The last few weeks have been full of exciting announcements for Dayton’s downtown revitalization and we just want to thank a few of the people we see investing their time and passion into our home.Continue reading
If you work for a company with government contracts, you’re well aware of how important security and compliance is, especially when it comes to how data is handled. While you might not be working with officially classified information as a non-federal contractor, you’re still handling potentially sensitive materials.
The primary standard governing the handling and accessing of non-classified information is NIST 800-171. NIST 800-171 (also referred to as NIST SP 800-171 or simply 800-171) is a set of security standards for non-federal computer systems, mandating how Controlled Unclassified Information (CUI) is to be handled.
NIST 800-171 was created in response to a lack of consistency across federal departments and their contractors that left openings for exploits and resulted in some major breaches of information. With NIST 800-171, all non-federal contractors have a universal set of standards to follow when it comes to how they handle CUI.
Handling Controlled Unclassified Information (CUI)
CUI is a classification created in 2008 to cover information that is potentially sensitive and relevant to US interests. CUI includes intellectual property, technical drawings, blueprints, legal materials, and more.
Before CUI, agencies used their own internal systems for marking and filing unclassified information, creating confusion and openings for security breaches. CUI helps keep unclassified information better protected and better organized through a filing system of categories and subcategories such as Agriculture, Patent, Law Enforcement, etc.
CUI should not be confused with classified information, which falls under NIST 800-53. Classified information is placed under significantly higher restrictions, can only be accessed with officials holding specific security clearance, and can result in criminal charges when mishandled.
Handling CUI might not be as strict, but it can still be a complicated process achieving NIST 800-171 compliance.
Achieving and Maintaining NIST 800-171 Compliance
If you’re handling CUI in any way, then you are bound to NIST 800-171 standards. If you are working for a federal or state organization, you fall under NIST 800-171. Even if you are working with a third party who in turn, is working with a government agency, you may need to follow NIST 800-171.
It’s always best to be safe rather than be in trouble with the federal government. Failure to protect CUI and follow NIST 800-171 will result in the loss of your current contract, as well as future work. It may incur additional penalties as well.
NIST 800-171 sets standards for user access, authentication procures, activity monitoring, maintenance and updates, physical server access, risk assessment, incident response, and more. Achieving compliance is not as simple as checking a few boxes. It is a process that is on-going. That’s where we can help.
Being located in Dayton, Ohio, DataYard is well-versed in NIST 800-171 compliance. We provide a roadmap experience for our clients, guiding them along the way to meeting all of the necessary standards and helping them maintain them.
From IT consultation to secured hosting to Dayton colocation, our suite of services can be tailored to meet all of the necessary NIST 800-171 standards. Contact us today to learn more and begin your journey towards true compliance.
Need Help Maintaining Compliancy?
TELL US WHAT YOU NEED
In today’s digital, data driven world, your IT department has never been more important. Digital security should be one of the top priorities of any modern business. After all, a data breach costs a company an average of $8.19 million.
Of course, an IT team handles much more than security. From setting up employees with company devices to upgrading software and hardware systems to simply keeping your systems running, your IT department is the heart of all things digital.
Because of this, you should carry very high expectations for your IT team, whether they’re in house or outsourced (or a combination). Third party IT companies can be a valuable asset, as they can typically provide more in-depth services at a much more affordable price.
But the wrong IT company can become a serious liability.
Here is What You Should Expect from a Third-Party IT Company
First and foremost, they need to actually offer the services you require. IT can cover a lot of area, and every company has different needs. Certain IT companies can be more niche than others. Check and see if they have familiarity with your systems as well, from server types to software that’s being used.
There is expected to be a certain amount of discovery when it comes to onboarding a new IT company, but they should have an idea of what they’re getting into.
The same goes for knowledge of your industries compliance needs and security standards. This is especially important for businesses that deal with NIST 800-171 and HIPAA compliance.
A lot of IT is also about thinking and planning ahead. That’s why it’s not enough for an IT provider to meet you where you’re at currently. Scalability is important to consider. As your business matures and grows, your IT needs grow with it.
Your IT provider needs to be able to step up their service as required.
Lastly, when IT emergencies arise, fast response time is critical. You need to make sure a company is easily reachable, effective at communicating what’s going on, and quick to act. While it can be difficult to know how quickly an IT company is going to respond until you’re actually working with them, you can watch for signs during your initial engagement with them.
If details are being skipped over or replies are coming a day or two later, you may want to look elsewhere.
At DataYard, We Aim to Exceed Expectations
We believe that quality IT Support cannot exist without high-level customer service. We want you to know that you have our attention. We’re here to assist you, answer questions, explain uncertainties, and do everything we can to put you at ease.
From the moment a client signs up, it’s our goal to not just maintain the status quo, but to improve your system so that you’re protected against the future. After all, IT isn’t just about protecting against current threats and potential problems. It’s about staying ahead of them.
We can cater our services to your needs. Whether you need a full external IT staff or another team to support your inhouse staff, we’ll integrate seamlessly with your company. And for those located near our data center in the Dayton, Ohio area, we make onsite visits as needed.
With DataYard at your side, you can expect a level of IT support that exceeds your needs.
We're Here for You
LEARN MORE ABOUT OUR IT SERVICES
As we mentioned in a recent post, a firewall is your first line of protection against malicious presences on the internet. A firewall is the gatekeeper to what’s entering your network or device, keeping the bad things out while letting the safe information in.
At least, that’s what it should be doing. But as malware, viruses, and hacking techniques evolve, the tools that protect against them need to evolve as well. A traditional firewall might not be enough to protect you.
For example, once upon a time, malware and hackers exploited holes in networks and security systems. Now, however, most exploit weaknesses in applications, which make them harder to flag and block.
That’s where Next Generation Firewalls come in.
What Makes a Firewall “Next Gen”?
A next generation firewall (or NGFW) isn’t simply the newest version or model of firewalls on the market. It’s a complete evolution, redefining how a firewall operates and what it protects you from.
Yes, a NGFW performs all of the traditional functions of firewalls, filtering traffic based off port, protocol, preset admin filters, etc., but that’s only the beginning.
The exact capabilities of a NGFW can vary, but they all must meet certain criteria. Gartner, one of the most senior authorities in IT, defines them as deep-packet inspection firewalls that move beyond port/protocol inspection and blocking to add application-level inspection, intrusion prevention, and bringing intelligence from outside the firewall.
In many ways, NGFW combines the features of traditional firewalls with features found in additional security tools, combining them into one efficient, streamlined package. This reduces complexity while enhancing control and improving performance.
For businesses where data security and system integrity are top priorities, having a NGFW is a must.
Do Small Businesses Need Next Generation Firewalls?
There’s no question that every business should have firewalls in place, no matter the size. But do small businesses benefit from the power of next generation firewalls? Absolutely. The level of control and security featured in a NGFW is something traditional firewalls simply can’t compete with.
That said, it can depend on what type of data you’re storing online and within your internal system. For certain smaller businesses, it could be overkill. Then again, when it comes to digital security, it’s always better to be safe than sorry when it comes to properly caring for your customers data.
Ultimately, it doesn’t hurt to talk to a professional team about what level of firewall you should have in place for your business. As it happens, we are a professional IT team that would be happy to answer those questions for you. Our Discovery process is a perfect health check for your security level while getting a great picture of your IT environment.
At DataYard, we provide IT consultation in addition to private cloud hosting, cybersecurity, colocation in Dayton, Ohio, and more. Big or small, we can scale our services to meet your needs on a reasonable budget.
Contact us today!
Is Your Data Protected?
LEARN MORE ABOUT OUR CYBER SECURITY SERVICES
The internet is two-way connection. You don’t just go onto the internet. The internet goes onto the device you’re using. If you’re not careful, a lot of bad things can get into your system through the internet.
Recently, we discussed some of the major threats that companies face on the internet. Now it’s time to look at the first step to protect yourself from those threats.
It’s Starts with a Firewall
A firewall is the gatekeeper to your network and/or device. Its purpose is to let safe information in while keeping the bad stuff out. Dangerous items could include spyware, viruses, hackers, and much more. Additionally, certain firewalls can be customized and configured to keep out content that’s technically “safe”, but unwanted on a particular network. For example, companies may use firewalls to block time-consuming websites such as Facebook or YouTube.
Firewalls can also act as a filter between different company networks. This is helpful in protecting your information from vendors and contractors you may work with.
Are All Firewalls the Same?
No. First of all, a firewall can either be a software program or a physical device. Both perform the function of flagging questionable content and preventing it from coming through, though they do so in slightly different ways.
A software firewall operates on your computer (or other device), protecting the information found there. Should a virus or hacker breach your network, a software firewall can still protect your individual device.
A software firewall continues to protect your device even when you’re on other networks, which is very beneficial.
Hardware firewalls are physical devices that act as the first point of connection to the internet, protecting your entire system and every device connected to it. Sometimes hardware firewalls double as routers. Other times, they connect to a router. Different hardware firewalls can offer different features.
Not only do hardware firewalls protect against hackers and viruses, but they also keep out spam traffic that can slow down your network.
The best form of protection is a mixture of both physical and device-based firewalls throughout the environment. DataYard provides a comprehensive solution that may include physical, hosted, and next-generation firewall solutions.
Firewall Systems Need to Stay Updated
Digital attacks are constantly changing as hackers find new flaws and loopholes in network systems and computer software. In order for your firewall to do its job, it needs to be maintained and updated. It’s important that you keep your network and online data somewhere that’s secure and protected against the latest threats.
As an IT partner DataYard values an ‘eat your own dog food’ model that incorporates all the products that we would recommend to a client including physical devices, hosted firewall solutions, and software-based products. The more points of security the better. All of these options are available to new and current clients utilizing DataYard’s access, cloud hosting services and colocation. Second to great firewall solutions we maintain backups as an extra safety measure.
For those who have extra security compliance standards to meet, we have you covered. Our team has a track record for providing thorough solutions that check all the boxes for all compliance requirements.
And for those who want to make sure they have the right firewalls in place and configured correctly, our IT support in Dayton, Ohio can help you out.
Not sure what you need? We’re happy to consult so you get the protection you need. Contact us today!
Our Data Center is Here for You
LEARN MORE ABOUT HOW WE CAN KEEP YOUR DATA PROTECTED
With so much of our lives and businesses online, cybersecurity is more important than it’s ever been. And it’s not just something that big businesses have to worry about. Nearly half of cyber-attacks are targeting small businesses.
For small businesses, one bad hack could be enough to put them out of business for good.
That means cybersecurity should be a top priority for all businesses. If any part of your business is storing information online (and it probably is), you need to protect yourself against threats. How do you do that?
The best place to start is by understanding what types of attacks are happening out there. Here are some of the most common types of attacks taking place in 2019.
Today's most common threats to your data...
Ransomware has been around since ‘89, and it’s a tactic that’s still going strong. As you might deduce from the name, ransomware is malware that gets into your system, locking you out of it, and cutting you off from your data. In order to get access back, hackers will demand payment or “ransom”.
Sophisticated encryption in modern day ransomware ensures that your data is virtually impossible to recover without gaining permission from the random holder. What’s even scarier is the fact that should you pay the ransom, the hacker might delete your information anyway.
This is why regular backup systems and segmentation is so important in modern server systems.
This is a relatively new attack that’s quickly gaining steam. You’ve probably heard of cryptocurrencies such as Bitcoin and Ethereum. Without going into too much detail (because cryptocurrencies can get very confusing, very fast), these currencies involve a process called mining, which requires a lot of computer power to perform efficiently.
This is where cryptojacking comes into play.
Cryptojacking involves planting hidden malware that secretly uses your company’s hardware and resources to mine cryptocurrencies. These attacks can be very hard to notice as they don’t cause obvious problems. They do, however, slow down your system and anyone who is connected to it.
The good news is it’s relatively simple to prevent cryptojacking from happening. Even if your system has been infected, a skilled IT professional can get it removed quickly.
Smart technology is only growing more popular. These devices connect with the internet and with each other, forming something called the “Internet of Things”. While these devices can offer a lot of convenience, they can also serve as areas of exploitation.
Individual devices have their own systems which require their own updates. Failing to update your devices is one of the easiest ways to expose yourself to attackers. Software and network updates exist largely to patch potential security risks in products.
Systems need to be in place to ensure that the various devices connected to your network are secure and up-to-date.
Everyone likes to think of their vendors and contractors as trusted allies, but the truth is, they can be massive security risks as well. Especially smaller companies who often lack proper security systems and dedicated IT teams.
If your vendors have any access to your system, they pose a potential threat. You need to account for this. An IT audit, or Discovery, as we like to call them, can help expose where these weaknesses exist and provide steps to remediation.
Despite a pretty wide awareness of phishing, it’s still a popular (and often successful) means of attack. Today’s phishing schemes are smarter than ever, often utilizing personal info and professional sounding email addresses to seem legitimate.
These schemes can easily steal important passwords or spread malware through one wrong click.
Cyber Attacks are Constantly Changing and Evolving
Technology is advancing faster than ever. With it, cyber-attacks are constantly evolving. The only way to protect yourself, your customers, and your partners is with on-going security. Software or a simple firewall isn’t enough.
You need a professional team by your side.
At DataYard, we provide cyber security in Dayton, Ohio and beyond. Our web hosting and cloud services ensure regular backups of your data are made and that your systems stay up-to-date. Our IT support services (AYS) can further assist you in forming proper security protocols and ensuring that you stay protected from the latest digital threats.
Contact us today to learn how we can keep you and your business safe.
Is your company safe?
LEARN MORE ABOUT OUR CYBER SECURITY SERVICES
The world’s most popular Internet browser, Google Chrome, is releasing an important update in the coming weeks. Starting with the public and stable release of Chrome update 68, the browser will show a yellow “warning” icon next to the URL of web sites which are not protected by a SSL cert, and when this icon is hovered over a “Not Secure” warning will be displayed. With over 53% of total browser market share, this update is sure to affect a wide swatch of users and websites.
Not sure if your website will be affected by this change? Visit your site in a browser, and then look at the URL in the address bar. If your address begins with “HTTP” and not “HTTPS”, your visitors may start to see a warning when this update is released.
To get ahead of the curve on this, give us a call or send us an email – for $175 a year, we can purchase, coordinate, and install a fix for this issue for any DataYard hosting customers. Just another way we are here to help you make IT better.
Earlier this month was Safer Internet Day, which is a day dedicated to creating awareness around safe internet usage mainly geared towards children and teens. I realized this topic didn’t exist when I was growing up. Think about it for a second. I am in my mid-late twenties and I have had more years with dial-up internet or no Internet at all, than I have with anything close to the high speeds we have today. I’ve grown up with the Internet quite literally. When I was a kid, teachers and parents were just trying to grasp the concept of the Internet and how it was used, let alone talk about how to safely address it. For this reason, I’ve taken it upon myself to catch all of us up on some quick Internet Safety Tips.
Creating complex passwords and changing your passwords regularly can go a long way. That means moving past the passwords like ‘Password123’ and ‘Jacob19’, onto more creative phrases and symbols. It is also beneficial to use different passwords for your different accounts and websites, rather than using the same one across the board. For this reason, I would recommend using tools like LastPass, KeePass or 1Password to help keep track of all of your different passwords. These tools can also be set up to remind you to reset your password every couple of months.
Public Network Security
Free public Wi-Fi has essentially become a basic utility, making the internet easily accessible virtually anywhere. This is also making users increasingly vulnerable. The challenge with public Wi-Fi is that it’s often unsecured, making it easy for hackers to access your device. If you want to utilize public Wi-Fi in a secure manner, you can purchase a Virtual Private Network (VPN). A VPN is a software that will provide you with a secure connection to the Internet.
At Home Network Security
Taking a comprehensive look at your home network will allow you to have peace of mind when you are connecting to the Internet at home on your various devices. Changing administrative passwords and implementing a few precautions can make your connection much safer. For a checklist on securing your home network check out our Securing Your Home Network blog.
Many times, Internet browsers themselves provide Safe Browsing functions (see Google). However, you can go an extra step and retrain yourself on not giving away personal information, avoiding questionable websites, only downloading software from sites you trust, and increasing your browsers security settings.
- Click Smart – don’t click on sketchy links or ads
- Share Selectively – don’t just share your personal information with anyone
- Shop Safe – when shopping online always make sure to look for https
Keep an eye on the addresses of the sites you are visiting. In the address bar for your website, you will see either HTTP or HTTPS (more about the difference) which represents how data is transferred between a web server and a web browser. With an HTTPS site, the data is encrypted, which keeps your information safe. This is extremely important for any online shopping or banking, and any site taking your personal information. You need to make sure that it has encryption.
Stay Up to Date
Staying up to date on the latest operating systems (OS) and software/application versions will ensure that you have the most up-to-date security measures in place. We recommend turning on auto-update when applicable.
If you have more questions about making your home a safe place please feel free to reach out to us on social media or at firstname.lastname@example.org
- Safer Internet Day – http://saferinternetday.us/
- Google’s Commitment to a Safer Internet – https://privacy.google.com/safer-internet.html
- Department of Defense (NSA) Recommendations http://dodcio.defense.gov/Portals/0/Documents/Cyber/Slicksheet_BestPracticesForKeepingYourHomeNetworkSecure_Web_update.pdf
HTTP (Hypertext Transfer Protocol) is the default protocol used to transfer data between a Web server and a Web browser. When you open Internet Explorer, Chrome, Firefox or Safari and type a URL in the address bar (for example, https://www.datayard.us); you’re actually sending an HTTP request to DataYard’s Web server requesting information; in this case DataYard’s homepage. When DataYard’s Web server receives this request, it searches for the desired information and responds to your Web browser with the appropriate information. This information is then displayed on your monitor and the HTTP connection is closed. If you were to click on any link within the home page, another HTTP request is sent to the Web server and it responds with the desired data and again displayed on your monitor.
HTTP is inherently insecure, meaning information is sent in plan or clear text. Why is this noteworthy? If a savvy person were to “snoop” on your Internet connection, they’d be able to read the data rather easily using simple tools found all over the Internet. This isn’t such a bother when you’re browsing for the latest football scores or reading up on recent events. However, if you’re paying bills, checking bank accounts or attempting to secure a loan of some type via an online finance tool, this becomes seriously concerning. The answer: HTTPS.
HTTPS (Hypertext Transfer Protocol Secure), as its name implies, is HTTP’s much more secure brother. If you were to type “google.com” into your favorite browser, you’ll likely see the address change and it’ll look like this…
Why is this, though? It’s because Google uses an SSL (Secure Socket Layer) certificate to encrypt data sent between their Web servers and your Web browser. Much the same can be said about almost any other Web domain that would be expected to serve up sensitive information (banks, online shopping, investment entities, utility companies that accept online payments, etc.). Without this certificate or HTTPS, if you were to complete an online shopping transaction and someone happened to be “snooping” on your device or Internet connection, they’d be able to see the details of your purchase in plain or clear text. Credit card information, shipping addresses and other details of your transactions would be wide open for the world to see. So how does HTTPS work exactly?
When an SSL certificate is purchased and placed on a Web server, the Web server holds a private key, basically an encryption algorithm that tells its public key holders how to decrypt the information its sending back and forth. Let’s take our first example of HTTP but this time we’re going to use HTTPS.
It’s time to pay bills and instead of using snail mail, you’ve opted to go green and pay online. You enter your vendors Web address in your browser, https://www.electriccompany.com. Immediately upon this request, Electric Company’s Web server will send your browser a public key, instructions on how to decrypt the encrypted information via the private key. Confused yet? You shouldn’t be. All this decrypting and encrypting is transparent to the user and is exclusively handled by the browser and server.
As you enter your credit card information and click “SUBMIT”, your credit card information, account details and other personally identifiable information is sent to the Web server within a snug, tightly-wrapped blanket of human-unreadable characters that can only be deciphered by the Web server and it’s private key. So the guy that’s been “snooping” on your Internet connection would only see a very lengthy and incoherent string of characters that would envy Da Vinci’s cryptex.
Now that you have a better understanding of HTTP and HTTPS, as well as their differences and advantages; how does one go about “securing” their Web site? It’s rather simple, actually and as more and more people conduct sensitive business in our technologically endowed world, certificate authorities (CA) are making this process even more streamlined than before.
Companies like VeriSign, GeoTrust, DigiCert and GoDaddy specialize in the sale and deployment of SSL certificates on a global scale. A user would simply purchase an SSL certificate from any of these CA’s then install the certificate on the appropriate Web Server(s). Once the installation is complete, any browser requesting information from that Web server would then have the benefits and peace of mind that all the transactions would be safe and secure! If you’re not up for the task just let us know and we’ll be sure to take care of everything giving you a wonderful gift, peace of mind.
DataYard’s new and updated mail filter features improvements to both spam and virus filtering performance and the user interface. This article explains how to create an account on DataYard’s Mail filter, update your password, add and remove entries from your whitelist and blocklist and adjust your spam filtering levels from the defaults.
Creating an account
Access the Mail filter login page at https://filter.datayard.us. Enter your email address in the username field and click “Create New Password”
It will tell you that an account has been created and will have sent an email to you with your password.
Now you can log in to the portal with your email address and password.
Here is what you’ll see when you log in. The page will default to the Quarantine Inbox that is disabled by default (you can enable it by following the instructions here).
Changing Your password
Upon logging in, click on Preferences
Then click Password
Enter your old password and desired password as directed, then click Save Password.
Updating your whitelist/blocklist
Click Preferences, then Whitelist/Blocklist
You will be presented with the following page. To add an address to either list, click into the entry box in either list, then enter the address and click Add. To remove an entry, click the trash can next to the entry you wish to remove.
To remove an entry, click the trash can next to the entry you wish to remove.
You can edit the list as a whole by clicking Bulk Edit on the list you wish to edit.
Never edit the first line and put each entry on its own line, as shown below. Click Save once finished.
Customizing your filter settings
Click on Preferences, then Spam Settings
In order to change your settings from your Domain defaults, select No for Use Domain Defaults under the Spam Scoring section, then click Save.
You’ll now be able to adjust the scoring levels for blocking, quarantine (see Enabling Your Spam Quarantine if you’d like to utilize the quarantine feature) and Tagging. Adjust the sliders to your desired levels and click Save. Higher numbers are less sensitive and lower numbers are more sensitive. For example, if you change the Block slider from the default level of 5 to 8, you will receive more messages.
The new mail filter includes comprehensive help, if you need an explanation for a setting or section, simply click the “Help” link at the top right of every section header.
You can also contact us any time at email@example.com or 937-226-6896 for assistance.