security and compliance Archives

As news of Russian forces launching an attack on Ukraine hit the headlines on February 24th, it is vital that you keep security top-of-mind as the risk of cyber attacks and state-sponsored advanced persistent threats (APTs) is increasing substantially. We urge everyone to take steps to improve their security posture and stay extra vigilant.

Here at KiteTech, we persistently monitor new and ongoing cyber security risks like this and develop a plan of action to ensure that our clients’ resources and data are fully protected. Below is a list of recommendations for security services that are vital in protecting your business from cyber threats.

Security Services That Protect Your Business

Multi-Factor Authentication

If we had to make a single recommendation for protecting your online accounts, it would be multi-factor authentication (MFA). Not only confirming this is turned on for your business, but ensuring your personal accounts are protected behind MFA as well.

Security Awareness Training

While industry standard security products are critical to protecting your organization, end users will always be your greatest risk. It’s crucial that you require employees to complete their annual security awareness training.

Antivirus/Endpoint Detection and Response (EDR)

Keeping antivirus signatures up to date is essential to protecting against known malware. Automatic updates should always be enabled for these products.

Geo-IP/Geolocation Filtering

Restricting access to accounts based on location has proven to be a very successful way of mitigating threats. While there are ways to circumvent these restrictions, its use in protecting against automated attacks is considerable. We encourage adopting this when available.

Cybersecurity Tips for End-Users

Now is the time to build a stronger line of defense against increasingly sophisticated cyber threats. Below are steps that end-users can take to ramp up their security practices.

Make sure MFA is turned on for all eligible accounts and working properly (can’t emphasize this one enough).

Keep an eye on your finances. Check for suspicious transactions and set up credit monitoring alerts.

If you have any backup emails or phone numbers tied to an account for recovery purposes, make sure they are updated with relevant information and MFA if applicable.

Utilize websites such as haveibeenpwned.com to check for compromised passwords. We have a subscription to ID Agent’s DarkwebID which features a live search function to check for password compromise tied to an email address. If you would like access to that, let me know.

If you aren’t using a password manager, I highly recommend moving towards the migration. It can be a lot of work, and some may be skeptical having all your passwords in once place, but the security features outweigh the risk. Some examples of password managers are LastPass and Dashlane.

Be wary of approving logins on the Microsoft Authenticator app. If you didn’t initialize authentication, deny the approval.

Take your time when reviewing emails with urgent or suspicious requests. Reach out to that person directly to validate. To those who may not be as tech savvy as others, don’t hesitate to ask for help. You’re not a burden for doing so whatsoever.

Be careful with what apps you allow to have access to what data, and consider only accepting necessary cookies for websites.

Make sure shared accounts are limited and all passwords for those are complex.

Be careful with pre-filling passwords, many websites don’t properly encrypt those and they have been common targets for keyloggers.

Most importantly, be extra cautious. Even with all the security controls out there, you as the end user will always have the keys to the castle.

It is more important than ever to make it a priority to improve your organization’s cybersecurity practices and train your employees to stay conscious of any suspicious activity. If you notice anything questionable, reach out to KiteTech immediately so we can investigate.

If you are not currently working with KiteTechnology and would like to learn more about our Managed IT and Security Services, please reach out and schedule a conversation. We are here to help!

Dillon Fornaro

Security Engineer
Kite Technology Group

If you’ve been a business executive for any length of time, then you’ve probably traveled this familiar journey when it comes to technology and your IT services. You heard the appeals to move to “the cloud”, so you started taking some steps. Perhaps, you moved your email to hosted Exchange. You may have also adopted a hosted line of business application. For example, if you are an insurance agency, a new agency management system like Applied Epic or AMS 360.

The problem is that as you added new functionality and responded to new requirements, very little went away in your local environment. You are still supporting and paying for a local network and servers. In fact, you were forced to invest further in the local environment to respond to rapid growth in security threats and the associated compliance requirements. Consequently, you are stuck in the middle. You have found yourself with feet firmly planted in both the old local environment and a new cloud environment. Your technology landscape got more complex, harder to secure, and more expensive to maintain.

I am here to tell you that good news has arrived for those businesses who have the foresight to take the next natural step. It is time to abandon your local IT infrastructure! Thanks to rapid improvements in the Microsoft 365 suite, the tools have matured to the point that you can trust your entire operation to the cloud.

The recent introduction of Microsoft 365 Business Premium (M365) brings together the Office Suite (Outlook, Word, Excel) with advanced security, collaboration tools (SharePoint, Teams, OneDrive) and PC management. M365 seamlessly integrates security features including user access and mobile device access (phones, tablets, laptops). It can even replace your phone system. In short, Microsoft 365 paired with your cloud-based agency-specific applications means you can say goodbye to all your local infrastructure. Your employees just need a workstation or laptop and a connection to the Internet and they can be fully productive from anywhere.

Why Microsoft 365 Should be Integral to your IT Services Stack

The benefits of “cutting the cord” on local IT infrastructure and going “all in” on Microsoft 365 are substantial. These benefits fall in three categories: security and compliance, collaboration/mobility, and cost.

Security and Compliance

Microsoft 365 Business Premium is built with a “security-first” mindset. It starts with identity management. M365 provides “state-of-the art” features that simplify the authentication of your users while taking extra precautions to ensure the user is who they say they are. With features such as “multi-factor authentication”, Microsoft has made it very difficult for thieves to steal credentials that allow them to access private systems and data. M365 also becomes the focal point of “single sign-on”, the place where your users sign in one time to access all their applications that they need to do their job. The result of MFA and single sign-on is a secure and convenient user authentication process.

But M365 security doesn’t end with identify management. M365 also manages the security of the end-user devices and the user activity once the user is logged in. InTune is an included device management platform that manages workstations as well as various mobile devices such as tablets and phones. M365 also includes antivirus, spam filtering and advanced threat protection to safeguard your business from cyber-threats including phishing, and ransomware. Finally, M365 can help you maintain regulatory compliance with policies to enforce data loss prevention (DLP) and email archiving.

Perhaps the most profound security impact of a full scale M365 deployment is the “addition by subtraction” that results from eliminating your local infrastructure. Your threat landscape, that is the various ways that your business can be attacked by unscrupulous individuals, gets a lot smaller once your data and applications are no longer kept in your building. There is no longer a need for sophisticated firewalls, network monitoring, physical security of servers, and local data backups once your technology is entirely maintained in the cloud.

Collaboration and Mobility

Microsoft 365 Business Premium is built with the modern business in mind. It has tools that facilitate the “work from anywhere” mentality that was thrust upon us all when the pandemic caused many of us to work from home. In fact, M365 flourishes when it comes to overcoming the challenges agencies are faced with when their team members are in various locations. It includes tools such as SharePoint and OneDrive that allow employees to share documents and collaborate on creating and editing written materials. These tools also effectively manage permissions to ensure those who are authorized have access while restricting access from others. M365 also includes Microsoft Teams allowing groups of employees to chat one-to-one, hold video meetings, and communicate seamlessly with others that have similar roles and interests.

Since all of the attributes of the user and user devices are managed from the cloud (i.e. M365), the user experience follows the user to wherever they go – from the office, to their home, to the local coffee shop. Once M365 is fully adopted, your users will quickly discover that they have access to all their technology applications and date from wherever they choose to work.

IT-Services Cost Effectiveness

Microsoft 365 Business Premium saves businesses money on their IT Services in three ways. First, it bundles all the necessary tools (Microsoft applications, security, device management) into a single license. Second, it provides a portal to allow technology professionals the ability to manage the deployment, maintenance, and troubleshooting of these tools from a single pane of glass. And finally, it eliminates the need to maintain and support unnecessary local IT infrastructure.

With the benefits of a full scale M365 implementation clear, let’s move on to the question of how to deploy Microsoft 365.

How to Adopt Microsoft 365 Effectively in your Business

Microsoft 365 Business Premium is a sophisticated and comprehensive suite of tools designed to work together to provide an outstanding user experience while maintaining the security of your data. While anyone can buy the M365 license, it takes an IT professional to configure M365 to ensure you actually achieve the intended benefits. From the security perspective, the fact that features such as MFA, single sign on, and advanced threat protection are included, doesn’t necessarily mean they are configured correctly. Or even turned on. You are going to want to make sure you are working with an IT service provider who has experience with the Microsoft 365 toolset and understands the needs of your business. That way, the compliance needs of your industry will be accounted for in the security configuration.

Similarly, an IT services provider familiar with your industry can ensure that the collaboration and mobility aspects of Microsoft 365 are designed to work in tandem with your other applications such as your line of business application or agency management system.

In summary, don’t get left behind. If your IT services provider is not talking to you about a plan to move your technology entirely to the cloud, then talk to us. We can get you there! Kite Technology provides Managed IT Services and Microsoft 365 Consulting to businesses in the Baltimore area and across the country. We specialize in serving independent insurance agencies, nonprofits, and many other professional organizations. Give us a call or schedule a complimentary consultation to get the conversation started.

Greg DiDio is the CEO of Kite Technology Group. KiteTech provides Managed IT Services and Consulting to professional organizations and independent insurance agencies across the country. KiteTech is proud to be one of only two IT companies in MD to earn the CompTIA Security Trustmark, certifying that KiteTech meets or exceeds security best practices.