Cyber Security

Network Security is the Biggest Threat to Your Business Relationships!

Network Security Risks: Your Clients, Vendors, and You!

Did you know the average hacker lives on your network for 9-months before being detected?  That is 9 months of cybercriminals digging into your financials, human resources information, and intellectual property!  Further, if your business is storing, accessing, or transmitting client or patient data, you legally responsible for securing those records.  As a result, clients, prospects, and patients will now view you as a security risk for sensitive information.

History of Network Security for Small- and Medium-Sized Businesses (SMB)

In the past, managed security was unaffordable to SMBs.  However, in recent years, the cost has come down significantly.  More importantly, managed security technology has advanced tremendously.  Therefore, small- and medium-sized businesses no longer have to rely on the basic block and tackle security techniques.  Instead, they can now armor their network with the most advanced security measures.

Do Criminals Want SMB Data?

Remarkably, the average SMB CEO claims hackers are not interested in their small company.  Yet, that is exactly what makes them a great target.  According to the Ponemon Institute, 69% of targeted attacks were SMBs.  Even more daunting is the fact that 60% of SMB businesses never recover from a severe cyberattack.  Therefore, network security is a must-have for all businesses that rely on their data, regardless of size.

Are You Responsible for Your Clients’ Data?

Unfortunately, a lack of security does not just put your data at risk.  In today’s world, many businesses are trusted with sensitive information that belongs to another company.  For this reason, supply-chain network security has become a mandatory requirement for vendors who want to do business with enterprise or government entities.  Specifically, these are vendors who have access to, transmit, or store their sensitive data.

Similarly, the HITECH Act requires all covered entities (healthcare providers) to adopt Business Associate Agreements.  This can be found in the HIPAA Risk Assessment Administrative Safeguards.  In short, this rule makes the vendors equally responsible for protecting patient data.

In addition, you should also take precautions if your business captures individuals’ personal information.  Examples include:

  • Credit Card/Debit Card Information
  • Social Security Numbers
  • Phone Numbers
  • Addresses
  • Drivers License Number
  • Passwords
  • Banking Information
  • Your employees’ personal information

It is a good exercise to think through all the companies you share this information with.  Examples include telemarketers, HR companies, data analysts, etc.  Next, take precautions to ensure your vendors are safeguarding your company’s sensitive information.

Georgia State Security Breach Notification and Network Security

Interestingly, all 50 states have implemented Security Breach Notification Laws that require businesses to notify individuals when there has been a breach that involves personally identifiable information. Specifically, Georgia Security Breach Notification Law lists the types of data that make individuals most vulnerable. Additional requirements state a company “shall notify the information broker or data collector of any breach of the security of the system within 24 hours following the discovery.”

Therefore, it is not only in your best interest to perform a Risk Assessment on yourself, but also on every vendor you share sensitive information with. This is because regardless of who is at fault for the breach, your employees and clients will ultimately hold you responsible if you did not do your due diligence.

Root Cause of Most Data Breaches

Interestingly, negligent employees and contractors account for 62% of all data breaches.  Unfortunately, Ponemon Institute 2019 Global State of Network Security report states, “The biggest problem is not having the personnel to mitigate cyber risks, vulnerabilities, and attacks (77 percent of respondents). The next biggest challenges are insufficient budget (55 percent of respondents) and management having no understanding of how to protect against cyberattacks (45 percent of respondents).”  That is where INSI can help.

INSI Has Network Security Programs for SMBs

Fortunately, you do not have to go through this alone.  INSI has comprehensive Managed Security packages to help protect your sensitive data.  Examples include:

  • Security Information & Event Management (SIEM) – 24/7 real-time threat monitoring, event correlation, and incident response.
  • End-Point Managed Detection & Remediation (MDR) – The next level of anti-virus analyzes and monitors events on devices, detect threats, stops the threat, and guides you to remediation.
  • Risk Assessments – Identify strengths, weaknesses, opportunities, and threats (SWOT) to your network by using policy-based frameworks.
  • INSI Complete Security Package – includes a security audit, network security vulnerability assessment, semi-annual security check, biannual penetration test, phishing email test and training, quarterly security checks, staff training, antivirus monitoring, web content filtering, web protection, and spam protection.

Contact INSI today to find out more about our security offerings at 770-387-2424.

About INSI

Since 1995, INSI has been providing IT support to small- and medium-sized businesses (SMBs) in both Georgia and Alabama.  We offer Managed Services and our own unique INSI Customized IT™ package.  Additional services include hosting, disaster recovery, managed security and unified communications.

6 Security Tips for the Unprecedented Remote Workforce!

Remote Workforce Security Tips

Who would have suspected in February that, as early as March 18th we would all be working from home full-time, cyber-teaching our kids, and on government lock-down?  We are indeed working in unprecedented times.  Like it or not, it has indeed changed the way we see the world, both personally and professionally.

Remote Workforce Impact on Companies

While this time has been especially hard on each one of us as workers, it is equally as hard for companies.  Imagine not only having the responsibility of making enough profit to keep all workers on the payroll but also blindly trusting each worker to protect your company data in a different environment.

Unfortunately, one honest mistake could cost the company a fortune.  Therefore, the remote worker’s ignorance or unwillingness to adhere to cyber-security policies could negatively impact a company’s ability to stay afloat.  Clearly, these are trying times for all of us.  As a result, it is up to each one of us to do our part to keep our companies profitable.

Ways You Can Help Protect Your Company Data

There are several ways you can protect your companies data when working remotely.  This includes a combination of safe practices and good communication with your IT team.  After all, your IT team is always available to help you make the right decisions.  Below is a list of ways you can do your part to help protect the company’s data.

1. Use Your Company’s VPN When Working From Home

Interestingly, when you are at your office you are on a private network.  As a result, you can send and receive data without it going over the public Internet.  Likewise, remote users typically have access to a Virtual Private Network (VPN) that allows you to do the same remotely.  Obviously, this VPN is a major security vulnerability if you do not use a properly configured firewall.

So, how do you know if you are on your company’s VPN.  It’s simple.  You will know if you are using the VPN because you will access it under your Window’s Settings.  However, there may be several reasons your company does not have a VPN.  Examples include Software as a Service Applications, Office 365, and other secure data sharing.  Therefore, you should ask your IT department about VPN access if you do not see it as an option in your Windows Settings.  They will let you know if you need it or not.  If you do, make sure you always log on when performing work tasks.

2. Reach Out to Your IT Team Before Loading Software

Always remember that your computer is company property and it is is not yours to do with as you please.  Clearly, your IT team exists to both protect your company’s data and keep you productive.  Therefore, you should include them on any and all software download decisions.

Often times, free software is offered to exploit the end-user device.  When this happens, hackers access end-users’ computers as an entry point to all company data.  Therefore, if you download an infectious software, you are giving access to hackers.

3. Save All Work on Corporate Drives

If you’re like most people, you have lost an important file at some point in your life. Undoubtedly, even thinking about it will likely make your heart sink as you remember having to recreate it from scratch.  Now imagine losing all the files on your computer.  That’s the risk you take when you do not back up your files to the corporate drive.

Unfortunately, there are many things that can go wrong when an employee takes their computer home.  After all, you just don’t have the same protections.  For most companies, this includes everything from firewall protection to desktop backups, surge protectors, or even theft.  For this reason, it is vitally important that you store all your documents on the company drive and not your local hard drive.

At the corporate level, all your data is being backed up in case of a natural disaster, hackers, hard-drive failure, or theft. In fact, this is done on a nightly basis.  Yet, when you are not connected, everything is being stored on your local drive.  That’s why it is extremely important that all remote workers copy new files on the company drive every night before they quit work for the day.

4. Think Before You Click

It may be hard to believe, but nearly 95% of attacks on business networks are the result of successful phishing emails.  Even worse, the average cost to a mid-size company is $1.6 million.  This could come in the form of a text like smishing. It could be a targeted attack, that appears to come from a trusted source, like spear phishing.  Yet, they can even come from a trusted friend or acquaintance.   The best thing you can do is to get educated on what a phishing email looks like and how to spot them.

Unfortunately, once a hacker is let into the system, they remain undetected for nearly 9 months on average.  Imagine the damage that a hacker can do in 9 months with unlimited access to all corporate data. Yikes!  Therefore, it is vitally important you get educated on what to look for and what to avoid.  Not just as a remote worker, but for all times.

5. Do Not Share Your Devices at Home

Sometimes it may seem harmless to share your work computer with your children or your spouse.  However, when you do this, you are risking the companies data.  Incidentally, no one ever purposely downloaded a virus.  Rather, they unknowingly visit questionable sites, click on phishing emails, and download infected games.  In the end, the company pays the price and you are the one who gets blamed. Therefore, when you work from home, make sure your family uses their own devices, not your companies assets.

6. Lock Devices When Unattended

It may surprise you to know that even in your own home, your work computer might not be safe.  In fact, anyone who has been in technology long enough can tell countless stories of company devices being improperly used at remote user’s homes.  For instance, one person’s roommate sent out a company-wide email claiming that person was having an affair with the Vice President.  On another occasion, a teenage son accessed his father’s computer, who was a doctor, to prescribe narcotics.  However, the cutest remote working story was when a toddler fell on a keyboard and accidentally sent the father’s venting message to the CEO.  Consequently, it was a message the father hadn’t actually intended to send.

Those are just a few examples of things gone wrong when a computer is left unattended.  Therefore, the best practice is to lock your computer when you leave it unattended.  Another great idea is to set automatic time-outs in the Window’s Settings.

When in Doubt Ask Your IT Department!

Your IT team is here to help.  Whenever you have a question, issue, or problem with your teleworker’s technology, it is best to reach out to them right away.  Most importantly, do not wait until things are out of hand before you contact them.  They want to know what is going on so that they can guide you in the right direction.

INSI is Here to Protect You!

This post is part of the INSI Awareness Campaign that is designed to keep our clients protected and informed.  In addition, you can click here to learn more about our security offerings.

Most importantly, if you are an INSI client and are concerned about remote workforce technology, please do not hesitate to contact our helpdesk at 770-387-2424.  Our engineers are more than happy to guide you on safe technology practices.  After all, we are here to serve you!

How To Protect Your Company From Spear Phishing!

Spear Phishing and How to Protect Your Company

Spear Phishing is a major issue causing small and medium-sized businesses billions of dollars in fraud.  Find out what it is and how you can protect yourself from it.

Example of Spear Phishing

Pam is the Director of Marketing for an international firm.  Recently she received an email from the CEO.  In the email, the CEO asked her to purchase ten $100 Walmart gift cards.  Further, the email stated that the gift cards were a reward for her team doing a good job on a recent project.  Certainly, Pam was thrilled the CEO called her for such an important task.

Quickly, Pam ran down to Walmart and purchased 10 gift cards.  Shen then followed the instructions and emailed him both the gift card and pin numbers.  Unfortunately, the expense was flagged and Pam found out she was a victim of a Spear Phishing attack.

What is Spear Phishing?

Spear phishing is when someone uses a false identity to target an individual.  Subsequently, the sender always appears to be a well known and trusted source. For example, it could appear to come from the target’s executive, boss, or trusted business partner.  As expected, it always involves money or clicking a link.  The most common include:

  1. Brand Impersonation – When a hacker impersonates a well-known company.  One popular example of this is an email from a financial institute that claims there is an issue with your account.  These emails look very legitimate.  The most common are emails from Microsoft or Apple stating there is an issue with your account.
  2. Business Email Compromise AKA CEO Fraud – This is when someone impersonates a C-level executive and requests the sender to wire money, transfer funds, or buy something like gift cards.
  3. Blackmail Scams – When someone claims to have compromising information on you and threaten to expose you if you do not pay them.

How Do These Scams Work?

Scammers are smart.  For instance, with Brand Impersonation or Business Email Compromise: they research the business, their employees, types of transactions, and those in authority.  Next, they establish an email address that is similar to one of the authority figures.  Finally, they email an employee with access to funds or company credit cards and request something that would not be suspicious or questioned by that employee.  On the other hand, Blackmail Scams cast out a wide net in hopes to catch more prey.

7 Technologies That Can Protect Your Company

Clearly, hackers understand the general user’s weaknesses and how to exploit them.  Therefore, the first step to eliminating this threat is to implement some basic technology tools.  After all, if the end-user never receives the email, there is no way they can click on a bad link or respond to it.

  1. Artificial Intelligence Tools – Machine learning tools can analyze abnormalities and filter those emails.
  2. Spam Filtering – Spam filtering will help detect any malware embedded in the email, filter suspicious emails, and identify the origin country of the email.
  3. Antivirus – Antivirus will help detect and filter any viruses.
  4. DMark Authenticating – This technology authenticates the phishing email and puts it into the spam folder or rejects it.
  5. Email Encryption – Email encryption allows you to send and receive sensitive information over the Internet.
  6. Multi-Factor Authentication – This technology requires two pieces of identification to access company data.
  7. Desktop Monitoring – Desktop monitoring will keep your patches and updates current to keep hackers from accessing your email accounts.

5 Employee Training Tips on Spear Phishing

No matter what you do, some emails will still get through.  Therefore, your greatest defense is to train your end-users.  Make sure your employees follow the directions below before acting on anything that requests some form of sensitive information:

  1. The most important advice you can give to an employee is to study the sender’s email address.  Often times, it is a single letter added or missing to the person’s name or domain.  Do not click or act on anything until verified.
  2. Make sure the employee verifies the domain name of the sender.  Do not click or act on anything until verified.
  3. Make sure all employees know that any request to spend money will come from company email addresses, not a personal email address.  Do not click or act on anything until verified.
  4. Train employees to report any questionable phishing emails, texts, or voice mails to your IT department.
  5. Tell the employees, “When in doubt: ask.”  Make sure they are not apprehensive about verifying an email from anyone in your company.  Including the CEO.

INSI is Here to Protect You!

This post is part of the INSI Awareness Campaign that is designed to keep our clients protected and informed.  In addition, you can click here to learn more about our security offerings.

Most importantly, if you are concerned about a spear-phishing email, please do not hesitate to contact our helpdesk at 770-387-2424 before opening it.  Our engineers are more than happy to check it out and make sure it is safe.  After all, we are here to serve you!

How to Protect Your Cell Phone From Smishing!

Smishing and How to Protect Your Cell Phone

What is a Smishing Email?

A smishing email is a general term for a text that requests for you to click on a link, respond, or provide personal/corporate information.  The results of a successful smishing attack could mean compromised pin number, credit card information, passwords, social security number, and other private details that could lead to stolen identity.

What Types of Viruses Are Phones Vulnerable Too?

Interestingly, the types of viruses infested on phones are similar to the ones you see on computers.  For instance, your phone can be compromised adware, malware, ransomware, spyware, or Trojan horses.

How Do You Avoid Becoming a Smishing Victim?

There are many ways you can arm yourself against smishing attacks.  They include awareness, research, and avoidance.

1.  Watch Out for Questionable Text

smishing exampleClearly, this text example is an attempt to scam Trump supporters.  Subsequently, smishing texts often claim to already have an existing relationship with you. Remember, if you are not sure don’t click or respond.

The second clue is an immediate call for action.  Smishing texts will use emotional manipulation to try to get you to click or respond immediately.  In this example, they are clearly aiming to use a scare tactic by using the word “FAILED” in caps.

In addition, smishing texts will often use banking information to solicit feedback.  In some cases, they can even provide part or all of your account numbers.  Make sure it is legitimate before clicking.

2.  Google the Phone Numbersmishing example 2

When in doubt research the phone number.  In this particular example, it was a car insurance company.  Obviously, this is not the Republican party as suggested in the text above.

3.  Be Wary of Location Awareness

Cybercriminals are smart! They can use the VPN app on your phone to reveal your location. Subsequently, they know that a local text is more personal and will often yield a response from their victims.  For example, they can make it appear that you are receiving an offer from a local pizza parlor.

4.  DON’T CLICK or Respond

Watch out for emails from unknown sources that ask you to click on something or respond.  Both of these activities will download a virus on your device.

You should also beware of unsolicited emails from known senders with short subject descriptions or just a link.  For example, that person in your church or networking group that you hardly know will likely not send you a text with just a link out of the blue.

How Do You Know if You Are Already Infected?

Your phone could already be infected without your knowledge.  Here are some simple clues to find out if you are infected.  Is your:

  • Phone crashing a lot?
  • Is the battery draining much faster?
  • Phone showing new apps you didn’t download?
  • Device showing an unexplained sizable increase in data usage?
  • Phone company billing you for questionable text charges?
  • Does the device receive pop-up adds?
  • Phone overheating often?

How to Clean Up a Virus on Your Phone

To clean up a virus on your phone the first thing you need to do is clear the history and data.  This should help with any type of pop-ups.  Secondly, power off and restart your phone.  Thirdly, restore from an earlier backup if the first two steps didn’t work.  Last, restore as a new device as a last alternative.

Be Proactive About Smishing

The most important thing you could do to avoid a smishing scam is to download antivirus software on your phone.  Many users believe their cell phones are immune to security threats, but that is not true.

If You Think You Have A Smishing Text – Let Us Know

This post is part of the INSI Awareness Campaign that is designed to keep our clients protected and informed.  In addition, you can click here to learn more about our security offerings.

Most importantly, if you are concerned about smishing texts, please do not hesitate to contact our helpdesk at 770-387-2424 before opening it.  Our engineers are more than happy to check it out and make sure it is safe.  After all, we are here to serve you!


INSI Announces Partnership with Cybriant to Add Managed Security Services

INSI Announces A Partnership with Cybriant to Add Managed Security Services

Marietta, GA, 02/20/2020 – INSI, a Manage Service Provider and creator of the Customized IT Support model, today announced a strategic alliance partner with Cybriant, a leader in cybersecurity services. This partnership will allow INSI to launch a line of cyber risk management services that will allow their clients to proactively combat relevant threats from cybercriminals. Through these services, INSI is making enterprise-grade cybersecurity services attainable for all organizations.

Cyber Security Threats

Cybercriminals are using every resource available to find vulnerabilities.  Too often organizations find out what made them vulnerable after an attack. By adding the following managed services, INSI now can help clients use a preventative approach to cyber risk management. These services include:

  1. Managed SIEM with 24 x 7 security monitoring
  2. Managed Detection & Remediation
  3. Risk-based Vulnerability Management
  4. Responsive Patch Management
  5. Web Application Protection as a Service
  6. Risk Assessments
  7. Compromise Assessments
  8. Penetration Testing
  9. Incident Response & Incident Containment

INSI’s Cyber Security Commitment to Our Clients

INSI has also added consultative services that will provide a framework for architecting, constructing, and maintaining a secure business with policy and performance alignment. Clients can contact INSI for Virtual CISO, Risk Assessments, Compromise Assessments, and Penetration Testing.

“At INSI, we take our clients cybersecurity very seriously,” says Deborah Frazier, Head of Sales and Marketing for INSI and author of the book, IT Outsourcing Secrets.  “Most companies believe their Managed Service Company is providing full IT security services.  Unfortunately, they are disappointed when an event happens and they cannot recover from it.  I have seen this happen with multiple prospects over the years.”

Stephen Nowell, VP of Operations added, “The truth is, most MSPs provide basic block and tackle which includes monitoring, preventive maintenance, antivirus, and spam filtering.  Backups and Managed Security are an additional offering.”

“However, at INSI, we realized there was a big enough need to warrant 24/7 monitoring and response.  On the other hand, we also knew it would take at least fourteen cybersecurity specialists, and experienced Cyber Security leadership to provide that support.  That is why we sought out a Georgia-based reputable Cyber Security company.  This supports our goals to back the local community.” Stephen concluded.

Cybriant’s Commitment to Our Clients

“Having an effective Cyber Risk Management Service requires a vigilant effort by focused professionals,” said Bill Brown, EVP with Cybriant. “Through INSI, Cybriant can design, implement, and manage your entire cyber risk management program, or we can augment and reinforce your program where needed.

Contact INSI For Your Cyber Security Solution Today

With an increasingly dangerous cyber threat landscape looming, organizations should understand their vulnerabilities. Contact INSI by going to INSI to increase your cyber resilience.

About INSI

Since 1995, INSI has been providing IT support to small- and medium-sized businesses (SMBs) in both Georgia and Alabama.  They offer Managed Services and their own unique INSI Customized IT™ package.  Also, their unique tiered structure allows clients to choose the exact services they want while reducing 80% of their cost on IT support tickets.  Additional services include hosting, disaster recovery, managed security, and unified communications. For more information, go to

About Cybriant

Cybriant assists companies in making informed business decisions along with sustaining effectiveness in the design, operation, and monitoring of their cyber risk management programs. We deliver a comprehensive and customizable set of strategic and managed cybersecurity services. These services include Risk Assessments, vCISO, 24/7 Managed SIEM with LIVE Monitoring and Analysis, 24/7 MDR, 24/7 Real-Time Vulnerability Scanning with Patch Management. We make enterprise-grade cybersecurity strategy and tactics accessible to businesses of all sizes. Find out more at