Why You Need Managed Service

As your business grows, the needs of your IT department change. At some point, depending on that rate of growth, a decision will need to be made towards simplifying some of the processes used to keep your productivity in check. Managed services might provide the support needed to handle the problems that exceed what your department can handle or they may simply add depth to an overworked department.

Regardless of the rationale, there are many services available that can make your business even more productive and efficient than it is already. Knowing when to make that decision to get Managed Service solutions for your business is the important part. There are several different services that can really be a lifesaver for a stressed out, overworked IT department.

Here are a few examples of what can be offered:

IT Service Management & Delivery Automation
True client partnerships are our main focus, incorporating the “always available” domestic delivery model. It is this core method that provides flexibility, cost reductions and helps build, integrate and support the next wave of operational transformation.

Data Center & Security Solutions
Infrastructure management solutions give order, efficiency and cost effectiveness inline with advances in technology. Managing, sharing, accessing and protecting data defines your business with the help of a true information technology partner that helps you maintain that competitive edge that separates the leaders from the followers.

Cloud Solutions
In this ever-changing landscape, being “traditional” just won’t be enough. A cloud management solution that is fully integrated with public, private and hybrid cloud architectures will put you in the driver seat. The best part of having this tool at your disposal is that it’s accessible from a single portal and managed through one pane of glass, enabling you to take control of the information efficiently, under one managed services umbrella. This will create the optimal mix of performance, reliability, cost and security for you.

DevOps & Software Development
DevOps is a managed service that assists development teams and businesses that want to run applications in the cloud. Working closely with your developers and in-house architects is critical to successfully leveraging the benefits that the cloud offers. This ensures that your environment runs effectively, efficiently and smooth.

When a client leverages managed services into their business, it’s not utilized solely for peace of mind. Freeing up your IT Department’s time to devote to core tasks brings an added dimension that puts you in a better position for continued growth. Outsourcing top-notch security and uptime can be a cost saving measure that provides big results.

It doesn’t matter which industry you are in, almost any business can benefit from managed services because it will help them achieve their objectives in a more timely manner. By giving the IT staff more time to focus on innovation and reducing unexpected costs, managed services provides you with the support your business needs to thrive.

Basic Practice Management Systems

A real insight is required to get into the medical practice management and how it performs. Medical office managers take on a number of issues, including administrative, legal, financial or even technological and sometimes all of these in the same day. This type of workload is not feasible to be handled by any one person. For this reason, there is a need of PMS. This system with cloud-based platform delivers unparalleled visibility into every practice on your network. The medical practice management tracks progress drives improvements and optimize results.

What are the responsibilities of your staff?

  1. Custom Benchmarking – Establish benchmarks for your practice based on the performance of other practices of your size, specialty or geographic regions.
  2. Applied Network Learning – By monitoring the network of providers, will get to know what helps your practice to thrive and can implement those tactics at your organization.
  3. Proactive Reviews and Coaching – Use specific medical practice management metrics to track your success, and analyze trends in your practice to pinpoint ways to increase collections, improve office efficiency and more.
  4. Visibility into our Entire Network – We can track the performance of practices throughout by network. Have the ability to share the best practices for practice management. This transparency produces real-time understanding about your performance. This way, be able to track your progress and quickly make improvements.

Practice Management Services that align with your successGetting the providers to pay is not just the task, rather than charging a substantial monthly or software fee. Any billing company can directly invest in your success by charging a small percentage of collections.

As a plan to self-regulate a medical practice’s revenue cycle, the right practice management system (PMS) is the key to achieving the potential efficiencies offered by electronic transitions and workflows. Medical billing software usually automates and streamlines practice’s administrative and billing functions. PMS software should typically have the ability to capture patient demographics, schedule appointments; should also be able to pre-register patients and determine patient financial responsibility for collections at the point of care. Should also maintain insurance payer lists, perform billing and generate reports.

The cloud-based practice management service will have your financial well-being in mind. There are low up-front costs (no paying for software licenses, installations or upgrades). There is no fee for disruptive updates. It is an easy transition without any need of costly add-on modules.

Intelligent, Streamlined Practice Management Services

A smart, streamlined workflow is essential for any medical practice. Choosing and integrating an appropriate, well supported PMS can be daunting. Choose a billing company that delivers a 5-stage workflow for staff to swiftly move through patient visits, with efficiencies from check-in through check-out. When administrative workflows smoothly, providers can focus on the patient in front of them. The information about the patient is collected up front in the practice management workflow so the claims go out as cleanly as possible, and it takes up less time for the billing process. Thus, when administrative workflows smoothly, providers can focus on the patient in front of them.

Ruby On Rails For VPS Server

If you’ve outgrown Heroku’s “free” tier, it’s likely that you’ll want to examine the various ways you’re able to create a private VPS to run any Rails apps you may have.

In order to do this, you should really be looking at the various “cloud” hosting providers (such as Digital Ocean, Linode, etc) who have now started to offer inexpensive VPS hosting onto which you’re able to deploy custom web based applications.

Since Rails is one of the cornerstones of modern web development, it’s important to consider how to set up a private server to run it. It’s actually quite simple.

99% Software…

The most important thing to remember with this is that to set up an HTTP (“web”) server, you ONLY require SOFTWARE to get it working.

The “web” works off the back of TCP/IP (the underlying “protocol” for the “Internet”) – which basically says that if you know the “public” IP address of a computer system, TCP/IP gives you the ability to attempt to “connect” to it.

Each time you “ping” a system, or perform any sort of “handshaking”, it’s done through TCP/IP. This works in both a LAN (Local Area Network) and WAN (Wide Area Network) capacity, providing users with the ability to “connect” to other devices that are “connected” to the Internet.

The problem with TCP/IP is that whilst *every* system that’s “online” can be “pinged”, it cannot be accessed. TCP/IP uses “ports” which basically allow for particular data to be transferred in certain ways – firewall software (which is now built into most operating systems) block access to most ports, to prevent hacking.

The part where HTTP (Hyper Text Transfer Protocol) plays here is that it allows for a “public” set of connectivity – delivered through port 80 (or 443 if using SSL). ANY “HTTP” enabled computer system essentially “opens” a certain folder to the Internet, making it accessible via port 80 of the TCP/IP protocol. This is done with “HTTP” (“Web”) server software.

To run a “web server”, you basically need a computer that’s connected to the “Internet”, has a publicly accessible IP address and is able to accept incoming requests via the HTTP protocol on either port 80 or 443.

This is the beginnings of how you set up a custom VPS server…

Servers Are A Dime-A-Dozen

Thus, anyone with an Internet connection, computer and HTTP server software (NGinx/Apache) can setup a web server.

You don’t even need a domain name – just use your public IP. Domain names are provided by ICANN as a way to make it easier to access web servers – what most don’t know is that a “domain” name simply routes a request to particular IP address. It’s still incumbent on the domain owner & website developer to make that IP accessible to “web” traffic (port 80/443).

The point is that what you pay for “hosting” is really the infrastructure required to keep a server running & operational. “Shared” hosting is basically the ability to buy a “user account” on a HUGE server (used by 1,000’s of websites), whereby the “hosting company” will pay for all the electricity, maintenance and support to ensure maximum uptime.

The problem for most people is that whilst “shared” hosting is a great way to get a simple “WordPress” website online, if you want anything more exotic, you’re at a loss. Specifically, Rails and the likes of NodeJS or other “new” technologies (which require deeper OS integration for their dependencies).

The answer to this (for now) is to set up your own VPS servers. These allow you maximum control over the way in which the server works, and also gives you direct access to the underlying operating system (which means you’re able to add as many dependencies as you want).

To do this, however, takes some setting up. This is done by firstly understanding the core settings / components required to get the server running & online. The following steps will explain how to do this.

Setting Up a Server

  1. VPS Running Ubuntu
    The first step is to get a VPS instance. As mentioned, the best providers of these are the new “cloud” systems such as Vultr, DigitalOcean, AWS, etc. Don’t worry about paying huge money for this – $5/mo is perfect to start with. You also need to use an operating system which is widely supported and not going to add unnecessary expense. Use Linux. You’re never going to look at the server after you’ve set it up, so a costly Windows license won’t matter anyway. Ubuntu is currently the most popular Linux variant. Whilst you could use others, we just recommend Ubuntu for the sake of compatibility.
  2. Install NGinx/Apache
    Next, you need to install the *web* server software. This is what will open port 80 (or 443) to the world, and allow people to connect to the server with their web browser. It must be noted that you’ll also need to install the “application server” with the web server, which typically comes bundled as one package. Both NGinx & Apache have their respective methods of achieving this, which are available on their websites.
  3. Install Ruby & RubyGems
    After you have installed the web server, you need to get Ruby/RubyGems installed. Whilst there are a number of ways to do this, the underlying basis is to build Ruby from source (which requires the build tools) and to install RubyGems on top of it.
  4. Get GIT Set up
    The way you get a Rails application onto the server is with GIT. To get this set up, you need to first download the GIT application (which is done through apt-get), and then add a custom (“bare”) GIT repository on the server. You then need to set up your local repository to handle the GIT remote repo, which should allow you to push to it.
  5. Push The App & Get Any Extras Set Up
    After this, you need to ensure that you are able to push the app to the server via GIT, and then add any extras (such as a database etc). Obviously, how you do this will be dependent on the “stack” setup that you have.

Ultimately, the process is actually quite mundane, and exactly the same as the myriad of “hosting” providers out there.They just use an application such as CPanel or Plesk to ensure that users are able to “manage” their various features properly.

 

Things About Crypto Currency You Should Know

“Crypto” – or “crypto currencies” – are a type of software system which provides transactional functionality to users through the Internet. The most important feature of the system is their decentralized nature – typically provided by the blockchain database system.

Blockchain and “crypto currencies” have become major elements to the global zeitgeist recently; typically as a result of the “price” of Bitcoin skyrocketing. This has lead millions of people to participate in the market, with many of the “Bitcoin exchanges” undergoing massive infrastructure stresses as the demand soared.

The most important point to realize about “crypto” is that although it actually serves a purpose (cross-border transactions through the Internet), it does not provide any other financial benefit. In other words, its “intrinsic value” is staunchly limited to the ability to transact with other people; NOT in the storing / disseminating of value (which is what most people see it as).

The most important thing you need to realize is that “Bitcoin” and the like are payment networks – NOT “currencies”. This will be covered more deeply in a second; the most important thing to realize is that “getting rich” with BTC is not a case of giving people any better economic standing – it’s simply the process of being able to buy the “coins” for a low price and sell them higher.

To this end, when looking at “crypto”, you need to first understand how it actually works, and where its “value” really lies…

Decentralized Payment Networks…

As mentioned, the key thing to remember about “Crypto” is that it’s predominantly a decentralized payment network. Think Visa/Mastercard without the central processing system.

This is important because it highlights the real reason why people have really began looking into the “Bitcoin” proposition more deeply; it gives you the ability to send/receive money from anyone around the world, so long as they have your Bitcoin wallet address.

The reason why this attributes a “price” to the various “coins” is because of the misconception that “Bitcoin” will somehow give you the ability to make money by virtue of being a “crypto” asset. It doesn’t.

The ONLY way that people have been making money with Bitcoin has been due to the “rise” in its price – buying the “coins” for a low price, and selling them for a MUCH higher one. Whilst it worked out well for many people, it was actually based off the “greater fool theory” – essentially stating that if you manage to “sell” the coins, it’s to a “greater fool” than you.

This means that if you’re looking to get involved with the “crypto” space today, you’re basically looking at buying any of the “coins” (even “alt” coins) which are cheap (or inexpensive), and riding their price rises until you sell them off later on. Because none of the “coins” are backed by real-world assets, there is no way to estimate when/if/how this will work.

Future Growth

For all intents-and-purposes, “Bitcoin” is a spent force.

The epic rally of December 2017 indicated mass adoption, and whilst its price will likely continue to grow into the $20,000+ range, buying one of the coins today will basically be a huge gamble that this will occur.

The smart money is already looking at the majority of “alt” coins (Ethereum/Ripple etc) which have a relatively small price, but are continually growing in price and adoption. The key thing to look at in the modern “crypto” space is the way in which the various “platform” systems are actually being used.

Such is the fast-paced “technology” space; Ethereum & Ripple are looking like the next “Bitcoin” – with a focus on the way in which they’re able to provide users with the ability to actually utilize “decentralized applications” (DApps) on top of their underlying networks to get functionality to work.

This means that if you’re looking at the next level of “crypto” growth, it’s almost certainly going to come from the various platforms you’re able to identify out there.

Things You Should Consider When Upgrading Your Wireless

Are your wireless access points getting outdated and need to be upgraded? Are you unsure which model/brands to choose? There are some things to consider when upgrading your wireless access points. Some of the things that you should consider when upgrading your wireless environment are speed and performance requirements.

You want to think 5 to 10 years (most likely) to avoid having to upgrade again and think in terms of the numbers of users that the access points will serve and also, the types of application that will be running on them. Some applications require more bandwidth and process performance than others such as video and gaming application. Also, what kind of devices will be connecting to them? There are going to be more mobile devices than ever in the future, especially with the Internet of Thing (IoT) devices. Each person may already have at least 3-5 devices (i.e., laptop, iPhone, Kindle, other IoT devices). These numbers increase so make sure your new wireless devices will have enough bandwidth to serve all these devices and with room for expansion.

There are many different vendors out there that make great wireless access points, and they offer different licensing model. Some people prefer not to pay a yearly subscription license. It depends on what you want and how you want to manage these wireless devices. Some vendors have a cloud-based management option that allows you to just have internet connectivity and you can manage the access points directly from the internet.

The other option doesn’t require a yearly subscription and those are non-cloud based and you need to be already on your corporate network to be able to manage it. With this option, you don’t have to worry about paying a yearly subscription fee. You just pay it once and you’re done.

So, once you have determined the type of applications, how many devices that you have that will be connecting to the them, and ow you want to manage it, you can decide to choose among some of good wireless access points brands such as the Aruba IAP models or the Cisco Meraki.

Some other things to think about is the network cabling and network switches that you have. The network cabling should be able to support the throughput of the new access points such as Cat5e, Cat6, or Cat6a (with the Cat6/6a to support anything over 1Gigabit interface type). The switches that you have should have enough PoE or PoE+ power (if that is the route that you’re going) to support the newer wireless access points models.

Now that you have an idea on what you need for the Wireless Access Points, your next question might be how many should I go with? We highly recommend having a site survey done to be able to determine how many access points you will need. The site survey will assist in determining which part of the building you need and want coverage and which areas have weak signals.

Find The Right Laptop Center Service

The world has become a home to some of the smartest and most innovative gadgets that will always blow our minds. While we are awed by the many functionalities of these gadgets especially computers and their hardware, the need to repair them is increasing. Computer repairing services have made it possible for us to get back our gadgets the way we bought them when they are faulty

computers may not be easily carried around especially for office people, who may want to work everywhere. The need to move around with a mobile office has brought laptop to our rescue. Laptops have made deadlines to be met and office works to be simple and fun. We have been able to enhance our productivity with laptops. Sometimes, we end up struggling to work with a laptop because of a simple fault that we are stuck.

When our laptops break down, we go for laptop repairing services that can be found online or offline to repair your gadget. It can be very frustrating when we are held in bondage by a faulty laptop. Few laptop or PC users most have experienced a situation where a gadget is tricky to repair. At the end of the day, we realize that the faulty was nothing to waste time or money on because it was something minor.

There are various way that we can get our gadgets repaired within a short time. The first thing that most gadget users think of when they need repairs is to visit service centers. There are disadvantages that come with these service centers. When a computer repairing services center has few professionals to handle a number of gadgets, some customers end up disappointed. The reason is why some people visit laptop manufacturer offices especially the companies that are nearby.

In a world where there are many laptop repairing services to choose from, it may be a daunting to pick the right one for your gadget. One of the ways to get past this level is to make use of the search engine like Bing, Yahoo or Google. To get the perfect service provider for your PC or laptop, you need to take out time to check the credibility of the center you want to use.

You need a repair professional who is competent with track record when it comes to getting your gadget fixed. You need to ask questions before choosing your repair center. You should not rely only on the information that old customers must have given you. Go the extra miles in reading more about the fault before you visit a repair center. The information you have will go a long way in making a case when you are talking to an expert.

Understanding Data Center Nowadays

Given the ever-increasing business demands for IT services, physical space is at a premium in many data center facilities. On the other hand, a number of organizations are looking to consolidate their data centers in order to save money, streamline operations and improve energy efficiency.

There are a number of drivers for consolidation projects. In some cases, the organization grew through mergers and acquisitions, inheriting multiple data centers that replicate services. In addition, many organizations have effectively reduced their IT footprint through virtualization and the adoption of hyper-converged infrastructure solutions. These technologies make it possible to eliminate underutilized equipment and replace what remains with smaller form factors.

The rationalization of these services can also facilitate consolidation. This has been a priority within the federal government through the Federal Data Center Consolidation Initiative. Federal agencies have been working to reduce the cost of their data operations by eliminating waste and implementing a shared services model.

Similar efforts are underway at the state level. According to the National Association of State Chief Information Officers (NASCIO), 42 percent of states had completed data consolidation projects in 2016, up from just 14 percent in 2007. In addition, 47 percent of states are currently working on consolidation projects, and 11 percent are in the planning stages.

That data comes from a newly released report, “Shrinking State Data Centers: A Playbook for Enterprise Data Center Consolidation.” The report notes that consolidation enables centralization of data infrastructure, which streamlines maintenance and strengthens security. Consolidation also offers an opportunity to introduce standards, better integrate systems and applications, improve support for legacy systems and enhance business continuity.

There are, of course, challenges. Resistance to change is always a huge hurdle – one that only intensifies when technical problems emerge or consolidation doesn’t meet business needs. In some instances, costs are higher than anticipated and regulatory compliance requirements aren’t met.

To help minimize risk, the NASCIO playbook recommends 9 steps organizations should take in a consolidation initiative:

• Conduct a needs analysis. IT should meet with business stakeholders to discuss their current requirements as well as anticipated growth.

• Remain engaged with stakeholders throughout the project. Making stakeholders feel they are part of the process helps minimize resistance to change.

• Plan carefully but remain flexible. The project plan should identify all impacts and provide enough flexibility to accommodate unforeseen issues.

• Document existing assets. Thorough documentation helps identify underutilized or unneeded resources, opportunities for reuse, and any resource gaps.

• Conduct a cost analysis. By understanding current costs, the organization can better calculate the savings afforded by consolidation.

• Implement standards wherever possible. Standards such as ITMS and ITIL help increase efficiency and security and further reduce costs.

• Expect the best but prepare for the worst. Maintain constant communication with stakeholders to manage expectations.

• Get buy-in. If all stakeholders are on board for the project, it is more likely to deliver long-term benefits.

• Report successes. Show the organization how much money has been saved, and the greater efficiencies and security that are gained.

While public sector agencies are leading the charge for data center consolidation, organizations across industry sectors can benefit from rationalizing and rightsizing their operations.

Why You Need Data Backup

As far as the security of vital information goes, it’s important that business owners take necessary steps to make sure that the data is backed up on a regular basis. Unfortunately, just half of the businesses make sure that their data is backed up on a routine basis. At times, the professionals are not experienced enough to carry out the data backup process.

The sad part is that disasters don’t give warnings before making a strike. As a matter of fact, dropping a hard drive by mistake can ruin a well established business. Irrespective of the kind of tragedy your business may suffer from, you should take steps to make sure your data is in good hands. Given below are 5 benefits of data backup for your business.

Higher Reliability

According to IT experts, the biggest benefit of data backup is the reliability it offers. The beauty of the system is that the backup process can be carried out on a daily basis without any problem and that the process is fully automated. Aside from this, you can get access to your files instantly, as the data is stored on a cloud server. So, you don’t have to wait for your files to be resent to you.

Easy Set-Up

At first, you may feel that creating a backup of your data is a hard nut to crack, but once you have got an understanding of the process, you will be able to do it with a few clicks. All you have to do is get the system ready and enable the automation feature. Once you have done that, rest assured that your data is safe and backed-up on a regular basis.

Reduced workload

It can take a lot of time to manually back up files. The manual process requires the services of at least one professional. On the other hand, remote data backup is automated, so you don’t need to worry about creating a backup of the files and then storing them on a DVD or USB drive. So, the whole process saves you a great deal of time.

Greater Security

In remote data backup, the data is stored in a safe location. So, the information is in good hands at all times. Usually, the security is increased through some advanced encryption systems. They are used on both software and hardware level. As a result, there is almost no chance of anyone breaking into the system. Your data will be safe from hackers as well.

Saves Money

For a moment, just think about the equipment required in order to create a backup of your business files. Aside from the equipment cost, you will also spend a good deal of money to buy space for the equipment installation. And if you own a lot of computers with plenty of data, the cost of the equipment and space requirement will be very high. So, opting for cloud storage can save you plenty of money.

So, these are 5 benefits of data backup for your business. Create the backup of your files to ensure the long life of your business.

How To Avoid Data Loss

Data loss is crippling for any business, especially in the age of big data where companies rely on digital information to refine their marketing, contact prospects, and process transactions. Reducing the chances for data loss is a vital part of a data management strategy.

The first goal should be to prevent data loss from occurring in the first place. There are many reasons which could lead to data loss. A few of them are listed below:

1) Hard drive failures

2) Accidental deletions (user error)

3) Computer viruses and malware infections

4) Laptop theft

5) Power failures

6) Damage due to spilled coffee or water; Etc.

However, if a loss does occur, then there are several best practices you can implement to boost your odds of recovery.

Secondly, don’t put all your storage eggs in the cloud basket. The cloud is vital for cost-effective storage, but it does have some pitfalls that shouldn’t be ignored. Many examples of data loss have occurred from an employee simply dropping their computer or hard drive, so talk to staff members about best practices. SD cards are much more fragile and should never be used as a form of longer-term storage.

Here’s a look at top ways you can protect your data from loss and unauthorized access.

Back up early and often

The single most important step in protecting your data from loss is to back it up regularly. How often should you back up? That depends-how much data can you afford to lose if your system crashes completely? A week’s work? A day’s work? An hour’s work?

You can use the backup utility built into Windows (ntbackup.exe) to perform basic backups. You can use Wizard Mode to simplify the process of creating and restoring backups or you can configure the backup settings manually and you can schedule backup jobs to be performed automatically.

There are also numerous third-party backup programs that can offer more sophisticated options. Whatever program you use, it’s important to store a copy of your backup offsite in case of fire, tornado, or other natural disaster that can destroy your backup tapes or discs along with the original data.

Diversify your backups

You always want more than one backup system. The general rule is 3-2-1. You should have 3 backups of anything that’s very important. They should be backed up in at least two different formats, such as in the cloud and on a hard drive. There should always be an off-site backup in the event that there is damage to your physical office.

Use file-level and share-level security

To keep others out of your data, the first step is to set permissions on the data files and folders. If you have data in network shares, you can set share permissions to control what user accounts can and cannot access the files across the network. With Windows 2000/XP, this is done by clicking the Permissions button on the Sharing tab of the file’s or folder’s properties sheet.

However, these share-level permissions won’t apply to someone who is using the local computer on which the data is stored. If you share the computer with someone else, you’ll have to use file-level permissions (also called NTFS permissions, because they’re available only for files/folders stored on NTFS-formatted partitions). File-level permissions are set using the Security tab on the properties sheet and are much more granular than share-level permissions.

In both cases, you can set permissions for either user accounts or groups, and you can allow or deny various levels of access from read-only to full control.

Password-protect documents

Many productivity applications, such as Microsoft Office applications and Adobe Acrobat, will allow you to set passwords on individual documents. To open the document, you must enter the password. To password-protect a document in Microsoft Word 2003, go to Tools | Options and click the Security tab. You can require a password to open the file and/or to make changes to it. You can also set the type of encryption to be used.

Unfortunately, Microsoft’s password protection is relatively easy to crack. There are programs on the market designed to recover Office passwords, such as Elcomsoft’s Advanced Office Password Recovery (AOPR). This type of password protection, like a standard (non-deadbolt) lock on a door, will deter casual would-be intruders but can be fairly easily circumvented by a determined intruder with the right tools.

You can also use zipping software such as WinZip or PKZip to compress and encrypt documents.

Use EFS encryption

Windows 2000, XP Pro, and Server 2003 support the Encrypting File System (EFS). You can use this built-in certificate-based encryption method to protect individual files and folders stored on NTFS-formatted partitions. Encrypting a file or folder is as easy as selecting a check box; just click the Advanced button on the General tab of its properties sheet. Note that you can’t use EFS encryption and NTFS compression at the same time.

EFS uses a combination of asymmetric and symmetric encryption, for both security and performance. To encrypt files with EFS, a user must have an EFS certificate, which can be issued by a Windows certification authority or self-signed if there is no CA on the network. EFS files can be opened by the user whose account encrypted them or by a designated recovery agent. With Windows XP/2003, but not Windows 2000, you can also designate other user accounts that are authorized to access your EFS-encrypted files.

Note that EFS is for protecting data on the disk. If you send an EFS file across the network and someone uses a sniffer to capture the data packets, they’ll be able to read the data in the files.

Use disk encryption

There are many third-party products available that will allow you to encrypt an entire disk. Whole disk encryption locks down the entire contents of a disk drive/partition and is transparent to the user. Data is automatically encrypted when it’s written to the hard disk and automatically decrypted before being loaded into memory. Some of these programs can create invisible containers inside a partition that act like a hidden disk within a disk. Other users see only the data in the “outer” disk.

Disk encryption products can be used to encrypt removable USB drives, flash drives, etc. Some allow creation of a master password along with secondary passwords with lower rights you can give to other users. Examples include PGP Whole Disk Encryption and DriveCrypt, among many others.

Make use of a public key infrastructure

A public key infrastructure (PKI) is a system for managing public/private key pairs and digital certificates. Because keys and certificates are issued by a trusted third party (a certification authority, either an internal one installed on a certificate server on your network or a public one, such as Verisign), certificate-based security is stronger.

You can protect data you want to share with someone else by encrypting it with the public key of its intended recipient, which is available to anyone. The only person who will be able to decrypt it is the holder of the private key that corresponds to that public key.

Hide data with steganography

You can use a steganography program to hide data inside other data. For example, you could hide a text message within a.JPG graphics file or an MP3 music file, or even inside another text file (although the latter is difficult because text files don’t contain much redundant data that can be replaced with the hidden message). Steganography does not encrypt the message, so it’s often used in conjunction with encryption software. The data is encrypted first and then hidden inside another file with the steganography software.

Some steganographic techniques require the exchange of a secret key and others use public/private key cryptography. A popular example of steganography software is StegoMagic, a freeware download that will encrypt messages and hide them in.TXT,.WAV, or.BMP files.

Protect data in transit with IP security

Your data can be captured while it’s traveling over the network by a hacker with sniffer software (also called network monitoring or protocol analysis software). To protect your data when it’s in transit, you can use Internet Protocol Security (IPsec)-but both the sending and receiving systems have to support it. Windows 2000 and later Microsoft operating systems have built-in support for IPsec. Applications don’t have to be aware of IPsec because it operates at a lower level of the networking model. Encapsulating Security Payload (ESP) is the protocol IPsec uses to encrypt data for confidentiality. It can operate in tunnel mode, for gateway-to-gateway protection, or in transport mode, for end-to-end protection. To use IPsec in Windows, you have to create an IPsec policy and choose the authentication method and IP filters it will use. IPsec settings are configured through the properties sheet for the TCP/IP protocol, on the Options tab of Advanced TCP/IP Settings.

Secure wireless transmissions

Data that you send over a wireless network is even more subject to interception than that sent over an Ethernet network. Hackers don’t need physical access to the network or its devices; anyone with a wireless-enabled portable computer and a high gain antenna can capture data and/or get into the network and access data stored there if the wireless access point isn’t configured securely.

You should send or store data only on wireless networks that use encryption, preferably Wi-Fi Protected Access (WPA), which is stronger than Wired Equivalent Protocol (WEP).

Use rights management to retain control

If you need to send data to others but are worried about protecting it once it leaves your own system, you can use Windows Rights Management Services (RMS) to control what the recipients are able to do with it. For instance, you can set rights so that the recipient can read the Word document you sent but can’t change, copy, or save it. You can prevent recipients from forwarding e-mail messages you send them and you can even set documents or messages to expire on a certain date/time so that the recipient can no longer access them after that time.

To use RMS, you need a Windows Server 2003 server configured as an RMS server. Users need client software or an Internet Explorer add-in to access the RMS-protected documents. Users who are assigned rights also need to download a certificate from the RMS server.

Data Protection You Should Know

Where to start with “A Practical approach to Data Protection”

Customer Data Protection

When someone says data protection people’s eyes glaze over, it’s understandable that the data protection act of 1998 is important not just to businesses but the public in general. The Data Protection Act will however, be replaced in 2018 by GDPR.

Don’t worry, this article is not going to depths on the data protection act, instead we want to focus on what you can do to protect your data and the clients data.

This article applies to everyone in business no matter if you are a one man band with client contact details held on your mobile phone, a shop owner who does or does not have to comply with PCI DSS or a multi-national corporation. If you have data about your business and/or your clients held anywhere (even on paper) then this applies to you!

First Thoughts on Security Considerations

As Microsoft Windows has developed, one of the key issues that Microsoft has tried to resolve is that of security. With Windows 10 they have taken a leap forward in protecting your data.

Many people seem to have focused on the working of the licence for Windows 10 and what it allows Microsoft to do; removing counterfeit software etc. Is this wrong? Of course not. In fact if you are in business and your systems have counterfeit software you are opening yourself up to data loss in a big way.

Pirated software usually has additional code in it that allows hackers to gain access to your system and therefore your data. With Cloud Based services these days, using legitimate software should be easier than ever, after all the monthly cost of a copy of Office 365 is a pittance.

Whilst we are on Cloud Based systems, it is worth remembering that unless you encrypt your data on the cloud then chances are it could end up in the wrong hands no matter how security conscious the vendor is. New hardware is already being developed that will take care of this for you, but it isn’t here yet, so be warned.

We will come back to security a little later after we have looked at the severe fines that you could incur by not taking Data Security seriously.

This is about BIG companies isn’t it?

No, definitely not, your companies data security is the responsibility of everyone in your company. Failing to comply can be costly in more than just monetary terms.

Throughout this article I will drop in a few rulings from the ICO that demonstrate how important it is to take these issues seriously. This is not an attempt to scare you, neither is it a marketing ploy of any sort; many people believe that getting “caught out” will never happen to them, in fact it can happen to anyone who doesn’t take reasonable steps to protect their data.

Here some recent rulings detailing action taken in the United Kingdom by the Information Commissioners Office:

Date 16 April 2015 Type:ProsecutionsA recruitment company has been prosecuted at Ealing Magistrates Court for failing to notify with the ICO. Recruitment company pleaded guilty and was fined £375 and ordered to pay costs of £774.20 and a victim surcharge of £38.

and here’s another:

Date 05 December 2014 Type:Monetary penaltiesThe company behind Manchester’s annual festival, the Parklife Weekender has been fined £70,000 after sending unsolicited marketing text messages.

The text was sent to 70,000 people who had bought tickets to last year’s event, and appeared on the recipients’ mobile phone to have been sent by “Mum”.

Let’s look at the simplest way in which you can protect your data. Forget expensive pieces of hardware, they can be circumnavigated if the core principles of data protection are not addressed.

Education is by far the easiest way to protect data on your computer’s and therefore in your network. This means taking time to educate the staff and updating them on a regular basis.

Here’s what we discovered – shocking practices

In 2008 we were asked to perform an IT audit on an organisation, nothing unusual, except that a week before the date of the audit I received a phone call from a senior person in that organisation, the call went something like this:-

“We didn’t mention before that we have had our suspicions about a member of staff in a position of authority. He seems to of had a very close relationship with the IT company that currently supports us. We also suspect that he has been completing work not related to our organisation using the computer in his office. When we told him about the up-coming IT audit he became agitated and the more insistant we were that he should comply, the more agitated he became”.

This resulted in this individuals computer being the subject of an all but forensic inspection, apart from an un-licenced game, we found nothing and believing that the information we were looking for may have been deleted we performed a data recovery on the disk drive.

The results caused consternation and required us to contact the ICO. We found a lot of very sensitive data that did not belong on that drive. It looked as though it had been there for some time and most of it was not recoverable suggesting it had been removed a good while ago.

As it turned out the disk drive had been replaced several months before and the IT company had used the drive as a temporary data store for another companies data. They formatted the drive and put the new operating system on thinking nothing of it.

It just goes to show that formatting a drive and then using it for months won’t remove all the previous data. No action was taken other than a slapped wrist for the IT firm for poor practices.

So who should be trained?

The best way to demonstrate the importance of data protection is by using top-down learning sessions where management is trained first, followed by junior management followed by the staff. In this way it’s obvious to management as well as the staff the data protection is not something that one person does it is in fact the duty of every employee within a company.

A data breach will affect everybody within the company not just the person responsible but, those ultimately responsible as well.

The training is not lengthy or difficult, but it should be provided by an expert in the field or a company whose expertise is beyond doubt.

In-house training on this subject is not recommended as it is only an outsider who will be taken seriously and who will have the 3rd party credibility required to enforce the importance of the issue.

Information Security is everyone’s business

Information Security Awareness Training: Here’s what should be covered:

  • Provide an easy-to-use online 40 minutes information security awareness training course for your employees to log on and learn best information security practices from.
  • Provide best practice course content of your compliance requirements.
  • Teach employees in simple non-technical language, how and why hackers hack.
  • Instruct employees in the best methods of protecting your systems and the sensitive information you process.
  • Explain employee inherent responsibilities for protecting your business information and identifying and reporting suspicious activity.
  • Supply this information efficiently and effectively, an information security threats risk assessment should be completed.

A good threats and risk assessment should answer the following questions:

  • What do I need to protect and where is it located?
  • What is the value of this information to the business?
  • What other vulnerabilities are associated with the systems processing or storing this information?
  • What are the security threats to the systems and the probability of their occurrence?
  • What would be the damage the business if this information were compromised?
  • What should be done to minimise and manage the risks?

Answering the questions above, is the first and most crucial step in information security risk management. It identifies exactly what your business needs protect and where it’s located and why you need to protect it in real cost impact terms that everyone should understand.Don’t end up like these guys:

Date 22 December 2014 Type:Monetary penaltiesThe Information Commissioner’s Office (ICO) has fined a marketing company based in London £90,000 for continually making nuisance calls targeting vulnerable victims. In several cases, the calls resulted in elderly people being tricked into paying for boiler insurance they didn’t need.

In plain English, make it very clear to every employee within the company exactly what their responsibilities are to the data that is within their grasp on an everyday basis, explain how to protect it, explain why we need to protect it and point out the consequences to the business of not doing so.

Most un-trained employees would probably think that data protection has little or nothing to do with them; but, if a data breach occurred the company could lose business when the news hits the press, that may lead to lay offs due to lost business. It really does fall on everyone in the company from cleaning staff to the CEO to take responsibility.

Who should deliver the training?

This topic is not something that any training company can deliver correctly. You really need to work with real security experts, companies that are highly qualified and well experienced.

Unfortunately, in the IT industry many individuals and companies have presented themselves as IT Security Guru’s and most are just scare mongers with an agenda. They want to sell one specific service no matter if you need it or not.

However, there are some very well qualified, genuinely helpful professional companies out there.

In 2011 I was fortunate enough to be at the eCrimes Wales when Richard Hollis from the RISC Factory spoke. His presentation spoke to the audience in a way that few others did that day, it established him in this authors mind as my go to person in the UK on data security issues. I managed to grab a quick word with him during a break and he was really helpful.

Why do I rate Rich so highly? Well his background is interesting to say the least, a background in service for the NSA means he knows what he’s doing and has more knowledge in this area than the average Joe. It also means that where other IT Security experts see an issue, Rich sees a much bigger picture.

Of course many other companies offer similar services and in the current economic climate it is good to shop around if you need to.

Getting started

First of all, watch and re-watch the video (linked below) and find it’s second part on YouTube, watch that as well. Take notes during the video and get those steps planned out in your mind, answer the key questions about your company, data and security.

Next, speak with your IT department if you have one, your IT support company if you don’t and see if they have any cost effective idea’s that you can implement without impacting on your IT budget too heavily.

You can start protecting your company data from outside sources for a couple of hundred GB pounds by installing the right kind of Firewall, with cloud based updates 24/7.

Quality Anti-Virus with built in Anti-Malware doesn’t have to cost the company a fortune either, but again, take advice. Many of these products slow the computer system down so much that they have a negative impact on performance. One of the most famous of these (beginning with N) is often sold in High Street electronics, stationary and consumer goods stores as being “the best”; in fact it is the best profit margin and not the best product, it slows the system down and needs a special piece of software to remove it completely!

Store sensitive data in an encrypted area of a RAID storage drive system with restricted access control. A NAS drive is a cheap and effective way of achieving this.

Don’t store sensitive data on Cloud Based systems like Dropbox, sure it’s cheap and easy to use, so if you are passing none critical data such as graphics, logo’s and promotional material; great! If you are passing your accounts to your accountant, a new product schematic to a machine tooling company etc. – use something else that has better security.

Nothing personal against Dropbox and similar products, but like Microsoft OneDrive as it is now both have been hacked in the past. Although the security has been improved dramatically, you should not take the risk.

Finally take advice from real experts when you have any doubts. People like Richard Hollis have dedicated their careers to security. As they park up outside a company for a meeting they have already analysed several security considerations automatically. When they walk through the front door they make a dozen more calculations and risk assessments. All before they even sit down and talk to you about your concerns.

Layers: Security is all about a layered approach. Think of it as an Onion. Here’s an example at a Physical level for a company that I used to work for many years ago.

As you entered the building you could not get past reception unless they “Buzzed you through” the security barriers in the reception area. These were swipe card controlled for staff.

Swipe cards for staff allowed them access only to those areas they were authorised to enter; so for example only IT support staff and some developers had access to the server room. Note here that unlike some companies the cleaner did not have access to the server room or to the developers area of work.

Get the idea?

On an electronic level, all critical systems were duplicated with independent power, backup power from a generator that had backup power from a UPS system.

Firewalls separated the different LANs and the inside from the outside of the company. Each department ran on its own LAN with connections between LANs for only those people who absolutely needed them.

You can carry on to much lower levels of protection like making sure that all USB drives are encoded and encrypted so that they can only be used to move data between the companies own PC’s.

These sorts of security measures are actually very simple to achieve, they are not rocket science, nether do they have to cost you an absolute fortune.

Remember – Plan, Do, Check, Act – repeat as required. But always get advice from professionals. Believe me, the kid next door who builds his own computers and sells them doesn’t know enough about the threats to your company.

If you are in the UK, consider undertaking Cyber Essentials the government scheme to get businesses to a minimum standard to protect data. This is seriously worth while looking at; during the recent NHS attack, none of the NHS Trusts that had completed and been certified Cyber Essentials standard establishments were penetrated.

We trust that you have found this article interesting, please tell your friends.