Cryptocurrency

There was no shortage of discussion surrounding cryptocurrency and its security flaws. The rise of exchange attacks grew, and quick scams reigned. The free operation of cryptocurrency exchanges and marketplaces will be significantly impacted by government regulation and criminal investigation in 2022, especially in the United States.

“This year, we will likely see new threat actors become strategic in their cost-benefit analysis of undertaking long-term mining versus short-term ransomware payments. The focus will likely fall to Linux and the growth of manipulation of social media platforms to determine price,” predicts Kelvin Murray, senior threat researcher, Carbonite + Webroot.

Supply chain

“Simply put, attacks on the supply will never stop; it will only get worse,” says Tyler Moffitt, senior security analyst at Carbonite + Webroot. Each year the industry gets increasingly stronger and more intelligent. Yet every year, we witness more never-before-seen attacks and business leaders and security experts are constantly looking at each other thinking, “I’m glad it wasn’t us in that supply chain attack,” continues Moffitt.

General Data Protection Regulation (GDPR) fines have more than doubled since they came out a few years ago just as ransom amounts have increased. These fine values have also been promoted on leak sites. Moffitt predicts GDPR will continue to increase their fines, which may serve to help, instead of thwart, the threat of ransomware extortion.

Phishing

Last year, we forecasted phishing would continue to remain a prevailing method of attack, as unsuspecting individuals and businesses would fall victim to tailored assaults. In our mid-year BrightCloud® Threat report, we found a 440% increase in phishing, holding the record for the single largest phishing spike in one month alone. Industries like oil, gas, manufacturing and mining will continue to see growth in targeted attacks. Consumers also remain at risk. As more learning, shopping and personal banking is conducted online, consumers could face identity and financial theft.

What to expect in 2022?

The new year ushers in a new wave of imminent concerns. In 2022, we expect to see an increased use of deepfake technology to influence political opinion. We also expect business email compromise (BEC) attacks to become more common. To make matters worse, we also foresee another record-breaking year of vulnerability discovery which is further complicated by bidding wars between bug bounty programs, governments and organized cybercrime. Most bug bounties pay six figures or less, and for a government or a well-funded cybercrime organization, paying millions is not out of reach. Ultimately, this means more critical vulnerabilities will impact individuals and businesses. The early days of 2022 will also be compounded by the discovery of Log4j bugs hidden within Java code.

“The critical vulnerability identified within Log4Shell is a great example of how attackers can remotely inject malware into vulnerable systems. This active exploitation is happening as we speak,” says Milbourne.

The key to preparing for the plethora of attacks we will likely witness in 2022 is to establish cyber resilience.

Whether you’re looking to protect your family, business or customers, Carbonite + Webroot offer the solutions you need to establish a multi-layer approach to combating these threats. By adopting a cyber resilience posture, individuals, businesses small and large can mitigate risks in the ever-changing cyber threat landscape.

Experience our award-winning protection for yourself.

To learn more about Carbonite and begin your free trial, please click here.

To discover Webroot’s solutions for yourself, begin a free trial here.