VIPRE Security is pleased to announce that the much anticipated&nbsp;<a href="https://excelmicro.com/vipre-endpoint-security-cloud-edition/">VIPRE Endpoint Security Cloud Mac agent is now available for purchase</a>. This new agent allows IT managers and administrators to use the same top-rated endpoint security you’d find in VIPRE’s Windows agent within a Mac operating system.



With the recent increase in malware attacks on businesses and organizations of all sizes, a strong endpoint security solution is the foundational cornerstone of any layered cybersecurity approach no matter what your OS may be.



Mac Endpoint Protection for Businesses



“This new Mac agent lets our Cloud customers&nbsp;<a href="https://excelmicro.com/cybersecurity-myths/">simplify their environments</a>&nbsp;and provide more protection across them,” says VIPRE Security&nbsp;<a rel="noreferrer noopener" href="https://www.linkedin.com/in/davidcorlette/" target="_blank">Director of Product Management David Corlette</a>. He continues, “They no longer need two separate solutions, but get the ease-of-use and protection quality of VIPRE Endpoint Security Cloud all in one place.”



IT administrators will find the same ease-of-use, operational efficiency, lightning-fast deployment, dynamic dashboards, and exceptional threat intelligence functions that customers have come to expect from the Endpoint Security Cloud solution. Corlette does mention however that while the Mac agent has the same core protection capabilities as the Windows agent, there are some additional items such network protection that will be brought to the new agent at a later date.



Why Should I Protect a Mac?



A large misconception about Mac computers is that they are safe and don’t require endpoint protection or antivirus software to protect them. While they are safer from malware than Windows devices this has primarily been due to a numbers game according to VIPRE Security&nbsp;<a href="https://www.linkedin.com/in/john-letourneau-2832338/" target="_blank" rel="noreferrer noopener">Senior Director of Customer Success, John Letourneau</a>.



Letourneau asks readers to take on a&nbsp;<a href="https://www.vipre.com/blog/mac-malware-cybersecurity/">cybercriminal’s mindset in a VIPRE Blog post</a>&nbsp;and asks the question, “Why attack Macs when there are so many unsecured, unpatched, easy to infect/hack Windows devices out there?” Easy targets get hit for a good reason and for a very long time it just wasn’t worth paying attention to the Mac side of the computer industry. The low hanging fruit that existed on the Windows side kept the bills paid and criminals happy. However, as global sales of Mac computers took off, bad actors took notice and began targeting those devices.



The increased number of devices combined with the false sense of security produced disastrous situations waiting to happen. These devices have suddenly become low-hanging fruit ripe for the taking and worth the risk/reward with no endpoint protection/antivirus standing in the way.



What is on the VIPRE Security Product Roadmap?



VIPRE Security has launched a flurry of new advances to their full arsenal of cybersecurity solutions over the past year. Our email and endpoint security solutions have seen innovations and improvements that will benefit users greatly. There are many more improvements in the works for the foreseeable future.



When asked about the future of VIPRE’s cybersecurity solutions, Corlette said, “We have big plans to improve our ability to protect our customers from malicious links within emails. We also are planning to bring Endpoint Detection and Response (EDR) capabilities to our standard agents.”



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Post originally appears on the VIPRE Security Blog

Mac Agent Now Available for VIPRE Endpoint Security Cloud

We need to stop over complicating things, especially when it comes to security. For well over the past decade cybersecurity has been a major concern for all businesses. Don’t believe me? Go and seek out the multiple articles, case studies, and threat reports, published daily. Each speaks to the threats and ongoing evolution of hackers and how sophisticated they have become. If you turn on any news channel or open a newspaper (yes some of us are still that old school), you will see large well-known businesses, government agencies, and organizations, getting impacted by data breaches. This ultimately leads to fear and uncertainty, especially with SMBs.



Smaller organizations can quickly become overwhelmed by the tech talk and tools needed to protect their business from being the next attack victim. They may ignore the news thinking their small 5-person organization will not be hit with an attack. What they don’t know is, they are the primary target because they are the easy target! According to the recent Verizon&nbsp;Data Breach Investigations Report,&nbsp;<a href="https://www.vipre.com/blog/verizon-dbir-2019-breakdown/">43% of the victims of malware incidents are SMBs</a>. It is our job as cloud security professionals to guide them in implementing the right layers of protection for their organization. We need to put our clients at ease by keeping security simple.



I am the first to admit that when I’m speaking with a doctor, half of what is described is so far over my head it can get frustrating. We ask the doctor to provide information in the most digestible manner for those of us not in the medical profession. The same should hold true with cloud security. A friend and colleague once told me that he explains cloud security like he is speaking with his grandmother. So recently I decided to put this to the test.



Like many companies,&nbsp;<a href="https://excelmicro.com/">Excel Micro</a>&nbsp;recently held a ‘bring your kids to work day’. I was tasked with explaining how&nbsp;<a href="https://excelmicro.com/email-security/">email</a>&nbsp;and endpoint security works to 8-11 year old children. Here is how we spent our day.



Welcome to your first lesson in email boys and girls. Comparing how email works to snail mail was straight forward as our children are becoming more technically proficient. They were quick to understand the difference between a physical address and an IP address. The challenge was explaining the security aspects of endpoint and email protection.



I decided to liken my approach to a reference that would resonate with the kids. I figured that with the Avengers taking the world by storm, the kids knew about super heroes and protecting others. We determined that Email and Endpoint Security solutions are invisible super heroes, the world security guards, keeping businesses safe from the bad guys. A bad attack could erase a business from existing in seconds like Thanos’ snap. (Insert&nbsp;<a href="https://media.giphy.com/media/AiEr9b7sX5VKIoIvQL/giphy.gif">sad meme about Peter Parker</a>) The cool thing was that they were interested enough to ask questions about not knowing if someone trying to get in was a bad guy or not and how that is determined. I was able to discuss with them what it means to have different rules (policies) and ways you can choose if someone is actually a good guy (allow/deny lists).



When the light bulb clicked, the youngest members of Excel Micro got extremely excited. They started brainstorming, providing ideas, and the questions were flying! It was like my own little focus group and I couldn’t be prouder of the experience these kids had while they visited.



There are lessons in this story that you can take into the field when speaking with non-technical clients. Explain solutions in a simplified manner or in a way that resonates with your customers. This help them grasp the subject in their terms.



It really is plain and simple, get prospective clients and current customers excited about the solutions you are presenting to them to protect them from the “bad guys”. If we overcomplicate security, we may be scaring our prospective customers away. We also could be missing out on increased recurring revenue with existing customers. Break it down in a way they can understand, and they will immediately be at ease and want to learn more.



Here’s to you Cloud Security Avengers! Continue to build customized layers to stop evil malicious hackers from erasing businesses from existence!

Keep Cybersecurity Simple

If you have spent any amount of time in managed IT services, the IT profession, or the cybersecurity industry, you are most likely aware of the numerous threats like ransomware that all types and sizes of businesses face daily. It seems that each day there is a new data breach at the forefront of the news cycle, wreaking havoc on governments and organizations. In fact, according to<a href="https://cofense.com/ransomware-delivered-97-phishing-emails-end-q3-2016-supporting-booming-cybercrime-industry/">&nbsp;PhishMe</a>, a new business will fall victim to ransomware every 14 seconds this year.



This statistic not only demonstrates hacker’s persistence, but it also demonstrates poor cybersecurity protection measures. Much of this unpreparedness stems from these organizations and solution providers believing cybersecurity myths that give them a false send of protection.



Let’s examine three of the most popular myths that circulate amongst IT professionals that just may prevent an organization from being truly protected.



<h2 class="wp-block-heading">Myth #1: Basic Spam Filtering is Enough</h2>



Countless IT professionals and business owners believe that the basic spam filter built into their email client is enough to protect their organization from phishing attacks, ransomware, and other email-based threats. The issue with traditional email security is that it uses passive instead of active filtering to determine if an email is malicious or not.



Passive filtering evaluates messages based on pre-determined parameters, assessing if it has seen this format of message and/or attachment before. The message is not analyzed by itself and is only cleared on reputation alone. Hackers can easily bypass passive filters when they utilize weaponized graymail (i.e. newsletters, promotional emails, etc.). They can launch this from a trusted email marketing platform to easily pass link-based ransomware attacks through your filter.



It makes more sense for businesses and organizations to utilize an&nbsp;<a href="https://excelmicro.com/email-security/">email security solution that uses active filtering</a>&nbsp;in addition to the spam filtering of an email security client. Active filtering examines the message by itself looking for inconsistencies in both the message body and sender information from an extensive database and lexicon of file types and irregularities. Additionally, many solutions are starting to deploy&nbsp;<a href="https://excelmicro.com/vipre-email-security/">attachment sandboxing</a>&nbsp;as part of their email security defense arsenal. Attachment sandboxing is a virtual environment that will open attachments to see if they are malicious before releasing them to the message recipient.



<h2 class="wp-block-heading">Myth #2: Cybersecurity Should Be Complex to be Effective</h2>



As cyberattack sophistication and destructive potential increases, it is no surprise that many MSPs seek out increasingly powerful and complex security products. Complexity within cybersecurity environments can significantly hinder efficiency and increases the difficulty of securing a network. As functionality gets added, administrative consoles become crowded with settings and commands which make it harder to properly configure the solution. A small change can sometimes require slogging through a half-dozen screens just to do something as basic as creating a file scan exception.



Security solutions that emphasizes management simplicity not only saves time and effort, but it also greatly reduces risk of misconfiguring a solution’s settings. Researchers estimate that&nbsp;<a href="https://www.infosecurity-magazine.com/opinions/to-err-is-human-to-automate-divine/">99% of firewall breaches</a>&nbsp;occur from misconfigured security products.



<h2 class="wp-block-heading">Myth #3: Email and Endpoint Security Means I’m Completely Safe</h2>



While hackers are the ones in the spotlight for most major attacks and breaches, it is more often the way they penetrated the networks that is most intriguing. According to the UK Information Commissioner’s Office has found that&nbsp;<a href="https://ico.org.uk/action-weve-taken/data-security-incident-trends/">4 out of the top 5 causes of data breaches</a>&nbsp;are attributed to human error. Many major breaches, including the Equifax data breach of 2017, are due to the mistake of employees failing to follow proper security warnings and protocols. What could prevent human error from playing such a factor in breaches? One word really solves this problem…training.



Proper education and training for employees and individuals is essential in preventing malicious actors from penetrating an organization’s network. Teaching how to recognize penetration attempts, spot attacks, and how to respond in the even of one actually happening can possibly mean life or death for business of all types and sizes.



<h2 class="wp-block-heading">Defeating the Myths</h2>



Myths about how to protect a network from cybercriminals will always circulate. What matters most though is that MSPs and IT professionals continue to educate themselves on how to best protect themselves and their organizations from the increasingly sophisticated threat landscape present in today’s environments.

Do You Believe These Cybersecurity Myths?

With the recent unsealed indictment against two&nbsp;<a href="https://www.vipre.com/blog/chinese-hackers-msp-hacking-case/" target="_blank" rel="noreferrer noopener">Chinese hackers</a>&nbsp;who sought to breach end-user networks by breaking into managed services it has become imperative to think about how MSP’s must protect their clients from possible breaches. While malicious actors can work tirelessly to wreak havoc on businesses of all sizes, the one often overlooked aspect of these threats is just how they are able to deliver and enact their nefarious schemes.



More often than not, SPAM or phishing emails are the main attack vector utilized by hackers to deliver such malware as ransomware, Trojan viruses, etc. One of our vendors, VIPRE Security, recently conducted a research report in which over 500 independent technology solutions providers were surveyed. They discovered that SPAM and phishing emails accounted for 63% of their customer’s ransomware infections.



With the cyberattack methods used by malicious actors becoming increasingly sophisticated, a MSP may wonder how they can protect themselves and their clients from these threats. There are numerous steps MSPs can take to prevent these types of intrusions from inflicting irreparable damage on a business.



Education



The human element is incredibly important when it comes to general cybersecurity. According to a recent report by Beazley Breach Response Services, accidental breaches caused by employee error or data breaches controlled by third party suppliers account for&nbsp;<a href="https://www.insurancebusinessmag.com/au/news/breaking-news/ransomware-attacks-rising-but-human-error-a-cause-for-concern-75415.aspx">30% of overall breaches</a>, only slightly behind the level of hacking and malware attacks.



Educating clients and employees can be a key differentiator in the reduction of phishing attacks experienced by targeted companies. A few areas MSPs can dive into are: common phishing language, how to identify suspicious emails and links, how to protect their personal information, and what to do in case a breach occurs. Additionally, security awareness training can be offered to provide additional value to services or as another possible way to increase revenue. As part of their security awareness program a services provider could utilize solutions that allow for launching of simulated phishing attacks. This gives the sophisticated MSP the opportunity to provide not only additional value, but proof that there is need for their services.



Use Multi-Factor Authentication



One of the most basic and long-held security beliefs is that an end-user must protect themselves from attacks by changing their password every 30 to 180 days. One school of thought believes when a user changes their password every month it limits how long a stolen password would be useful to a stealthy attacker. However, according to Purdue University CERIAS, the mandatory password changes can cost companies billions in lost productivity and&nbsp;<a href="http://www.cerias.purdue.edu/site/blog/post/password-change-myths/">does little to improve security</a>.



The safest way to protect end-users is by utilizing multi-factor authentication (MFA). MFA leverages several types of authentication to reduce the probability of compromise. Most organizations use “user and password” as the primary authentication factor and add a second factor such as a “one-time password” generated by a token (hardware or software), sent through an SMS message.



Implement Cloud Email Security



Probably the most effective way of removing human error from becoming a problematic factor in ransomware attacks is to prevent the malicious emails from even reaching the inbox of a user.&nbsp;Implementing a solid email security solution is the answer.&nbsp;With the right software a MSP will be able to thwart most of the possible attacks that target their end-user clients. Savvy solution providers should choose a solution that keeps clients safe from emerging email-based threats using a multi-layered security posture. The layered security posture sends each email through multiple checkpoints that check for various characteristics of emails that are malicious. Finally, look for advanced protection features such as spam filtering protocols, anti-phishing measures, and malicious attachment filtering.



There is never truly one singular foolproof method of protection from phishing attacks. The best path to take is to utilize a layered security approach that uses email and endpoint security which decreases the possibility of being penetrated by attacks. As the sophistication of attacks grows, creating multiple security checkpoints will reduce liability, increase security, and create long-term value in your services for your clients.

3 Steps to Better Email Security for MSP Clients

<h5 class="wp-block-heading">A guide for opening tickets and getting the most out of support</h5>



Opening a ticket when you have an issue with most IT and customer service industries seems straight forward and to the point. Plenty of us do it everyday if not multiple times per day. Those of us behind the support desk wish every ticket could be easy and resolved quickly. However, this is not always the case as many requests do not go smoothly. Let us take some time dive into how to get the most out of our IT tickets and how to best handle support technicians.



Let’s begin by breaking our IT tickets into 4 categories.



<ol>
<li>The Issue Ticket</li>
</ol>



This is the most common in the IT world and ranges from “OH NO EVERYTHING IS ON FIRE!” to “My spacebar stoppedworkingsuddenly” (Get it?). The Issue tickets can be submitted by end-users to the support desk, the support desk to a vendor, or fellow support desk looking for help.



<ol start="2">
<li>The Helper Ticket</li>
</ol>



These cases are often simple fulfillment requests. Those of us submitting the ticket know what we need or what needs to be done but simply do not have the access or permission to do it. “Please reset users X password” or “Please issue user X a new keyboard” are some of the common requests



<ol start="3">
<li>The Complaint Ticket</li>
</ol>



Complaint tickets are no fun, but we all deal with them. That is all I will say on this subject



<ol start="4">
<li>The RFI Ticket</li>
</ol>



Simple, direct, and easy to close. Every tech loves these tickets. “I’d like an admin guide for X.” and “Is X compatible with my machine?”



Now that we know a bit about the most common types of support tickets, let’s look at each of these and see what the best practices are for opening a ticket in that category.



When you open an&nbsp;issue ticket&nbsp;its always best to be polite, even if you are frustrated with the situation. Include, as best you can, the details of what is wrong (Screen shots are extremely helpful if applicable) Include any steps you’ve taken to try and fix it yourself or even if you just have a hunch of what might be wrong. Just giving a support tech your ideas will get the ball rolling and helps the support tech see that you are not just looking for a magic wand fix, even if the hunch is wrong. No matter what the ticket type is, seek to collaborate with the tech to resolve the issues. Ending a ticket with “Let me know if I can provide anymore info, let me know how I can help” shows the tech that you are willing to help them to resolve the issue instead of just frustrating them further by yelling. We don’t always know what info the tech might need, so making it clear you know they may need more is great. Also, don’t be afraid to think “out loud” in a ticket, I have always as a tech appreciated when the client on the other end was right there with me trying to come up with the answer.



Helper tickets&nbsp;generally get the same set of rules as issue tickets. Saying “Let me know what info you need, or how I can help” will help you get things resolved more quickly. These tickets may not need extra attention normally, but letting the tech know that your aware you may have forgotten to include something and are willing to do what is needed to help the process along will get your tickets processed fast and correctly.



Stop and think a moment before you open a&nbsp;Complaint Ticket. Complaint tickets normally fall into one of two piles. Either you are upset and are looking to vent, or you want something to change to be different and create change. If you are looking to vent, then IT is not where your ticket should go. Instead seek out a company’s customer service outlets where they want your feedback via an account manager, sales rep, or customer service portal for the respective brand. However, if you are to create change to a product or a would like to submit a “feature request” the opening a case with IT is the right way to go.



In most situations when you suggest product improvements or changes, your ticket will be passed along to the appropriate teams to handle your concerns. Keep in mind, that’s where this story ends. Techs don’t get a lot of say on the direction of a product or software. It is like complaining to a cashier in a store about prices, they really can’t do much except listen. Such requests are almost always taken into consideration and passed along to the appropriate parties, but submitting feedback is often a one-way street and you will not get updates on that request after it is submitted.&nbsp; Most major product changes need to have a groundswell of the same improvement to really create change.



Finally, there is the&nbsp;RFI Ticket&nbsp;(Request for Information Ticket). This ticket type is simple enough and can be resolved. However, it is best practice to be polite, be specific, and most importantly be patient with the person handling your request. Even if what you’re asking for is simple, the tech on the other side might not have that info at his fingertips and may have to go hunting for it.



In closing, remember always to just be polite and provide as much relevant info as possible when working with support techs. Checking for updates on tickets is always great, but unless it’s a true emergency remember that the person on the other side of that ticket is just that…a person. They really do care and want to resolve your issue as fast as possible as well, but it is not always in the cards. The more time they spend providing you updates the less time they have available to work on the problem at hand. Hourly updates are great, but every ten minutes spent typing an email to give you a rundown of the current situation is time not spent digging through the logs and code looking for the root of the problem.

Posts

Mac Agent Now Available for VIPRE Endpoint Security Cloud

Keep Cybersecurity Simple

Do You Believe These Cybersecurity Myths?

3 Steps to Better Email Security for MSP Clients

How Can I Help?