The recent AT&T data breach shows that even big businesses aren’t immune to cyberattacks and highlights the critical need for strong cybersecurity. This incident shows just how risky the digital world can be for businesses and why it’s crucial to always stay vigilant about security.

Note: This incident did NOT involve any of OneNeck’s services or systems.

The AT&T Data Breach: What Happened?

In March 2024, AT&T revealed customer information had been compromised. AT&T stated that data was “illegally downloaded from our workspace on a third-party cloud platform.” AT&T didn’t name the service, but it’s been linked to recent data thefts on the Snowflake platform.

The breach impacted almost every AT&T wireless customer, as well as MVNO users and even landline customers who interacted with mobile numbers. Data stolen included call and text message logs from May 1, 2022, to October 31, 2022, and a smaller batch from January 2, 2023​. Ultimately, this incident affected nearly 109 million customer accounts.

Thankfully, the contents of calls and texts were not exposed. However, scammers could use the metadata to guess personal details and carry out phishing attacks.

Cybersecurity Recommendations

To protect you and your organization from suffering such a breach, it is crucial to adopt proactive security measures. Here are a few essential recommendations:

1. Regularly Update and Strengthen Passwords: Make sure your accounts have strong, unique passwords, and update them regularly, especially if you think they might be compromised.
2. Use Multi-Factor Authentication (MFA): Turn on Multi-Factor Authentication (MFA) for extra security. This extra step makes it much harder for unauthorized access.
3. Monitor for Suspicious Activity: Review account statements and credit reports regularly for unusual activity. Set up alerts for large transactions or changes to account details.
4. Educate and Train Employees: Education on security best practices is vital. Conduct regular training sessions to help employees recognize phishing attempts and other common scams.
5. Encrypt Communication: When discussing sensitive information, use encrypted messaging apps and email services to protect the data from interception.
6. Regular Security Assessments and Audits: Conduct regular security assessments and audits to identify and resolve system vulnerabilities.

Shared Responsibility for Cybersecurity

Cloud Service Providers (CSPs) are responsible for securing the infrastructure and services they provide, which includes protecting against threats to their data centers, managing physical security, and ensuring robust safeguards against external attacks.

However, businesses must still ensure data protection and access controls. They should vet their CSPs to understand the security measures they use and discover any potential vulnerabilities. Communication and transparency between businesses and their CSPs are key. Both parties must work together to identify and mitigate risks and respond quickly to incidents.

Broader Implications for Businesses

As attacks become more complex, the obligation to protect customer information increases. Companies should invest in robust security technologies and adopt a proactive and holistic approach to cybersecurity. The AT&T attack is a stark reminder that even companies with extensive resources are vulnerable.

This incident shows why having a thorough cybersecurity plan is so important. This plan should include tech solutions, regular employee training, and awareness programs. Cybersecurity is not solely the responsibility of the IT department; it requires a company-wide commitment to best practices and vigilance.

Reach Out and Get in Touch with an Experienced Partner

Keeping yourself updated on the latest threats, using solid security practices, and always thinking ahead are crucial to keeping your data safe.

However, navigating security can be challenging. This is where an experienced partner can make a difference. OneNeck offers comprehensive IT security services, including our robust vCISO services, to help you navigate these challenges. Our team of experts is dedicated to providing your business with the highest level of protection. Contact OneNeck today to see how we can help protect your organization against future threats.

Monthly Security Workshop: Identity and Going Passwordless

This month we explore the latest advancements in securing user identities without relying on traditional passwords. We highlight methods such as biometric authentication, Windows Hello for Business, FIDO2 security keys, and the use of the Microsoft Authenticator app. This presentation also delves into Microsoft Identity Protection’s robust features, including risk-based conditional access and real-time threat detection, designed to safeguard user accounts and sensitive data from potential security breaches.

Additionally, we provide an overview of how passkeys in Microsoft Authenticator work, emphasizing their role in streamlining secure access across devices.

Welcome to July’s edition of the OneNeck IT Solutions patching blog. As the summer heat intensifies, so do the risks posed by unpatched vulnerabilities. Staying vigilant in our cybersecurity efforts is crucial protection and will help keep your organization from getting burned. This month, we bring you critical updates from Microsoft and significant patches within the Linux environment to ensure your systems remain secure and efficient.

Microsoft’s July Patching Overview

This month, Microsoft has addressed a total of 142 vulnerabilities, categorized as follows:

• 26 Elevation of Privilege Vulnerabilities
• 24 Security Feature Bypass Vulnerabilities
• 59 Remote Code Execution Vulnerabilities
• 9 Information Disclosure Vulnerabilities
• 17 Denial of Service Vulnerabilities
• 7 Spoofing Vulnerabilities

Two actively exploited zero-day vulnerabilities were patched this month for Microsoft products. CVE-2024-38080 is a Windows Hyper-V Elevation of Privilege Vulnerability that could allow attackers to gain elevated access to affected systems. CVE-2024-38112 is a Windows MSHTML Platform Spoofing Vulnerability that could deceive users into interacting with malicious content. These vulnerabilities require immediate attention to prevent potential exploitation and maintain the security of your systems.

Highlighted Patches for July:

• CVE-2024-38080: Windows Hyper-V Elevation of Privilege Vulnerability
• CVE-2024-38112: Windows MSHTML Platform Spoofing Vulnerability
• CVE-2024-35264: .NET and Visual Studio Remote Code Execution Vulnerability
• CVE-2024-37985: Arm: CVE-2024-37985 Systematic Identification and Characterization of Proprietary Prefetchers

Exchange Updates

Microsoft’s Hotfix for Exchange, released in April, addresses numerous known issues from the March Exchange Security Update. Since OneNeck’s customers have not been affected by these issues, we have postponed applying the Hotfix to their Exchange Servers and will wait for the next Exchange Update.

In the Hotfix, Microsoft introduced support for ECC certificates and Hybrid Modern Authentication for OWA/ECP, which are available exclusively for Exchange Server 2019. These features will be included in the next Security or Cumulative Update for Exchange 2019.

Additionally, Microsoft has acknowledged the need for DKIM and DMARC for Exchange Server On-Prem following Google and Yahoo’s Q1 2024 announcement. However, no updates are currently available to the public. Customers routing their mail through MS365 should be mostly unaffected by the changes from Google and Yahoo.

As mentioned last month, Microsoft has released an Exchange Server Roadmap update, defining their plans for Exchange Server SE (Subscription Edition). This edition is aimed to be released early in the third quarter of 2025, coinciding with the end-of-life date for Exchange Server 2016 and 2019. Exchange Server SE will be the code equivalent to Exchange Server 2019 CU15. OneNeck encourages all its customers using Exchange to upgrade to Exchange Server 2019. If you have any questions about how OneNeck can assist you with your upgrade decisions, please contact the Service Desk.

Linux Patching Insights for July

This month’s Linux updates are crucial for maintaining the security and stability of your environment. Noteworthy patches include:

• CVE-2024-32462: Security update for flatpak
• CVE-2024-5688, CVE-2024-5690, CVE-2024-5691, CVE-2024-5693, CVE-2024-5696, CVE-2024-5700, CVE-2024-5702: Security update for firefox
• CVE-2022-27635, CVE-2022-36351, CVE-2022-38076, CVE-2022-40964, CVE-2022-46329: Security update for linux-firmware
• CVE-2023-4408, CVE-2023-50387, CVE-2023-50868: Security update for bind, bind-dyndb-ldap, and dhcp
• CVE-2024-32487: Security update for less
• CVE-2024-2961, CVE-2024-33599, CVE-2024-33600, CVE-2024-33601, CVE-2024-33602: Security update for glibc
• CVE-2024-32002, CVE-2024-32004, CVE-2024-32020, CVE-2024-32021, CVE-2024-32465: Security update for git
• CVE-2023-6597, CVE-2024-0450: Security update for python3.11
• CVE-2024-33871: Security update for ghostscript
• CVE-2023-6597, CVE-2024-0450: Security update for python3.9 available for Red Hat Enterprise Linux 9
• CVE-2022-23816, CVE-2022-29901: Oracle Linux Unbreakable Enterprise kernel security update

These updates address a wide range of vulnerabilities essential for protecting your Linux servers against potential breaches and ensuring robust system functionality. Please apply any applicable patches immediately.

Microsoft Office & SharePoint Updates

While our scheduled patching activities are comprehensive, they are designed to complement your internal update processes for a wide range of products, including Microsoft Office and SharePoint. We encourage our clients to regularly review and apply updates across all software to ensure the highest level of security. For insights on integrating these updates seamlessly into your security strategy or how OneNeck can support your efforts, do not hesitate to reach out to our Service Desk.

Closing Thoughts

Maintaining a solid cybersecurity posture through regular patching is crucial as we continue through the summer months. Just as sunscreen protects you from the sun’s harmful rays, promptly applying these updates will help safeguard your systems against potential threats. If you need assistance or have questions, OneNeck supports your cybersecurity efforts.

Stay secure and patched, while keeping yourself protected from the heat of summer’s vulnerabilities.

Each month, OneNeck engineers review newly released updates from vendors, like Microsoft, to understand any known issues, actions required and understand the priority of each. This is done immediately following Patch Tuesday releases, and we monitor for adjustments to patches throughout each month.

The information above is gathered monthly during this review and posted for awareness to our customers. This information is generally updated only once per month and is based on our engineers’ review of the information provided by the vendor at that time. As always, for the most up-to-date patching information, please see the vendor’s website or contact us.

Note: If OneNeck actively manages a device or software that is impacted by any of these vulnerabilities, when necessary, OneNeck will be in direct contact with you regarding remediation.

Two methods to protect your organization’s data and IT infrastructure are Backup as a Service (BaaS) and Disaster Recovery as a Service (DRaaS). While both services provide data backup and recovery, each solution offers functions you may or may not need. 

Why You Need Data Backup and Disaster Recovery 

Companies today depend on their data to carry out daily operations, decision-making and customer interactions. This data can include sensitive information, financial records, customer data and intellectual property. 

Data loss or downtime can have severe outcomes such as financial loss, reputation harm and legal repercussions. With a reliable backup and disaster recovery strategy in place, you can ensure uninterrupted business operations and minimize the impact of data loss or system failures.

What is Backup as a Service?

Backup as a Service (BaaS) is a managed, cloud-based solution that provides automated and secure backup of your organization’s data. With BaaS, your data is stored in an off-site location such as a secure data center to ensure its safety and accessibility in the event of a disaster or system failure. 

BaaS is simple. Instead of relying on tape drives or physical storage devices, you can automate the backup process and eliminate the need for manual intervention. This keeps your data backed up regularly without any hassle or disruption to your daily operations.

Why Use Backup as a Service Providers?

One main benefit of BaaS is data protection. With BaaS, your data is securely stored off-site, protecting it from physical damage, theft or natural disasters, and ensuring it can be easily restored when needed.

Backup as a Service providers offer cost-efficient subscription-based services. By paying a subscription fee based on your storage requirements, you eliminate the need for expensive hardware like tape drives or additional servers and the associated maintenance and management costs. 

As your organization grows and your data storage needs increase, BaaS allows you to easily scale up your storage capacity without additional hardware or infrastructure upgrades. This flexibility ensures that your backup solution can adapt to your changing business needs.

What is Disaster Recovery as a Service?

While BaaS focuses on data backup, Disaster Recovery as a Service (DRaaS) covers your entire IT infrastructure. DRaaS solutions back up your data and replicate servers and applications to a secure offsite location. They also include failover mechanisms and testing procedures to ensure business continuity. 

In the event of a disaster, you can quickly and seamlessly switch to the replicated environment, minimizing downtime and ensuring your business operations can continue without interruption.

Benefits of DRaaS Providers

In addition to data backup, Disaster Recovery as a Service offers the benefit of near-instant recovery, as your replicated environment is readily available and can be activated with a few simple steps. This minimizes downtime so your business can continue operating without significant disruptions.

With the comprehensive disaster recovery capabilities of DRaaS, your organization can maintain business continuity even in the face of major disruptions. Whether it’s a natural disaster, hardware failure or cyber-attack, DRaaS solutions ensure that your critical systems and data are protected and available when you need them. Additionally, DRaaS providers often offer regular testing and verification of their disaster recovery capabilities to ensure that your disaster recovery plan is effective and that your systems can be recovered successfully. 

Evaluating DRaaS and Backup as a Service Providers

DRaaS and BaaS providers offer many solutions. Before you choose, consider these factors:

1. Reliability and performance: The provider should have a good track record. Check customer reviews and testimonials to gauge their reputation and ensure their services meet your organization’s needs.
2. Security and compliance: DRaaS providers must have robust security measures to protect sensitive and confidential information, including encryption, access controls and regulation compliance.
3. Support and Service Level Agreements (SLAs): Check the provider’s level of support and SLAs, and look for guarantees regarding recovery time objectives (RTOs) and recovery point objectives (RPOs) to ensure they can meet your organization’s recovery needs.

Finding the Right Backup and Disaster Recovery Solution for Your Business

Your business can’t afford to be down, even after a disaster. That’s why data backup and disaster recovery are essential for the continuity and security of your business. Whether you opt for Backup as a Service or Disaster Recovery as a Service, OneNeck’s Reliacloud can provide the protection your organization needs. 

Reliacloud has flexible options to get your organization’s perfect fit, with numerous hyperscale cloud and on-premise backup and disaster recovery options that help protect your organization from downtime and data loss. To learn more, read how OneNeck’s Reliacloud can protect your organization from downtime and data loss.

Disaster Recovery as a Service (DRaaS) is an important part of modern business continuity planning. When your business relies on its data, you must have a robust disaster recovery strategy for unexpected events.

What is Disaster Recovery as a Service?

DRaaS is a cloud-based solution that helps your business recover its IT infrastructure and data after a disaster. Unlike traditional disaster recovery methods such as setting up and maintaining a secondary data center, DRaaS uses the cloud to eliminate the need for another data center and reduce costs while simplifying the recovery process. 

How Does DRaaS Work?

When you put a DRaaS solution in place, your critical systems and data are replicated to a secure cloud environment. This replication can happen in near real-time, ensuring that your data is always up to date. 

When disaster strikes, such as a natural event or cyberattack, your DRaaS solution provides failover, meaning your replicated environment automatically takes over, allowing you to continue operations. Failover is quick and efficient and it minimizes the impact of the disaster on your business. When you restore your primary infrastructure, your data and operations will automatically fail back—switch back from the DR environment—ensuring a smooth transition back to normal operations. 

Why Your Business Needs Disaster Recovery Services

All businesses can benefit from implementing a robust disaster recovery strategy. Some of the key benefits of DRaaS include:

1. Minimized downtime: DRaaS provides quick failover and failback so your operations can resume promptly after a disaster.
2. Cost savings: Traditional disaster recovery methods can be expensive due to the additional infrastructure, hardware and maintenance costs. DRaaS saves money by eliminating upfront investments and offering a pay-as-you-go model.
3. Scalability: As your business grows, so does your data. DRaaS lets you scale your disaster recovery capabilities based on your evolving needs. 
4. Reliability: DRaaS solutions are built on robust and redundant cloud infrastructures, ensuring high availability and data integrity. 

What to look for in a DRaaS solution

When selecting a DRaaS solution for your business, consider these key factors:

1. Data security: Look for a DRaaS provider with a secure infrastructure, backed by certifications such as ISO 27001 and SOC 2.
2. Ease of implementation: The solution should be easy to implement and integrate with your existing systems and come with adequate support from the vendor. 
3. Recovery Time Objective (RTO) and Recovery Point Objective (RPO): RTO is the maximum acceptable downtime, while RPO signifies the maximum acceptable data loss. Choose a DRaaS solution that aligns with your RTO and RPO requirements.
4. Testing and monitoring capabilities: The DR solution should provide comprehensive testing and monitoring tools for an effective disaster recovery strategy.
5. Support and SLAs: Evaluate the DRaaS vendor’s support and their Service Level Agreements (SLAs) which guarantee uptime, response and resolution times.

How to Implement Disaster Recovery Service

Implementing DRaaS requires careful planning and execution. Here are some best practices to consider:

1. Assess your business requirements: Identify critical systems and data that need protection and conduct a thorough risk assessment to prioritize your disaster recovery efforts.
2. Define your RTO and RPO: Determine your maximum acceptable downtime and data loss for each critical system.
3. Regularly test your disaster recovery plan: Ensure that your disaster recovery plan works as expected with regular tests to identify any gaps or areas for improvement.
4. Train your team: Provide regular training and conduct drills so your IT team is well-versed in the DR solution and understands its roles and responsibilities during a disaster recovery event. 
5. Monitor and update: Continuously monitor your DR solution, update it as your business evolves and regularly review your disaster recovery plan to incorporate any changes in your IT infrastructure or business processes.

Flexible, Reliable Disaster Recovery Service

When disaster strikes, the last thing you want to worry about is data loss and downtime. OneNeckIT Solution’s ReliaCloud DRaaS offers a comprehensive and reliable solution for your disaster recovery needs. With a robust cloud infrastructure, industry-leading security measures and a wide range of service level options, ReliaCloud DRaaS ensures the highest level of data protection and availability.

OneNeck’s ReliaCloud DRaaS gives you reduced downtime, scalable recovery capabilities and 24/7 support from a team of experts. With OneNeck’s extensive experience and expertise in disaster recovery, you can trust that your business is in safe hands. Learn more by reading about OneNeck’s ReliaCloud DRaaS and how it can help safeguard your data.

Cyber incidents are no longer a question of if but when. Today’s organizations must be prepared to respond effectively to these incidents to avoid minor disruptions potentially becoming catastrophic breaches. This is where Incident Response (IR) becomes indispensable. Today I will cover the critical aspects of Incident Response, focusing on the concepts of “left of boom” (before an incident) and “right of boom” (after an incident).

Understanding “Left of Boom” and “Right of Boom”

Imagine preparing for Hurricane Ian, which my family and I experienced in 2022. “Left of boom” covers all the proactive steps we took before the hurricane hit, such as practicing the installation of hurricane shutters (making sure all parts and tools were ready), stocking up on essential supplies, and planning evacuation routes. In cybersecurity, “left of boom” is similar: it involves threat hunting, conducting regular security assessments, training employees, and developing and testing Incident Response plans.

Conversely, “right of boom” pertains to the reactive measures taken after the hurricane has passed. This involved assessing home, property, and neighborhood damage, cleaning up debris, and restoring normalcy. The aftermath can be chaotic and challenging, requiring swift and effective action to return to a state of normalcy. In cybersecurity, the “right of boom” includes detecting the breach, containing the threat, eradicating malicious actors, recovering from the incident, and conducting post-incident reviews to improve future responses. Just as in a hurricane, the speed and efficiency of your response can make a significant difference in minimizing damage and disruption. 

The Cost of Cybersecurity Incidents

The financial implications of a cybersecurity incident can be staggering. According to IBM’s 2023 Cost of a Data Breach Report, the average cost of a data breach was $4.45 million. This figure includes direct costs such as legal fees, regulatory fines, and notification expenses, as well as indirect costs like reputational damage and lost business opportunities.

However, the same report highlights a significant silver lining: organizations with a well-developed Incident Response plan saw an average decrease of $2.66 million in financial impacts. This substantial reduction underscores the value of being prepared and having a robust IR plan in place.

The Growing Rate of Cyberattacks

The frequency and sophistication of cyberattacks are increasing at an alarming rate. A recent study by Accenture revealed a 31% increase in cyberattacks between 2020 and 2022. This surge underscores the urgent need for businesses to not only invest in advanced security technologies but also to develop comprehensive Incident Response strategies.

Key Elements of an Effective Incident Response Plan

Developing an effective IR plan involves several critical components:

• Preparation: Establishing and training an Incident Response team and developing policies and procedures.
• Identification: Detecting and determining the nature and scope of the incident.
• Containment: Implementing short-term and long-term containment strategies to limit the damage.
• Eradication: Removing the incident’s root cause and ensuring the system is free from malicious actors.
• Recovery: Restoring and validating system functionality ensures systems are back to normal operations.
• Lessons Learned: Conducting a thorough post-incident review to identify lessons learned and improve future response efforts.

Industry Statistics on Incident Response

According to Help Net Security, astonishingly, 47% of mid-sized businesses do not currently have an incident response plan. This lack of preparedness puts organizations at a severe disadvantage in effectively managing and mitigating security incidents. This is supported in Fortinet’s Global Threat Landscape Report that highlights 68% of organizations with an incident response plan were able to mitigate at least some impacts of cyberattacks within hours, compared to 27% of those without such plans.

Additionally, Microsoft’s Digital Defense Report highlights that organizations with incident response plans experienced 58% fewer successful ransomware attacks compared to those without.

Covering Both Sides of the IR Boom

The importance of a robust Incident Response plan cannot be overstated. By incorporating both “left of boom” and “right of boom” strategies, organizations can significantly mitigate the impact of cyber incidents. The proactive measures taken before an incident and the effective actions implemented afterward are crucial for reducing financial losses and maintaining business continuity. Focusing on both aspects strengthens the overall response. Neglecting one can leave the organization vulnerable and the other less effective.

As cyber threats continue to evolve, staying prepared and resilient is paramount. Investing in Incident Response not only protects your organization but also ensures you are well-equipped to handle the inevitable challenges ahead. By prioritizing Incident Response, businesses can transform potential crises into manageable events, safeguarding their operations, reputation, and bottom line.

At OneNeck, we take a holistic view of cybersecurity, offering numerous services, including comprehensive security assessments and Virtual CISO services. Ensure your organization is prepared and resilient against evolving cyber threats by partnering with us. Our expertise and tailored solutions will help safeguard your operations, reputation, and bottom line.

Monthly Security Workshop: Mastering Incident Response

This workshop dives into the critical topic of Incident Response. This session explores the concept of “left of boom” (proactive measures before a security incident) and “right of boom” (reactive measures after an incident has occurred).

We discuss the various considerations under the umbrella of Incident Response, from preparation and detection to containment and recovery. Learn how to effectively manage and mitigate security incidents to protect your business. Discover the comprehensive services OneNeck IT Solutions offers to support you on both sides of the “boom.”

Welcome to June’s edition of the OneNeck IT Solutions patching blog. As we approach the Summer Solstice; the longest day of the year, it’s a perfect reminder to shed light on and address vulnerabilities within your systems. Staying proactive in patching and updating is essential as we move into the summer months. This month, we highlight critical updates from Microsoft and significant patches within the Linux environment to ensure your systems remain secure and efficient.

Microsoft Patching Overview

This month, Microsoft has addressed a total of 51 vulnerabilities, categorized as follows:

• 25 Elevation of Privilege Vulnerabilities
• 18 Remote Code Execution Vulnerabilities
• 3 Information Disclosure Vulnerabilities
• 5 Denial of Service Vulnerabilities

Notably, one zero-day vulnerability was patched this month for Microsoft products CVE-2023-50868. This vulnerability involves the NSEC3 Closest Encloser Proof and can exhaust CPU resources, potentially leading to a denial of service. When combined, these updates address an array of critical issues, including remote code execution, privilege escalation, and security feature bypasses. Promptly applying these patches is crucial to prevent potential exploits and maintain system integrity.

Highlighted Patching for June

This month’s critical updates include:

• CVE-2023-50868: MITRE: NSEC3 Closest Encloser Proof Can Exhaust CPU
• CVE-2024-30080: Microsoft Message Queuing Remote Code Execution Vulnerability
• CVE-2024-30082, CVE-2024-30087 & CVE-2024-30091: Win32k Elevation of Privilege Vulnerability
• CVE-2024-30064, CVE-2024-30068, CVE-2024-30088 & CVE-2024-30099: Windows Kernel Elevation of Privilege Vulnerability
• CVE-2024-30085: Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability

Exchange Updates

As mentioned in last month’s blog, Microsoft released a Hotfix for Exchange late in April to cumulatively address the issues resulting from the March Exchange Security Update. OneNeck’s customers have not been affected by these issues; as such, our team has held off on applying the Hotfix and will wait for the next Exchange Update.

In the April Hotfix, Microsoft introduced support for ECC certificates and Hybrid Modern Authentication for OWA/ECP, available exclusively for Exchange Server 2019. The following Security or Cumulative Update for Exchange 2019 will also include these features.

Microsoft has recognized the need for DKIM and DMARC for Exchange Server On-Prem following the Q1 2024 announcement from Google and Yahoo. However, at his point in time there have not been any further updates. Customers routing their mail through MS365 should be mostly unaffected by the changes mentioned above rather than sending mail directly from their On-Prem Exchange Server.

Additionally, Microsoft released an Exchange Server Roadmap update this month, outlining their plans for Exchange Server SE (Subscription Edition). This edition is expected to be released early in the third quarter of 2025, coinciding with the end-of-life date for Exchange Server 2016 and 2019. Exchange Server SE will be the code equivalent to Exchange Server 2019 CU15. OneNeck encourages all customers using Exchange to upgrade to Exchange Server 2019. If you have any questions about how OneNeck can assist you with your upgrade decisions, please contact the Service Desk.

Linux Patching Insights for June

This month’s Linux updates are crucial for maintaining the security and stability of your environment. Noteworthy patches include:

• CVE-2023-25775: Kernel Security and Bug Fix Update addressing critical kernel vulnerabilities.
• CVE-2023-20592: Linux-firmware security update to enhance hardware compatibility and security.
• CVE-2023-45235: Edk2 Security Update to improve firmware security.
• CVE-2023-50868: Bind and DHCP security update to secure DNS and network configuration.
• CVE-2024-0450: Python3 Security Update to fix vulnerabilities in the Python programming language.
• CVE-2024-1394: Grafana Security Update and Oracle Linux grafana security update to enhance performance monitoring security.
• CVE-2024-23213: Webkit2gtk3 Security Update to secure web content rendering engines.
• CVE-2024-24549: Tomcat Security and Bug Fix Update to improve web server security.
• CVE-2024-3019: Oracle Linux pcp security update to enhance performance monitoring security.
• CVE-2024-31083: Tigervnc / Xorg-X11 Security Update to secure remote desktop and graphical server environments.
• CVE-2024-32487: Less Security Update to fix vulnerabilities in the less file pager.
• CVE-2024-33602: Glibc Security Update to address critical issues in the GNU C Library.
• CVE-2024-4777: Firefox Security Update to ensure secure web browsing.
• CVE-2023-1989, CVE-2023-40551, CVE-2024-1086: Oracle Linux Unbreakable Enterprise kernel security update to address multiple kernel vulnerabilities.
• CVE-2024-2201: Oracle Linux shim security update to improve boot loader security.

We recommend that you promptly apply all relevant patches to safeguard Linux servers, provide system functionality and ensure robust security.

Microsoft Office & SharePoint Updates

While our scheduled patching activities are comprehensive, they are designed to complement your internal update processes for a wide range of products, including Microsoft Office and SharePoint. We encourage our clients to regularly review and apply updates across all software to ensure the highest level of security. For insights on integrating these updates seamlessly into your security strategy or how OneNeck can support your efforts, do not hesitate to contact our Service Desk.

Closing Thoughts

Maintaining a solid security posture through regular patching is crucial as we move into the heart of summer. Just as applying sunscreen shields you from the sun’s harmful rays, quickly applying these updates will help safeguard your systems against potential threats. If you need assistance or have questions, OneNeck supports your cybersecurity efforts.

Stay secure and patched, and let’s keep your systems cool and protected this summer.

Each month, OneNeck engineers review newly released updates from vendors, like Microsoft, to understand any known issues, actions required and understand the priority of each. This is done immediately following Patch Tuesday releases, and we monitor for adjustments to patches throughout each month.

The information above is gathered monthly during this review and posted for awareness to our customers. This information is generally updated only once per month and is based on our engineers’ review of the information provided by the vendor at that time. As always, for the most up-to-date patching information, please see the vendor’s website or contact us.

Note: If OneNeck actively manages a device or software that is impacted by any of these vulnerabilities, when necessary, OneNeck will be in direct contact with you regarding remediation.

As businesses increasingly migrate to the cloud, effectively managing associated costs is crucial. IT budgets dedicate significant amounts to cloud services, with predictions suggesting this will escalate. This surge in cloud investment makes Financial Operations for cloud environments— FinOps —an essential discipline for managing costs in cloud environments.

Importance of FinOps in Cloud Management

Moving to the cloud often presents organizations with tremendous opportunities, offering scalability, flexibility, and initial cost savings. However, without a disciplined approach, cloud expenses can quickly become unpredictable and may spiral out of control. This is where FinOps plays a crucial role. By adopting FinOps practices, organizations can ensure cloud costs are transparent and predictable, avoid needless expenses and make smarter cloud investments. They can also maintain agility to adjust resources in real time, match spending with demand and avoid over-provisioning and underutilization.

Key Elements of FinOps in Cloud Management

• Collaboration Across Teams: Foster cultural change to enhance cost efficiency, requiring real-time collaboration to the second as resources are managed and act as a catalyst for continuous improvement and quick decision-making.
• Decisions Driven by Business Value: Focus on unit economics and value-based metrics rather than aggregate spending, encouraging strategic trade-offs between cost, quality, and speed to drive innovation and enhance market responsiveness.
• Cultural Shift Towards Accountability: Empowers individual teams to manage their cloud usage and budgets, promoting cost as a critical factor alongside uptime and performance. Ensures decisions are supported by real-time financial data, clean data practices, and benchmarking against industry standards.
• Centralized Management: Advocates for centralized management and executive sponsorship to streamline FinOps practices, utilizing automation to reduce duplication and efficiently manage resources and discounts.
• Maximizing the Variable Cost Model: Treats the cloud’s variable cost model as an opportunity for optimization. It advocates for just-in-time resource management to avoid over-provisioning and underutilization and recommends continuous adjustments to cloud usage for optimal efficiency.

Optimizing Azure Resource Management within FinOps Framework

Through its robust toolkit designed to operate within the FinOps framework, Microsoft Azure helps businesses manage and properly align cloud resources. The key is to discover these tools, many of which you likely already have access to, and then understand how to utilize their insights and recommendations.

Right-Sizing Azure Resources

Right-sizing is crucial for aligning resource consumption with actual demand. Azure’s capabilities allow for dynamic resource adjustment—scaling up during peak usage times and scaling down in quieter periods. This flexibility is critical to maintaining performance without overspending. Azure Advisor analyzes resource usage and configurations to offer tailored recommendations, helping to identify underutilized resources.

Enhancing Cloud Management with Strategic Tools

Beyond right-sizing, Azure provides tools that support broader cost optimization and cloud management. Azure Cost Management delivers analytics and insights that enable businesses to monitor and control spending. This tool is instrumental in implementing financial accountability through showback and chargeback, which attribute cloud costs to specific departments or projects, promoting responsible usage and precise budgeting.

Automation and Multi-Cloud Flexibility

Azure supports extensive automation capabilities that reduce manual overhead and minimize costs. Automation is critical in implementing routine tasks like performance tuning and cost adjustments, preventing resource wastage and improving operational efficiency. Additionally, Azure’s multi-cloud strategy offers flexibility and risk mitigation by not depending solely on a single cloud provider. 

Monitoring and Strategic Decision-Making

Effective cloud management requires monitoring cost anomalies and informed decisions about region selection and service deployment. Azure’s ample monitoring tools help identify unexpected charges, and its analytics capabilities support strategic decision-making.

What You Should Focus On Now

Azure environments typically change often. Keep your eye on the costs.

1. Start with Cost Avoidance—downsize first. If you can turn it off while maintaining patching and backups, do so for stretches of time.
2. Develop a cost optimization process using Azure Advisor.
3. Keep track of your decisions on Azure Advisor recommendations
4. Review your optimizations to make sure they are doing what you thought they would
5. Keep your cost optimizations in mind when making changes.

Enhancing Your Cloud Investment with the Right-Sized Partner

Azure offers the potential to maximize the value of cloud investments. However, without adhering to the principles and discipline required by the FinOps framework, organizations can find themselves spending unnecessarily and without purpose.

OneNeck is an experienced Microsoft Solutions Partner with the technical expertise to maximize your Azure investment. We offer a wide range of Azure Support Services that can help you navigate the complexities of your cloud environment and manage and optimize costs.

Ready to optimize your Azure investment? Contact us today to learn how we can help transform your cloud strategy.

Monthly Security Workshop: Cloud Security in Microsoft Azure

This workshop delves into the shared responsibilities of Customers, Partners, and Service Providers in cloud security, emphasizing the critical three-way relationship and its impact on security posture. We explore essential security requirements and regulatory challenges, alongside demonstrating the ‘what, why, and how’ of key security tools and best practices through engaging case studies. Designed for IT leaders, security professionals, and business executives, this workshop aims to equip viewers with a comprehensive understanding of their roles in securing cloud environments, ensuring they are well-prepared to mitigate risks and implement effective security measures.

Welcome to May’s edition of the OneNeck patching blog. As we transition deeper into spring, it’s crucial to stay vigilant in our cybersecurity efforts to ensure that exposures don’t replace May flowers. While Microsoft addressed fewer vulnerabilities than last month, they still tackled a significant array of issues. Additionally, our team observed numerous important updates within the Linux environment. 

Microsoft’s May Patching Security Overview

This month, Microsoft has addressed a total of 61 vulnerabilities, broken down into the following categories:

• 17 Elevation of Privilege Vulnerabilities
• 2 Security Feature Bypass Vulnerabilities
• 27 Remote Code Execution Vulnerabilities
• 7 Information Disclosure Vulnerabilities
• 3 Denial of Service Vulnerabilities
• 4 Spoofing Vulnerabilities

This month’s patch release tackles multiple crucial vulnerabilities. Two zero-day vulnerabilities are notably patched, as well as a publicly disclosed vulnerability affecting .NET 7 & 8 alongside Visual Studio. The prompt resolution of these issues is critical in preserving the security integrity of systems, as they could allow attackers to exploit privileges or bypass security measures, leading to unauthorized access or data exposure.

Highlighted May Patching

This month’s critical updates include:

• CVE-2024-30040: Windows MSHTML Platform Security Feature Bypass Vulnerability
• CVE-2024-30051: Windows DWM Core Library Elevation of Privilege Vulnerability
• CVE-2024-30046: Visual Studio Denial of Service Vulnerability

Resolution of Known Issues from April 2024 Updates

Microsoft has resolved issues from last month’s updates, which predominantly affected VPN functionalities and NTLM authentication on Windows Servers. For more detailed insights, you can review the updates on the following blogs:

• Microsoft fixes VPN failures caused by April Windows updates
• Microsoft fixes Windows Server bug causing crashes, NTLM auth failures

Exchange Updates

Microsoft released a Hotfix for Exchange late last month to address the numerous known issues from the March Exchange Security Update. Fortunately, OneNeck’s customers were unaffected by these issues, so we will hold off on applying the Hotfix to customer Exchange Servers and wait for a future Security Update.

In the April Hotfix, Microsoft introduced support for ECC certificates and Hybrid Modern Authentication for OWA/ECP, available exclusively for Exchange Server 2019. The next Security or Cumulative Update for Exchange 2019 will also include these features.

Microsoft has recognized the need for DKIM and DMARC for Exchange Server On-Prem following the Q1 2024 announcement from Google and Yahoo. However, they do not have any updates to announce at this time. Customers routing their mail through MS365, rather than sending mail directly from their On-Prem Exchange Server, should be mostly unaffected by the changes from Google and Yahoo.

Additionally, Microsoft released an Exchange Server Roadmap Update this month, outlining their plans for Exchange Server SE (Subscription Edition). This edition will likely be released early in the third quarter of 2025, coinciding with the end-of-life date for Exchange Server 2016 and 2019. Exchange Server SE will be the code equivalent to Exchange Server 2019 CU15. OneNeck encourages all customers using Exchange to upgrade to Exchange Server 2019. If you have any questions about how OneNeck can assist you with your upgrade decisions, please contact the Service Desk.

Linux Patching Insights

This month’s Linux updates address various vulnerabilities crucial for maintaining the security and stability of your environments. Notable patches include:

• CVE-2023-50269: Security updates for Squid to bolster network management security.
• CVE-2023-50868: Updates for Bind and DHCP enhancing DNS and network configuration security across Red Hat and Oracle Linux.
• CVE-2024-1488: Security updates for Unbound on Oracle Linux to ensure robust DNS security.
• CVE-2024-31083: Tigervnc and X.org server security updates for Oracle Linux, essential for secure remote desktop and graphical server environments.
• CVE-2023-40551: Shim security updates enhancing boot loader integrity.
• CVE-2023-52425, CVE-2024-1394: Security and bug fix updates for Grafana and Grafana-PCP on Oracle Linux, crucial for maintaining performance monitoring tools.
• CVE-2024-21094: Java-11-Openjdk security update to maintain Java application security.
• CVE-2024-23213: Webkit2gtk3 security updates to enhance web content rendering security.
• CVE-2024-3019: Pcp security, bug fixes, and enhancement updates.
• CVE-2024-3864: Firefox security updates across multiple distributions, vital for secure web browsing.

The quick application of these patches is crucial in mitigating risks and maintaining a secure environment.

Microsoft Office & SharePoint Updates

While our scheduled patching activities are comprehensive, they are designed to complement your internal update processes for a wide range of products, including Microsoft Office and SharePoint. We encourage our clients to regularly review and apply updates across all software to ensure the highest level of security. For insights on integrating these updates seamlessly into your security strategy or how OneNeck can support your efforts, do not hesitate to contact our Service Desk.

Closing Thoughts

As we move deeper into spring, it’s an ideal time to refresh and reinforce your cybersecurity measures by staying current with essential patching practices. As nature renews, let’s ensure our systems are fortified and secure. Timely and informed patch management is crucial in defending against vulnerabilities. If you have questions or need assistance, OneNeck is here to support your cybersecurity efforts.

Stay secure and patched, and let’s spring into action together.

Each month, OneNeck engineers review newly released updates from vendors, like Microsoft, to understand any known issues, actions required and understand the priority of each. This is done immediately following Patch Tuesday releases, and we monitor for adjustments to patches throughout each month.

The information above is gathered monthly during this review and posted for awareness to our customers. This information is generally updated only once per month and is based on our engineers’ review of the information provided by the vendor at that time. As always, for the most up-to-date patching information, please see the vendor’s website or contact us.

Note: If OneNeck actively manages a device or software that is impacted by any of these vulnerabilities, when necessary, OneNeck will be in direct contact with you regarding remediation.

Having a robust storage solution can make or break your data management strategy. A versatile cloud storage service like Azure Storage is designed to handle everything from vast amounts of unstructured data to high-demand enterprise applications. Whether you’re dealing with blobs, files or even Kubernetes containers, read on to understand how Azure can streamline and secure your data management practices effortlessly.

What is Azure Storage?

Azure Storage, developed by Microsoft, is a comprehensive cloud storage solution tailored for modern data management. It supports a wide range of data types and is designed to provide high availability, massive scalability and robust security. 

Services Overview 

Azure Storage and its various components are designed to meet a varying range of data storage requirements for businesses, large and small. Here’s a quick overview of each data service. 

Azure Blobs: Think of Azure Blob storage as your go-to for handling massive amounts of unstructured data. This is perfect for serving images or documents directly to a browser, storing files for distributed access or streaming video and audio.

Azure Files: When you need managed file shares that cloud applications can access using standard SMB (Server Message Block) protocol, Azure Files is your answer. You can mount file shares concurrently from cloud or on-premises deployments of Windows, Linux and macOS.

Azure Elastic SAN: This service supports enterprise-grade, high-performance block storage. Azure Elastic SAN mimics the capabilities of on-premises Storage Area Networks (SANs), providing you with scalability, flexibility and high throughput for your critical workloads.

Azure Queues: Queues is useful for storing large numbers of messages that can be accessed from anywhere in the world via authenticated calls using HTTP or HTTPS. This is particularly helpful if you’re building robust applications that must scale to process messages asynchronously.

Azure Tables: This NoSQL store is perfect for storing structured non-relational data. Use it when you need to store TBs (terabytes) of structured data capable of serving web scale applications.

Azure Managed Disks: These are block-level storage volumes managed by Azure and used with Azure Virtual Machines. Managed Disks are available in a range of sizes and performance levels, including ultra-high performance.

Azure Container Storage: If you’re working with containers like Kubernetes or developing microservices, Azure offers integrated container storage solutions. These ensure high performance and seamless scalability for containerized applications.

About Azure Storage Explorer

If you are using several Azure Storage services, you might need some support managing them. Azure Storage Explorer was built just for this. It equips you with the tools to upload, download and manage blobs, files, queues, tables and Data Lake Storage entities efficiently.

It also supports connections across multiple subscriptions and is compatible with all Azure regions, Azure Stack and Azure Government. Additionally, Azure Storage Explorer provides a user-friendly graphical user interface (GUI) that makes it accessible, even for those new to cloud storage management, supporting a wide range of operating systems.

Key Features and Benefits of Azure Storage

Azure Storage is engineered to provide a robust set of features that cater to diverse data storage requirements. It can:

• scale on demand
• adjust based on your storage capacity needs
• protect your data against loss with data redundancy
• secure your data with advanced encryption

These features and more make Azure Storage a preferred choice for enterprises looking for a reliable and scalable cloud storage solution.

Best Practices for Implementation

Implementing Azure Storage effectively involves adhering to several best practices that ensure both security and efficiency. Here are some important guidelines:

• Maintain distinct storage accounts for development and production to safeguard data integrity and optimize performance. This separation prevents accidental data manipulation and helps you manage resources more effectively.
• Enable Microsoft Defender for comprehensive threat detection.
• Use Azure Resource Manager to deploy and manage your storage resources securely.
• Implement soft delete for blobs and containers to protect against accidental deletions.
• Ensure all data transfers are conducted over HTTPS and restrict shared access signature tokens to HTTPS connections only.
• Take advantage of Microsoft Entra ID for robust access management.
• Apply the principle of least privilege through Azure Role-Based Access Control (RBAC) to minimize unnecessary access rights.
• Secure your account access keys using Azure Key Vault and regularly regenerate these keys to mitigate the risks of unauthorized access.

Manage Azure Storage with OneNeck

OneNeck can help manage your Azure storage environment, no matter what tier or configuration you have in place today. Our team will provide management and oversight of your environment, 24/7, from initial design and deployment to operations support, along with recommendations for potential optimization within your environment. Contact us to have a chat with our team.

It’s no secret that cyber threats are evolving and increasing in frequency and sophistication, making securing the endpoints of your infrastructure an imperative. The rise in volume and diversification of connected devices has considerably increased the vulnerability of IT environments and critical data, such as customer and financial information. Due to these heightened risks, adopting robust endpoint protection is no longer nice to have but rather an essential part of one’s security posture.

Why Endpoint Protection Matters

Endpoint protection is much more than traditional antivirus software; it’s the frontline defense of your network against cyber threats. As threats grow in complexity and craftiness, conventional security measures have proven outdated and oftentimes ineffective.

Endpoints, including computers, laptops, mobile devices, and other network-connected hardware, are frequently a network’s most vulnerable entry points. As such, they are prime targets for attackers seeking the easiest route into a digital environment.

Modern endpoint protection strategies involve significantly more than simply reacting to attacks, such as malware. They include security measures that comprise advanced algorithms and threat intelligence. This more sophisticated level of defense allows for detecting, preventing, and responding to threats in real time.

Endpoint Protection as Part of a Comprehensive Security Strategy

As remote and hybrid workforces gradually become the norm, the increasing array of connected devices is quickly expanding businesses’ attack surface. Even a single endpoint breach can have devastating effects, leading to financial losses and damage to organizational reputation. Reinforcing endpoints is essential to business continuity and resilience, ensuring operations proceed without disruption, even in the event of an attack.

Sufficient protection encompasses prevention, detection, swift response, and robust recovery. This comprehensive strategy ensures security incidents are managed effectively and that the impact of breaches is minimized, thus sustaining business operations and preserving the trust of stakeholders.

Furthermore, regulatory compliance mandates strict data protection standards in many sectors. Endpoint protection helps organizations meet these requirements, safeguarding sensitive data as it travels across devices. Businesses can avoid legal and financial repercussions associated with non-compliance by ensuring secure access and robust data protection measures.

Key Aspects of Endpoint Security

Effective endpoint protection involves a multifaceted approach—which extends beyond mere defense to encompass proactive management and compliance adherence— to guard against incoming threats and mitigate potential vulnerabilities. Organizations should prioritize the following vital aspects of endpoint protection:

Comprehensive Security Posture

• Holistic Integration: Endpoint protection should seamlessly integrate into your overall security strategy. This integration enhances defenses against various threats, including malware, ransomware, and other malicious activities. A well-rounded security posture detects threats and actively prevents them.
• Continuous Security Updates: Keeping protection systems up-to-date is vital. Regular updates ensure security measures are equipped to handle the latest threats, thus maintaining the integrity and security of organizational data.

Advanced Threat Detection

• Leveraging AI and ML: Modern solutions utilize artificial intelligence (AI) and machine learning (ML) to anticipate, identify, and neutralize threats in real time. This technology adapts to emerging threats, ensuring robust defense capabilities.
• Behavioral Analysis: Behavioral analysis features monitor device behavior for unusual activity, which could indicate a breach. This capability allows for quicker isolation and mitigation of potential threats, reducing potential impacts.

Policy Management and Compliance

• Robust Policy Development: Developing and rigorously enforcing comprehensive security policies are fundamental for the integrity of your infrastructure. These policies set the standard for security behavior and incident response.
• Regulatory Compliance: Utilizing tools such as Security Information and Event Management (SIEM) systems not only aids in achieving compliance with various regulatory standards but also in protecting sensitive information. This accountability is essential for maintaining organizational credibility and trust.

Enhancing Endpoint Protection is Just the Start with the Right Security Partner

Endpoint security is a cornerstone of robust cybersecurity. It plays a crucial role in a resilient and proactive security posture, helping organizations defend against current threats and prepare for future challenges. Working with a knowledgeable partner enables organizations to stay ahead of vulnerabilities and effectively protect their data.

Ready to enhance your security strategy? OneNeck’s experienced security team will deliver the tools and expertise to safeguard your data.

Contact us today to find out how we can help you fortify your endpoints.

To align its subscriptions worldwide, Microsoft announced it is set to revise its licensing structure for Microsoft 365 and Office 365, including changes to how Microsoft Teams licensing is bundled into these services. Initially implemented in the European Economic Area (EEA) and Switzerland, these changes are now being extended globally.

What’s Changing with Microsoft Licensing and Teams?

As of April 1, 2024, Microsoft has significantly adjusted the offering of Teams with Microsoft 365 (M365) and Office 365 (O365) subscriptions. Microsoft Teams will now be separated from the standard M365 and O365 licensing packages. For Enterprise-level offerings, Microsoft Teams will only be available as a separate purchase for new customers. This change was the company’s response to the regulatory ruling in European courts, which aimed to enhance competition and reduce package bundling that limited customer choice.

Changes to Microsoft Teams Licensing and What They Mean

Here’s what these changes entail:

1. New Licensing Structure:
   • Microsoft will offer new versions of M365 and O365 that do not include Microsoft Teams. These offerings will be identified by a “(No Teams)” label appended to the suite names. This change aims to allow businesses to tailor their software packages more precisely, choosing only the necessary components.
2. Standalone Microsoft Teams SKU:
   • Alongside the updated suites, Microsoft is rolling out a standalone Microsoft Teams option for enterprise customers. This move allows businesses to incorporate Teams into their operations as a separate purchase.
3. Phasing Out Current Teams-Inclusive Enterprise SKUs:
   • Microsoft will discontinue the sale of new subscriptions to existing enterprise SKUs that include Teams, such as Microsoft 365 E3/E5 and Office 365 E1/E3/E5. New customers will need to navigate the new suite options that exclude Teams.

Source: Microsoft 

What This Means for Microsoft Customers Who Use Enterprise Subscriptions

The upcoming licensing changes by Microsoft will have specific implications for enterprise customers, affecting both existing and new customers differently. Here’s how these changes impact users:

• Existing Customers: If you currently use an M365 or O365 plan that includes Teams, you can continue with your existing subscription, including any renewals and upgrades. This provision ensures that licensing changes do not interrupt your organization’s day-to-day operations. Additionally, this continuity allows your team to maintain access to all current features and future updates without reassessing your software licensing needs.
• New Customers: From April 2024 onward, new customers must abide by the updated licensing structure. This change will require selecting from the new suites that do not include Microsoft Teams as a default component. Depending on business requirements, new customers must add Teams as a separate purchase to ensure their organization can access Microsoft’s comprehensive communication and collaboration tools.

Understanding “No Teams” Implications for SMB Customers

For small and medium business (SMB) customers, the upcoming changes to Microsoft 365 licensing present new choices that align with different business necessities regarding Microsoft Teams.

 Options Available to SMB Users

Unlike their Enterprise counterparts, SMBs will have the flexibility to select from the existing M365 suites that include Teams or opt for new versions of these suites that do not include Teams. This change allows SMBs to tailor their software solutions more closely to their specific operational requirements.

1. Existing SMB Suites with Teams:
   • Microsoft 365 Business Basic/Standard/Premium: These current offerings include Microsoft Teams, among other features. They are designed to meet the diverse needs of SMBs, from basic office applications and cloud storage to advanced security and device management.
2. New SMB Suites Without Teams:
   • In response to the broader licensing changes, Microsoft will also offer new versions of the Business Basic, Business Standard, and Business Premium suites without Microsoft Teams. These “No Teams” versions will cater to businesses that may prefer alternative communication tools or do not require the integrated collaboration features that Teams provides.

As Microsoft introduces these changes, staying informed and prepared will enable SMBs to make decisions that align with their goals and ensure continuity in their business practices.

Frontline Worker Subscriptions

Frontline Worker subscriptions Microsoft 365 F1 and Microsoft 365 F3 with teams will continue to be offered side by side with “No Teams” versions to give customers the flexibility to choose.

Moving Forward with a Trusted Partner

Microsoft’s changes to the licensing of M365 and O365, particularly the separation of Teams from many of its suite offerings, mark a significant shift in how businesses will access and deploy these tools.

As these adjustments unfold, organizations must understand how they will impact current and future software usage and deployments. The evolving landscape will influence decisions and strategies, regardless of whether one is an existing Microsoft/Office 365 user or considering new subscriptions.

As an experienced Microsoft Solutions Partner, OneNeck is ideally placed to guide and support your company through these changes. Our experts are ready to help you understand what these licensing updates mean for your business and to find the best options to meet organizational needs.

If you have any questions or need advice on navigating the new Microsoft licensing environment, Contact OneNeck today to set up a consultation.

Welcome to April’s edition of the OneNeck IT Solutions patching blog. With spring well underway, unfortunately, the trees and flowers are not the only things blossoming. Our team found itself navigating a busy month in cybersecurity, focusing on an extensive number of patches from Microsoft, including critical updates for two zero-day vulnerabilities and significant updates across various Linux distributions.

Microsoft’s April Patching Overview

Microsoft has addressed a staggering 150 vulnerabilities this month, categorized as follows:

• 31 Elevation of Privilege Vulnerabilities
• 29 Security Feature Bypass Vulnerabilities
• 67 Remote Code Execution Vulnerabilities
• 13 Information Disclosure Vulnerabilities
• 7 Denial of Service Vulnerabilities
• 3 Spoofing Vulnerabilities

This broad range underscores the vital importance of comprehensive patch management. Notably, two zero-day vulnerabilities were addressed:

• CVE-2024-26234: Proxy Driver Spoofing Vulnerability
• CVE-2024-29988: SmartScreen Prompt Security Feature Bypass Vulnerability

The Proxy Driver Spoofing Vulnerability could lead to significant data breaches by capturing sensitive information or injecting malicious data into sessions. At the same time, the SmartScreen Bypass could reduce the efficacy of one of Windows’ primary defenses against downloaded internet malware. Promptly addressing these vulnerabilities helps maintain the effectiveness of security barriers and prevents attackers from exploiting these sophisticated techniques.

Highlighted Patches

Critical vulnerabilities that require immediate attention include:

• CVE-2024-20678: Remote Procedure Call Runtime Remote Code Execution Vulnerability
• CVE-2024-20670: Outlook for Windows Spoofing Vulnerability
• CVE-2024-26221: Windows DNS Server Remote Code Execution Vulnerability

These vulnerabilities present a diverse range of threats—from remote code execution to spoofing—that could compromise the integrity and confidentiality of affected systems. The potential impact of these issues includes unauthorized data access, system control, and bypassing security mechanisms. Organizations must prioritize these updates to mitigate these risks effectively. Timely patch application protects individual systems and fortifies the overall network security, preventing potential cascading effects of breaches stemming from these vulnerabilities.

Linux Patching Insights 

This month’s Linux updates are crucial for maintaining the security and stability of your environment. Notable patches include:

• CVE-2024-2616: Critical security updates for Firefox, enhancing web security across multiple Oracle and Red Hat distributions.
• CVE-2024-26602: Important Kernel security and bug fix updates for Oracle and Red Hat Linux.
• CVE-2023-50868: Important updates for Dnsmasq, bolstering network management security.
• CVE-2024-21626: Docker security update crucial for container management.
• CVE-2023-45234: Security update for Edk2, enhancing system firmware security.
• CVE-2024-0646 and CVE-2023-46589: Kernel and Tomcat security updates are vital for system and web application security.
• CVE-2024-0775 and CVE-2023-45871: Updates for Oracle Linux’s Unbreakable Enterprise kernel, addressing critical vulnerabilities.

The range of patches this month underscores the importance of comprehensive security measures across various components of Linux systems. From web browsing and container management to core kernel operations and network services, each update plays a pivotal role in closing security gaps and enhancing the resilience of IT infrastructures. By proactively applying these updates, organizations can significantly reduce their exposure to cyber threats and ensure the continuity of their operational capabilities. These efforts are crucial to upholding stringent security standards and safeguarding sensitive data and system processes against emerging vulnerabilities.

Exchange Server

As a reminder, Microsoft will no longer be releasing Cumulative Updates for Exchange Server 2016. As a result, our team strongly recommends that all customers upgrade to Exchange Server 2019. If you have questions about how OneNeck can assist you with your upgrade decisions, do not hesitate to contact the Service Desk (800-272-3077).

Microsoft Office & SharePoint Updates

While our scheduled patching activities are comprehensive, they are designed to complement your internal update processes for a wide range of products, including Microsoft Office and SharePoint. We encourage our clients to regularly review and apply updates across all software to ensure the highest level of security. For insights on integrating these updates seamlessly into your security strategy or how OneNeck can support your efforts, do not hesitate to contact our Service Desk.

Closing Thoughts

April’s extensive patch release reminds us of the dynamic nature of cybersecurity threats and the ongoing need for vigilance. Renew your commitment to cybersecurity this spring by staying updated and proactive. For any support or questions, OneNeck is here to assist you.

Stay secure and patched, and let’s spring into action to keep our networks as vibrant and resilient as the season.

Each month, OneNeck engineers review newly released updates from vendors, like Microsoft, to understand any known issues, actions required and understand the priority of each. This is done immediately following Patch Tuesday releases, and we monitor for adjustments to patches throughout each month.

The information above is gathered monthly during this review and posted for awareness to our customers. This information is generally updated only once per month and is based on our engineers’ review of the information provided by the vendor at that time. As always, for the most up-to-date patching information, please see the vendor’s website or contact us.

Note: If OneNeck actively manages a device or software that is impacted by any of these vulnerabilities, when necessary, OneNeck will be in direct contact with you regarding remediation.

Data modernization has become a buzzword for moving to the cloud and adopting digital tools. But modernization is not just about staying current; it’s about uncovering data-driven insights that improve decision-making and elevate your business.

Microsoft Azure facilitates these goals with platforms for machine learning, advanced analytics, containerization, data lakes, automation and more. These tools are essential for the kind of business growth and efficiency that can redefine the potential of your business.

The Impact of Data Modernization on Business Growth

We all know what we want our business to do in the next decade: grow, grow, and grow some more. To do this, you must start taking small steps toward large-scale modernization that will impact:

• Decision-Making: Building a single source of truth ensures your data is accurate and reliable so you can make informed decisions faster.
• Customer Experience: Advanced analytics provide deeper insights into customer behavior, market trends and operational efficiencies.
• Innovation: A modern data infrastructure sets a strong foundation for developing new products or services or improving existing ones.
• Risk Management: Enhanced data security and governance ensures your business complies with the latest regulations and mitigates risks associated with data breaches or loss.

Building the Business of the Future with Azure

Your future business will be defined by today’s use of cutting-edge technologies. By adopting Azure Cloud, your organization positions itself to be reliable, secure and at the forefront of innovation.

Successful Data Modernization with Azure Data Factory

Azure Data Factory (ADF) is a cloud-based data integration service that facilitates the creation of ETL, ELT and data integration pipelines.

With ADF, you can:

• Store your data in centralized cloud storage, such as Azure Data Lake.
• Employ analytics and machine learning to refine your data.
• Streamline the transition of your ETL/Big Data workloads to Microsoft Azure.
• Support real-time data with over 90 built-in connectors.
• Efficiently and securely manage data movement and orchestration tasks.

Successful Data Modernization with Azure Synapse Analytics

Azure Synapse Analytics is more than an analytics service; it’s a comprehensive solution that melds multiple technologies to offer unparalleled insights and performance. It ensures:

• Robust security and governance
• Seamless integration with other Azure services
• Scalability according to your needs
• Better decision-making through advanced analytics
• Robust security

Successful Data Modernization with Azure Databricks

Azure Databricks is a unified data analytics platform that accelerates innovation across various domains, from data science and engineering to business analytics. Here are its key advantages:

• Built on the highly performant Databricks runtime engine, which ensures that your data workloads are processed at lightning speed.
• Scales automatically and elastically so you can manage fluctuating data workloads seamlessly and cost-effectively.
• A comprehensive platform that supports a diverse range of analytical workloads, languages, and tools.

Successful Data Modernization with Azure Data Lake Storage

Azure Data Lake Storage is engineered for high-performance analytics workloads, ensuring that your data is not only accessible but primed for valuable insights.

Azure Data Lake Storage:

• Removes data silos, allowing for a seamless data ecosystem
• Provides a single platform that caters to all your storage needs
• Automatically transitions your data to the most cost-efficient tier
• Offers encryption at rest and advanced threat protection

Successful Data Modernization with Azure Cosmos DB

Azure Cosmos DB is a globally distributed, multi-model database service that excels in managing diverse data formats, from key-value pairs to graph-based databases. It ensures that your data is handled with precision by:

• Allowing you to replicate your data across any number of Azure regions worldwide.
• Providing the flexibility to choose the best model for your application’s needs.
• Offering five distinct levels of consistency—Strong, Bounded-staleness, Session, Consistent Prefix and Eventual—to cater to various use-case scenarios.
• Designing containers to scale horizontally, making them capable of handling millions of read and write requests per second.

Choosing the Azure Modernization Solutions That are Right for You

These strategic moves toward data modernization with Azure are not just about adopting new technologies; you are setting the foundation for a business that can adapt and grow in a digital economy where technology is a strategic asset.

Need help determining which Azure modernization solutions are right for you? Reach out, and let’s talk. With OneNeck, you benefit from a trusted partner with extensive experience in modern data architecture, Gold level partnership with Microsoft and deep expertise in all things IT to help you navigate complexities, reduce technical debt and achieve maximum value from your data.

Gathering data from multiple sources and formats and bringing it together in a useful format can present a challenge, but data analysis and visualization in an Azure environment can be streamlined with data transformation tools. One such method is through  ETL (Extract, Transform, Load) which is the process of extracting data from various sources, transforming it into a consistent format and loading it into a target system for analysis and visualization. This process is needed when data resides in different formats and structures across multiple sources.

The importance of ETL (Extract, Transform, Load) in data analysis and visualization

Most organizations have various sources of raw data. ETL allows them to consolidate all sources into a single repository. This simplifies the data analysis process by ensuring that data is accurate and complete. 

ETL process and its components

The ETL process consists of three main components: extraction, transformation and loading.

1. Extraction involves gathering data in disparate formats and structures from various sources, such as databases, spreadsheets, files and APIs. 
2. The transformation phase entails using ETL tools to clean, validate and structure data, ensuring quality and consistency. Transformations may also include calculations, aggregations and derivations to create new data elements.
3. Loading is the process of mapping the transformed data to a target system, such as a data warehouse or data mart and placing it into the appropriate tables or data structures for analysis and visualization.

Popular Azure ETL tools for data processing and integration

Azure offers a variety of ETL tools with powerful capabilities for data processing and integration. 

Azure Data Factory

Azure Data Factory is a fully managed data integration service that allows you to create, schedule and orchestrate data pipelines for ETL workflows while providing a visual interface for designing and monitoring those pipelines.

Azure Databricks

Azure Databricks is an Apache Spark-based analytics platform that enables big data processing and ETL at scale, providing a collaborative environment for data engineers and scientists to build and deploy ETL workflows. 

Azure Synaps Analytics

Formerly known as Azure SQL Data Warehouse, Azure Synapse Analytics is a cloud-based service combining enterprise data warehousing, big data integration and analytics for a unified experience. 

ETL automation and scalability in Azure

Within the Azure environment, ETL processes can be automated for greater efficiency, reliability and scalability. 

• Azure Logic Apps enables you to create automated workflows that integrate with various systems and services, reducing manual effort and increasing productivity.
• Azure Functions is a serverless computing service that allows you to specify triggers to run code and automatically execute data processing and integration tasks. 
• Azure also offers scalable storage services such as Azure Blob Storage and Azure Data Lake Storage. These services handle large volumes of data generated by cloud data ETL processes, providing high throughput and low latency.

Data quality management in ETL

Your insights and decisions rely on the accuracy of the data used, making data quality critical. Within the Azure environment, these data quality management features help ensure accuracy: 

• Azure Data Factory has built-in functions including standardization, deduplication and validation processes to ensure data quality before loading it into the target system.
• Azure Databricks uses Apache Spark for data profiling and data cleansing tasks that identify and fix data quality issues. It also integrates with Azure Machine Learning to automate data quality checks and validations.
• Azure Synapse Analytics uses data validation rules and data quality indicators to define and enforce data quality standards and monitors for any data quality issues during the process.

Data visualization and reporting using ETL outputs

After the ETL process, data is ready for analysis and visualization. Microsoft Power BI is a tool you can use to create interactive reports and dashboards, connect to your outputs such as Azure SQL Database or Azure Analysis Services and visualize using charts, maps and tables. 

Power BI integrates with Azure Synapse Analytics to create interactive reports and dashboards directly from your Synapse Analytics data. You can also use other data visualization tools like Azure Data Studio and Azure Machine Learning Studio which have a rich set of features for data visualization, including drag-and-drop interfaces, data exploration and advanced analytics capabilities.

Your partner in data modernization

Data modernization is a complex process. Gain expertise in Azure ETL tools by working with the team of experts at OneNeck IT Solutions. We’ll guide you to design and implement efficient workflows in Azure environments for tailored solutions that meet your business requirements. OneNeck has the knowledge and experience you need in your data modernization journey.

Cybersecurity remains at the forefront of national security concerns, especially with state-sponsored cyber activities targeting critical infrastructure. Recent advisories from the Cybersecurity and Infrastructure Security Agency (CISA), in collaboration with the National Security Agency (NSA) and the FBI have brought to light the activities of People’s Republic of China state-sponsored actors, notably referred to as Volt Typhoon (also known as Vanguard Panda, BRONZE SILHOUETTE, Dev-0391, UNC3236, Voltzite, and Insidious Taurus). These cyber criminals, whose latest attack was identified in May 2023, are strategically positioning themselves within IT networks of U.S. critical infrastructure sectors, including—Communications, Energy, Transportation Systems, Water and Wastewater Systems—to potentially launch a disruptive or destructive cyber attack.

The Dangers Presented by Volt Typhoon’s Cyber Attack

Volt Typhoon’s most recent strategy highlights the sophisticated use of “living off the land” (LOTL) techniques. This method involves leveraging legitimate features of a system to remain undetected while conducting malicious activities. Specifically, the actors engage in detailed reconnaissance, exploiting vulnerabilities in public-facing network appliances for initial access, and then they leverage administrator credentials for lateral movement and domain control. The result is a combined strategic and stealth approach. These tactics signify a departure from traditional cyber-based espionage, hinting at a more ominous intent of pre-positioning for future activities.

Tactics and Techniques Utilized by Volt Typhoon:

• Establish initial access through vulnerabilities in network appliances, followed by VPN use.
• Obtain administrator credentials, often via privilege escalation or insecure storage.
• Use lateral movement to domain controllers using valid credentials and Remote Desktop Protocol.
• Discover and utilize PowerShell for targeted queries on Windows event logs via stealth networks.
• Use the Volume Shadow Copy Service to achieve full domain compromise by accessing the Active Directory database (NTDS.dit).
• Employ offline password-cracking techniques to gain elevated network access.
• Strategic infiltration focuses on OT assets and tests access with default vendor or compromised OT system credentials.
• Creates the potential for significant disruption, including manipulating HVAC systems or critical energy and water controls.

For a more detailed overview, visit the CISA Cybersecurity Advisory website.

Strategic Implications and Recommendations

The revelation of Volt Typhoon’s activities should serve as a wake-up call for bolstering security measures across critical infrastructure sectors. Additionally, these attacks underscore the importance of adopting a proactive and strategic approach to security, emphasizing resilience and the capacity to deter sophisticated threats.

Key recommendations for mitigating the risk posed by Volt Typhoon include:

• Patching of Internet-facing Systems: Regularly update and patch Internet-facing systems, prioritizing critical vulnerabilities known to be exploited by Volt Typhoon. This patch management reduces the attack surface and protects against known exploits.
• Phishing-resistant Multifactor Authentication (MFA): Deploy phishing-resistant MFA to safeguard access to networks and sensitive information. This process adds a crucial layer of security that attackers using stolen credentials cannot easily bypass.
• Conditional Access Policies: Implement conditional access policies that evaluate the context of access requests (user identity, location, device security status, etc.) and apply appropriate security controls. This access restriction helps minimize risks by ensuring only legitimate, authenticated, and authorized access to critical resources.
• Comprehensive Logging and Monitoring: Implement an extensive logging and monitoring regime. Ensure all application, access, and security logs are collected and analyzed in detail, focusing on detecting subtle, sophisticated tactics like those employed by Volt Typhoon, including LOTL techniques.
• Technology Lifecycle Management: Develop a strategy for managing the end-of-life of technology the manufacturer no longer supports. Update or replace outdated systems to close vulnerabilities that attackers could exploit.

Weathering the Typhoon of a Cyber Attack with a Trusted Partner

The activities of Volt Typhoon highlight the evolving threat landscape and the need for constant vigilance and adaptation in cybersecurity practices. By understanding and monitoring the tactics and strategies employed by these bad actors, cybersecurity professionals can better protect both their organization’s valuable data and critical infrastructure from potential threats. This requires technological solutions and a strategic mindset that anticipates and mitigates against the sophisticated methods utilized.

However, the complexity, sophistication, and sheer volume of these threats often surpass the capabilities of in-house IT staff. This gap is where teaming with a reliable security partner becomes paramount. A seasoned security partner brings expertise, advanced technology solutions, and a proactive approach to identifying and mitigating threats, offering a comprehensive strategy that extends beyond traditional measures. This expertise ensures organizations can defend against complex attacks and stay ahead of potential vulnerabilities.

OneNeck IT Solutions offers a strategic advantage in response to such threats. Our experienced team provides a broad range of security services designed to protect against sophisticated cyber threats. Our security solutions, including cloud, managed, and professional services, help ensure a robust defense against a cyber attack from actors like Volt Typhoon.

Partnering with OneNeck is the perfect next step for organizations looking to enhance their security posture. Contact us today to learn more about how our services can protect your organization from sophisticated cyber threats.

For much of my adult life, I’ve been surrounded by family and friends who are dentists and orthodontists. I’ve seen first-hand the demanding time commitment required to care for patients while still trying to maintain staffing, run a dental practice, and manage an oral care business. It’s all-consuming, and while the focus is on keeping smiles bright and healthy, there’s an unseen menace that’s not so easily brushed away: cyber threats.

It’s a tricky situation; dentists, orthodontists, and their office managers are experts at filling cavities, not firewall vulnerabilities. And who can blame them? When juggling appointments, patient care, and the daily operations of a dental office, there’s barely enough time to floss, let alone fend off cybercriminals.

However, as the digital age continues to evolve rapidly, so does the sophistication of cyber threats, making it crucial for dental practices to prioritize cybersecurity. Unfortunately, as with the broader healthcare industry, the dental industry is far from immune to these attacks. Recently, we’ve seen the unprecedented impacts of ransomware attacks on Change Healthcare (the technical arm of United Healthcare), and there have been several instances targeting dental offices as well, resulting in significant financial losses and the compromise of sensitive patient information. Such breaches damage the trust patients place in their healthcare providers and can come with hefty fines and legal ramifications.

Rooting Out Risk: Cybersecurity Hygiene for Dental Professionals

So, how can dental and orthodontic practices brace themselves against these threats? Here are 3 must-dos to keep your practice’s digital hygiene in tip-top shape:

Regular Check-Ups to Discover Cyber Threats

Just as regular dental check-ups prevent minor issues from becoming major problems, regular cybersecurity assessments can help identify vulnerabilities before exploitation. This prevention includes keeping all software up to date with regular patching, conducting periodic security training for all staff to know what to be on alert for, and implementing strong password policies to protect access to critical applications, data and systems.

Seal the Gaps in Your Defenses

Ensure that all patient data is encrypted and securely backed up. Consider it the digital equivalent of enamel to prevent decay. Encryption acts as a barrier, making it difficult for unauthorized individuals to access sensitive information.

As fluoride treatment provides additional protection on top of enamel, so does multi-factor authentication (MFA). So, even if a staff member’s password is compromised, MFA protects unauthorized data and account access.

Don’t Go It Alone Against Cyber Threats

Dental practices should consider partnering with cybersecurity experts to safeguard their operations, just as patients turn to dental professionals for their expertise. OneNeck IT Solutions offers a robust portfolio of security consulting services, managed services, and resale solutions tailored to dental practices’ unique needs. Our team understands the challenges you face and is equipped to handle the technicalities of cybersecurity, allowing you to focus on what you do best: caring for your patients.

Recommended by 9 out of 10 Security Professionals

In an industry where trust is paramount, ensuring the security of patient data is not just about regulatory compliance; it’s about maintaining the confidence and loyalty of those you serve. In today’s battle against cyber threats, it’s imperative to have a strong defense to lessen the likelihood of a painful recovery. Think of OneNeck IT Solutions as your practice’s cybersecurity orthodontist, here to straighten out your digital defense and keep your practice’s data as healthy as the smiles you create.

Remember, while the world of cybersecurity may seem daunting, you’re not alone. By taking proactive steps and partnering with the experienced professionals, your practice can bite back against cyber threats. Just like preventive dentistry, early detection and treatment can save you from more painful procedures down the line.

Contact us today to craft a custom security plan that keeps your data safe, secure, and shining brightly.

Monthly Security Workshop: Phishing Awareness

Phishing attacks continue to be one of the most pervasive and damaging threats to organizations worldwide. Watch this engaging workshop on Phishing Awareness, where we will unravel the sophisticated tactics used by cybercriminals and provide you with essential strategies to safeguard your organization. Learn how to identify phishing attempts, implement effective training programs, and utilize cutting-edge tools to protect your sensitive information. Our cybersecurity expert will share real-world examples and actionable insights to enhance your defense against these relentless attacks. Don’t miss this crucial opportunity to fortify your knowledge and strengthen your organization’s resilience against phishing threats.

Welcome to March’s edition of the OneNeck IT Solutions patching blog. As spring approaches, we’re here to help ensure your IT environment is prepared and protected against the latest identified vulnerabilities. This month’s update highlights a variety of patches across Microsoft products and Linux environments, aiming to keep your systems secure and efficient.

Microsoft’s March Patching Overview

In March, Microsoft tackled a total of 59 vulnerabilities, detailed as follows:

• 24 Elevation of Privilege Vulnerabilities
• 3 Security Feature Bypass Vulnerabilities
• 18 Remote Code Execution Vulnerabilities
• 6 Information Disclosure Vulnerabilities
• 6 Denial of Service Vulnerabilities
• 2 Spoofing Vulnerabilities

Fortunately, there are no zero-day vulnerabilities to address this month, allowing IT teams to focus on routine updates and fortifications against potential future exploits.

March’s Patching Highlights

This month’s updates require particular attention to the following vulnerabilities:

• CVE-2024-21407: A Critical Remote Code Execution Vulnerability in Windows Hyper-V.
• CVE-2024-21400: An Elevation of Privilege Vulnerability in Microsoft Azure Kubernetes Service Confidential Container.
• CVE-2024-26199: An Elevation of Privilege Vulnerability in Microsoft Office.
• CVE-2024-20671: A Security Feature Bypass Vulnerability in Microsoft Defender.

These patches address a range of issues, from remote code execution, which could allow unauthorized access to systems, to enact an elevation of privilege. Including a Security Feature Bypass Vulnerability in Microsoft Defender highlights the necessity of this month’s updates, as it affects a core component of Microsoft’s security infrastructure, potentially leaving systems vulnerable to various threats. Administrators are urged to prioritize these patches to mitigate the risks associated with these vulnerabilities, ensuring the protection of systems against exploitation.

Featured Linux Patching Updates

Our Linux Team has closely examined the landscape and identified several critical updates for this month. Each patch plays a significant role in maintaining the security and stability of Linux environments:

• CVE-2023-45863: Important updates for Oracle Linux Unbreakable Enterprise Kernel version 4.14.35 and 5.4.17, enhancing kernel security.
• CVE-2023-4623: Critical security update for the Oracle Linux kernel, bolstering system defenses.
• CVE-2023-42753: Important update for Oracle Linux, addressing security and bug fixes for enhanced system stability.
• CVE-2023-4921: Security update for Oracle Linux Unbreakable Enterprise Kernel version 4.1.12, targeting vulnerabilities for improved security.
• CVE-2023-50868: Significant security update for Oracle Linux’s Unbound, enhancing the security framework of network resolution.
• CVE-2023-6622: Updates for Oracle Linux Unbreakable Enterprise Kernel, patching critical security gaps.
• CVE-2024-0646: Kernel Security Update, crucial for maintaining the integrity and security of the Linux kernel.
• CVE-2024-1551, CVE-2024-1552, CVE-2024-1553: This is a series of important Firefox security updates vital for secure web browsing and system security.
• CVE-2024-21885: An important security update for Oracle Linux’s TigerVNC, ensuring secure remote desktop connections.

These updates safeguard your Linux servers against potential breaches and system vulnerabilities. Given the critical nature of these vulnerabilities, we recommend a thorough review and timely application of these patches to maintain optimal security and functionality within your Linux environment.

Exchange Server

OneNeck strongly cautions customers not to apply the Security Updates for Exchange this month carelessly. Doing so may cause issues with OWA, Exchange Monitoring, and attachment inspection/scanning conditions. We encourage you to review all documentation available from Microsoft regarding this month’s update before proceeding. Customers who are contracted with us for Exchange Management will have the update installed under separate change requests.

Additionally, it is crucial to note that Microsoft will no longer be releasing Cumulative Updates for Exchange Server 2016. As a result, our team strongly recommends that all customers upgrade to Exchange Server 2019. If you have questions about how OneNeck can assist you with your upgrade decisions, do not hesitate to contact the Service Desk (800-272-3077).

SQL Server 2019 Cumulative Update

There is a known issue with KB5033688 (Cumulative Update 25 for SQL Server 2019), released on February 15^th, 2024. This fix might create access violation dump files when the SESSION is reset for reuse. Microsoft is continuing to work on a resolution for this issue. We anticipate this fix will likely be included in the next Cumulative Update release. 

Microsoft Office & SharePoint Updates

While our scheduled patching activities are comprehensive, they are designed to complement your internal update processes for a wide range of products, including Microsoft Office and SharePoint. We encourage our clients to regularly review and apply updates across all software to ensure the highest level of security. For insights on integrating these updates seamlessly into your security strategy or how OneNeck can support your efforts, do not hesitate to reach out to our Service Desk.

Closing Thoughts

As we march into spring, the proactive application of these updates is key to maintaining a strong cybersecurity posture. Stay ahead of potential threats by ensuring your environment is up-to-date. If you need assistance or have questions, OneNeck is here to support you.

Stay secure and patched, and let’s welcome a safe start to spring together.

Each month, OneNeck engineers review newly released updates from vendors, like Microsoft, to understand any known issues, actions required and understand the priority of each. This is done immediately following Patch Tuesday releases, and we monitor for adjustments to patches throughout each month.

The information above is gathered monthly during this review and posted for awareness to our customers. This information is generally updated only once per month and is based on our engineers’ review of the information provided by the vendor at that time. As always, for the most up-to-date patching information, please see the vendor’s website or contact us.

Note: If OneNeck actively manages a device or software that is impacted by any of these vulnerabilities, when necessary, OneNeck will be in direct contact with you regarding remediation.

When it comes to IT security, it’s nearly impossible to overstate patch management’s significance. It’s a pivotal process that, if disregarded, often leads to dire consequences. The intricate nature of today’s IT ecosystems, with their vast networks and complex software interdependencies, presents a challenging landscape. This complexity necessitates a strategic, well-informed approach to navigating the patch management labyrinth, ensuring the integrity and security of critical technical infrastructures.

Consequences of a Breach

The 2017 Equifax breach should stand as a stark reminder of the vulnerabilities inherent in neglecting patch management. This breach, one of the largest in history, exposed the sensitive personal information of approximately 147 million U.S. consumers, including names, Social Security numbers, and dates of birth. The attack’s success was attributed to exploiting a known vulnerability that simply wasn’t patched in a timely manner.

The fallout from this incident was immense, leading to widespread criticism of Equifax’s data security practices and the eventual settlement with the Consumer Financial Protection Bureau (CFPB), the Federal Trade Commission (FTC), and 48 states, amounting to nearly $700 million in monetary relief and penalties. This breach underscores the ever-evolving cybersecurity threats confronting private and government entities and highlights the critical need for stringent patching practices​​​​.

Embracing Patch Management Services

Patching is a never-ending journey where IT teams can easily fall behind; however, embracing managed services offers a more tenable long-term option. These services, adhering to stringent security frameworks such as NIST 800-171 or CIS Controls, provide dedicated resources necessary for the efficient and timely application of patches. This approach aids organizations in maintaining compliance with changing regulations and strengthens defenses against cyber threats.

Managed services providers offer a dual advantage:

• Free Up Internal Resources: Allows organizations to reallocate their internal resources towards core business operations, enhancing productivity and focus.
• Access to Cybersecurity Expertise: Provides organizations with the latest cybersecurity expertise, keeping pace with evolving threats and technologies and ensuring a proactive defense mechanism.

By leveraging the knowledge and capabilities of managed service providers, organizations can navigate the patch management labyrinth with greater confidence and efficiency, ensuring a more robust security posture.

Risk and Response

Vulnerability scanning and security assessments play complementary yet distinct roles in the patch management process. Continuous vulnerability scanning is critical for identifying software that requires updates or may be associated with known bugs or vulnerabilities. On the other hand, risk assessments are conducted periodically to inform the policies and procedures that influence an organization’s vulnerability management efforts. While these assessments provide strategic direction and help ensure that patching practices are standardized and effective, it’s important to note that patching activities can proceed independently of risk assessments. When properly combined, these activities lay a solid foundation for developing and maintaining robust mitigation strategies.

Ultimately, the value of these assessments lies in identifying holes in vulnerability management policy and procedure, thus creating a catalyst for the necessary remediation to close those gaps. Interpreting the results requires a deep understanding of the organization’s risk profile and the potential impact of each vulnerability. This interpretation is where frameworks like CIS Controls prove invaluable, guiding organizations systematically to manage technical vulnerabilities effectively. Adhering to such standards ensures that the insights gained from assessments lead to actionable, prioritized steps that enhance the organization’s overall security posture.

Organizations can create a proactive defense mechanism by regularly assessing their security policies and procedures, thus directing the vulnerability scanning and patch management processes. This strategic approach addresses current vulnerabilities and sets the stage for a more resilient and secure IT infrastructure.

Lessons from the Field

The hacking of SolarWinds serves as a stark reminder of the critical importance of integrity and thoroughness in the patch management process. In this breach, attackers compromised the software development or update mechanism used by SolarWinds, a company that produces network management software widely used across government and private sectors. The attackers inserted malicious code into the company’s Orion software updates, which, once deployed, created a backdoor for the attackers into the victim’s IT environment.

The significance of this incident lies not only in its scale but also in the method of attack. It illustrates that the security process is as vital as the application of the patches. In this instance, attackers exploited organizations’ trust in their software vendors and the updates they provide. This breach underscores organizations’ need to apply patches promptly and verify the integrity and security of the patches themselves, along with the mechanisms used to deliver and install them.

Consultative Approach to Patch Management

The effectiveness of patch management critically hinges on a consultative approach. With the complex landscape of cybersecurity threats evolving rapidly, consulting services offer the expertise needed to navigate these challenges efficiently. Adopting a consultative approach to patch management not only streamlines the process of addressing vulnerabilities but also fortifies an organization’s defenses against future cybersecurity threats.

• Expert Guidance: Provide specialized knowledge to help organizations sift through complex vulnerability reports, ensuring a clear understanding of the threat landscape.
• Prioritization of Patches: Identify and prioritize patches crucial for maintaining operational security and compliance, focusing efforts where they are most needed.
• Proactive Vulnerability Management: Advocate for continuous monitoring and early threat detection per cybersecurity frameworks like CIS.
• Constant Vigilance: Encourage a culture of vigilance and ongoing assessment within organizations, promoting a thorough and integrity-focused patching process.

A Patch Management Partnership: Crafting a Secure Future

The journey through the patch management landscape is more than just a technical endeavor; it demands a strategic mindset that embraces continuous improvement and an understanding of the broader cybersecurity environment. Patch management requires a holistic strategy encompassing multiple facets of cybersecurity. This comprehensive approach integrates managed services to offload and streamline patch applications, employs detailed security assessments to uncover vulnerabilities, and follows the principles laid out by established security frameworks.

This path, though demanding, paves the way to a secure and robust digital future, safeguarding the organization’s assets and data against potential breaches. OneNeck is here to help with an experienced team that provides tailored solutions for patching and any other aspect of systems management your organization may need. Our extensive expertise across multiple platforms and industries allows us to deliver a right-fit solution for you.

Contact us today to speak with a member of our team.

***Check out our Monthly Patching Blog series to keep up-to-date on the latest critical updates from our vendors. ***

A critical vulnerability has been uncovered in ConnectWise’s ScreenConnect. Identified under CVE-2024-1709, this susceptibility poses a significant threat, prompting immediate and decisive action to safeguard sensitive information and maintain operational integrity.

Importantly, for our clients and partners, OneNeck has not been impacted by this vulnerability. However, we recognize the importance of staying informed on all potential security threats and providing guidance on mitigation strategies to our partners and customers.

A Closer Look at the ScreenConnect Vulnerability

Initially reported on February 13, 2024, through ConnectWise’s vulnerability disclosure channel, the exposures demand immediate action from on-premise customers. These security risks involve:

• CWE-288: Authentication bypass using an alternate path or channel
• CWE-22: Improper limitation of a pathname to a restricted directory (“path traversal”)

Both vulnerabilities highlight the need for stringent security measures. The CVSS score stands at a critical 10 for CWE-288, underlining the severity of the threat. This score is calculated based on several metrics, indicating that the vulnerability is easily exploitable and the potentially high impact on confidentiality, integrity, and availability that could result. 

Indicators of Compromise

The following IP addresses have been identified by ConnectWise as being used by threat actors and are provided below for your protection and defense.

IOCs:

155.133.5.15

155.133.5.14

118.69.65.60

ConnectWise’s Response and Remediation Steps

ConnectWise promptly issued a security bulletin outlining remediation steps after discovering the vulnerability. Cloud customers, including those using “screenconnect.com” and “hostedrmm.com,” were automatically secured against these vulnerabilities as of February 19, requiring no additional actions on their part.

On-prem users, on the other hand, are urged to update to the latest ScreenConnect version, 23.9.10.8817, immediately to protect against these threats, with version 23.9.8 being the minimum requirement to mitigate the reported vulnerabilities. Notably, ConnectWise has lifted license restrictions to ensure all customers, even those not currently under maintenance, can upgrade to the latest version.

• For instructions on updating to the newest release, please reference this document.
• Link to patch: Download

Immediate Steps for ScreenConnect Users

The identification of CVE-2024-1709 necessitates immediate action from ConnectWise partners. As mentioned above for cloud users, remediation has been automatically applied, ensuring security without further steps needed, though continued monitoring of your environment is highly recommended. For on-premises users, updating your systems is critical. Upgrading to the latest ScreenConnect version is not just recommended; it’s essential for safeguarding against potential exploitation.

Best Practices and a Partner That Has Your Back

The discovery of this issue serves as a valuable lesson for all organizations in the importance of timely updates and the implementation of a robust cybersecurity framework.

Key recommendations include:

• Regularly updating and patching software to mitigate vulnerabilities.
• Monitoring systems for indicators of compromise to detect and respond to threats promptly.
• Educating stakeholders about the importance of cybersecurity hygiene.

At OneNeck, the security of our customers is our top priority. We are dedicated to informing our customers about potential security threats, regardless of whether we directly manage those services. Our commitment extends beyond mere awareness; we actively provide support and guidance to ensure our customers can navigate the cybersecurity landscape confidently. Should you need assistance or have concerns about your security posture, our Customer Support Center is ready to help.

As we embrace the extra day this leap year brings, OneNeck is here to ensure that February’s additional time is met with heightened cybersecurity vigilance. This month, we navigate through a blend of routine maintenance and critical zero-day patches that demand immediate attention. Let’s leap into this month’s updates, highlighting not only the routine patching tasks but also addressing essential vulnerabilities that could significantly impact the security posture of your IT environment.

Microsoft’s Patching Synopsis

Microsoft has addressed 73 vulnerabilities, categorized as follows:

• 16 Elevation of Privilege Vulnerabilities
• 3 Security Feature Bypass Vulnerabilities
• 30 Remote Code Execution Vulnerabilities
• 5 Information Disclosure Vulnerabilities
• 9 Denial of Service Vulnerabilities
• 10 Spoofing Vulnerabilities

This release includes patching two zero-day vulnerabilities, highlighted in the following, underscoring the importance of timely updates.

February’s Patching Highlights

Key vulnerabilities spotlighted for this month include:

• CVE-2024-21351 – Windows SmartScreen Security Feature Bypass
• CVE-2024-21412 – Internet Shortcut Files Security Feature Bypass
• CVE-2024-21410 – Exchange Server Elevation of Privilege Vulnerability
• CVE-2024-21413 – Outlook Remote Code Execution Vulnerability

Given their critical nature, these vulnerabilities demand immediate attention from IT professionals. The risk they pose, if left unpatched, could lead to significant breaches, data loss, and system compromise. We urge organizations to prioritize these updates to safeguard their networks against attacks.

Exchange Updates

OneNeck has proactively addressed the Exchange Server vulnerability identified in this month’s update cycle for those under our Exchange Management service. Furthermore, for clients utilizing Exchange 2019 and covered under our management services, deploying this month’s Cumulative Update will proceed through distinct change requests. Note: Microsoft has discontinued Cumulative Updates for Exchange Server 2016. In light of this, we strongly advocate for all our clients to consider migrating to Exchange Server 2019 to ensure continued security and support. If you have questions about how OneNeck can assist you, please reach out to our Service Desk (800-272-3077).

Linux Patching Overview

This month, our Linux Team has meticulously identified a series of necessary patches for bolstering your Linux environments’ security and functionality. Here’s a detailed breakdown of these vital updates:

• CVE-2023-42753: Security update for the RHEL 7 Kernel, enhancing system defenses.
• CVE-2023-5633, CVE-2023-20569, CVE-2023-42753: Addresses multiple vulnerabilities for the RHEL 8 Kernel,
• CVE-2023-40283, CVE-2023-42753, CVE-2023-46813: Security enhancements for the RHEL 9 Kernel, closing multiple critical gaps.
• CVE-2024-20926, CVE-2024-20945, CVE-2024-20952: Java-1.8.0-Openjdk and Java-11-Openjdk security updates are crucial for maintaining Java applications’ security integrity.
• CVE-2023-44446: Update for Gstreamer-Plugins-Bad-Free, safeguarding multimedia processing.
• CVE-2024-0409, CVE-2024-21885, CVE-2024-21886: Xorg-X11-Server security updates, crucial for graphical system stability and security.
• CVE-2024-0751, CVE-2024-0753, CVE-2024-0755: Firefox security updates for secure web browsing.
• CVE-2024-0229, CVE-2024-21885, CVE-2024-21886: Tigervnc security updates, enhancing remote desktop security.

While categorized as moderate, the following updates are still important for maintaining the integrity and security of various system components and services:

• CVE-2023-43804, CVE-2023-45803: These patches for Python-Urllib3 address vulnerabilities in HTTP client software, mitigating risks that could compromise web communication security.
• CVE-2023-39615: The Libxml2 security update for XML processing ensures the security and integrity of XML applications.
• CVE-2022-44638: A Pixman update strengthening the core image rendering libraries, protecting systems from vulnerabilities affecting graphic content processing.
• CVE-2023-7104: Fortifies Sqlite database stability and security, preventing data integrity issues.
• CVE-2023-27043: Enhances the overall security framework of Python3 applications, addressing vulnerabilities in scripting and automation.
• CVE-2023-5981, CVE-2024-0553, CVE-2024-0567: Updates to Openssh ensuring secure system access and communication.
• CVE-2024-0553: Gnutls security update marks improvements in SSL/TLS communication security, addressing vulnerabilities in encrypted data transmission.

While these patches are classified as moderate in severity, their implementation is vital for proactively safeguarding Linux environments against a range of security threats. We recommend system administrators apply these updates promptly to ensure ongoing security and stability.

Microsoft Office and SharePoint Updates

While our scheduled patching activities are comprehensive, they are designed to complement your internal update processes for a wide range of products, including Microsoft Office and SharePoint. We encourage our clients to regularly review and apply updates across all software to ensure the highest level of security. For insights on integrating these updates seamlessly into your security strategy or to find out how OneNeck can support your efforts, do not hesitate to reach out to our Service Desk.

TLS 1.0 and TLS 1.1 Update Advisory

As previously announced, Microsoft will disable TLS 1.0 and TLS 1.1. While no specific date has been set, we urge all customers to prepare their environment for these changes. For more information, visit the Tech Community Blog.

Closing Thoughts

This month, taking a “leap” into cybersecurity vigilance reminds us of the extra steps we can take to fortify our digital defenses. With each monthly patching cycle, we reaffirm our commitment to your cybersecurity. Remember, staying up-to-date with patches is a key defense strategy. Please contact us for any assistance or questions; our team is ready to help.

Stay secure and patched; let’s use this extra day– and every day– as an opportunity to continue safeguarding your IT infrastructure together.

Each month, OneNeck engineers review newly released updates from vendors, like Microsoft, to understand any known issues, actions required and understand the priority of each. This is done immediately following Patch Tuesday releases, and we monitor for adjustments to patches throughout each month.

The information above is gathered monthly during this review and posted for awareness to our customers. This information is generally updated only once per month and is based on our engineers’ review of the information provided by the vendor at that time. As always, for the most up-to-date patching information, please see the vendor’s website or contact us.

Note: If OneNeck actively manages a device or software that is impacted by any of these vulnerabilities, when necessary, OneNeck will be in direct contact with you regarding remediation.

Monthly Security Workshop: Trends in Cybersecurity

In a rapidly evolving digital landscape, staying ahead of cybersecurity threats is more critical than ever. This insightful workshop on Trends in Cybersecurity explores the latest developments and emerging trends that are shaping the future of digital defense. From the rise of artificial intelligence in threat detection to the increasing importance of zero-trust architectures, our security expert will delve into the strategies and technologies that are revolutionizing how organizations protect their sensitive data. Whether you’re a cybersecurity professional or an IT decision-maker, this webinar will provide you with the knowledge and tools to enhance your security posture and stay ahead of cyber adversaries. Watch now to learn from industry leaders and gain actionable insights into the future of cybersecurity.

As businesses continue to modernize and migrate workloads to the cloud, one daunting task persists — migrating databases. Database migration can require complex data transformations and usually takes many steps. This task can be overwhelming on your own, but with the assistance of Azure Database Migration Service, migrating data, schema and objects to Azure becomes significantly more streamlined and efficient.

Why Migrate to Azure Data Platforms?

Migrating to Azure data platforms offers your organization numerous advantages over on-premises infrastructure.

Scalability

Azure platforms provide scalability and flexibility, allowing you to easily scale your resources up or down based on your needs. This allows you to handle increasing workloads and sudden spikes in traffic without hassle.

Protection

Azure data platforms offer high availability and disaster recovery options, ensuring that your data is protected and accessible at all times. Additionally, Azure provides advanced security features, such as encryption and threat detection, to safeguard your data from unauthorized access.

Cost

With Azure data platforms, you only pay for the resources you use, eliminating the need for expensive infrastructure investments.

What is Azure Database Migration Service?

Azure Database Migration Service is a fully managed service offered by Microsoft Azure that allows you to migrate your databases to Azure data platforms with ease. It supports various source databases, including SQL Server, MySQL, Oracle and PostgreSQL, and provides a seamless migration experience.

The Azure Database Migration Service lets you perform both online and offline migrations and offers a range of migration methods, such as database backup and restore, online data migration and offline data migration using Azure Data Box. It also offers a comprehensive monitoring dashboard, so you can monitor your migration and troubleshoot any issues that may arise.

How to Use Azure Database Migration Service

The user-friendly interface of Azure Database Migration Service guides you through the migration process. Here’s how to get started:

1. Create an instance of the service in your Azure portal.
2. Select the source and target databases you want to migrate.
3. Choose the migration method that best suits your needs and configure the required settings.
4. Start the Azure data migration process and monitor its progress using the built-in monitoring dashboard.

Azure Database Migration Service also allows you to schedule migrations to ensure minimal business disruption.

Proven Techniques for a Successful Database Migration with Azure

Follow these proven techniques to ensure a smooth and seamless database migration using Azure Database Migration Service.

Source Database Assessment

The first step is conducting a comprehensive assessment of your source database, analyzing the database schema, dependencies and performance metrics. This helps you understand your source database so you can effectively plan and strategize the migration process.

Trial Migration

Conduct a trial migration to identify any potential issues or challenges that may arise before proceeding with full-scale Azure data migration. Addressing any concerns early on helps minimize disruptions and ensure a successful transition.

Industry Standards

Follow industry best practices and standards, like ensuring data integrity and security throughout the migration process. Implementing robust security measures and encryption protocols safeguards your data from unauthorized access or potential breaches.

Backups

Make backups of your data, establish recovery procedures and regularly test and validate your backup systems, in case any unforeseen issues occur during the migration.

Ongoing Monitoring

After the migration, ongoing monitoring and optimization are vital for maintaining optimal performance, security and compliance. Regularly review performance metrics, fine-tune configurations and address any performance bottlenecks to ensure that your migrated database operates at peak efficiency.

Stay Secure in the Cloud

Know that you have access to a reliable and secure solution with Azure Database Migration Service. When migrating your databases, it simplifies the process and lets you confidently move your data to the cloud. Azure infrastructure gives you scalability, flexibility and security while lowering costs.

Once you’ve transitioned to a cloud or hybrid environment, secure your data with the help of OneNeck IT Solutions. We’ll help protect your cloud infrastructure resources with our virtualized network security services, ensuring compliance while reducing the load on your IT team. Learn more about OneNeck’s Cloud Security Solutions.

Cloud computing offers scalability and easy access to data for all your locations. But just like in on-premises data centers, your data in the cloud is vulnerable to breaches, accidental deletions, and system failures. Your organization needs a comprehensive backup strategy to protect against data loss and attacks and to ensure you meet compliance requirements. Microsoft Azure Backup is an easy-to-use solution for backing up business information as well as meeting your IT compliance obligations.

What are Azure Backups?

Microsoft Azure Backup is a cloud-based service that allows businesses to protect and restore their data by backing it up in the cloud. It can back up your entire infrastructure, including virtual machines, databases and files. Using Azure Backup service eliminates the need for traditional, on-premises backup methods such as tape or disk-based systems and provides a more reliable and scalable solution for data protection.

Features of the Azure Backup Service

Azure Backup offers seamless integration with other Azure services, like Azure Site Recovery and Azure Monitor. You can use these services as part of your business continuity and disaster recovery (BCDR) strategy for outages and to monitor the health and performance of your backups.

Azure Backup service can perform incremental backups — only backing up changes made since the last backup — and automated backups — scheduled backups based on your specific requirements. Both options reduce storage costs and the time it takes to back up your data. You have the option to store backups in multiple geographic locations, which ensures that in the event of a disaster, your data is safe and can be restored from a different region.

Azure Backup has features to help you meet regulatory compliance or legal requirements, including long-term backup retention and granular recovery so that you can restore individual files or entire virtual machines.

The service also offers hybrid backup, allowing you to back up your data to the Azure cloud or an on-premises location, providing flexibility and an added layer of protection, ensuring that data is always available, even after a network failure or any other disaster.

Benefits of Microsoft Azure Backup for Data Security

Because the service was designed for ease of use and security, Azure Backup offers several benefits for your organization.

Reliability: Azure Backup uses redundant storage and data replication to ensure backups are always available to your organization, even during hardware failures or natural disasters.

Advanced security features: With industry-standard encryption algorithms to protect your data in transit and at rest, Azure Backup helps prevent unauthorized access and provides built-in monitoring and alert capabilities to notify you about potential security threats.

Cost-effective protection: Traditional backup methods often require expensive software licenses and hardware, but cloud-based Azure Backup eliminates the need for hardware investments and software licenses. You only pay for the storage you use, allowing you to scale your backup requirements as needed and keep costs low.

Compliance certifications: Microsoft Azure and Azure Backup have many global, industry, and government certifications to help your organization meet regional, national, and industry-specific regulatory requirements. In addition, the service lets you retain data as long as required by your business and to meet regulatory compliance.

Strategies for Cloud Security and Compliance

While Azure Backup service provides robust data protection in the cloud, businesses should also implement additional cloud security and compliance strategies. Extra layers of security such as multi-factor authentication (MFA), regular monitoring and auditing, and regularly educating employees on data security best practices will help keep attackers at bay.

Protecting sensitive data in the cloud while meeting compliance requirements is a challenge for IT departments everywhere. However, with the help of industry security experts, you can ease your IT burden and get back to business. Secure, scalable cloud backup from Microsoft Azure Backup coupled with cloud security and data center compliance from OneNeck IT Solutions can give you the peace of mind you’re looking for. Count on OneNeck’s ReliaCloud security services and audit documentation to secure your applications and data.

Ready to learn more? Read about OneNeck’s cloud security and compliance solutions.

As we step into Data Privacy Week, we should reflect on the importance of protecting data throughout an organization and at an individual level. In a time when digital transformation is rapidly advancing, data privacy challenges have become more complex and demanding. This week is a timely reminder of the continuous efforts needed to safeguard sensitive information in our hyper-connected world.

The acceleration of digital integration into our daily lives and businesses brings countless potential vulnerabilities. Addressing data privacy vulnerabilities requires a shift in mindset and advanced technical solutions approach.

Emphasizing Security Awareness Training: Empower Your Workforce

A knowledgeable and vigilant workforce is a critical defense mechanism against cyber threats, and building this first line of defense is a multifaceted endeavor. Cyber threats constantly shift, necessitating regular training to keep the workforce aware of the latest risks, threats and defense mechanisms. Continuous education is crucial in building a proactive culture of security. It ensures employees are not just aware but are also actively participating in safeguarding organizational data.

Engagement is the key to retention, and this is where interactive training platforms come into play. By employing simulated attacks, interactive learning modules, and incorporating real-world scenarios, the training process becomes more than just a routine exercise. It becomes an immersive experience, significantly enhancing the understanding and retention of cybersecurity best practices. This approach ensures the principles of cybersecurity are not just learned in theory but are ingrained in the everyday behavior and mindset of the workforce.

Robust Data Access Controls: A Strategic Necessity for Data Privacy

One of the most critical yet often overlooked cybersecurity areas is managing internal access to data. Robust data access controls are not just an add-on but a strategic necessity. How data is accessed and handled internally can have significant impact on an organization’s vulnerability to security breaches.

These controls serve as the foundation of a comprehensive cybersecurity strategy, ensuring sensitive information is accessed responsibly and securely. The goal of course, is preventing unauthorized external access and accurately manage how internal users interact with, share, and utilize data.

• Customized Access Rights – Tailoring access controls to employees’ specific needs and roles is essential in minimizing unnecessary data exposure. This customization ensures that employees have access to the data they need for their roles and no more, thereby reducing the risk of internal data breaches.
• Automated Solutions – With the complexity of modern network environments, manually managing access rights is no longer viable. Automated tools are crucial for the efficient management and monitoring of access rights, ensuring that the right people have the proper access at the correct times and that access is revoked when no longer needed. These systems play a role in identifying and responding to unauthorized access attempts, enhancing overall data security.

If it’s been a while (or not yet happened) since your Microsoft Active Directory or Entra ID environment was reviewed and optimized, OneNeck’s expert Microsoft security consultants can quickly and easily engage to ensure your automated tools are helping (rather than hindering) your security efforts.

The Power of Segmentation: Isolating Risks

Network segmentation involves creating distinct barriers within a network, effectively separating different areas to isolate risks and prevent breakouts. Organizations can significantly mitigate the impact of potential breaches by dividing the network into distinct zones, each with its own unique types of data and access levels.

When networks are segmented, a breach in one area is contained, preventing it from spreading across the entire network. This isolation is particularly beneficial in large organizations, where the diversity and volume of data can vary significantly across different departments. By segmenting these areas, organizations can apply tailored security measures appropriate for the sensitivity of the data contained within each segment.

This approach also aids organizations in meeting various compliance requirements. With data privacy regulations (such as General Data Protection Regulation, GDPR) becoming increasingly stringent, demonstrating effective data management is crucial. Network segmentation simplifies this process by clearly defining data boundaries. When data is segmented and categorized, applying specific regulatory standards to each data type becomes easier, streamlining the compliance process. This clear delineation of data not only aids in compliance but also enhances overall security management, making it easier for organizations to identify and rectify any potential vulnerabilities within specific segments.

Reinforcing Data Privacy Defenses

As cyber threats become more sophisticated, multi-layered security systems are imperative. Advanced firewalls, Intrusion Prevention Systems (IPS), Intrusion Detection Systems (IDS), and comprehensive antivirus solutions are among these critical defenses. These components work together to create a formidable barrier against a wide range of threats.

• Next Generation Firewalls – The role of firewalls in cybersecurity cannot be overstated. Next-generation firewalls go beyond traditional packet filtering, offering deeper inspection and control of network traffic. These firewalls analyze traffic for malicious activities and apply rules that go far beyond IP addresses and ports, offering a more nuanced defense against sophisticated attacks.
• Real-time Threat Detection – Intrusion Prevention Systems (IPS) and Intrusion Detection Systems (IDS) provide real-time monitoring and immediate response to unusual activities traversing a firewall with such capabilities. These systems are essential for identifying potential threats as they occur, allowing for quick countermeasures to prevent or minimize damage.
• Comprehensive Antivirus Solutions – Antivirus software remains a fundamental element of cybersecurity defense. However, these programs must be comprehensive, regularly updated, and capable of dealing with the latest malware and virus threats. Modern antivirus solutions should protect against known viruses and offer heuristic analysis to detect new, unknown threats.

A Data Privacy Partner You Can Rely On

While Data Privacy Week serves as a crucial reminder of the ongoing importance of protecting data, it’s vital to recognize that the principles and strategies discussed are not just for a single week but are part of a continuous effort. Let it catalyze ongoing education, strategy enhancement, and technological advancement in data security. As we step beyond this observance week, let’s all embrace the responsibility of ensuring data privacy as a fundamental aspect of our digital existence, demonstrating organizational and individual commitments to safeguarding our most valuable digital assets daily.

 At OneNeck, we take a holistic approach to data privacy. We provide a broad selection of services and solution packages tailored to the specific needs of our customers. Are you in need of a partner to help administer your security demands? We’ve got your back with our comprehensive managed services suites.

Contact us today to see how we can be your data protection partner.

Happy New Year from all of us at OneNeck! As we enter 2024, we’re back with our monthly patching blog, committed to guiding you through the latest updates and patches. A fresh year brings new opportunities to enhance cybersecurity measures, ensuring that your IT infrastructure remains robust against emerging threats. Starting the year on a secure footing is vital, and our first patching update of the year is designed to help you maintain a resilient and robust defense against cyber threats.

Microsoft’s January Security Overview

In the first month of 2024, Microsoft has addressed a range of vulnerabilities:

• 10 Elevation of Privilege Vulnerabilities
• 7 Security Feature Bypass Vulnerabilities
• 12 Remote Code Execution Vulnerabilities
• 11 Information Disclosure Vulnerabilities
• 6 Denial of Service Vulnerabilities
• 3 Spoofing Vulnerabilities

Notably, this month has no zero-day vulnerabilities in need of patching, which is a decidedly positive start to the year!

Patching Highlights for this Month

The following are among the most critical patches and should be prioritized:

• CVE-2024-20674: A security feature bypass vulnerability in Windows Kerberos.
• CVE-2024-20700: A remote code execution vulnerability in Windows Hyper-V.
• CVE-2024-20683 & CVE-2024-20686: Elevation of privilege vulnerabilities in Win32k.
• CVE-2024-20677: A remote code execution vulnerability in Microsoft Office.
• CVE-2024-21318: A remote code execution vulnerability in Microsoft SharePoint Server.

Additionally, global issues with the BitLocker Security Feature Bypass Vulnerability (CVE-2024-20666) updates have been reported, affecting various Windows OS versions. Microsoft has released a guide on automating the update to WinRE images for Windows 10 and Windows 11 to address this security issue, which can be found here.

January’s Linux Patching Updates

Our Linux Team has carefully examined the patches for this month, ensuring crucial vulnerabilities are brought to your attention. Here’s the breakdown:

• CVE-2023-39193: Addresses a critical security concern within Oracle Linux 7’s Unbreakable Enterprise Kernel (UEK) version 4.1.12, enhancing system defenses against malicious attacks.
• CVE-2023-4623: Fortifies Oracle Linux 7’s UEK version 4.14, patching vulnerabilities that potentially compromise system integrity.
• CVE-2023-5178: Updates Oracle Linux 7’s UEK version 5.4.17, targeting security gaps to bolster the kernel’s protective measures.
• CVE-2023-44446: Enhances GStreamer 1’s security, patching vulnerabilities to maintain the integrity and stability of multimedia content processing.
• CVE-2023-5869: Focuses on securing PostgreSQL, a powerful open-source database system, against exploits that could affect data confidentiality and integrity.
• CVE-2023-5557: Updates Tracker Miners, essential tools for indexing and searching data, to close security potentially exploitable loopholes.
• CVE-2023-42917: Provides vital security improvements to WebKit2GTK, the engine behind numerous GNOME applications, ensuring safer web content rendering.
• CVE-2023-45871: Bolsters the security framework of the RHEL 9 Kernel, critical for the operational safety and reliability of Red Hat Enterprise Linux systems.

While classified as moderate, the following updates are essential for maintaining the integrity and security of various system components and services.

• CVE-2022-44638: Fortifies the Pixman library, by patching vulnerabilities that compromise graphic content security.
• CVE-2023-39615: Provides crucial updates to LibXML and closes gaps that can execute arbitrary code or access sensitive information.
• CVE-2022-24963: Focusing on the Apache Portable Runtime (APR) library, and closes security holes affecting a broad range of software, from web servers to database systems.
• CVE-2023-38473: Enhances the security of Avahi, by addressing vulnerabilities that disrupt service discovery or compromise network communications.

Furthermore, updates are rolling out for widely used utilities like Curl and OpenSSL, targeting vulnerabilities to prevent unauthorized access and data breaches.

Microsoft Office & SharePoint Updates

While our scheduled patching activities are comprehensive, they are designed to complement your internal update processes for a wide range of products, including Microsoft Office and SharePoint. We encourage our clients to regularly review and apply updates across all software to ensure the highest level of security. For assistance on integrating these updates seamlessly into your security strategy or to find out how OneNeck can support your efforts, please reach out to our Service Desk.

TLS 1.0 and TLS 1.1 Disabling Updates

Updates to disable TLS 1.0 and TLS 1.1 are forthcoming. There have yet to be announcements of a specific date, but customers are encouraged to ensure their environment is ready for these changes. For more information, please refer to the Tech Community Blog.

New Year, Same Focus on Security

As always, OneNeck is here to assist with your cybersecurity needs. Stay tuned for the next patching blog, and remember to keep your systems secure and up to date.

Stay secure and stay patched!

Each month, OneNeck engineers review newly released updates from vendors, like Microsoft, to understand any known issues, actions required and understand the priority of each. This is done immediately following Patch Tuesday releases, and we monitor for adjustments to patches throughout each month.

The information above is gathered monthly during this review and posted for awareness to our customers. This information is generally updated only once per month and is based on our engineers’ review of the information provided by the vendor at that time. As always, for the most up-to-date patching information, please see the vendor’s website or contact us.

Note: If OneNeck actively manages a device or software that is impacted by any of these vulnerabilities, when necessary, OneNeck will be in direct contact with you regarding remediation.

Cloud computing is generally considered to be a safe bet when it comes to system security. Cloud platforms often come with sophisticated security features like access control, user authentication, encryption, and more.

However, they can be challenging when it comes to regulatory compliance. Not every solution is built with the specific cloud restrictions and requirements of various regulatory bodies in mind. Fortunately, cloud compliance solutions are designed to enhance data security and help organizations adhere to regulatory requirements.

What is Cloud Compliance?

Cloud compliance is adherence to the local, national and international regulations and industry standards that cover storing, processing and transmitting data in the cloud. These regulations and standards protect sensitive information and ensure the privacy, integrity and availability of data. Complying with these regulations helps organizations reduce the risk of data breaches and any fines or reputational damage that may come along with a breach.

The Importance of Cloud Regulatory Compliance and Data Security

Cloud security standards and regulations are complex and ever-changing, and meeting them can take significant time and resources. However, non-compliance carries the risk of fines, legal action, reputation damage and loss of customer trust. Companies must prioritize cloud compliance and data security to ensure sensitive information stays safe while preserving their reputation and upholding customer trust.

Compliance Standards

Depending on the industry and the type of data being stored and processed, cloud compliance standards can vary. Some key standards affecting many organizations include:

PCI DSS

If your company stores, processes, transmits or handles credit card data using cloud services, your provider must be Payment Card Industry Data Security Standard (PCI DSS) compliant. Compliant cloud providers must protect credit card data from unauthorized access or breaches with robust security measures such as regular security audits and strict access controls.

HIPAA

Most people have heard of the Health Insurance Portability and Accountability Act (HIPAA), the national law creating regulations to define and protect sensitive healthcare information. HIPPA regulations apply to organizations that handle electronic protected health information (ePHI). 

Organizations that use cloud services to store or process ePHI must ensure their cloud provider meets HIPAA compliance requirements, which include implementing safeguards, conducting risk assessments and controlling data access to protect sensitive healthcare information from unauthorized access or disclosure.

Other Cloud Compliance Standards

In addition to the standards above, your company may be required to comply with other regulations, depending on the industry and the geographic regions you operate in. 

The EU-U.S. Privacy Shield Framework protects the personal data of individuals in the European Union (EU) by requiring transparency from companies that use it.

The American Institute of Certified Public Accountants’ (AICPA) Statement on Standards for Attestation Engagements No. 18 (SSAE 18) is a cloud compliance standard for third-party data centers. Data centers get certified by completing examinations and providing supporting documentation of organizational and IT controls to protect mission-critical IT infrastructure.

Additional cloud compliance standards include the General Data Protection Regulation (GDPR) for organizations that handle the personal data of European Union citizens, the Federal Risk and Authorization Management Program (FedRAMP) for government agencies and the International Organization for Standardization (ISO) standards for various industries. 

Cloud Compliance Solutions for Your Organization

With changing regulations and so many moving parts, maintaining cloud compliance can be challenging for any IT department. Fortunately, there are cloud compliance solutions that can help you navigate the complexities of regulatory compliance to ensure you meet all requirements. 

OneNeck IT Solutions offers comprehensive cloud compliance solutions to help organizations comply with regulations. OneNeck’s ReliaCloud meets HIPAA/HITECH, U.S.-EU Privacy Shield and Type 2 SSAE 18 (SOC 1) compliance requirements and others, freeing up your IT resources. 

Don’t face overwhelming compliance requirements on your own. By partnering with OneNeck, you have experts on your side so you can focus on what you do best—managing your business. Learn more about OneNeck cloud compliance solutions here.

Did you get my email? If you are deploying outdated Exchange servers, this straightforward question may no longer be quite so innocuous. To bolster email security, Microsoft has announced a policy of throttling and blocking emails from an out-of-date on-premises Exchange server. This initiative responds to the increasing cybersecurity threats targeting vulnerabilities in older, unsupported versions. Microsoft aims to compel administrators to promptly update and patch their Exchange servers by implementing a transport-based enforcement system. This decision underscores the importance of maintaining up-to-date systems to ensure secure and reliable email communication.

Microsoft’s Enforcement System

Microsoft’s transport-based enforcement system represents a pivotal advance in securing email communication against the vulnerabilities of outdated Exchange servers. This system is methodically designed, initially identifying and reporting servers running outdated software, then progressing to throttling email traffic from these servers. The ultimate step, reserved for persistently non-compliant servers, involves blocking email traffic entirely. The rationale is straightforward: to motivate administrators to prioritize updates and patch their servers, thereby maintaining a robust, secure email environment.

The initial focus of this enforcement is on Exchange 2007 servers, identified as particularly vulnerable due to their age and lack of support. However, Microsoft has indicated that this is just the beginning. The enforcement scope is set to widen. Microsoft has confirmed that Exchange 2010 and 2013 will fall under enforcement beginning this month. There is an expectation for Exchange 2016 and 2019 servers to follow suit shortly. This expansion highlights the escalating priority of cybersecurity and the need for proactive measures against potential vulnerabilities due to outdated servers.

Source: Microsoft

Enforcement Stages

Microsoft is adopting a progressive enforcement approach, gradually increasing throttling and then introducing stages of blocking, which can lead to up to 100% blockage of non-compliant traffic.

• The escalation of enforcement actions includes increased throttling, the introduction of blocking, and complete blocking until the server is updated or decommissioned.
• Stage 1 begins with a report-only mode upon the first detection of a non-compliant server, allowing 30 days for remediation.
• Failure to update within 30 days increases throttling over the next 30 days (Stages 2-4).
• After 60 days, throttling and blocking escalate, with increased blocking every 10 days for another 30 days (Stages 5-7).
• At 90 days without remediation, Stage 8 is reached, where Exchange Online will block all messages from the server until compliance is restored.

Managing the Exchange Server New System

Understanding the challenges of transitioning to updated server systems, Microsoft has provided a temporary reprieve for organizations. This measure, accessible via the Exchange Admin Center (EAC) or Exchange Online PowerShell, allows administrators to halt the enforcement of the new security protocols temporarily. Designed for organizations that need more time to update their on-premises Exchange servers, this pause is crucial to ensure ongoing email services without disruption.

Enforcement Pause

• Tenants can pause enforcement actions for up to 90 days per year, similar to a pre-paid debit card system. You may require 5 days in Q1 to remediate a server, or perhaps 15 days in Q2. Then, another 7 days in Q3, and so forth, up to 90 days per calendar year.
• The enforcement pause is manageable through the new mail flow report in the EAC and puts the server back into a report-only mode for the duration specified by the admin, up to the annual limit.

However, this reprieve is a temporary solution. Administrators must use this time wisely, focusing on updating and securing their servers. During these periods, developing and implementing proactive server maintenance and security steps are imperative to avoid long-term risks and potential breaches.

Security Implication Beyond Exchange Server

The enforcement of updated security protocols on Exchange servers by Microsoft reflects a larger, more critical conversation in cybersecurity. While addressing specific vulnerabilities in Exchange servers, this initiative is a poignant reminder of the need for robust cybersecurity practices across all digital platforms. Organizations must regularly update and monitor their systems, not just in response to immediate threats but as a part of a continuous commitment to digital security.

The implications of this initiative extend beyond Exchange servers. It underscores the importance of a comprehensive security strategy that includes layers of defense against emerging threats. This strategy should encompass proactive updates, regular system monitoring, and the implementation of advanced security measures. In doing so, organizations can better protect themselves against a wide range of cyber threats, ensuring the security and reliability of their digital operations.

Ensuring Continuous Protection with Patch Management Services

As we have explored the critical need for up-to-date security measures, it’s clear that regular patch management is an essential component of any robust security strategy. Navigating the complexities of patch management can be daunting for any organization, but it’s a vital step in safeguarding against vulnerabilities.

This protection is where OneNeck’s Patch Management services step in. By offering comprehensive systems management solutions, our team helps provide peace of mind that your IT infrastructure is secure and current. With services tailored to monitor and continuously apply necessary updates, we’ll ensure your systems comply with the latest security standards and are resilient against emerging threats.

For a deeper understanding of how patch management forms the core of a robust defensive IT strategy, consider reading further here and exploring the benefits of proactive patching on our Monthly Patching blog site.

Beyond the Throttle: A Partner to Ensure Exchange Server Security

The recent actions by Microsoft underscore the necessity of keeping On-Premises Hybrid Exchange Servers up to date. These developments highlight an urgent need for server maintenance for organizations without Exchange Management services. As an experienced Microsoft CSP and Solutions partner, OneNeck is ready to ensure your servers remain current, secure, and performing at their best.

Keep your business safe from outdated technology. Partner with our experienced team and proactively step towards seamless and secure server operations. Contact us today to keep your systems in top condition.

Microsoft has a jam-packed feature set in most licensing packages. However, it’s difficult for organizational IT groups to roll out the entirety of these features and options. They are afraid (and rightfully so) that chaos will reign if they immediately implement everything Microsoft offers. However, there are several features designed to maximize productivity that every organization should consider implementing. The best part is that they are probably included in the licensing your business is already paying for!

#1: Free Audio-Conferencing

Microsoft offers free audio conferencing for users with many Office packages, including Microsoft 365 Basic, Standard, Premium, E3, E5, F1, F3, and Office 365 E1, E3, and F3. This service features unlimited dial-in and 60 minutes per assigned license of dial-out. However, a significant number of users with access to this feature aren’t utilizing it to its full potential.

A key advantage for organizations using a paid third-party audio-conferencing service is the potential cost-saving benefit. With free audio conferencing included in qualifying Microsoft licenses, reducing or even eliminating the expenses associated with these third-party services might be possible.

For more details on how to set up audio conferencing for Teams, which is complimentary with certain Office licensing, you can refer to the following resource:

• Setup Audio Conferencing for Microsoft Teams

#2: Microsoft Bookings

Microsoft Bookings simplifies the process of scheduling meetings, especially with external parties. Ideal for one-on-one or small group meetings, Bookings is incorporated in most Microsoft packages, such as Office 365: A3, A5, E1, E3, E5, F1, F3, and Microsoft 365: A3, A5, E3, E5, F1, F3, Business Basic, Business Standard, Business Premium. Notably, Bookings is not a standalone app and requires the Outlook Web App or Outlook on the web, as it integrates with and stores data in Outlook.

Bookings offers a user-friendly solution for organizations looking to streamline their scheduling processes and to top it off; it’s a tool you likely already have access to. Implementing Bookings significantly eases the coordination of meetings, offering an accessible way for clients and team members to schedule time together. I use Bookings to allow clients an easy way to get us together.

Setting up Bookings is a straightforward process:

MS Bookings (turn on) (Make scheduling meetings easier on everybody)

• 1 – Main set up page
• 2 – Create a Calendar
• 3 – Define a service offering in Bookings
• 4 – Customize and publish your booking page
• 5 – Create a Service with Multiple-staff at the same meeting

#3: Assigning Licensing by Groups

The best practice for businesses managing many users is assigning licenses using Active Directory groups. This approach facilitates automation, streamlining the onboarding process and minimizing errors. This method of license assignment requires Entra ID licensing, which is available in various M365 packages or as an add-on.

The use of Active Directory for license assignment not only simplifies management but also integrates with other Microsoft security features, including Multi-Factor Authentication (MFA) and Conditional Access policies.

Here’s how you can get started:

• MS-500 part 1 – Implement and manage identity and access

• • Manage Licenses

• Assign or remove licenses in the Azure Active Directory portal

• • To assign a license to a group

#4: Microsoft Power Automate

Power Automate is akin to bringing the concept of macros into enterprise workflows. This tool offers the capability to implement automated responses, streamline workflows, and integrate various Microsoft applications seamlessly. Power Automate is included in several Microsoft 365 licensing options, such as E3, E5, F1, Business Basic, Standard, and Premium, and Office 365 E1, E3, E5, and F3. Note that Intune and EntraID might be required for certain functionalities if not included in your package.

Imagine being able to automatically forward emails from an unattended mailbox, reformat them, and then send them to a ticketing system, or enabling a user to run a .Net application and automatically post the results to a SharePoint site. The possibilities with Power Automate are vast, offering solutions that range from simple task automation to complex enterprise-level workflows.

Interested in exploring the capabilities of Power Automate? Get your start here:

Using Microsoft Power Automate (included in most packages)

• Check out the Home Page
• Create your first flow
• Trigger a cloud flow based on email properties – Microsoft Learn.

#5: Microsoft To Do

Among Microsoft 365’s suite of productivity tools, Microsoft To Do stands out for its simplicity and effectiveness. This application enables users to create straightforward task lists, but its true power lies in integrating with other Microsoft applications like Teams and Outlook.

With To Do, you can compile tasks, share with a team, and assign responsibilities, fostering collaboration as everyone can view and contribute to the same list. Integration with Outlook allows you to flag emails for follow-up directly in To Do, where tasks can be further detailed with due dates and assigned to specific team members. Organizations can significantly reduce clutter across their Inbox and Teams, streamlining communication and project management.

Microsoft To Do is a valuable resource for those ready to enhance their organizational habits.

Using Microsoft To Do | Microsoft 365

• To Do List and Task Management App | Microsoft To Do(Includes Install)
• To Do Help & Learning | Microsoft Support
• Six tips to make the most of Microsoft To Do on Windows | Microsoft Tech Community

Your Microsoft Productivity Partner for 2024 and Beyond

Are you ready to unlock the full potential of Microsoft 365 and take your team’s productivity to new heights? At OneNeck, as a seasoned Microsoft CSP and Solutions Partner, we’re committed to helping you excel in the Modern Workplace. From optimizing your licensing strategy to maximizing your use of Microsoft’s productivity tools, we provide the support you need to succeed.

Ready to transform your workflows and enhance collaboration? Contact us today and transform the way you work in 2024 and beyond!

In the vastness of the internet exists a somewhat mysterious shadowy corner known as the dark web. Though often misunderstood, this concealed segment of the web poses significant risks to personal and corporate data security. As per a recent report, in 2023, roughly 2.7 million users accessed the dark web daily, many with nefarious intent, while others are simply searching for anonymity but often encountering much more than they bargained for.

Distinct from the ‘surface web’ – the part of the internet we frequently use – and the ‘deep web,’ which contains protected information like medical records and financial data, the dark web is intentionally hidden and inaccessible through standard search engines and browsers. Access requires specific software and configurations, thus creating an environment where users can remain anonymous and untraceable.

The Allure and Perils of the Dark Web

The dark web presents tantalizing but dangerous options for those accessing it. Its allure lies not just in the obscurity it offers but in the promise of freedom from oversight. This shadowy network attracts diverse users: privacy advocates seeking refuge from surveillance, journalists sharing sensitive information under the cloak of anonymity, and, unfortunately, individuals engaging in illegal activities.

However, the characteristics that make the dark web appealing also render it dangerous. This hidden corner of the internet has become a hotspot for a range of cybercriminal activities. The anonymity and lack of regulation facilitate and embolden these illicit transactions. It has been estimated that 75% of Dark Web sites are marketplaces. Another study suggests that anywhere from 2% to 5% of the global GDP is laundered on the dark web.

The dark web serves as a breeding ground for security threats, providing a hub for black-market transactions and a haven for hackers and cybercriminals. In 2021 alone, ransomware attacks were recorded every 11 seconds, causing damages upwards of $20 billion. This stark reality highlights the critical need for robust cybersecurity measures. The sale of personal and corporate data, hacking tools, and ransomware kits is rampant. As technology advances, so do the tactics and tools employed in the dark web’s shadowy corridors, making it a moving target for law enforcement and cybersecurity experts.

Corporate Data in the Crosshairs

Emerging as a distinct threat to corporate data, the dark web poses a substantial risk to the integrity and security of global businesses. Kaspersky’s research highlights this issue’s gravity, revealing an average of over 1,700 posts monthly related to the sale, purchase, or distribution of corporate databases and documents. This alarming trend includes a range of sensitive information, from confidential business strategies to private customer details, which, in the wrong hands, can lead to disastrous consequences, including identity theft, compliance failures, financial fraud, and severe reputational damage to the companies involved.

The trafficking of corporate data on the dark web has far-reaching implications that extend well beyond a breached organization. When sensitive personal data falls into the wrong hands, it can lead to a cascade of privacy violations affecting countless individuals. Customers and employees find their personal information, financial details, and identities at risk of being exploited.

Businesses bear a crucial responsibility, not just to their bottom line, but to their customers, clients, and partners, and must enact robust cybersecurity measures. This obligation includes deploying advanced security technologies, conducting thorough employee training and awareness programs, executing regular security audits, and constant preparedness via effective incident response plans. By doing so, they preserve their interests and protect the personal and financial well-being of their clients and partners from the ripple effects of data breaches.

Safeguarding Against Dark Web Dangers

While challenging, there are effective strategies and policies that organizations can deploy to help defend against the multifaceted threats of the dark web. Comprehensive protection requires a solid security foundation and an agile and dynamic approach. Some basic principles to safeguard against dark web dangers include:

• Establish robust password protocols – Craft intricate and unique passwords for each account to minimize unauthorized breaches.
• Enable Multi-Factor Authentication (MFA) – Implement additional verification steps to access accounts, significantly enhancing security against unauthorized access and breaches.
• Stay current with software updates – Regular updates can prevent the exploitation of system vulnerabilities.
• Prioritize cybersecurity education – Equip employees with the knowledge and practices to act as the first line of defense against cyber intrusions.

Cybercriminals continuously develop new tactics, and companies must respond by adopting a holistic approach. This approach includes strengthening security by employing advanced security measures such as encryption, firewalls, and intrusion detection systems and regularly conducting security audits to identify and address vulnerabilities.

Furthermore, developing a robust incident response plan is essential for minimizing damage during a data breach. This plan should include protocols for immediate action, communication strategies, and recovery processes.

A Partner to Help Light the Way

The challenges posed by the dark web are daunting but not insurmountable. OneNeck is here to guide you with robust cybersecurity solutions tailored to protect your personal and corporate data. Don’t wait until threats become breaches; act now.

Contact our security experts today for a Security Awareness Call and start fortifying your defenses against the ever-evolving digital threats of the dark web.

As Nutanix transitions from their Xi Leap service, businesses must find a reliable alternative for disaster recovery needs. OneNeck stands out as a natural choice, recognized for its service excellence by Nutanix, allowing you to make the switch with confidence.

ReliaCloud^® Disaster Recovery as a Service (DRaaS)

OneNeck designs its ReliaCloud DRaaS with your needs in mind. It balances flexibility and reliability, aligning with Nutanix’s standards to minimize disruptions in your operations while safeguarding your data effectively.

Tailored for Nutanix Xi Leap Users

Understanding the nuances of Xi Leap, OneNeck’s DRaaS solution is designed to offer a familiar experience. It’s not just a service switch; it’s also an upgrade with advanced features and functionality. When comparing Nutanix Xi Leap and OneNeck DRaaS, here are some critical aspects to consider:

Integration and Onboarding

Both our solutions focus on simplifying the disaster recovery process, although through different integrations. Nutanix leverages its AOS platform, while OneNeck customizes our solution based on client infrastructure.

Automation and Replication

Each service provides automated disaster recovery processes emphasizing reducing complexity and streamlining operations.

Testing and Security

We offer non-disruptive testing to ensure DR readiness and maintain security, highlighting our commitments to consistent reliability and regulatory compliance.

Customization and Flexibility

While our approaches differ, both our services aim to offer flexible solutions tailored to businesses’ specific needs and requirements. Additionally, OneNeck’s DRaaS includes multiple options like full production DRaaS, storage optimization, limited protection, and production protection.

Committed to Quality

OneNeck’s recognition as a Champion in the Nutanix Elevate Service Provider Program, combined with over 150 Nutanix certifications, reflects our commitment to quality in Nutanix-based managed services. We’re continually learning and growing to serve our customers’ needs better.

A Strategic Step Forward

Choosing OneNeck is more than just opting for a new service provider; it’s a strategic decision for your business’s future. With comprehensive managed services and the robust ReliaCloud platform, OneNeck is well-positioned to elevate your disaster recovery capabilities.

Take the Next Step after Nutanix Xi Leap

Ready to upgrade your disaster recovery strategy? Explore OneNeck’s DRaaS solutions and contact us for a smooth and efficient transition from Nutanix Xi Leap.

Welcome to the December 2023 edition of OneNeck’s monthly patching blog. Our cybersecurity team remains vigilant, continuously analyzing the latest patches essential for maintaining your IT infrastructure’s security. With the year coming to a close, it’s crucial to ensure that your systems are updated to mitigate potential vulnerabilities that could compromise your network.

Microsoft’s December Security Brief

For December, Microsoft has addressed a total of 34 vulnerabilities, which are categorized as follows:

• 10 Elevation of Privilege Vulnerabilities
• 8 Remote Code Execution Vulnerabilities
• 6 Information Disclosure Vulnerabilities
• 5 Denial of Service Vulnerabilities
• 5 Spoofing Vulnerabilities

This month’s update cycle is particularly noteworthy for addressing an AMD zero-day vulnerability disclosed in August, but that has remained unpatched until now. The vulnerability, tracked as CVE-2023-20588, was a division-by-zero flaw affecting some AMD processors that could potentially lead to information disclosure.

Patching Highlights for the Month

Among the vulnerabilities addressed, the following patches are particularly critical and should be prioritized.

• CVE-2023-35628: This patch addresses a Remote Code Execution Vulnerability in the Windows MSHTML Platform.
• CVE-2023-36019: Fixes a Spoofing Vulnerability in the Microsoft Power Platform Connector.
• CVE-2023-35636: Remedies an Information Disclosure Vulnerability in Microsoft Outlook.

Linux Patching for December

Our Unix Team has identified several vulnerabilities with essential patches that should be conducted without delay:

• CVE-2023-46847: Critical security and bug fix update for Squid.
• CVE-2022-45884; CVE-2022-3523: Focuses on security enhancements and bug resolutions for the Kernel.
• CVE-2023-6204; CVE-2023-6209: Bolsters Firefox browser security.
• CVE-2023-34058: Enhancement for open-vm-tools.
• CVE-2022-32885: Update targeting both security and functionality improvements in Webkit2gtk3.
• CVE-2023-3972: Security enhancement for insights-client.
• CVE-2023-38545: Bolsters security for Curl.
• CVE-2023-44487: Network protocol enhancements for Nghttp2.
• CVE-2023-23583: Update for Microcode_ctl, focusing on system firmware security.
• CVE-2023-40217: Security update for Python.
• CVE-2023-5367: Security improving Tigervnc’s secure functionality.
• CVE-2023-1989: Update for the Unbreakable Enterprise Kernel’s (UEK) security.

These patches safeguard your Linux servers against potential breaches and system vulnerabilities. We recommend reviewing the detailed advisories for each CVE to understand the implications and take appropriate action.

In addition, December also brought several moderate-level updates enhancing the security and functionality of various Linux components. Notable among these are a security update for Samba (CVE-2023-3961), enhancing file and print service security; updates for DNS server software BIND (CVE-2022-3094) and DNS request handling in c-ares (CVE-2020-22217); a firmware update enhancement in fwupd (CVE-2022-3287); and security improvements for the printing system CUPS (CVE-2023-32324) and the text editor Emacs (CVE-2022-48337). While less critical, these updates are still necessary for maintaining a well-protected and efficient Linux environment.

Microsoft Office and Exchange Patching

Per our standard practice, OneNeck does not conduct patching for Microsoft Office products during our scheduled updates. We urge all customers to apply the latest Microsoft Office updates promptly. Should you need assistance or have any inquiries regarding this process, please don’t hesitate to contact our Service Desk.

Exchange

We continue to recommend that all customers upgrade to Exchange Server 2019. For those with OneNeck Exchange Management contracts, we will handle the Exchange Security Updates separately.

TLS 1.0 and TLS 1.1 Updates

As a reminder, Microsoft will soon implement updates to disable TLS 1.0 and TLS 1.1. We strongly advise preparing your systems for these updates to ensure seamless application functionality. For detailed information and guidance, please refer to Microsoft’s official communication.

Looking Forward to the New Year

As we conclude our December patching cycle, we encourage you to stay proactive by implementing these updates. Our team at OneNeck is always ready to support you in strengthening your cybersecurity posture.

Stay secure and stay patched; we look forward to bringing you more updates in the new year!

Each month, OneNeck engineers review newly released updates from vendors, like Microsoft, to understand any known issues, actions required and understand the priority of each. This is done immediately following Patch Tuesday releases, and we monitor for adjustments to patches throughout each month.

The information above is gathered monthly during this review and posted for awareness to our customers. This information is generally updated only once per month and is based on our engineers’ review of the information provided by the vendor at that time. As always, for the most up-to-date patching information, please see the vendor’s website or contact us.

Note: If OneNeck actively manages a device or software that is impacted by any of these vulnerabilities, when necessary, OneNeck will be in direct contact with you regarding remediation.

Successful organizations constantly seek ways to stay ahead of the curve in the ever-evolving business landscape. One such opportunity is the shift from traditional on-premises systems to cloud-based architectures. This transition is not merely a fleeting trend; it’s a strategic move for businesses aiming for scalability, flexibility, and efficiency. As the cloud becomes an integral part of the modern business landscape, understanding the intricacies of cloud migration becomes vital.

The Significance of Cloud Migration

The modern workplace has ushered in a surge in both the volume and diversity of data and applications. Managing these increasing complexities in traditional systems can be cumbersome, expensive and inefficient. Cloud systems offer a solution, providing scalable storage, enhanced security and cost-effective operations. Moreover, with the rise of remote work and global collaborations, cloud systems facilitate easy access to data and applications worldwide, ensuring business continuity and agility.

The impact of cloud migration extends beyond mere technological advancements; it signifies a profound shift in business operations and strategy. Embracing the cloud equips businesses with extensive agility, allowing them to scale operations in response to demand, optimize resource utilization, and realize significant cost savings. This migration also revolutionizes collaboration. With the cloud, data and applications become universally accessible, enabling teams to work seamlessly in real-time, boosting productivity and spurring innovation. Furthermore, the cloud allows for data-driven decision-making. Businesses can make strategic choices rooted in real-time data by harnessing advanced analytics and AI-driven insights.

Strategic Framework for Cloud Migration

Embarking on the cloud migration journey is not a one-size-fits-all approach. It requires a tailored strategy, considering each organization’s unique needs and objectives. Here’s a deeper look into the foundational steps for a successful cloud migration:

• Strategize the Move: Before any migration begins, it’s crucial to have a deep understanding of the current infrastructure. This knowledge involves auditing existing applications, data storage needs, and network configurations. By defining clear objectives for the migration, businesses can set measurable goals, whether they are cost savings, improved performance, or enhanced scalability.
• Select the Appropriate Cloud: The cloud ecosystem offers a plethora of options. From public clouds that offer vast scalability to private clouds that provide enhanced security, the choice depends on the business’s specific needs. Hybrid and multi-cloud strategies are also gaining traction, allowing companies to leverage the best of both worlds.
• Execute the Transition: This is where the rubber meets the road. A well-defined strategy ensures that the migration process is smooth, with minimal disruptions. It involves selecting the right tools, setting up the necessary configurations and ensuring data integrity during the transfer.
• Assess the Migration: A successful migration is not just about moving data and applications. Once the migration is complete, testing is essential to ensure all components function optimally in the new environment, including performance testing, security audits and functionality checks.

During this process, it’s essential to ensure that the existing systems remain operational. Businesses cannot afford downtimes, and a phased migration approach limits disruptions to daily operations.

Decoding the 6 Rs of Cloud Migration

Experts have outlined the ‘6 Rs’ of cloud migration to streamline this process and ensure a successful migration. These represent six strategies or pathways that businesses can adopt. The journey to the cloud is multifaceted, and the 6 Rs provide a structured approach to navigating this endeavor:

• Re-host: This is the most straightforward approach. It involves moving applications and data to the cloud without significant changes, ensuring a quick and cost-effective migration.
• Re-platform: While similar to re-hosting, this strategy goes a step further by optimizing applications to harness the full potential of the cloud, leading to improved performance and reduced costs.
• Repurchase: This strategy involves a shift in the IT consumption model. Instead of traditional software deployments, businesses might opt for SaaS solutions, leveraging cloud-native applications that are regularly updated and maintained by providers.
• Retain: Not all applications or data might be suitable for immediate migration. Some components may remain on-premise due to compliance needs, legacy system dependencies, or other reasons, leading to a hybrid cloud approach.
• Retire: Over time, certain applications become redundant or obsolete. Instead of migrating them, businesses can decommission them, leading to cost savings and reduced complexity.
• Re-factor: This is the most intensive approach, involving a complete redesign of applications to be cloud-native. While it requires significant effort, the long-term benefits of scalability, performance, and future readiness can be tremendous.

The 6 Rs: A Strategic Blueprint for Cloud Success

While the benefits of cloud migration are evident, the journey itself can be fraught with challenges, and the 6 Rs provide a structured basis to address them. By understanding and implementing one or more of these strategies, businesses can:

Minimize Downtime: Ensuring that operations continue smoothly during the migration process.

Optimize Costs: By choosing the right strategy, organizations can avoid unnecessary expenses and ensure a return on their cloud investment.

Future-Proof Operations: Companies can be prepared for technological advancements by adopting cloud-native solutions and architectures.

A Partner That Has Your Back

With an extensive track record of designing and implementing successful cloud migrations, OneNeck brings a wealth of experience and expertise to the table. We understand that each migration is as unique as the organization undertaking it. We emphasize a tailored approach rooted in industry best practices and hands-on experience. Our team of experts works closely with you to understand your specific needs, goals and industry requirements, crafting a migration plan that is both strategic and seamless.

To ensure a successful migration to the cloud, we conduct a Hybrid Cloud Assessment that covers all the bases, including workload analysis, bandwidth analysis, and end-user experience analysis. This assessment allows us to create a plan that aligns perfectly with your objectives.

But our role doesn’t end with the migration. We remain by your side, offering support and consolation. Whether you are on the cusp of a cloud transition or just contemplating the possibilities, we are here to guide you every step of the way.

Contact us today to explore strategies and solutions for your cloud migration journey.

It’s strange to live in a world where a cyber attack can take place deep in a data center or right in your back pocket. The breadth of the threat landscape causes increased concern for your , company’s reputation and bottom line — a breach can be lurking in the most innocent of places, like an employee email about receiving a company gift.

In 2022, the global average cost of a data breach was $4.35 million. You can no longer just set your threat protection and walk away. You must be proactive in securing your networks against potential vulnerabilities. A critical component of this approach is the implementation of a thorough vulnerability assessment and vulnerability testing.

What Is a Vulnerability Assessment?

A vulnerability assessment is the systematic testing of your computer systems to identify and prioritize as many vulnerabilities as possible. It’s a proactive way for your organization to understand weaknesses and react to cyber threats before damage is done.

Too often, you find out about security shortfalls after a breach happens. The advantage of vulnerability testing is that it enables you to find security gaps in your network and fix them before they become a problem. This proactive approach can save your company time and resources while keeping operations running smoothly.

Why You Need Vulnerability Assessment and Testing

Performing vulnerability testing is crucial to understanding your organization’s cybersecurity landscape and serves multiple critical functions in maintaining the integrity of your defense against cyber threats.

• Proactive Defense: Identifying vulnerabilities before a breach occurs lets you fix them before attackers find them.
• Compliance: Certain industries have regulations requiring regular assessments to ensure that systems safeguard sensitive data effectively.
• Reputation Protection: A commitment to Identifying and addressing vulnerabilities early instills trust with your clients and stakeholders.

4 Steps of a Vulnerability Assessment

Vulnerability assessments typically follow these four steps: plan, scan, analyze, and remediate.

1. Plan

In the planning phase, you’ll identify which assets will be assessed, including those on-premises and in the cloud, and determine the most critical systems where the most sensitive data resides. This is also when companies should review the specific requirements of their industry and regulatory standards.

2. Scan

Scanning involves using automated network tools to scan for and identify potential vulnerabilities within the defined scope. This phase can include:

• Network-based scans to identify vulnerable systems on wired or wireless networks.
• Host-based scans to identify vulnerabilities in workstations, servers, or other network hosts.
• Application scans to test to identify known software vulnerabilities and check network and web application configurations.
• Database scans to detect vulnerable points in databases.

3. Analyze

In the analysis phase, cybersecurity professionals gather the generated reports and review the results of the scans. In this step, security experts prioritize vulnerabilities based on their severity and assess the potential impact on the organization. The analysis phase is crucial for understanding which vulnerabilities pose the greatest risk and require immediate attention.

4. Remediate

Once the security gaps have been identified and prioritized, remediation involves addressing and mitigating those identified vulnerabilities. This may include patching, updating applications, reconfiguring settings, or implementing additional security tools or procedures.

Identify Your Security Gaps Now

While companies of all sizes will benefit from vulnerability testing, the fact is that many companies don’t have the resources to perform the steps needed to thoroughly examine and protect their IT systems. OneNeck IT Solutions can help in your security journey. Our vulnerability assessment, scan, and remediation services can help you identify the security gaps in your system and fix them before opportunistic attackers get in. If you need additional security services, we also offer a cost-effective virtual CISO (vCISO) service with a team of security experts to help you address all your security and compliance needs.

Don’t take chances with your IT systems. Learn more by reading about OneNeck’s cybersecurity assessments here.

In a unique twist of events in the cybersecurity world, a ransomware attacker has crossed into uncharted territory. Exploiting a new legal loophole, they reported their victim, digital lending technology vendor MeridianLink, to the U.S. Securities and Exchange Commission (SEC) for failing to promptly disclose a breach. This case marks a significant evolution in ransomware tactics. It highlights the crucial intersection of cybersecurity, legal compliance, and corporate responsibility.

The Ransomware Attack on MeridianLink

The ransomware attacker, a group known as Alphv/BlackCat, claims to have infiltrated MeridianLink’s network on November 7th, 2023, resulting in the theft of significant amounts of customer data and operational information. While MeridianLink confirmed the cybersecurity incident, the exact timeline of the breach’s discovery and reporting remains unclear. The company claims that the attack occurred on November 10^th and that the threat was quickly nullified.

MeridianLink’s official statement on the incident: “Upon discovery on the same day, we acted immediately to contain the threat and engaged a team of third-party experts to investigate the incident. Based on our investigation to date, we have identified no evidence of unauthorized access to our production platforms, and the incident has caused minimal business interruption.” The company also added that it cannot share further details due to its ongoing investigation.

Why the SEC Complaint

Since July 26th, 2023, the SEC has mandated that public companies disclose significant cyber incidents within four days. These rules went into effect in September. However, it is worth noting that the disclosure requirement takes effect on December 18th for large organizations, while smaller companies have a deadline of June 2024.

Regardless of specific dates, the intent here is clear; –add another layer of pressure on cyberattack victims to give in to the demands of their attackers and pay the requested ransoms. By filing such complaints, companies now face the possibility of bad publicity, erosion of client trust, and financial losses, as well as potential compliance and legal ramifications.

Implications for Cybersecurity and Compliance

While a cyber assailant filing a complaint to a governmental organization for an attack they are responsible for may seem a bit like an arsonist reporting a fire, this incident underscores how cybercrime is constantly evolving. Now, attackers are even leveraging legal and regulatory frameworks to their advantage. This development is a stark reminder for businesses to fortify their security defenses and remain transparent and prompt in their breach disclosure practices.

Cybersecurity and Resilience

Ultimately this incident underscores a critical lesson for all organizations: the importance of having effective cybersecurity measures and being resilient in the face of a successful attack. Further highlighted is the evolving nature of cyber threats and the need for a comprehensive cybersecurity approach that encompasses prevention and response strategies.

So, what are businesses supposed to do to meet evolving threats? Here are some key points to consider for organizations aiming to bolster cybersecurity defenses:

Proactive Cybersecurity Measures

• Regular Risk Assessments – Organizations can stay ahead of emerging threats and vulnerabilities by continuously evaluating cybersecurity risks.
• Advanced Threat Detection – Leveraging cutting-edge technologies to detect threats early is crucial in a landscape where attack methods constantly evolve.
• Employee Training and Awareness – Human error can be a significant vulnerability, empowering employees with knowledge and best practices is vital.
• Robust Data Encryption – Encrypting sensitive data is a fundamental security practice that ensures data integrity, even in the event of unauthorized access.
• Multi-Factor Authentication (MFA) – MFA is a critical layer in defense strategies, adding depth to access controls and reducing the risk of unauthorized entry.

Bridging Defense and Recovery

While proactive measures serve as the first line of defense, laying the groundwork for prevention, an organization’s resilience strategies are the contingency plans that take over when defenses are breached. This dynamic transition is crucial for maintaining operational continuity and upholding stakeholder trust through adversity.

A comprehensive cybersecurity approach embodies this transition, ensuring that threat prevention vigilance is complemented by incident response robustness. It guarantees that organizations not only deter potential breaches but bounce back with speed and efficiency, safeguarding their operational integrity when breached.

 Resilience in the Face of an Ransomware Attacks

• Incident Response Plan – A clear and actionable incident response plan is vital for quick and effective action in a breach.
• Rapid Response Team – A dedicated team ready to tackle cybersecurity incidents, with defined roles and responsibilities, is essential for minimizing damage and restoring operations swiftly.
• Communication Strategy – Effective communication during and after an incident is crucial for maintaining stakeholder trust and managing reputational risks.
• Legal and Regulatory Compliance – Understanding and adhering to legal and regulatory requirements ensures an organization’s response is effective and compliant.
• Backup and Recovery Procedures – Regular backups and robust recovery processes are the safety nets that ensure business continuity in the face of cyber adversity.

From Compliance to Confidence with OneNeck

The MeridianLink ransomware attack, coupled with the regulatory maneuverings of the attackers, exemplifies the dual threats of modern cybersecurity: technical and compliance. OneNeck is well-versed in the dynamics of both cyber threats and compliance landscapes. Our suite of cybersecurity solutions is designed to address these challenging fronts head-on.

Contact us today to fortify defenses and align your cybersecurity strategies with today’s demands. Together, we can ensure that your organization is secure, compliant, and, above all, resilient in the face of any threat.

Welcome to OneNeck’s monthly patching blog for November 2023. As your proactive partner in cybersecurity, our team is dedicated to identifying and addressing the most critical updates that can impact your IT infrastructure. Our engineers are committed to dissecting and understanding the latest vendor-released patches, ensuring that our Managed Patch Services keep your systems secure and operational.

Microsoft Security Brief

In November, Microsoft has patched 58 vulnerabilities, sorted into the following categories:

• 16 Elevation of Privilege Vulnerabilities
• 6 Security Feature Bypass Vulnerabilities
• 15 Remote Code Execution Vulnerabilities
• 6 Information Disclosure Vulnerabilities
• 5 Denial of Service Vulnerabilities
• 11 Spoofing Vulnerabilities

Notably this month, 3 zero-day vulnerabilities are currently being actively exploited.

Patching Highlights for November

These patches require your immediate attention due to their high-risk potential:

• CVE-2023-36025: Addresses a Security Feature Bypass Vulnerability in Windows SmartScreen.
• CVE-2023-36033: Fixes an Elevation of Privilege Vulnerability in the Windows DWM Core Library.
• CVE-2023-36036: Remedies an Elevation of Privilege Vulnerability in the Windows Cloud Files Mini Filter Driver.
• CVE-2023-36397: Patches a Remote Code Execution Vulnerability in Windows Pragmatic General Multicast (PGM).
• CVE-2023-36413: Corrects a Security Feature Bypass Vulnerability in Microsoft Office.

ASP.NET Core Applications Advisory

Developers utilizing ASP.NET Core 8.0 applications should be aware of the following advisory from Microsoft and take particular note of CVE-2023-36038 – an ASP.NET Core Denial of Service Vulnerability, where a remote unauthenticated user can issue specially crafted requests to a .NET application which may result in denial of service.

Linux Patching Updates

Our Unix Team has compiled an extensive list of Linux patches and vulnerabilities that demand attention this month:

• CVE-2023-3609; CVE-2023-32233; CVE-2023-35001: Patches for Red Hat Enterprise Linux 7 (Kernel), addressing critical security issues and enhancing system stability.
• CVE-2023-3341: Linux security update for BIND, crucial for maintaining domain name system integrity.
• CVE-2023-5721; CVE-2023-5724; CVE-2023-5725; CVE-2023-5728; CVE-2023-5730; CVE-2023-5732; CVE-2023-44488: A series of vital Firefox updates, reinforcing browser security and addressing various vulnerabilities.
• CVE-2023-40217: An important update for Python 3.x, enhancing security features and fixing vulnerabilities.
• CVE-2023-5217; CVE-2023-44488: For libvpx, focusing on addressing security concerns in this multimedia library.
• CVE-2023-44487: An update for nghttp, ensuring robustness against potential network protocol vulnerabilities.
• CVE-2023-38545; CVE-2023-38546: Bolsters security features for curl.
• CVE-2023-0567; CVE-2023-0568; CVE-2023-0662; CVE-2023-3247; CVE-2023-3823; CVE-2023-3824: Updates for PHP, addressing various security issues to ensure script integrity and system safety.
• CVE-2023-44487: Addresses security vulnerabilities and enhances web server protection within Tomcat.
• CVE-2022-0934: Ensures DNS forwarding and DHCP server stability within dnsmasq.
• CVE-2021-40211: A security update for ImageMagick, crucial for maintaining security in image processing tasks.
• CVE-2023-3609; CVE-2023-35001; CVE-2023-32233: Key patches for Oracle Linux 7 (Kernel 3.10), focusing on kernel vulnerabilities and system enhancements.
• CVE-2022-34918; CVE-2023-2513; CVE-2023-4387; CVE-2023-22024; CVE-2023-3772; CVE-2023-35001; CVE-2023-4206; CVE-2023-3611; CVE-2023-4459; CVE-2023-3776: For Oracle Linux 7 (Kernel 4.1.12), targeting various kernel security issues.
• CVE-2023-42753; CVE-2023-22024: Oracle Linux 7 (Kernel 4.14) patches, enhancing kernel protection and stability.
• CVE-2023-20588; CVE-2023-5090; CVE-2023-20569; CVE-2023-42753; CVE-2023-22024: Regarding Oracle Linux 7 (Kernel 5.4), focusing on kernel security and functionality improvements.

Microsoft Office and Exchange Updates

Please note that OneNeck does not patch Microsoft Office products during scheduled patching. We recommend customers apply Microsoft Office updates immediately. If you have questions about how our team can assist you within in your Microsoft environment, contact our Service Desk.

Exchange

For Exchange, we continue to recommend upgrading to Exchange Server 2019 and remind you that we’re here to apply necessary Exchange Security Updates for managed clients.

TLS 1.0 and TLS 1.1 Disabling Updates

Updates disabling TLS 1.0 and TLS 1.1 are on the horizon. Ensure you prepare your environment for these changes to maintain application functionality. For more information, visit Microsoft’s post on the timeline and process of these updates.

November Patching Cycle

As November’s patching cycle concludes, we invite you to remain engaged for next month’s updates. Keeping your systems up-to-date is more than a best practice—it’s necessary. Our team is ready to assist if you have any questions or need support.

Stay secure and stay patched!

Each month, OneNeck engineers review newly released updates from vendors, like Microsoft, to understand any known issues, actions required and understand the priority of each. This is done immediately following Patch Tuesday releases, and we monitor for adjustments to patches throughout each month.

The information above is gathered monthly during this review and posted for awareness to our customers. This information is generally updated only once per month and is based on our engineers’ review of the information provided by the vendor at that time. As always, for the most up-to-date patching information, please see the vendor’s website or contact us.

Note: If OneNeck actively manages a device or software that is impacted by any of these vulnerabilities, when necessary, OneNeck will be in direct contact with you regarding remediation.

Cybersecurity Maturity Model Certification (CMMC) is a security framework created by the U.S. Department of Defense (DoD) to ensure companies prove their information security protocols are robust and mature enough to protect sensitive DoD data known as Controlled Unclassified Information (CUI). Understanding this framework and achieving organizational certification is an important step to winning deals and contracts.

Introduction to CMMC

What does CMMC mean?

The acronym CMMC stands for Cybersecurity Maturity Model Certification. By tying together several leading cybersecurity standards into five maturity levels ranging from basic to advanced, the CMMC program provides a verifiable roadmap for improving your organization’s security posture. To get certified, your organization must meet the criteria of at least the first level of certification.

Purpose and Goals of CMMC Certification

The goal of the CMMC certification is to deter uncontrolled access and possible misuse of crucial defense industry information residing outside the controlled federal systems. It intends to offer greater assurance to DoD that a contractor can adequately protect sensitive unclassified information at a level commensurate with your risk. Obtaining your certification establishes your firm as a reliable, diligent entity committed to cybersecurity.

CMMC Maturity Levels

CMMC 2.0—the most recent iteration of the model—has three levels of maturity that are applicable depending on the kind of information your company stores and the type of work it does. Each has its own list of requirements that build upon the level before it.

Level 1

At this initial stage, the focus is on implementing basic security measures. It includes 17 different practices that ensure companies are protecting Federal Contract Information (FCI).

Level 2

To achieve the second level, organizations must meet another 48 safeguards by embracing universally accepted best practices while incorporating relevant protective measures on Controlled Unclassified Information (CUI).

Level 3

Level 3 maturity means a company has good cyber hygiene or the satisfactory application of all NIST SP 800-171 Rev.1 guidelines along with an additional seven other controls totaling up to a sum of 130 required practices.

Preparation Steps for Cybersecurity Maturity Model Certification

So, what does it take to get you prepared to be CMMC certified? Working towards your Cybersecurity Maturity Model Certification (CMMC) will be much easier if you follow these pivotal steps to ensure you have all your ducks in a row.

1.   Determine Your CMMC Level and Scope

Determining the appropriate CMMC level for certification involves a careful assessment of your organization’s specific circumstances, cybersecurity risks and the requirements of your contracts or projects with the DoD. Review your DoD contracts and project specifications to understand what level you need and what its requirements are. From there, determine the types of data and assets your organization will handle or have access to during DoD projects.

2.   Run a Cybersecurity Practices Gap Analysis

Test current cybersecurity measures against the standard CMMC framework using a gap analysis template or similar digital tool. Pinpoint unmet practices or processes across domains like access control, asset management and incident response. Document the gaps and discuss the actions that must be taken to address them.

3.   Build a System Security Plan

A system security plan (SSP) is effectively a high-level blueprint of your program where you clearly outline how cyber safeguards are implemented universe-wide in compliance with defined CMMC 2.0 requirements. You likely already have one in place — the next step is to update it with the information you uncovered in step two. If you don’t already have an SSP, you’ll need to build one.

4.   Engage a Trusted Partner

Engaging a trusted partner can spell the difference between a smooth certification and one with lots of avoidable pitfalls. Selecting a trusted CMMC third-party assessment organization (C3PAO) familiar with both best practices and potential loopholes within your specific industry sector makes sense. This partner-ally can run cybersecurity assessments, gap analyses and ensure you and your team fully understand the expectations and requirements of certification.

The Support You Need to Get Certified

OneNeck’s security assessments are executed by a team of experts who stay on top of evolving threats, changing regulations and best practices. We help you cover all the bases so you can understand your current state, see how it measures up against the CMMC framework and take the necessary steps to get certified.

Contact us for a security assessment consultation.

The threat of cyber breaches looms larger than ever before. These incidents are not just occasional blips; they have become a persistent part of online existence. Last year, there were over 1800 reported breaches affected over 400 million people, with no signs of slowing down. This reality underscores the critical need for robust preparedness and comprehensive knowledge of cybersecurity practices. Every day presents new challenges and potential threats, making it imperative for organizations to stay vigilant and proactive in their defense strategies. It’s not about if a breach will happen, but when—and how well you can respond and recover.

The Power of Preparation: Incident Response Plans

Imagine the moment you detect a breach. Your immediate instinct might be panic, but with a robust Incident Response Plan, you can ensure a swift and organized response.

Isolating affected systems is one of the first and most crucial steps. This action helps to prevent the further spread of malware or potential data leaks. It’s akin to stopping a water leak before flooding your house. You can minimize the damage and start the recovery process by acting swiftly.

But an IRP isn’t just about immediate actions. It also covers assessing the breach’s impact, communication strategies, and post-incident reviews. It’s a comprehensive approach that looks at the incident from all angles, ensuring nothing is overlooked.

Preparation truly is the key. In the face of a cyber incident, having a plan ready to activate can be the difference between a minor hiccup and a major catastrophe. It’s the difference between feeling lost and having a clear direction. In cybersecurity, where every second counts, an Incident Response Plan is your best ally.

Maintaining Trust: The Role of Communication in Cyber Incidents

In the aftermath of a cyber breach, communication becomes a pivotal front in maintaining trust. The way an organization handles information sharing can significantly influence its reputation and the trust it has built.

Internally, it’s crucial to keep staff informed. This transparency ensures that employees, from the C-suite to the frontline, understand the breach’s implications and the remedial actions underway. This clarity prevents the spread of confusion and aligns the team’s response efforts.

Externally, the need for openness is even more critical. Customers and partners who have entrusted their data to the organization deserve to know the breach’s impact. Transparency with these stakeholders and, when necessary, the media is fundamental to maintaining the organization’s integrity. Timely and forthright communication helps manage public perception, ensuring the breach does not permanently damage the organization’s image.

Damage Control: Assessing and Recovering from a Breach

After addressing the immediate threats of a cyber breach, organizations must turn to a meticulous investigation of the incident. Like detectives reconstructing the events at a crime scene, they must identify the breach’s nature, scope and origin. Key steps include:

• Conducting a Forensic Analysis – Tracing the attack’s pathways to assess the extent of the infiltration. This helps determine if the breach was a targeted attack or a random malware strike, which is crucial for crafting an effective defense strategy.
• Identifying the Breach’s Source – Determining whether it was an external attack, an internal oversight, or a combination of factors. Pinpointing the cause is essential to prevent similar incidents in the future.
• Assessing the Compromised Data – Understanding the type of data compromised to dictate the recovery strategy. The response might range from notifying affected parties to enhancing security protocols, depending on whether sensitive customer information or operational data was involved.

Navigating the Aftermath of a Breach: Technical Recovery and Legal Obligations

One of the most effective preventive measures against cyber threats is ensuring that systems are continuously updated. Every software update often comes with patches that address known vulnerabilities. By neglecting these updates, organizations leave their doors open to cybercriminals always looking for such weaknesses.

But what happens when cybersecurity preventions fail? That’s where backups and disaster recovery come into play. Think of backups as safety nets, ready to catch you when you fall. In the unfortunate event of data loss due to a breach, having a recent backup and an effective disaster recovery plan means you can restore your systems to their pre-breach state with minimal downtime. This swift restoration minimizes operational disruptions and helps maintain trust with stakeholders who expect uninterrupted service.

However, the aftermath of a breach isn’t just about technical recovery. There’s a legal landscape to navigate. Different regions have varying data protection laws, many of which mandate timely notifications to affected parties in the event of a data breach. Non-compliance can result in hefty fines and further reputational damage. Thus, being aware of and compliant with these regulations is not a mere formality; it’s an integral part of post-breach management.

Learning from a Breach: Training and Review

When the dust settles, stepping back and analyzing the incident is essential. What vulnerabilities were exploited? Were there any lapses in protocol or human errors? Answering these questions provides a roadmap for strengthening cybersecurity measures.

However, technical safeguards are just one piece of the puzzle. Human error remains one of the most significant vulnerabilities in any security system. Continuous employee training is crucial. Regular training sessions ensure that staff are aware of the latest threats and equipped with the knowledge to counteract them. From phishing scams to sophisticated malware attacks, employees should be the first line of defense, not the weakest link.

Moreover, cybersecurity training should not be a one-off event. Regular updates, refresher courses and drills can help ingrain security best practices in the organizational culture.

While technology provides the means to combat cyber threats, your employees wield these tools. Investing in their training and fostering a culture of security awareness ensures that they’re always ready, vigilant, and proactive in the face of potential breaches.

Fortify Your Organization Against a Breach

OneNeck is more than just a vendor; we’re your cybersecurity partner. Whether you are looking to strengthen your overall security posture, utilize cost-effective vCISO services, conduct comprehensive security assessments, ensure timely patching or empowering your team with top-notch training, we’re here to help. Our expertise and commitment ensure that you’re prepared for today’s threats and the challenges of tomorrow.

Don’t wait for a breach to reveal the gaps in your cyber-defenses. Contact us today, and let’s work together to build a resilient and robust security framework for your organization.

Whether you’re a small startup or a multinational corporation, the way you manage and maintain your network can significantly impact your operations, security and overall efficiency—especially when you’ve got bandwidth-hungry applications to handle and a growing number of devices connecting to your network. Managed network services enable businesses to alleviate routine tasks and focus on strategic initiatives. With a managed network services provider, you can delegate these mundane responsibilities and concentrate on building an IT infrastructure that fuels business growth.

What are Managed Network Services?

A managed network is a communication network overseen and maintained by a specialized third party known as a Managed Service Provider (MSP). With an MSP partnership, businesses engage a third party to handle basic IT operations, including managing complex networking environments, troubleshooting, improving performance levels and operating system maintenance—tasks that were traditionally handled by in-house IT staff.

How do Managed Network Services Differ from Traditional In-house Services?

Managed and traditional in-house services have notable distinctions that make them suitable for different types of businesses.

• Ownership and Responsibility—In a managed network, the organization outsources the responsibility for network management to a third-party provider. In a traditional network, the organization is responsible for all aspects of its design, implementation, management and maintenance.
• Proactive vs Reactive—Managed network providers actively monitor network performance to anticipate issues before they arise. In contrast, traditional network management is often reactive due to time and resource constraints.
• Scalability—Managed service providers (MSPs) can quickly adjust resources to accommodate changing business needs. Scaling a traditional network often involves procuring and configuring additional hardware at a significant cost in time and money.
• Cost Structure—In a managed network, the organization pays a recurring fee to the managed service provider, simplifying budgeting. Costs for a traditional infrastructure include hardware and software, as well as staff salaries, training and maintenance.

Choosing a Managed Network Service Provider

Choosing a managed network service provider is an important decision. You want to find a trusted partner capable of managing the entire network infrastructure that your internal teams rely upon daily.

Here are some factors to pay attention to when selecting the right managed network solution provider for your business.

Company Reputation and Track Record

A provider’s track record of handling diverse challenges is a strong indicator of their expertise. Select an MSP that has had its mettle tested. One who is adept at overcoming various obstacles is likely better equipped to handle unforeseen issues with your network. A thorough evaluation of customer reviews, case studies and LinkedIn profiles can provide valuable insights into the experience of each potential partner.

Technical Expertise

This might be obvious, but it still needs to be said: Choose an MSP that does more than monitoring and device management. Your provider’s services should align with your long-term initiatives and deliver integrated security intelligence that aligns with IT infrastructure and back-end technology. To avoid the future cost of technology changes, make sure your MSP can protect your existing investments by requesting a list of platforms the provider is certified to manage.

Customizability of services

Every organization has unique network requirements based on its industry, size, operations and objectives. Look for providers that offer a wide range of services, provide multiple service levels, give you the ability to mix and match and have prepackaged offerings. This kind of customizability allows you to pay for the services and features you actually need, rather than being locked into a fixed package that may not be applicable to your needs.

OneNeck Delivers Customized, Comprehensive Managed Network Services

Choosing managed network services enables businesses of all sizes to secure their digital assets by leveraging new technology and experienced IT professionals.

With industry-leading technology, OneNeck delivers operational excellence and compliance through rigorous, flexible and accessible network management services. Contact us to learn more about our managed security services.

The “as a Service” model has undoubtedly transformed the way businesses operate. From Software as a Service (SaaS) to Infrastructure as a Service (IaaS) and Platform as a Service (PaaS), these models have been instrumental in streamlining operations and promoting innovation. Yet, lurking in the digital shadows is a more sinister iteration of this model— Cybercrime as a Service (CaaS).

Advent of CaaS: Democratizing Cybercrime

The introduction of CaaS marked a pivotal moment in the evolution of cyber threats. This model transformed cybercrime from isolated acts of digital mischief into a structured and scalable service. With CaaS, cybercrime is no longer confined to the tech-savvy elite. Instead, it became a marketplace where malicious tools, infrastructure, and services are readily available for purchase or rent.

CaaS platforms offer a range of services, from ransomware toolkits to botnets for rent, making it alarmingly simple for individuals with limited technical knowledge to launch sophisticated cyberattacks. This shift not only increased the volume of cyberattacks (an attack every 39 seconds) but also their complexity and impact.

The primary driver behind CaaS is profit. By commodifying cybercriminal tools and services, CaaS providers have tapped into a lucrative market, catering to a growing clientele of aspiring cybercriminals. This commercial approach has led to a surge in cybercrime activities as attacks become more accessible to a broader audience.

In essence, CaaS has streamlined and professionalized the world of cybercrime. What was once a domain of individual hackers has now morphed into an organized, service-driven industry with revenue streams, customer bases and even customer support.

The Dark Web’s Marketplace

At its core, CaaS provides a platform where individuals or groups with malicious intent can offer cybercriminal tools, infrastructure, and services to other criminals for a fee. This model has dramatically democratized the world of cybercrime. Previously, launching a sophisticated cyberattack required considerable technical expertise. Now, thanks to CaaS, even those with limited technical knowledge can orchestrate advanced cyberattacks.

Cybercrime as a Service offers an array of malicious tools and services. Here’s a closer look at some of the primary offerings:

• Ransomware as a Service – This service provides clients with ready-made ransomware toolkits. These toolkits encrypt a victim’s data and demand a ransom for its release, turning digital assets into hostages for extortion activities.
• Exploit as a Service – These are specialized tools for targeted malware campaigns. They exploit known vulnerabilities in software and systems, allowing cybercriminals to infiltrate and compromise targeted devices or networks.
• Phishing as a Service – This service delivers comprehensive phishing campaigns, often mimicking legitimate entities, to deceive individuals into revealing sensitive information. These campaigns steal data such as login credentials, credit card numbers, and other personal information.
• DDoS-for-Hire – Distributed denial-of-service (DDoS) attacks are a common form of cyber-attack that overwhelms targeted websites or networks by flooding them with an excessive amount of traffic.
• Botnets for Rent – This service offers networks of infected computers, known as ‘zombies,’ available for lease. Hackers can utilize these extensive networks to distribute spam emails, mine cryptocurrencies, or launch DDoS attacks to overwhelm targeted websites.

Economic Impact of CaaS

The rise of Cybercrime as a Service has brought about profound financial implications. The commodification of cybercriminal tools and services has not only democratized the world of cybercrime but has also turned it into a highly profitable venture. According to a report from AtlasVPN, the annual revenue generated from CaaS activities is estimated to exceed $1.6 billion.

This booming segment of the cybercrime ecosystem is not without its consequences. The ease of access to malicious tools and services has led to a sharp increase in cybercrime incidents. For businesses, this means not only direct financial losses from attacks (predicted to reach $10.5 trillion by 2025) but also potential reputational damage, which can have long-lasting effects on customer trust and brand value. Individuals also find themselves at heightened risk, facing threats to personal data and financial assets. The economic shadow cast by CaaS is vast, affecting entities ranging from large corporations to everyday internet users.

Defending Against the CaaS Threat

The commercialization and accessibility of cybercrime tools mean that threats can come from any direction and at any time. To effectively counter these threats and safeguard their digital assets, businesses need to adopt a holistic approach to cybersecurity. Combatting the menace of Cybercrime as a Service requires a comprehensive and multi-faceted approach:

• Proactive Defense – Organizations must cultivate a culture of proactive cybersecurity measures and accountability.
• Collaborative Engagement – It’s essential to coordinate with industry associations, law enforcement, and the broader cybersecurity community to form a united front against cyber threats.
• Continuous Learning – By analyzing past security incidents, organizations can learn, adapt, and bolster their defense mechanisms. Additionally, training employees to be aware of threats and how to respond appropriately is critical.
• Advanced Security Measures – Employing cutting-edge security solutions ensures real-time monitoring, swift threat detection, and rapid response.

One particularly effective way for organizations to combat the onslaught of attacks generated through CaaS is by deploying Managed Detection and Response (MDR). MDR combines sophisticated technology alongside artificial and human intelligence to continuously monitor your systems for threats and mitigate incidents. This security solution helps discover and intercept attacks before significant damage occurs. 

Strengthening Defenses Against Security Threats

The escalating threat of Cybercrime as a Service underscores the importance of organizations to be proactive and well-prepared. Seeking expert guidance and forming strategic partnerships can make all the difference. OneNeck offers a comprehensive suite of security solutions tailored to address the challenges of today’s cyberattacks, including those generated by CaaS. By aligning with trusted partners like OneNeck, organizations can bolster their defenses, ensuring a secure and resilient digital environment in the face of these evolving threats.

Don’t wait for a breach to happen. Contact our security experts today.

Choosing the appropriate virtualization deployment model can make a world of difference for your environment. However, deciding between containers vs virtual machines isn’t always clear-cut. They each have strengths and weaknesses, depending on your operating environment.

What is a Virtual Machine (VM)?

Choosing the appropriate virtualization deployment model can significantly impact your environment. VMs can run multiple instances of operating systems on a single physical machine. They can also store data, connect to networks, and perform other computing functions.

VMs exist independently of one another yet share the same hardware resources such as CPU power or storage space. You can run multiple “virtual computers” on a single physical computer. Each VM behaves like a separate, isolated computer, so you can run different operating systems or software on each VM without them interfering with each other.

Pros and Cons of VMs

VMs have advantages and disadvantages that can vary depending on the specific use case and needs. Here are some of the pros of VMs:

1. Isolation: VMs provide isolation between different virtual machines, so if one VM crashes or has security issues, it doesn’t affect other VMs running on the same physical host.
2. Resource Allocation: VMs allow efficient distribution of computing resources, such as specific amounts of CPU, memory, and storage so each VM can operate effectively.
3. Versatility: VMs enable you to run multiple operating systems and applications on a single physical host. This is useful for testing, development, or running applications that require different environments.

Some cons of VMs include:

1. Increased Resource Usage: Because they run complete operating systems—which load up entirely separate instances of binaries, libraries and system resources—VM resource usage is naturally higher.
2. Slow Performance: VMs install an entire OS for each instance, making them resource-heavy and slow to spin up.
3. Limited Scalability: A single server can only support a limited number of VMs, limiting the scalability of VMs in response to dynamic traffic conditions.

What are Containers?

A container is a package of software that contains the necessary elements to run applications in any environment. By sharing the host system’s OS kernel instead of requiring its own OS, containers are compact and can run in a private data center, the public cloud, on a developer’s personal laptop or anywhere you need it.

Pros and Cons of Containers

Here are some of the pros of containers:

1. Resource Efficiency: Containers use fewer compute resources than traditional virtual machines by leveraging shared operating systems.
2. Scalability: Servers can run more containers with the same amount of resources, and applications are easier to scale based on demand.
3. Rapid Deployment: Containers can be created and launched quickly to meet demand.
4. Cloud Compatible: The flexibility of containers makes them ideal for deploying in the cloud.

Cons of containers include:

1. Limited OS Support: Containers typically rely on a Linux kernel, so they may not be as suitable for applications that require specific operating systems, like Windows.
2. Security Risks: Misconfigured containers or vulnerabilities in the container runtime can pose security risks and endanger your organization.
3. Learning Curve: Deploying containers to automatically provision, scale and manage containerized applications can be challenging for organizations and individuals who are new to these technologies.

Which Option is Better for You?

When it comes to the debate about container vs VM, both have unique characteristics and advantages, depending on your unique situation.

Virtual machiness are easy to create and support various OS options, making them suitable for developers. They also provide a layer of security by keeping instances isolated. However, VMs use more resources — companies with budget to allocate to additional computing power will be well-suited to VMs.

Containers operate well in a cloud environment, are flexible and portable and can easily scale horizontally. They consume fewer resources and are faster to deploy. However, due to their shared resources, they are more vulnerable to cyber-attacks and require robust protection. Companies that are confident in their cybersecurity posture, defense strategy and disaster recovery plan can benefit most from the flexibility and scalability of containers.

Your organization’s virtualization strategy will depend largely on your business needs and infrastructure. Whether you land on the VM, container or combination side of the container vs VM debate, it’s essential to protect your network from attacks.

OneNeck has partnered with Fortra’s Alert Logic to offer Managed Detection and Response (MDR). By combining our teams of round-the-clock security experts with Fortra’s Alert Logic’s award-winning SaaS security platform and continuous threat research and analytics. Learn more about Always-on Support with MDR from OneNeck and Alert Logic by reading the brochure here.

Are your containers secure? OneNeck has partnered with Alert Logic to offer top-notch intrusion detection for containers. Explore our specialized offering and fortify your container security.

Names, often the first point of interaction, play a crucial role in setting expectations and understanding the crux of a product. Recognizing this, Microsoft announced a significant shift for one of its cornerstone services. As of October, Azure Active Directory (Azure AD), known and utilized by organizations worldwide, has officially transitioned to its new identity as Microsoft Entra ID.

Why the Change from Azure AD to Microsoft Entra ID?

Microsoft’s shift from Azure Active Directory® to Microsoft Entra ID® highlights its commitment to adaptability in a world where businesses use multiple cloud services and platforms. The new name, Microsoft Entra ID, clarifies that this tool is designed for easy identity management across different systems and platforms.

Additionally, the term “Active Directory” has often been linked with Windows Server Active Directory. By introducing “Entra ID,” Microsoft draws a clear line between its cloud-based identity service and the traditional on-premises system. This change also aligns with Microsoft’s goal to unify its product range under the Microsoft Entra banner, ensuring users’ consistent and straightforward experience.

Source: Microsoft

What Does This Mean for Current Users?

For those already using Azure AD or in the process of deploying it, there’s good news:

• No Interruptions: Your Azure AD will continue to function as usual. All configurations, deployments, and integrations remain unaffected.
• Familiar Features: You can access all the Azure AD features through the Azure portal, Microsoft 365 admin center, and now, the Microsoft Entra admin center.
• Consistent Licensing & Pricing: There are no changes to licensing, terms, service-level agreements, product certifications, support, or pricing.

Transitioning Smoothly from Azure AD to Microsoft Entra ID

Understanding the potential challenges and concerns that come with such a significant change, Microsoft has attempted to minimize disruption for its users, aiming to provide continuity and consistency, even as it introduced a new identity for a familiar product. A couple of things to note for this transition:

• Consistency in Tools: Login URLs, APIs, PowerShell cmdlets, and Microsoft Authentication Libraries (MSAL) that businesses and developers rely on remained unchanged, ensuring no disruptions to existing workflows.
• Updated Service Plans: As of October 1, 2023, users will have noticed changes in the display names for service plans. For instance, what was once known as Azure AD Free is now called Microsoft Entra ID Free.

What’s in a Name?

Names in the tech world are often more than just labels. As Microsoft transitioned from Azure Active Directory to Microsoft Entra ID, it was crucial to ensure that while the branding evolved, the underlying essence and the value it offers to users remained constant. This consistency means that even with the new nomenclature, users can expect the same robust features and functionalities they’ve grown accustomed to. For instance:

• Consistent Access Control: What was previously known as “Azure AD Conditional Access” has transitioned to “Microsoft Entra Conditional Access,” continuing to offer users granular control over who has access to what.
• Seamless Sign-On Experience: The “Azure AD single sign-on” feature, which provides users with a frictionless login experience across applications, is now branded as “Microsoft Entra single sign-on.”

It’s important to note that although many names have been changed, specific terminologies have been retained for clarity and continuity. Terms like Active Directory, developer tools, and Azure AD B2C continue to hold their original names, ensuring familiarity for long-time users.

The Bigger Picture for Microsoft Entra ID

Microsoft’s decision to rename Azure Active Directory to Microsoft Entra ID is more than just a rebranding; it reflects a broader attempt to make technology more accessible and secure for all users in the Modern Workplace

• Embracing Multicloud and Multiplatform: As businesses diversify their tech stacks, using services from various providers and platforms, there’s a growing need for solutions that can effortlessly bridge these different environments. Microsoft Entra ID is designed with this in mind, offering robust multicloud and multiplatform functionalities that ensure seamless identity management, no matter where your services are hosted.
• Clear Distinction from Traditional Systems: For many, the term “Active Directory” is synonymous with the on-premises identity solutions of yesteryears. With the introduction of “Entra ID,” Microsoft is signaling a clear departure from these traditional systems, emphasizing its cloud-first approach and the advantages that come with it.
• Simplified Secure Access: With threats to digital security becoming increasingly sophisticated, there’s a pressing need for tools that offer robust protection without adding complexity. Microsoft Entra ID is a step in this direction, streamlining protective identity and network access processes making them more intuitive and user-friendly.

Partner with OneNeck

As you navigate these changes, remember you’re not alone. OneNeck, as an experienced Microsoft CSP and Solutions Partner, is here to guide and support you every step of the way. Whether you’re seeking insights on the new functionalities or an in-depth Entra ID Assessment, our team is ready to assist. Let us help you harness the full potential of Microsoft Entra ID and ensure a seamless transition for your organization.

Contact us today and take the next step in your digital transformation journey.

Cyberattacks during wartime have become a potent weapon, affecting the warring nations and regular citizens worldwide. Such shifts in cyber threats highlight the interconnected nature of our digital world, where geopolitical events in one region can have digital repercussions across the globe. A recent example underscores this global reach: the Israel-Hamas conflict has increased cyber threats even in seemingly unrelated countries like Australia. With this evolving landscape of digital warfare, it’s crucial to understand the various cyberattacks that emerge during conflicts and their potential impacts.

DoS Attacks: More Than Just Wartime Cyberattacks

Denial of Service (DoS) attacks aim to incapacitate systems vital for offensive and defensive measures. By targeting infrastructure and applications that fortify and defend, attackers can effectively blind these systems, potentially masking a physical assault. Critical systems, whether for gathering intelligence, executing attacks, or facilitating communication, can be interrupted, severely limiting or preventing retaliation. Within hours of Hamas rockets entering Israel, DoS attacks started to spring up on Palestinian and Israeli sites, including nearly 3 dozen directed at Israeli government pages.

While the average individual might not directly encounter these cyberattacks, the implications for businesses are profound. Software and hardware companies supplying defense contracts should be proactive, anticipating the need for patching vulnerabilities and assisting in recovery and restoration efforts. Alarmingly, attackers might even compromise these defense-related companies well before conflicts arise, scouting for weaknesses to exploit.

Propaganda and False Information: Manipulating the Masses

In the age of information, controlling the narrative is a powerful tool. The compromise of news websites, especially during conflict, can significantly sway public perception. With awareness of this power, attackers employ various tactics to manipulate the masses. By attempting to swing the narrative in their favor, they can elicit support for a different side or even exaggerate the gravity of situations to create panic or confusion. This deception is not just about spreading false information but crafting a storyline that serves their agenda.

Unless you’re directly involved in the security of these news organizations, you’re likely a consumer of the information they provide. In such a scenario, how do you discern fact from fiction? The key lies in diversification. It’s crucial to cross-reference information, seeking out multiple sources before placing trust in a single outlet. Doing so gives you a more holistic view of events and safeguards yourself against falling prey to one-sided narratives.

Moreover, in this era of digital news, consider revisiting traditional forms of journalism, such as newspapers and magazines, which often undergo rigorous editorial processes.

Deep Fakes & AI: The New Face of Deception

With advancements in deep fake technology and AI, it’s become alarmingly easy to fabricate convincing audio and video. Deep fake technology uses advanced machine learning algorithms to craft realistic yet entirely fabricated content. The possibilities are endless and frightening, from altering speeches to manipulating facial expressions. Imagine a scenario where a video surfaces online showing a nation’s leader declaring war, admitting to crimes or even expressing sympathy for the opposition.

But it’s not just about political figures. Ordinary citizens can also become targets. From creating defamatory content to blackmail, the personal repercussions of deep fakes can be devastating.

In a world where seeing once meant believing, we now find ourselves questioning the authenticity of everything we view.

So, how can one navigate this treacherous digital landscape?

• Consider the source. Is the content coming from a reputable outlet?
• Look for corroborating evidence. Are other trusted sources reporting the same news?
• Stay informed. Tools and platforms that detect deep fakes are also emerging and can offer additional protection.

Phishing & Financial Scams: Exploiting the Heartstrings During Wartime

War, with its devastating images and heart-wrenching stories, naturally evokes a strong emotional response. Always looking for vulnerabilities, scammers recognize this emotional state as an opportunity. Malicious actors deceive people by pretending to be charitable organizations or creating stories of suffering and need.

You might receive an email detailing the plight of war victims, complete with poignant images and a call to action. Or a message on social media from a seemingly reputable organization urging immediate donations to help those in need. While the instinct to help is commendable, pausing and evaluating is crucial. With awareness and caution, one can avoid falling into these traps.

Before making any donations, always verify the legitimacy of the organization. It is important to take simple steps such as checking official websites, reading reviews, and examining an organization’s records. Be especially wary of unsolicited requests for funds, no matter how genuine they seem. Remember, legitimate organizations rarely, if ever, resort to aggressive or emotionally manipulative tactics.

Supply Chain Interruption: The Global Domino Effect

Disrupting the supply chain can deliver a significant advantage in wartime. Whether it’s the agricultural sector ensuring food supplies, the energy sector providing fuel, or the industries engaged in arms manufacturing and defense technology, no area is immune. The objective is clear: weaken the opposition by cutting off resources.

However, the ramifications of such attacks extend far beyond the immediate conflict. In our interconnected global economy, disruptions in one region can ripple across industries, economies and livelihoods worldwide. For instance, a cyberattack on an oil refinery could lead to fuel shortages, escalating prices and transportation disruptions across continents.

For global citizens and businesses, this presents a dual threat. On the one hand, there’s the direct risk of being targeted in cyberattacks aimed at weakening specific supply chain elements. On the other, there’s the indirect impact. As supply chains falter, essential commodities can become scarce, leading to increased living costs, shortages of items and even socio-economic unrest.

Navigating this complex scenario requires a multi-faceted approach. Governments and industries must collaborate to fortify their digital and physical infrastructures. Regular audits, cybersecurity training, and international cooperation can help mitigate risks. It’s a wake-up call for individuals to understand the vulnerabilities inherent in our globalized system. Being informed, prepared and adaptable can help reduce supply chain challenges.

Wartime Cyberattacks: Safeguarding Yourself with a Trusted Partner

The digital warfare landscape is vast and ever-evolving, impacting not just nations in conflict but resonating globally. Economies, societies, businesses and individual lives are intertwined, making the consequences of digital threats far-reaching. As we move forward, we must recognize the magnitude of these challenges and the importance of staying informed.

Awareness, vigilance, and proactive measures are not just buzzwords; they are necessities in this digital age. By understanding the threats and taking timely actions, we can safeguard our digital assets and ensure a more secure future for all.

OneNeck offers cutting-edge cybersecurity solutions tailored to your needs. Having a trusted partner can make all the difference in challenging times.

Contact us today for a comprehensive cybersecurity assessment and fortify your digital defenses.

 Welcome to OneNeck’s monthly patching blog for October 2023. As your steadfast partner in IT security, our mission is to spotlight pivotal updates crucial to maintaining the integrity of your systems. Our dedicated engineers delve deep every month to dissect vendor-released patches, determining their ramifications and guiding necessary actions for our clientele. With OneNeck’s Managed Patch Services, you can rest easy, confident that your systems remain secure, safeguarded, and current.

Key Patching Takeaways for October:

This month, Microsoft addressed a total of 104 flaws. These vulnerabilities are categorized as follows:

• 26 Elevation of Privilege Vulnerabilities
• 3 Security Feature Bypass Vulnerabilities
• 45 Remote Code Execution Vulnerabilities
• 12 Information Disclosure Vulnerabilities
• 17 Denial of Service Vulnerabilities
• 1 Spoofing Vulnerabilities

It’s worth noting that three of these vulnerabilities are zero-day—vulnerabilities known to malicious entities and potentially already being exploited.

Highlighted Patches for the Month:

Given their significant security implications, the following patches necessitate immediate attention:

• CVE-2023-41763: Skype for Business – Elevation of Privilege Vulnerability. Here, An attacker could make a specially crafted network call to the target Skype for Business server, which causes the parsing of an HTTP request to an arbitrary address and potentially disclose IP addresses, port numbers or both to the attacker.
• CVE-2023-36563: Microsoft WordPad – Information Disclosure Vulnerability. Exploiting this vulnerability could allow the disclosure of NTLM hashes.
• CVE-2023-35349: Microsoft Message Queuing – Remote Code Execution Vulnerability. Successful exploitation of this vulnerability could allow an unauthenticated attacker to execute code on the target server remotely.

Important Patching Update from Our Unix Team

For October, a series of significant Unix patches have been released. This month, our team breaks down the following patches:

• CVE-2020-22219: Important – Security Update for FLAC. This vulnerability addresses potential code execution flaws related to FLAC audio file parsing.
• CVE-2022-40982, CVE-2023-22024, CVE-2023-3106, CVE-2023-3567, CVE-2023-42753: Important – Oracle Unbreakable Enterprise kernel security updates. These patches target vulnerabilities that could lead to unauthorized system access, data leaks, or disruptions in Oracle’s enterprise kernel services.
• CVE-2023-20593 & CVE-2023-4004: Important – Oracle Linux kernel security and enhancement updates. These patches mitigate vulnerabilities in the Oracle Linux kernel, focusing on improving system stability and preventing potential privilege escalations.
• CVE-2023-20900: Important – open-vm-tools security update. A patch to address potential risks associated with VMware tools, granting a malicious actor Guest Operation Privileges
• CVE-2023-35001 & CVE-2023-35788: Important – Kernel security bug fixes and enhancement updates. These patches correct vulnerabilities in the Unix kernel that allow an out-of-bounds write in the flower classifier code that could result in denial of service or privilege escalation.
• CVE-2023-4580 & CVE-2023-4585: Important – Firefox security updates where Push notifications stored on disk in private browsing mode were not encrypted, potentially allowing the leak of sensitive information.
• CVE-2023-4863: Important – A security update for libwebp that allows a remote attacker to perform an out-of-bounds memory write via a crafted HTML page.

Microsoft Office Updates:

OneNeck does not patch Microsoft Office products during scheduled patching. We recommend all customers take the necessary action to apply Microsoft Office updates to their environment as soon as possible. If you have questions about how OneNeck can assist you with this in your environment, please contact the Service Desk.

Exchange Updates:

OneNeck encourages all customers to upgrade to Exchange Server 2019. OneNeck will apply Exchange Security Updates (along with the additional actions) under separate Change Requests for customers contracted with OneNeck for Exchange Management.

Microsoft will soon push out updates to disable TLS 1.0 and TLS 1.1. OneNeck encourages all customers to ensure their environment is adequately updated to ensure applications function with this updated security posture. For further details on TLS updates, please check the information provided by Microsoft’s blog post.

We look forward to sharing more insights next month, and as always, we’re here to assist and answer any queries you might have. Keeping your systems updated is crucial for security, and we’re committed to guiding you every step of the way.

Stay secure and stay patched!

Each month, OneNeck engineers review newly released updates from vendors, like Microsoft, to understand any known issues, actions required and understand the priority of each. This is done immediately following Patch Tuesday releases, and we monitor for adjustments to patches throughout each month.

The information above is gathered monthly during this review and posted for awareness to our customers. This information is generally updated only once per month and is based on our engineers’ review of the information provided by the vendor at that time. As always, for the most up-to-date patching information, please see the vendor’s website or contact us.

Note: If OneNeck actively manages a device or software that is impacted by any of these vulnerabilities, when necessary, OneNeck will be in direct contact with you regarding remediation.

Roughly two years ago, Microsoft announced changes to its licensing management system and began transitioning functionality away from its Volume Licensing Service Center (VLSC) and into the Microsoft Admin Center. Since this announcement, functionality mostly remained paralleled at both locations.

However, as of Spring 2023, Microsoft has begun to remove these functionalities from the VLSC, with customers needing to access them exclusively on the Microsoft 365 Administration site. With the enforcement of this change and the retirement of particular features in VLSC, many customers are now finding they are having difficulties accessing these elements and are unsure exactly how to proceed. Read on to learn more about the VLSC changes and features being retired and ways to access your licensing.

Understanding Microsoft Volume Licensing in Microsoft 365

The Microsoft VLSC has traditionally been the go-to platform for managing licenses, retrieving keys and downloading software. However, in line with its stated intent of creating a more integrated and universal experience, Microsoft has been gradually shifting certain functionalities from the VLSC to the Microsoft 365 Admin site, also known as the Microsoft Admin Center.

Microsoft presents a variety of licensing solutions tailored to meet the unique requirements of its users. As a reputable reseller, OneNeck offers volume licensing through the Open Value plan, among other options. Such plans are especially suited for clients looking for on-premises solutions or those interested in leveraging the advantages of Software Assurance.

What’s Changing with VLSC and Microsoft Admin Center?

In April 2023, Microsoft decided to retire specific features from the VLSC. These retirements mean these features will be exclusively available on the Microsoft Admin Center. The move is part of Microsoft’s broader strategy to streamline its services and offer a more cohesive user experience.

To view volume licensing in the Microsoft 365 admin center, you must have registered a license ID (volume licensing agreement or enrollment) in the VLSC. After registering in the VLSC and signing into the Microsoft 365 admin center at least once, it won’t be necessary to return to VLSC for those volume licensing features that have been relocated.

As a result of these changes, many clients are now transitioning to the Microsoft Admin Center from the VLSC. If you’re one of them, here are some resources to guide you through the process:

• Frequently Asked Questions for the Volume Licensing Service Center | Microsoft Learn
• Frequently Asked Questions for sign-in. | Microsoft Learn
• Landing page for the Volume Licensing Service Center | Microsoft Learn

Assistance with Transitioning to Microsoft Admin Center

Transitioning to a new platform can sometimes be challenging. If you encounter issues accessing your licensing details on the Microsoft Admin Center, don’t hesitate to seek help. Microsoft has a dedicated Volume Licensing Service team ready to assist you. For those users that purchased licenses from 3^rd-party sources, you will most likely need to contact Microsoft Support in order to register a license ID in the VLSC and then gain access to the Microsoft Admin sites.

Typical response time for web inquiries can range upwards to 24 hours. So, if your concern is urgent, it’s advisable to contact them via phone.

Transitions, like the shift from VLSC to the Microsoft Admin Center, can present challenges. While these changes usually aim to offer a more streamlined experience, they can also require adjustments and a period of adaptation. OneNeck understands these challenges and is here to assist. We aim to help you navigate these changes smoothly, ensuring you can efficiently manage your licensing and continue your operations with minimal disruption.

If you have questions or need support, don’t hesitate to contact our team today.

The world’s attention is spread thin from the recent unrest in the Middle East to the prolonged conflict between Ukraine and Russia and a US presidential election on the horizon. These events, while primarily political and military in nature, also significantly impact our digital world. The interconnectedness of our global society means that disruptions in one area can lead to challenges in another. As geopolitical tensions rise, the online environment becomes a new battleground for conflicts, espionage, and cyberattacks. Individuals, businesses, and nations must exercise cyber vigilance, understanding that physical borders aren’t the only boundaries at risk.

Bad actors, state-sponsored and opportunistic hackers, are always looking for moments of vulnerability. They exploit the heightened emotions and distractions of global events to launch cyberattacks. As tensions escalated around Israel, documented cyberattacks paralleled the physical military confrontations. But it’s crucial to understand that these digital threats aren’t confined to the primary participants of these global events. Allies, supply chains, businesses and even individuals can find themselves caught in the crossfire.

Given the current state of affairs, it’s more important than ever for everyone to exhibit cyber vigilance. Here’s what you can do to safeguard your digital assets:

Cyber Vigilance Education

While it may be a cliché, knowledge truly is power when it comes to cybersecurity. It’s about having the right tools and cultivating an informed mindset to discern threats and act proactively. Understanding the attackers’ tactics and adopting a vigilant approach can significantly reduce our vulnerability to cyber threats. Here’s how you can bolster your cybersecurity knowledge:

• Understanding Attacker Tactics

  • Stay Informed – Regularly read up on the latest cyberattack methods. Knowledge is your first line of defense.
  • Real-world Examples – Familiarize yourself with case studies of recent cyberattacks to understand their modus operandi.

• Distrust and Verify

  • Be Skeptical – Always question unsolicited communications, especially if they ask for personal or financial information.
  • Double-check – If you receive an unexpected request, contact the person or organization directly using a verified method, like their official phone number, before taking action.

• Formal Training with KnowBe4

  • What is it? – KnowBe4 is a platform that offers security awareness training to help organizations and individuals recognize and combat cybersecurity threats.
  • Why is it important? – With the proper training, you can identify phishing emails, malicious attachments and other threats before they become a problem.

Patch Regularly

Staying updated is not just about accessing the latest features; it’s a critical defense mechanism. Regularly updating your software protects you against known vulnerabilities that cybercriminals could exploit. Think of patches as digital armor, reinforcing your systems against potential threats. Here’s why regular updates are essential and how you can maintain them:

• Update Computer Operating Systems

  • Stay Current – Manufacturers regularly release updates that patch vulnerabilities. Ensure you’re always using the latest version.
  • Automate – Set your system to update automatically whenever a new version is available.
  • Patch Management – Investing in patch management ensures critical updates are prioritized and applied in a timely manner.

• Mobile Device Updates

  • Consistent Checks – Mobile devices are frequent targets. Regularly check for software updates to stay protected.
  • Beware of Third-party Stores – Only download apps from official app stores to reduce the risk of malware.

• Application Updates

  • Why it Matters – Outdated software can have vulnerabilities that hackers exploit. Keeping them updated closes these security gaps.
  • Set Reminders – If your software doesn’t update automatically, you can use tools or set up calendar reminders to check for updates regularly. This way, you can ensure that your software is always up-to-date with the latest features and security patches.

Bolster Defenses

A proactive stance is always better than a reactive one. While staying informed and keeping systems updated is essential, having robust defenses in place is equally crucial. Think of these defenses as the walls of a digital fortress designed to keep intruders at bay. From multi-layered authentication methods to strong passwords and robust antivirus measures, here’s how you can fortify your digital defenses:

• Embrace Multi-Factor Authentication (MFA)

  • Extra Layer – MFA requires two or more verification methods. These methods often consist of something you know (password), something you have (a phone) or something you are (fingerprint).
  • Deterrence – MFA can prevent unauthorized access even if a hacker gets your password.

• Strengthen Passwords

  • Complexity is Key – Use a mix of uppercase, lowercase, numbers, and symbols. Creating passphrases is a helpful way to ensure length and complexity are accounted for while remaining memorable for the user.
  • Avoid Common Mistakes – Never use easily guessable passwords like “password123” or “admin.”
  • Use a Password Manager – These tools generate and store complex passwords for you, reducing the risk of breaches.

• Invest in Antivirus Software

  • Real-time Protection – Good antivirus software monitors your system in real-time, catching threats before they can do substantial harm.
  • Regular Scans – Schedule weekly or daily scans to ensure no malware has slipped through.

Your Trusted Cyber Vigilance Ally

Cyber vigilance is always necessary, but its importance during turbulent times cannot be overstated. While global events capture our attention, it’s essential to remember that our digital spaces require consistent protection. We boost digital safety by staying informed, maintaining vigilance and applying best practices. Especially during challenging periods, a dedicated approach to online security is crucial to prevent potential threats and maintain the integrity of digital interactions.

Choosing the right security partner is pivotal. Whether you’re looking to strengthen cybersecurity measures, enhance IT infrastructure or explore new digital solutions, OneNeck is here to support and guide you.

Don’t compromise on digital security. Contact us today; together, we’ll help ensure a robust and secure digital experience.

On October 10, 2023, Citrix released a security bulletin concerning the discovery of two critical vulnerabilities. This announcement highlighted vulnerabilities in their flagship products: NetScaler ADC (formerly Citrix ADC) and NetScaler Gateway (formerly known as Citrix Gateway). These vulnerabilities are particularly concerning as, if successfully exploited, they could compromise the integrity and security of systems and data. Specifically, the vulnerabilities could lead to:

• CVE-2023-4966: Sensitive information disclosure
• CVE-2023-4967: Denial of service

Source: Citrix

Affected NetScaler Versions

The following versions of NetScaler ADC and NetScaler Gateway are affected:

• NetScaler ADC and NetScaler Gateway 14.1 before 14.1-8.50
• NetScaler ADC and NetScaler Gateway 13.1 before 13.1-49.15
• NetScaler ADC and NetScaler Gateway 13.0 before 13.0-92.19
• NetScaler ADC 13.1-FIPS before 13.1-37.164
• NetScaler ADC 12.1-FIPS before 12.1-55.300
• NetScaler ADC 12.1-NDcPP before 12.1-55.300

These vulnerabilities do not directly impact customers utilizing Citrix-managed cloud services or Citrix-managed Adaptive Authentication, and, as such, no immediate action is required.

Another important item to note is that NetScaler ADC and NetScaler Gateway version 12.1 is now End-of-Life (EOL) and remains vulnerable.

For more detailed information, please refer to the official Citrix security bulletin on the Citrix Knowledge Center.

Recommended Action

In light of these recent discoveries, OneNeck cannot emphasize enough the importance of timely action. We strongly urge all affected customers to prioritize the installation of the updated versions of NetScaler ADC and NetScaler Gateway. By doing so, you can ensure your systems’ continued security and integrity, safeguarding them against potential exploits.

We have some reassuring news for our valued customers utilizing OneNeck’s managed services. We’ve already initiated contact and are actively supporting you in addressing these vulnerabilities. Rest assured, we’re on top of this situation to ensure your systems remain secure.

OneNeck’s Commitment to Customer Security

At OneNeck, we prioritize the security of our customers. We understand the complexities and challenges of managing and updating IT infrastructure. Beyond these immediate concerns, we also offer Citrix Assurance Services as well as comprehensive patch management to ensure long-term system security and stability. As a trusted partner, we stand ready to help any customer needing support, whether for installing the necessary patches or for broader IT management solutions.

Additionally, we invite you to check out our Monthly Patching Blog series. It’s a valuable resource to keep you informed on the latest critical updates from our vendors, ensuring you’re always ahead of potential threats.

If you require assistance or have any concerns, please contact our Customer Care Center. Our team is ready and available to guide you through the update process and beyond, ensuring your systems remain secure and resilient.

Many organizations have adopted Microsoft Teams as a cornerstone in the ever-evolving world of remote work and collaboration. To better support these organizations, Microsoft released an update for Teams optimized for Virtualized Desktop Infrastructure (VDI). This update is crucial for those utilizing VDI deployments like Citrix Workspace, Azure Virtual Desktops, VMware Horizon and Microsoft Remote Desktop Services. In this blog, we’ll outline the new requirements and walk you through the installation process.

Key Benefits of Microsoft Teams for VDI Deployments:

Azure Virtual Desktops

Microsoft’s Azure Virtual Desktop now offers audio/video (AV) optimization for Teams on VDI.

Citrix DaaS/Virtual Apps and Desktops

Teams is now compatible with various versions of the Citrix Workspace app and Citrix Virtual Delivery Agent (VDA). However, it’s worth noting that Citrix Virtual Apps (also known as published apps) is currently not supported.

VMware Horizon

Teams is now supported on Horizon Agent 7.13.1 or 2103, ensuring optimized Teams experiences for VMware Horizon users.

Microsoft Remote Desktop Services

Users can benefit from AV advancements with the new Teams client.

Minimum Requirement:

To install the new Teams, virtual machines need to satisfy the minimum requirements outlined here.

Source: Microsoft

How to Install Microsoft Teams for VDI:

To ensure a successful installation of Microsoft Teams for VDI, follow the guidelines provided by Microsoft in their official documentation. Here’s a summarized step-by-step guide:

1. Check Virtualization Provider Requirements: Ensure your virtualization provider is certified. Currently, Microsoft Teams for VDI with AV optimization is certified with Azure Virtual Desktops, Windows 365, Citrix, and VMware.
2. Review Minimum Version Requirements: The minimum version requirements for software components vary depending on your virtualization provider. For instance, Azure Virtual Desktop requires:
   • Remote Desktop Client for Windows 1.2.1755
   • Remote Desktop Client for Mac 10.7.7
   • WebRTC Redirector Service 1.1.2110.16001
3. Deploy Necessary Registry Keys: To optimize the new Teams client when being deployed via Azure Virtual Desktops, a registry key must be deployed.
4. Installation Options:
   • Option 1: Uninstall the classic Teams client and install the new one. This is the recommended method; you can use the direct or “bulk deployment” method.
   • Option 2: Install both apps ‘side by side’. Users can switch between them using the toggle on the top left of the Teams UI.
5. Ensure Profile and Cache Location: The new Teams client stores all settings and configurations in a designated folder. To ensure the proper functioning of MS Teams, ensure the persistence of this folder.

Enhancements in New Teams:

The new Teams client introduces a range of improvements to enhance the user experience in VDI environments:

• Channels 2.0: This is a significant upgrade to how channels function in Teams. Channels 2.0 offers a more organized and streamlined approach to team collaboration. Users can navigate and collaborate more efficiently within their teams with enhanced features like pinned channels, better notification management, and improved search capabilities.
• Multi-window Support: Previously, users often found it cumbersome to juggle between different chats, meetings, and documents within a single Teams window. With the new update, Teams now supports multiple windows by default, allowing users to open chats, meetings, or documents in separate windows for a more flexible and multitasking-friendly environment.

 Key Takeaways for OneNeck Customers:

The Teams update for VDI addresses the specific needs of organizations using virtualized environments. With this update, Microsoft introduced changes to ensure seamless integration of Teams across various VDI deployments, including Citrix DaaS and Desktops, Azure Virtual Desktops, VMware Horizon and Microsoft Remote Desktop Services. Organizations should stay updated on these changes, understand the new requirements and follow the recommended installation procedures.

If you need help upgrading or deploying Teams in a VDI environment, OneNeck, an experienced Microsoft Solutions Partner, can simplify M365 management.

Contact us today to ensure a smooth transition and get the most out of your Teams experience.

October is more than just the month of fall foliage and Halloween; it’s a period that has, for the past two decades, been dedicated to cybersecurity. As we mark the 20th Cybersecurity Awareness Month, it’s clear that with the increasing volume and sophistication of cyberattacks, cybersecurity and its subsequent awareness are just as, if not more, important today. The collaborative efforts of governmental agencies and those in the tech industry underscore the imperative of ensuring individuals and businesses remain secure.

Cybersecurity Awareness Month: A Two Decades Journey

Cybersecurity Awareness Month was established when our digital landscape looked quite different. Following the tragic events of 9/11, government agencies and tech industry leaders collectively recognized the critical need for digital safety. Organizations including the Department of Homeland Security (DHS), the White House, and tech leaders such as Microsoft, Amazon, Cisco and others joined together to educate the public on the necessity of safe technology usage. This effort gave birth to Cybersecurity Awareness Month. This campaign has evolved over the years to be co-managed by the National Cybersecurity Alliance (NCA) and the U.S. Cybersecurity and Infrastructure Security Agency (CISA).

During its first instance, the primary advice of Cybersecurity Awareness Month was straightforward: change passwords in tandem with smoke detector battery replacements. While this was a practical starting point, the digital landscape has evolved dramatically. With the rise in volume and sophistication of cyberattacks, such simplistic advice is no longer sufficient. The nature of threats has shifted from mere password breaches to advanced persistent threats, ransomware attacks, and sophisticated phishing schemes. The goals and recommendations have matured over the years, reflecting the complexities of today’s cyber threats.

With that said, one of the primary objectives of Cybersecurity Awareness Month is to let users know that being safer does not need to be overly complicated or arduous. Rather, by adding a handful of simple actions to our daily routines, we can all become significantly safer whenever we are online.

Image source: cisa.gov

Everyday Actions for Cybersecurity Awareness Month

Awareness is undeniably the foundation of digital safety. However, it’s the actions we take, based on that awareness, that truly determine our security in the digital realm. This year’s theme from CISA, “Secure Our World,” is a firm reminder, emphasizing our collective role in fortifying the digital space. Let’s delve deeper into the four actions highlighted by the campaign:

Use Strong Passwords

In today’s digital age, where data breaches have unfortunately become commonplace, the significance of using robust passwords cannot be overstated. A strong password is the first line of defense against potential cyber threats. But what constitutes a strong password? In a post from earlier this year, OneNeck’s Security Specialist, Nick Santilli, states that ideally, it should be a combination of letters (uppercase and lowercase), numbers and special symbols, making it difficult for cybercriminals to guess or crack. He further recommends that instead of passWORDS, think more in terms of passPHRASES. Passphrases are typically longer than passwords and, therefore, harder to crack.

Moreover, with the plethora of online accounts most of us manage, remembering unique passwords for each can be daunting. This need for password organization is where password managers come into play. These tools store your passwords securely and generate strong, random passwords for your accounts.

Enable Multi-Factor Authentication (MFA)

While a strong password is crucial, it’s not infallible. Cybercriminals have developed methods to compromise even the most complex passwords. This need to supplement the protection offered by login credentials is where Multi-Factor Authentication (MFA) steps in.

As mentioned in our March blog, To MFA or Not to MFA – It’s Not Really a Question Anymore, MFA requires users to provide two or more verification factors to access an account, making unauthorized access incredibly challenging. This validation could be something you know (password), something you have (a phone or hardware token), or something you are (fingerprint or facial recognition). By adding this additional layer of security, even if an attacker manages to steal your password, they won’t be able to access your account without the second verification factor.

Recognize and Report Phishing

Phishing attacks are the most common form of cybercrime. Cybercriminals craft seemingly legitimate emails, messages or websites to deceive individuals into providing sensitive data, such as personally identifiable information, banking details or login credentials. It’s imperative to be discerning and vigilant. For organizations, educating and training employees is essential. One particularly effective method to train and test is using simulated phishing attacks.

While organizations can employ training methods, individuals must also be vigilant in recognizing and responding to potential threats. Always verify the source before clicking on any links or downloading attachments. Look for telltale signs of phishing, such as generic greetings, spelling errors or suspicious email addresses. Trust your instincts and avoid interacting with the message if something seems amiss. Moreover, reporting suspicious activity is fundamental in curbing such threats and ensuring that others are warned quickly.

Regularly Update Software

The digital landscape is dynamic, with cyber threats constantly evolving. To counter these threats, software developers regularly release updates that patch known vulnerabilities. Keeping your software updated, be it your operating system, applications or antivirus, protects against the latest known threats.

Auto-updates are one option for keeping software current. Still, they might not always be feasible for organizations due to compatibility issues, work schedules or other business requirements. In such cases, investing in patch management becomes crucial. Patch management ensures that updates and patches are prioritized and applied promptly, offering a structured approach to maintaining software security.

OneNeck: Your Partner for Cybersecurity Awareness Month and Beyond

At OneNeck, our core values resonate deeply with the goals of Cybersecurity Awareness Month. While security might be intricate for professionals, we understand that it should be accessible and straightforward for everyone else. Simple measures such as MFA, password managers and cybersecurity education (like recognizing phishing scams) can significantly enhance digital security for your business.

Take action this Cybersecurity Awareness Month. Partner with OneNeck, and let’s work together to fortify your digital defenses, ensuring a safer and more secure online environment for your business.

Cybersecurity is a critical concern for organizations worldwide. As businesses increasingly rely on networked technologies, potential risks and vulnerabilities have escalated. Consequently, cyber insurance has become a vital tool in the risk management strategy of many organizations. In this blog, we delve into cyber insurance, highlighting its necessity, the challenges in acquiring it and strategies to secure better rates and coverage.

The Growing Need for Cyber Insurance

Cyber insurance serves as a safety net, helping organizations mitigate the financial and operational repercussions of cyber threats like ransomware. However, many businesses are at a crossroads, unsure of what policies to obtain or if insurers will even underwrite their risk.

Recent research underscores the growing perception among organizations that ransomware poses a significant threat to their viability. Despite increased awareness and dedicated efforts to counter these threats, a mere 15% of companies have adopted active cyber insurance policies, as the Enterprise Strategy Group (ESG) reported.

Challenges in Acquiring Cyber Insurance

While it stands to reason that obtaining cyber insurance should be a straightforward process, given its importance for most organizations, the actual experience tells a different story. Organizations frequently encounter a series of obstacles in pursuing cyber insurance. These hurdles, including soaring premium rates and rigid underwriter requirements, add layers of complexity to the acquisition process.

A notable 56% of IT and security leaders find it challenging to navigate these hurdles, highlighting the need for expert guidance to facilitate a smooth policy acquisition process. Let’s examine the primary challenges organizations face:

Escalating Rates

• Surge in Premium Rates: The cyber insurance market is experiencing a significant premium rate increase. This surge is primarily attributed to the growing frequency and severity of cyber-attacks, which have heightened the risk factors associated with providing coverage.
• Market Dynamics: The dynamics of the insurance market, influenced by global economic factors and regulatory changes, also play a crucial role in the escalation of rates. Organizations need to stay abreast of these dynamics to negotiate better terms.

Coverage Limitations

• Restricted Scope of Protection: Organizations often find that the coverage offered by cyber insurance policies is limited, restricting the scope of protection and leaving them vulnerable to uncovered threats under standard policy terms.
• Customization Challenges: Tailoring a policy to suit an organization’s unique needs and risk profile can be complicated. It requires a deep understanding of the potential risks and the ability to negotiate terms that offer comprehensive protection.

Meeting Underwriter Requirements

• Comprehensive Cybersecurity Assessment: Meeting the stringent requirements set by underwriters is a significant hurdle. This process often entails a detailed assessment of the organization’s cybersecurity posture, including evaluating the attack surface and the effectiveness of the existing security measures.
• Demonstrating a Robust Security Program: Organizations must show a robust security program encompassing vulnerability management and a well-functioning security operations function. This presentation assures underwriters of their preparedness to mitigate potential cyber threats.

What Companies Need to Know

Navigating cyber insurance requires a solid understanding of your company and the insurance landscape. The first step is a comprehensive self-assessment to gauge your company’s cybersecurity posture. This process helps identify the strengths and weaknesses of your existing cybersecurity measures, allowing you to opt for coverage that aligns precisely with your company’s needs. It is vital to avoid succumbing to the pressure of accepting terms or add-ons that do not mesh with your business operations.

Understanding the terminology and nomenclature used in the cyber insurance sector is equally important. This knowledge enables communication of your needs and empowers you to negotiate terms that serve your company’s best interests. Keeping abreast of trends and dynamics in the cyber insurance market is crucial and includes understanding insurance companies’ evaluation of potential clients.

It’s worth noting that the cyber insurance industry operates with considerable flexibility due to a lack of stringent regulations, allowing insurers significant leeway in setting terms and conditions. This freedom grants insurers substantial discretion in determining policy coverage and associated costs.

Strategies to Secure Better Cyber Insurance Rates and Coverage

It’s no secret that companies seek ways to snag better deals and broader coverage from their cyber insurance policies. Let’s walk through some key strategies that can serve as an outline for securing an approach that is both economically viable and comprehensive:

• Collaborative Assessment and Action Planning: Organizations must engage in a collaborative security assessment process to secure better rates and coverage. This involves working closely with managed service providers like OneNeck, who guide IT and security leaders through meticulously evaluating the current environment and identifying gaps. This assessment culminates in a proposed action plan that bolsters security measures and streamlines the process.
• Leveraging Managed Detection and Response (MDR) Services: Increasing numbers of organizations recognize the importance of utilizing Managed Detection and Response (MDR) services as a vital step in meeting the prerequisites for cyber insurance. Engaging with MDR providers not only helps fulfill the requirements but also strengthens the security program, enhancing the organization’s credibility and standing in the eyes of insurers.
• Building a Tailored Security Program: Every organization has a unique infrastructure and risk profile. Hence, adopting a one-size-fits-all approach to cybersecurity isn’t viable. Organizations must strive to build a security program that aligns with their environment, operating model and risk profile. This process involves understanding the attack surface, assessing external assets that add risk and implementing preventative security controls.
• Incident Response (IR) Planning: IR planning is a core activity that prepares organizations to respond effectively to cyber incidents. It encompasses a range of strategies and processes designed to mitigate the impact of cyber-attacks and ensure swift recovery. Moreover, if your company has encountered security breaches, it might influence policy eligibility and the cost. Being prepared to showcase the measures implemented to mitigate future risks can be a strong bargaining point.

Partnering with Experts for a Secure Future

Navigating the complex world of cyber insurance requires a proactive and achievable cyber defense plan. Organizations must focus on building continuous processes supported by automated tools to meet the dynamic demands of the cyber landscape. Moreover, partnering with experts like OneNeck can facilitate a seamless journey towards securing a robust cyber insurance policy, ensuring you are well-prepared to face the evolving cyber threats head-on.

To further empower your organization, we invite you to watch our insightful webinar, “Take the Driver’s Seat from Your Cyber-Insurance Underwriter.” This session, led by OneNeck industry experts, will provide you with the knowledge and tools to confidently navigate the complex landscape of cyber insurance. The webinar is available on demand, allowing you to access this valuable information at your own pace and convenience.

Contact us today to strengthen your cybersecurity posture and find the best cyber insurance solutions tailored to your needs. Our expert team is here to guide you every step of the way, ensuring a safer and more secure digital journey ahead.

Take the first step towards a proactive and fortified cyber defense strategy today.

Learn How Microsoft Power Platform Brings Automation and Efficiency to Your Team

In today’s business environment, the need for innovative and efficient solutions to manage data has never been more crucial. As organizations grapple with an ever-increasing influx of information, Microsoft Power Platform® provides an answer. This modern technology suite empowers businesses and individuals alike, offering tools to analyze, automate and act decisively. The result? Enhanced productivity and growth that positions companies at the forefront of their industries.

Here’s a closer look at the platform — what it is, what it does and how it will benefit your organization.

What is Microsoft Power Platform?

Microsoft Power Platform is a robust and scalable suite of capabilities to help you transform data analytics, accelerate application development, automate processes and create intelligent virtual assistants with ease. It seamlessly integrates various functionalities, ensuring that organizations have the tools they need to navigate the complexities of today’s digital landscape. Whether it’s harnessing data insights, developing custom applications or streamlining operations, the Power Platform is designed to be a versatile ally in driving business growth and innovation.

Power Platform includes the following components:

• Power Apps
• Power Automate
• Power BI
• Power Pages
• Power Virtual Agents

Let’s look at each of these in more detail.

Power Apps

Power Apps is a low-code app development tool that allows virtually anyone to design applications tailored to their specific needs without requiring in-depth coding skills. It democratizes app creation by offering users intuitive drag-and-drop interfaces and pre-built templates which make it simple to build complex features with ease—all without IT or app dev team interventions.

Power Automate

Power Automate replaces time-consuming and laborious manual tasks. The tool streamlines departmental work or cross-functional collaborations using conditional logic (read: similar to programming ‘if-then’ statements) that triggers necessary tasks automatically based on your chosen criteria.

Whether you are dealing with HR onboarding tasks or seeking to optimize a marketing campaign’s outreach, Power Automate dramatically increases simplicity and productivity.

Power BI

Microsoft’s Power BI intelligence tool simplifies data analysis via interactive visualizations and consolidates information from different sources onto user-friendly dashboards.

From graphs depicting sales performance metrics to charts showing vital customer behavior trends, Power BI provides extensive transparency for smarter, data-informed decision-making processes.

Power Pages

Power Pages is a no-code tool that allows general business users to create dynamic, informative websites and pages quickly and easily. With an extensive library of web page templates and drag-and-drop design operations, virtually anyone can build intuitive interfaces for market-tailored creations and personalized user experiences.

Recently OneNeck’s parent company, TDS, used Power Pages to transition from an inefficient email-based system to a centralized portal, enhancing communication and request management for their extensive network. Read the case study here.

Power Virtual Agents

Chatbots and digital assistants are all the rage. Microsoft’s Power Virtual Agents features Microsoft’s AI capabilities and pre-built templates to deploy responsive virtual agents without requiring coding skills. These bot assistants can answer routine questions, resolve common issues and intelligently route more complex problems to human operators.

Benefits of Using the Microsoft Power Platform

Embracing Power Platform can be a game-changer for your business. Throughout your digital transformation journey, Microsoft’s all-encompassing technology prioritizes efficiency and innovation to deliver three key benefits:

Streamlined Business Operations

The Microsoft platform automates previously manual processes. Unburden your team from routine tasks to save time, resources and frustration while streamlining operations and improving data quality and accuracy.

New Data Insights

Enterprise data can provide a wealth of helpful insights—so long as you have the right tools to analyze it comprehensively. Microsoft solutions like Power BI turn abstract numbers into actionable insights through powerful data visualization capabilities. Now, you can make truly data-informed decisions quicker and more confidently with real-time analytics instead of relying on gut instinct and guesswork.

Low-Code for Non-Technical End Users

Low-code and no-code tools are ushering in a new era of DIY app, website, and workflow design. Microsoft Power Platform is a scalable solution that provides intuitive design and development features that allow any non-technical business user to easily create custom tools to solve business challenges big and small, for today and tomorrow.

How to get started with Microsoft Power Platform

Ready to take Microsoft Power Platform for a spin? As a Microsoft Solutions Partner, OneNeck is the go-to resource for helping your team get the tools and platform components it needs to meet and address your most pressing business challenges.

Schedule a free, 4-hour Power Platform consultation with OneNeck to explore how it can help you be more efficient and make a greater impact on the work you do every day.

Recently, Cisco made a pivotal announcement that marks a new direction in strategy. They announced the end-of-life of the HyperFlex Data Platform, a key product in the hyperconverged infrastructure (HCI) market.

Cisco has set September 11, 2024, as the final order date, though renewals will be accepted for existing subscriptions until February 28, 2029. Cisco has stated that this move reflects their commitment to staying aligned with current market trends and ensuring that they continue to meet the evolving requirements of their customers. In a statement from Cisco, they further explained the decision. “Cisco made the decision to discontinue its Cisco HyperFlex HCI product family based on evolving customer needs and market dynamics. This decision has been timed to best support our customers, partners, and employees.”

Partnership with Nutanix

Following the decision to discontinue HyperFlex, Cisco has moved to partner with Nutanix. Nutanix, known for their cloud software and HCI solutions, complements Cisco’s offerings in the hyperconverged domain.

The collaboration aims to simplify hybrid multicloud operations. With this alliance, Nutanix’s software will be compatible with Cisco’s Unified Computing System (UCS) hardware, including the M5 and M6 generation servers. As a result, the “Cisco Compute Hyperconverged with Nutanix” solution has been introduced. This solution integrates Cisco’s compute and networking capabilities with Nutanix’s Cloud Platform, providing businesses with an option for multicloud environments.

By combining their respective strengths, Cisco and Nutanix aim to offer a solution that addresses the challenges of modern hyperconverged infrastructure. This partnership emphasizes both companies’ practical approach to address industry needs. As the industry adapts to these significant shifts, the role of experienced partners becomes even more crucial.

OneNeck – Your Partner for Both Cisco and Nutanix Solutions

OneNeck has built robust and longstanding partnerships with both Cisco and Nutanix. As a Gold Certified Cisco partner, our deep-rooted expertise in Cisco solutions is a testament to our dedication and commitment to excellence. Additionally, our commitment to Nutanix has not gone unnoticed. In early 2023, Nutanix spotlighted our partnership as we were honored with the Global and Americas Service Provider of the Year title. Beyond this, OneNeck holds the distinction of being both a Nutanix Champion Service Provider and a Champion Reseller.

This dual alliance places OneNeck in a unique position, especially during industry shifts like the one presented by this transition. We understand the intricacies of both the Cisco and Nutanix offerings, and this knowledge equips us to offer tailored guidance to businesses.

As companies grapple with multi-cloud decisions, OneNeck is poised to provide clarity, direction and solutions that harness the combined strengths of both Cisco and Nutanix. More than just understanding the technology, we grasp the broader business implications. This holistic context ensures that our clients navigate the change seamlessly and harness it for growth and innovation.

As the HCI landscape undergoes significant changes, OneNeck stands as a steadfast partner for businesses. Our goal is to ensure that companies navigate these transitions seamlessly, making the most of their infrastructure investments and positioning themselves effectively for future industry developments.

Navigating Hyperflex Changes with Expertise and Insight

The decision by Cisco to transition from HyperFlex and collaborate with Nutanix marks a notable change in the HCI market. With this collaboration, businesses can expect solutions that address the challenges of today’s multi-cloud environments.

OneNeck, with our deep-rooted partnerships and expertise, stands ready to guide businesses through this transition. Our tight alignment with Cisco and Nutanix equips us with the insights and knowledge to provide timely and effective solutions.

If your organization is navigating these changes or exploring a new HCI strategy, we’re here to help. Contact us today.

The cloud’s vast potential is undeniable, but it also introduces a unique set of challenges that require specialized expertise. Understanding and implementing robust security measures becomes crucial as organizations transition from traditional on-premises infrastructures to cloud-based and hybrid systems.

Harnessing the Cloud: Opportunities and Obstacles

Cloud computing has significantly impacted the way companies function, offering a range of benefits that cater to modern needs. One of its primary advantages is scalability and flexibility. The cloud can adjust to varying demands for a small startup or a large enterprise. This adaptability means utilizing resources on an as-needed basis, often reducing the necessity for significant upfront investments in infrastructure. The cloud can scale to meet those demands as businesses grow or change.

Traditional IT setups involve high initial costs, from procuring hardware to establishing and maintaining data centers. In contrast, cloud computing introduces a more flexible financial model, shifting expenses to operational ones. Organizations can better manage their budgets, paying only for the resources they use. This provides financial flexibility and reduces reliance on physical hardware, allowing businesses to adapt quickly to changing needs without being bogged down by legacy systems.

Cloud computing facilitates global collaboration, allowing teams worldwide to work together in real-time and access shared resources and tools. Additionally, businesses can effectively reach global markets, serving clients from any location. However, this accessibility also presents challenges; every access point in the cloud can be a potential vulnerability, underscoring the importance of robust security measures.

Shared Responsibility in Cloud Security

In cloud computing, the concept of “shared responsibility” is paramount. It delineates security obligations between the cloud service provider and the user. While the provider is typically responsible for the underlying infrastructure and ensuring the cloud platform’s security, the user is tasked with safeguarding their data and applications.

Encryption, for instance, becomes a collaborative effort where the service might offer the tools, but users must implement and manage them. Understanding and embracing this shared model is crucial for adequate cloud security, as it underscores the idea that security is a joint effort, requiring vigilance from both the provider and the user.

However, shared responsibility doesn’t end with technical measures. It extends to regulatory compliance and best practices. Standards such as NIST, HIPAA and CIS Controls serve as security and data protection benchmarks. These standards represent legal obligations and set the foundation for trust and ethical data handling. By aligning with these recognized standards, consumers and providers can ensure they meet the highest security benchmarks, further strengthening their collaborative defense against potential threats.

Network Security: A Multi-Layered Approach

Let’s visualize a secure cloud environment as a fortress designed with multiple layers of defense to deter potential threats. Firewalls are the primary gatekeepers, monitoring and controlling incoming and outgoing network traffic based on predetermined security policies. Intrusion Detection Systems (IDS) continuously scan for suspicious activities or policy violations, serving as vigilant sentinels that alert administrators to potential threats.

Inside the network, internal security measures are vital. Techniques like micro-segmentation create isolated environments, ensuring a breach in one segment doesn’t jeopardize the entire system. Intrusion Prevention Systems (IPS) don’t just detect threats; they actively block malicious activities, maintaining the network’s resilience against cyberattacks. Additionally, regular vulnerability assessments highlight weaknesses, allowing for timely remediation.

IAM: Beyond Simple Permissions

Identity and Access Management (IAM) extends beyond the basic premise of granting or denying access. At its core, IAM is a holistic approach to managing digital identities, ensuring that the right individuals access the right resources at the right times and for the right reasons.

Understanding user behavior is pivotal in this process. IAM systems can continuously monitor and analyze user activities and detect patterns and anomalies that might indicate potential security threats. It’s not only about the timing of access; accessing high-value data or making bulk data transfers when it’s not part of their usual tasks can also be flagged.

Furthermore, IAM systems can take proactive measures such as implementing multi-factor authentication (MFA). MFA requires the user to provide two or more verification factors to gain access, adding an extra layer of security and ensuring that even if a malicious actor has login credentials, they will still need another verification form, making unauthorized access significantly more challenging.

Proactive Defense: More than Just Monitoring

Managing vulnerabilities is an obvious cornerstone of cloud security. However, the reactionary nature of traditional anti-virus software can no longer address the sophisticated and agile nature of modern attacks.

Regular assessments and penetration tests help identify and address potential weak spots before attackers can exploit them. It’s crucial to have an efficient patch management system in place, ensuring that vulnerabilities are dealt with swiftly.

As businesses increasingly adopt container and microservices architectures, the need for security intensifies. It is essential to integrate protective measures from the development stage and maintain them throughout the software’s lifecycle. By proactively managing vulnerabilities, organizations can reduce the window of opportunity for potential exploits. This proactive stance protects applications and data and fosters a culture of ongoing vigilance, a necessity in an environment where threats can emerge unpredictably.

The Human Element of Cloud Security

While advanced tools and protocols are indispensable, the human element is pivotal. It’s a common misconception that most security breaches are solely due to technological vulnerabilities. Human error or oversight often serves as the gateway for cyberattacks. Without the proper knowledge, employees can inadvertently become the weakest link, falling prey to sophisticated phishing attacks or unintentionally mishandling sensitive data.

Recognizing this, organizations must invest in continuous cybersecurity education. Regular training sessions, enriched with the latest threat intelligence, equip employees with the skills to discern potential threats. Security Awareness Training on identifying phishing emails, safe browsing practices, and secure password management can transform employees from potential security risks to vigilant watchdogs.

Choosing a Cloud Service Partnership

Selecting the right Cloud Service Provider (CSP) is a critical decision. Your CSP needs to be much more than a vendor; they are integral to your organization’s security posture. It’s not just about the tools and features they offer but also about their approach to security as a whole.

When considering a CSP, it’s essential to delve into its security philosophy. Questions to ponder include: How frequently do they undergo security audits? How swiftly do they respond to identified threats? A reputable CSP will be forthright about its security protocols, past incidents and remediation measures. This transparency ensures that you’re not just choosing a service but entering into a partnership built on trust and mutual security goals.

Navigating Cloud Security with OneNeck

In the evolving landscape of modern cloud computing, businesses are presented with unparalleled opportunities and inherent challenges. As organizations leverage the cloud’s capabilities, the significance of robust security becomes increasingly evident. A comprehensive approach to cloud security, which integrates technology, processes, and the human element, is essential for a confident and risk-mitigated digital transition.

At OneNeck, we pride ourselves on being more than just a provider of technical services. With extensive expertise in cloud solutions, we offer a partnership built on trust, experience and dedication. As a leading Cloud Service Provider, we prioritize proactive security measures and have a deep understanding of the evolving threat landscape.

As you consider your next steps in the cloud domain, let our experience and expertise guide you. Contact us today to ensure your cloud endeavors are both innovative and secure.

Welcome to OneNeck’s monthly patching blog for September 2023. Our team remains committed to informing you about the latest patches and updates that might affect your systems. Every month, our engineers scrutinize newly released updates from vendors to identify any known issues requiring action and assign priority to each patch. As part of our dedication to safeguarding your systems, we offer comprehensive Managed Patch Services to assist clients in keeping their environments secure and up-to-date.

Alert: Microsoft Exchange Server Vulnerabilities

This month, we place a particular highlight on the critical updates concerning the Microsoft Exchange Server. We strongly urge all customers to ensure that their Exchange Servers are updated with the September Security Update for Exchange as soon as possible to protect against numerous critical vulnerabilities.

Last month, we addressed the following vulnerabilities :

CVE-2023-21709, CVE-2023-38181, CVE-2023-38185, CVE-2023-35368, CVE-2023-38182 and CVE-2023-35388

September brings about additions to this list. Microsoft has flagged these CVEs as being critical. These are all concerning Remote Code Execution Vulnerabilities:

• CVE-2023-36744
• CVE-2023-36745
• CVE-2023-36756

Once the updates have been installed, you should also complete the further actions discussed in this article from Microsoft.

Microsoft Patching Updates

This month, Microsoft rectified 59 flaws divided into various categories, including two zero-day or actively exploited bugs:

• 3 Security Feature Bypass Vulnerabilities
• 24 Remote Code Execution Vulnerabilities
• 9 Information Disclosure Vulnerabilities
• 3 Denial of Service Vulnerabilities
• 5 Spoofing Vulnerabilities
• 5 Edge – Chromium Vulnerabilities

This month, we are placing a significant focus on a select group of patches that address both critical and high-severity vulnerabilities. We strongly urge you to integrate the following patches into your system to bolster your security posture against potential exploitation:

• CVE-2023-36802 – This patch mitigates a vulnerability in the Microsoft Streaming Service Proxy that could allow attackers to elevate privileges within your system.
• CVE-2023-36761 – This update addresses a flaw within Microsoft Word that can lead to unintended information disclosure, exposing confidential data to malicious actors.
• CVE-2023-38143, CVE-2023-38144 – These updates rectify Windows Common Log File System Driver vulnerabilities. They prevent attackers from exploiting the system to elevate their privileges.
• CVE-2023-36744*, CVE-2023-36745* & CVE-2023-36756* – As noted in the Alert section above, these patches are critical in securing the Microsoft Exchange Server against remote code execution vulnerabilities, preventing unauthorized access and potential data compromise.

Important Patching Update from Our Unix Team

This month, our team highlights a selection of updates, including two critical patches, that are essential to securing your system. Here, we breakdown these patches to provide you with the knowledge to fortify your network and data effectively against imminent security threats:

• CVE-2023-4057: Addresses a critical security vulnerability within Firefox. It is highly recommended that this update be implemented swiftly to prevent potential breaches.
• CVE-2023-38408: This is a critical update enhancing the security structure of OpenSSH, designed to bolster its defenses against potential cyber threats. Prioritize this patch to protect against unauthorized access and potential data breaches.
• CVE-2023-35788: This significant update addresses security and bug issues concerning the kernel, readily available for Red Hat Enterprise Linux 7 users.
• CVE-2023-32360: Authentication issue addressed with improved state management. An unauthenticated user may be able to access recently printed documents.
• CVE-2023-2235: A substantial update bringing security and bug fixes for the kernel, specifically geared towards users utilizing Red Hat Enterprise Linux 8.
• CVE-2023-3899: An essential update for the subscription manager, focusing on tightening security protocols and enhancing overall performance.

By updating your systems with these patches, you are taking a proactive step in securing your network and data. Our team stands ready to assist our customers at any time to provide any guidance or support needed throughout this process.

Microsoft Office Patching

OneNeck does not cover Microsoft Office products during scheduled patching. However, we advocate that all customers promptly apply Microsoft Office updates in their environment. For assistance or inquiries, don’t hesitate to contact our Service Desk.

Exchange Updates

We recommend all customers to upgrade to Exchange Server 2019. OneNeck will facilitate the August Exchange Security Update under separate Change Requests for clients enlisted with OneNeck for Exchange Management. For support or further information, please get in touch with our Service Desk at 800-272-3077. Additionally, note that Microsoft will soon deactivate TLS 1.0 and TLS 1.1. Ensure your environment is up to date to prevent any application malfunctions. For details, visit Microsoft’s Blog Post.

As we wrap up, we remind you to stay tuned for next month’s blog and feel free to contact us with any queries or concerns. Remember, staying informed is your first line of defense.

Stay secure and stay patched!

Each month, OneNeck engineers review newly released updates from vendors, like Microsoft, to understand any known issues, actions required and understand the priority of each. This is done immediately following Patch Tuesday releases, and we monitor for adjustments to patches throughout each month.

The information above is gathered monthly during this review and posted for awareness to our customers. This information is generally updated only once per month and is based on our engineers’ review of the information provided by the vendor at that time. As always, for the most up-to-date patching information, please see the vendor’s website or contact us.

Note: If OneNeck actively manages a device or software that is impacted by any of these vulnerabilities, when necessary, OneNeck will be in direct contact with you regarding remediation.

Uncover Security Gaps with Proactive Pen Tests

The battle of cybersecurity is more of a game of chess than a warzone. As our reliance on digital platforms intensifies, so does the sophistication of attacks. And as cyber-attacks become more intelligent, our cybersecurity technology evolves in hopes that we can stay ahead of malicious actors before they access digital assets and personally identifiable information (PII).

But is it enough? Even with incredibly thorough security measures, there are still likely to be holes in any company’s attack surface. The only way to plug them is to find them—and the only way to find them is to use penetration testing.

What is penetration testing?

Penetration testing is a deliberate and approved cyber-attack on a computer system, carried out to assess and improve the security of the system.

Unlike actual cyber attacks, which aim to exploit systems for malicious intent, pen tests are conducted to identify vulnerabilities and weaknesses before bad actors do. These tests provide invaluable insights into potential attack vectors, enabling organizations to bolster their defenses and ensure data remains safe.

What are the types of pen testing?

Each type of penetration test offers important approaches to proactively find and address potential vulnerabilities. No test is fully comprehensive, so a mix of different types of tests is the best way to ensure a comprehensive review of your cybersecurity posture. Let’s explore these distinct methodologies.

• Black Box Testing: Here, the tester has no prior knowledge of the target system, mimicking the approach of real-world attackers who have no internal knowledge of the system.
• White Box Testing: Testers have full knowledge of the system’s architecture and source code. This approach is exhaustive and helps identify vulnerabilities deep within the system.
• Gray Box Testing: A middle ground between black and white box testing, testers have partial knowledge of the system. This testing is efficient in highlighting vulnerabilities from both internal and external perspectives.
• Red Team Testing: A dynamic approach where a group of ethical hackers simulate real-world cyber-attacks to test an organization’s detection and response capabilities.
• Blue Team Testing: Opposite to red teaming, blue team testing focuses on defense. Blue teams defend against simulated attacks and hone their incident response strategies.

Benefits of penetration testing

On average, 57% of attackers can complete an end-to-end attack in less than a day. While the basic benefit of pen testing is clear—uncovering vulnerabilities before they are exploited by malicious actors—there are many reasons why pen testing is valuable.

• Simulates real-world attack scenarios, giving an authentic picture of potential security breaches.
• Maintains compliance with regulations to avoid potential legal consequences.
• Demonstrates a commitment to security, which increases customer trust.
• Saves significant costs that might come from ransom payments, data loss, legal implications, penalties and lost business.
• Ensures that an organization’s defenses adapt and grow in tandem, always a step ahead of potential attackers.

The 5 phases of pen testing

The process of penetration testing is typically divided into five sequential phases. Each phase ensures your approach to testing is methodical, enabling you to identify security gaps so you can improve your security posture. Here are the five phases of penetration testing:

Pen Test Phase 1: Planning and Reconnaissance

Before the actual test, the objectives, scope and methods of the test are defined. This phase includes determining the systems to be tested and establishing the boundaries of the test.

From there, the tester begins reconnaissance by gathering as much information as possible about the target system. This could involve identifying IP addresses, domain details and network services. The idea is to find potential entry points and understand the system’s architecture.

Pen Test Phase 2: Scanning

This phase aims to identify how the target system will respond to various intrusion attempts. Testers can use tools and methods to detect vulnerabilities both statically (by analyzing application code) and dynamically (by evaluating the system while it’s running).

Pen Test Phase 3: Gaining Access

Now, testers try to exploit the identified vulnerabilities. This means they’ll attempt to hack into the system, mimicking potential real-world attacks. This phase demonstrates what type of data could be accessed or stolen from a successful breach.

Pen Test Phase 4: Maintaining Access

This phase simulates what cyber attackers do after they’ve breached a system. The goal is to understand if the system can detect and resist prolonged unauthorized presence. Testers attempt to create a “backdoor” for themselves, emulating how malware might operate to stay undetected within a compromised system.

Pen Test Phase 5: Analysis

Post-testing, this phase is all about documentation and feedback. A detailed report is generated, outlining vulnerabilities discovered, data accessed, methods used and the duration of the testers’ unnoticed presence in the system. The report also typically includes recommendations for securing the identified vulnerabilities, providing organizations with actionable insights to bolster their defenses.

Penetration Testing with OneNeck

Penetration testing is an important part of OneNeck’s suite of cybersecurity solutions. Our real-world risk assessment includes the execution of full-scope Red Team exercises, mimicking tactics and techniques employed by even the most recent threats. These tests go well beyond a standard checklist, revealing business-specific risks present in your network and infrastructure.

With OneNeck, you can keep moving forward because we’ve got your back. Learn more about our penetration testing solution or reach out for a free quote.

The cyber threats that organizations face today have evolved beyond the computer viruses of decades past. Attacks are more sophisticated, well-planned and stealthy than ever. Organizations must stay alert and be ready to deal with cyber threats anytime and anywhere, with a strong response plan for what is, these days, inevitable.

What is Managed Threat Detection?

Managed threat detection and response (MDR) is an outsourced security solution that monitors for threats to ensure fast response and remediation of security incidents. Managed detection can address today’s common threats, such as ransomware, denial of service (DoS) attacks, phishing and attacks that blend two or more threats.

The Challenges of Managing Threat Detection

One of the reasons cyberattacks are so hard to defend against is that as organizations evolve, so do attackers. For every advance in security, attackers come up with a new way to get around it. IT teams can face these additional challenges in managing threat detection:

• Too many alerts. As security technology grows more sophisticated, it also has more false alarms, making it a constant struggle to determine which threats are real, and which are just noise.
• Not enough skilled staff. Many organizations are short-staffed already and don’t have the cybersecurity expertise needed to implement and run managed detection in their environment.
• Too many endpoints. Between office and remote workers, networks today have more geographically dispersed endpoints, resulting in a larger attack surface — and more stuff to protect.
• A growing number of threats. Worldwide cyberattacks were up 38% in 2022 compared to the previous year. Many of them targeted collaboration tools used by remote workers.
• Disconnected tools. When an organization’s security tools are pieced together from different vendors, they may not work well together to enable a cohesive response.

As organizations grow, keeping up with these challenges will only get more complex, taking time and resources away from other business priorities.

4 Reasons Businesses Partner with Managed Detection Providers.

One of the best ways to stay on top of cyber threats is to partner with a managed detection provider. Managed detection providers are specialists with the expertise and resources to focus on advanced threat protection to keep your organization’s devices and data safe from breaches. Here are four reasons why you should partner with a managed detection provider:

1.   Save time and resources

To stay on top of the latest emerging threats, you need a comprehensive suite of the latest security tools and the time to configure and monitor them. However, the cost of investing in those tools, as well as setting them up and monitoring them, is beyond many organizations’ reach. It’s far more cost effective to work with a managed detection provider who already has the technology and monitoring capabilities and the skilled staff to keep your environment safe.

2.   Leverage industry experience and expertise

Even with the latest security tools, you and your team need to keep your finger on the pulse of new threat actors, attack vectors and attack techniques. When you engage a provider that works with a diverse range of problems in your industry, you get access to their real-world experience. Their trained staff also keeps a close eye on new and unexpected developments in cyber threats so you know what might be coming before it hits you.

3.   Gut-check your cybersecurity strategy

The threat landscape evolves so rapidly that yesterday’s strategy might not work against today’s attacks. In addition, it is difficult to address every potential threat vector with a third party to check your work. Working with a managed detection provider who is experienced in security strategies ensures that you’ve cemented every crack in your security posture to keep your network and devices safe.

4.   Gain support amid cybersecurity talent shortages

With a reported 700,000 cybersecurity positions unfilled in 2022, you may not be able to hire the staff you need to manage cyber detection and response at your organization. Outsourcing to a managed detection provider that already has a full staff greatly eases the burden and cost of recruiting, hiring and training in a very competitive market.

Modern Businesses Need Managed Threat Detection

No organization is too small to be immune to a security attack. Cybersecurity should be at the top of everyone’s priority list. But for many organizations, lack of staff or budget pushes security farther down the list, leaving their environment vulnerable to attack.

Fortunately, there’s a solution: Experts who continually monitor your environment, with access to the latest research and analytics, who are ready to respond when threats arise.

OneNeck IT Solutions has partnered with Fortra’s Alert Logic to bring you round-the-clock managed detection and response services. Our security experts, along with the award-winning security platform from Fortra’s Alert Logic, collect and analyze real-time data to assess and mitigate every threat, any time of the day and night.

Are you ready to learn more about how OneNeck and Fortra’s Alert Logic can provide you with next-level managed detection and response services? Read more about managed detection here.

The New Commerce Experience (NCE) is Microsoft’s latest platform for licensing. With NCE, customers can choose from various subscription terms, including annual and monthly options. Microsoft has revealed plans requiring a transition, impacting customers currently using Legacy licensing. While NCE aims to offer a simplified approach to licensing and provide customers with significant control over their subscriptions, the transition may present challenges for some organizations. The shift to a new licensing platform can be complex, and businesses may need assistance understanding new terms, managing subscriptions and optimizing cloud investments.

For organizations currently on Legacy licensing, partnering with a trusted advisor can be invaluable during this transition. A knowledgeable partner can provide guidance, answer questions, and help navigate the complexities of the new licensing model. With proper support, businesses can confidently transition to NCE and continue to make the most of their Microsoft cloud services.

Transition Timeline for Microsoft New Commerce Experience Licensing Platform

Microsoft has announced that legacy SKUs for Microsoft 365/Office 365 and related online services will automatically be moved to the New Commerce Experience starting with any renewal occurring on or after January 1, 2024. This transition will impact commercial clients still using Legacy licensing, mainly affecting academic, nonprofit and government subscription clients. This change is part of Microsoft’s ongoing efforts to modernize its licensing model and provide customers with a more flexible and transparent approach to managing cloud services.

Microsoft New Commerce Experience Pricing and Commitment

Microsoft has not announced any pricing changes associated with the transition to NCE. However, there will be adjustments to the commitment terms for customers. Customers must commit to a 1-year duration, with no cancellations or reductions allowed after 168 hours (7 days) from the time of order until renewal. Alternatively, customers can choose a 1-month term at a 20% premium, with the same restrictions on cancellations and reductions. These new commitment terms are designed to provide customers with more predictable billing and greater flexibility in managing their subscriptions. While the transition to NCE may require some adjustments, it allows businesses to benefit from a more streamlined and transparent licensing model.

Source: Microsoft

Support from an Experienced Microsoft CSP

OneNeck will assist customers with the transition to NCE starting in November 2023 as soon as the new SKUs become available. We will reach out to affected clients and work with them to ensure a smooth migration process. Our team of experts will be available to answer any questions and provide guidance throughout the transition.

Since the introduction of NCE two years ago, OneNeck has consistently collaborated with our clients each year, helping them manage their subscriptions and integrate new Microsoft features as they become available. If you’re transitioning to NCE for the first time, rest assured you’ll receive the same dedicated experience.

A Partner You Can Trust

The transition to the New Commerce Experience represents a significant shift in Microsoft’s licensing model. While change can often seem daunting, OneNeck is here to help customers navigate the process and ensure a smooth transition. We will work closely with affected clients to provide support and guidance throughout the migration process.

If you’re not currently a OneNeck client but would like more information or assistance with the NCE transition, we’re happy to help. Our team of experts is available to answer any questions and provide guidance on the migration process. Whether you’re a small business or a large enterprise, we’re committed to helping you make the most of your Microsoft investments.

For more information on the changeover to NCE and its impacts, please contact us at OneNeck. Whether you’re looking for assistance with the NCE transition, need help with Microsoft services, are looking for a partner to help you navigate the Modern Workplace or have any other Microsoft-related needs, our team of experts is here to provide the support and guidance you need.

Instead of investing in costly infrastructure upgrades that are difficult to secure, more and more organizations are transitioning to cloud services Fifty-eight percent of IT leaders cite security as one of the top reasons for their transition to the cloud.

However, that doesn’t mean IT leaders can walk away and trust that their data is safe. Cloud security is a shared responsibility, especially in a multi-cloud environment or hybrid cloud deployment where security must be managed across multiple platforms.

If security is a high priority for your organization, leaning on your internal team and cloud provider to manage all endpoints, attack vectors, and cloud deployments may not be enough. An extra layer of protection with cloud managed security services ensures your data stays safe in this ever-broadening threat environment.

What is Managed Cloud Security?

Managed cloud security is a third-party security service that helps you lock down your company’s cloud-based infrastructure and applications. Cloud security managed services include anti-virus, firewall management, intrusion detection and monitoring and testing for vulnerabilities.

What are the Different Types of Cloud Security?

For businesses with a variety of cloud platforms and configurations, a few basic security services are essential for a minimum level of protection.

• Identity and Access Management (IAM)— Ensures each user has the correct access (and lack of access) to your organization’s assets. User identity is validated using passwords, single sign-on and multi-factor authentication.
• Network and Device Security— Puts barriers such as encryption and VPNs between the user and the data in contained environments.
• Security Monitoring/Alerting— Notifies you of unusual activity and potential breaches. These systems can be automated but should be monitored by security personnel.
• Disaster Recovery and Business Continuity Planning— A documented plan with steps to take before and after a breach. The plan should spell out data redundancy tactics and recovery steps.

5 Reasons to Invest in Managed Cloud Security

Though your cloud provider may have a standard cloud security package, here are five reasons why you should be prepared to fill in any security gaps with your own cloud security managed service.

1.   Strengthen your security posture.

A managed cloud security provider has specialized expertise, advanced security technologies and the staff to continuously monitor your cloud environment without interruption. Accidental misconfigurations are one of the most common cybersecurity risks and happen most often in cloud environments. A vulnerability assessment conducted by a skilled cloud security provider can uncover misconfigurations and other vulnerabilities which will strengthen your organization’s overall security posture.

2.   Address cybersecurity skill and talent shortages.

Hundreds of thousands of IT security positions go unfilled each year due to a shortage of skilled professionals. Hiring your own staff can be a nearly impossible—and undoubtedly expensive—task. Working with a third-party provider ensures you have experienced security experts monitoring your environment at all times, without the hassle of employee turnover, recruiting, rehiring and training.

3.   Respond quickly to threats.

A dedicated security team can provide real-time monitoring and incident response, identify and contain threats and remediate the damage to reduce downtime and minimize data loss.

4.   Focus on your core competencies.

Cybersecurity diverts time and resources away from your core business activities. When you outsource to experts, you get top-of-the-line security monitoring and technology while gaining the time you need to handle the highest, most strategic security priorities.

5.   Improving compliance.

Many organizations face regulatory requirements that are non-negotiable. These expectations are much easier to meet with a cloud managed security service provider that can continuously monitor and report on your organization’s compliance with local, federal, and international law. This ensures your organization meets its obligations according to industry standards and regulatory guidelines and helps you avoid penalties due to noncompliance.

Engage a Strong Cloud Security Partner

Investing in managed cloud security gives you a full team of security experts on your side to monitor and mitigate attacks. With this proactive approach, you’ll have fewer security incidents, experience less downtime and can always rest assured that you’re in compliance.

Leveraging the expertise of managed cloud security providers like the team at OneNeck IT Services leaves you free to focus on your core business activities while the experts ensure a robust defense against ever-evolving threats. With OneNeck’s help, you can reap the benefits of cloud flexibility and scalability without compromising security.

Ready to learn more? Read about OneNeck’s cloud security solutions.

Endpoint security is a crucial component of the delivery and management of cloud services. Traditionally antivirus software has served as the primary front line for endpoint defense. However, with the dynamic nature of increasingly sophisticated attacks, more agile security solutions are becoming necessary. A study by Gartner states that by the end of 2023, more than 50% of enterprises will move away from solely relying on antivirus offerings and transition to one or more forms of detection and response capabilities. Three endpoint security solutions have emerged as the primary methods for defending against these threats: Endpoint Detection and Response (EDR), Extended Detection and Response (XDR) and Managed Detection and Response (MDR).

While EDR, XDR and MDR solutions are related and share some common features, they each provide distinct security aspects. In this blog, we’ll break down the differences and similarities between these three solutions, helping you decide what solution best suits your organization’s needs.

Endpoint Detection and Response (EDR)

EDR is a security solution that protects endpoints, including desktops, laptops or mobile devices from cyber threats. EDR uses advanced technologies to detect, analyze and respond to threats, and this protection is essential as endpoints are often the primary targets of cyberattacks. With the proliferation of the hybrid workforce, employees are using multiple devices to access company data, leading to a corresponding increase in attack surfaces, making it crucial to have a robust endpoint security solution to protect against threats that target these devices. EDR services provide real-time protection by preventing malware, ransomware and other threats from compromising devices.

Endpoint Security Features of EDR:

• Endpoint Protection – Real-time defenses are at the core of EDR, safeguarding endpoints from malware, ransomware and other malicious threats.
• Threat Detection – Leveraging advanced analytics and machine learning, EDR pinpoints and analyzes threats specifically targeting endpoints.
• Threat Response – With EDR’s automated capabilities, organizations can swiftly contain and counteract threats.
• Forensics and Investigation – Delving deep, EDR furnishes comprehensive forensic data, aiding organizations in dissecting and comprehending cyber threat intricacies.

Microsoft Defender for Endpoint is one example of an industry-recognized EDR solution. Defender for Endpoints delivers advanced threat detection, investigation, and response capabilities. Machine learning, behavioral analysis and threat intelligence detect and respond to endpoint dangers. Cisco Secure Endpoint is another widely used option that provides a unified solution for endpoint protections alongside threat intelligence to block threats or contain breaches by remediating malware attacks.

Extended Detection and Response (XDR)

XDR is an advanced security solution focusing beyond just devices, offering comprehensive protection for endpoints, networks and cloud environments. This holistic approach to threat detection and protection allows organizations to identify and mitigate threats more effectively, reducing the risk of a successful cyberattack. XDR is ideal for organizations desiring a rounded approach to security, providing a unified security solution across an organization’s IT environment. By weaving together protections for endpoints, networks, and the cloud, XDR presents a unified front against security threats, ensuring faster detection and a more coordinated response.

Endpoint Security Features of XDR:

• Unified Protection – Bridging gaps across endpoints, networks and cloud spaces, this feature ensures a cohesive cybersecurity strategy.
• Advanced Threat Detection – Harnessing the power of analytics, machine learning and extensive threat intelligence, XDR casts a wide net to spot and explore threats throughout the IT landscape.
• Automated Response – In the face of threats, XDR acts with its rapid automated response tools, enabling organizations to swiftly counteract potential dangers.
• Threat Hunting – Going beyond passive defense, XDR actively seeks out potential hazards, empowering organizations to take a proactive stance against cyber threats.

Industry leaders offering XDR services include the likes of Palo Alto, Microsoft and Cisco. These companies are well known for their comprehensive cybersecurity solutions and have developed their XDR offerings to provide holistic protection for organizations’ IT environments. By leveraging the expertise and resources of these industry leaders, companies can ensure the safety of systems and data from threats and quick and effective responses during a breach.

Managed Detection and Response (MDR)

MDR is a security service blending advanced threat detection, incident response, and continuous monitoring. Using a mix of cutting-edge technologies and human expertise, MDR providers swiftly detect and counter threats. This makes it a go-to solution for organizations without in-house cybersecurity resources. In this era of increasingly sophisticated and targeted security threats, it’s not just about detection but also about proactive defense. MDR’s approach aids businesses in identifying threats early, leveraging advanced threat intelligence to bolster their defenses and protect their systems and data.

Key Features of MDR:

• 24/7 Monitoring – MDR providers offer round-the-clock monitoring of your network, systems, and data to detect and respond to threats in real time.
• Threat Intelligence – Providers use threat intelligence to identify and analyze emerging threats, helping organizations stay ahead of cybercriminals.
• Incident Response – During a security breach, MDR providers offer incident response services to contain and mitigate the breach’s impact.
• Compliance Management – Beyond just threat management, MDR providers also ensure organizations align with regulatory standards, setting up and upholding essential security controls.

Several notable MDR services stand out in the industry. Fortra’s Alert Logic offers integrated protection tailored for cloud-based, hybrid, and on-premises workloads. Microsoft’s MDR incorporates managed hunting services, security posture assessments, and advanced threat protection. While, Cisco has integrated its MDR solution into the SecureX platform, providing a suite of security services that encompass threat detection, incident response, and proactive threat hunting.

Navigating Endpoint Security Landscape and Beyond

MDR, EDR and XDR are robust cybersecurity solutions that offer unique benefits to organizations. The choice between EDR, XDR and MDR depends on an organization’s needs, resources and threat landscape. MDR is an excellent solution for organizations that use extensive cloud solutions and need additional support to provide and manage robust threat protection. EDR is designed for organizations that may be less cloud-based but seek additional defense beyond the reactive nature of antivirus and malware. XDR is ideal for organizations that wish to extend threat detection and prevention beyond endpoints to include cloud services, networks, identities or even email. Ultimately many organizations will likely seek a combination of these solutions to ensure comprehensive protection for their systems and data.

OneNeck is an experienced partner that can help you discover and implement MDR, EDR or XDR solutions tailored to your company’s needs. Combining our expertise, resources and extensive partnerships, we’ll help protect your systems and data from cyber threats and ensure the safety and security of your environments.

Contact us today to learn more about our managed security solutions or assessment services and see how we can help you implement robust security measures for your organization.

Our monthly patching blog continues our commitment to keep you abreast of the latest threats and updates that might affect your systems. This month, Microsoft and Linux have released several significant updates, some of which addressed critical vulnerabilities.

Windows Patching Highlights

This month, Microsoft addressed 87 flaws, broken down into the following categories:

18 Elevation of Privilege Vulnerabilities: These could allow attackers to gain elevated privileges, compromising system integrity.

3 Security Feature Bypass Vulnerabilities: These flaws could permit attackers to bypass security features, leading to unauthorized access.

23 Remote Code Execution Vulnerabilities: These vulnerabilities could allow an attacker to remotely execute arbitrary code, leading to unauthorized access and data compromise.

10 Information Disclosure Vulnerabilities: Potentially exposing sensitive information to unauthorized parties.

8 Denial of Service Vulnerabilities: Allowing an attacker to crash or slow down the system.

12 Spoofing Vulnerabilities: Allowing an attacker to disguise themselves as another user.

This month’s updates tackle a variety of vulnerabilities that impact different Windows components. They include fixes for zero-day vulnerabilities that hackers have actively exploited, as well as vulnerabilities in Microsoft Office, Microsoft Exchange, and other areas of the Windows operating system.

August’s Highlighted Patches Include:

CVE-2023-38180 – .NET and Visual Studio Denial of Service Vulnerability: This flaw could allow an attacker to crash or slow down the system.

ADV230003 – Microsoft Office Defense in Depth Update: An improvement to Microsoft Office’s security features.

CVE-2023-36884 – Windows Search Remote Code Execution Vulnerability (update now available): Addressing a previously reported vulnerability that could allow an attacker to execute arbitrary code remotely.

CVE-2023-35385, CVE-2023-36910, & CVE-2023-36911 – Microsoft Message Queuing Remote Code Execution Vulnerability: Could allow unauthorized remote code execution.

CVE-2023-21709, CVE-2023-38181, CVE-2023-38185, CVE-2023-35368, CVE-2023-38182, & CVE-2023-35388 – Microsoft Exchange Security Updates: Patches for various vulnerabilities that may lead to unauthorized access and data leakage.

CVE-2023-32019 – This update was installed with June 2023 Security Updates, but the setting was disabled. The August updates will switch the setting to enabled.

Linux Patching

Moving on to Linux, we have a collection of vital security updates addressing vulnerabilities across various components. This roundup includes patches for critical vulnerabilities that demand immediate attention and essential updates to maintain overall system integrity.

• CVE-2023-20593 – A critical security vulnerability affecting the Linux firmware package in Oracle Linux is resolved. Attackers could exploit this issue to potentially access sensitive information on vulnerable systems.
• CVE-2023-1999 – The libwebp library contained a vulnerability addressed in this update. Exploiting this issue allowed attackers to use the ApplyFiltersAndEncode function and loop through to free best.bw and assign best = trial pointer.
• CESA-2023:3145 – A vulnerability found in the Apache Portable Runtime Utility Library (apr-util) allowing attackers to execute arbitrary code with elevated privileges.
• CVE-2023-25652 – A vulnerability in Git permitting attackers to feed specially crafted input to `git apply –reject`, a path outside the working tree, overwriting it with partially controlled contents.
• CVE-2023-24329 – An issue in the urllib.parse component of Python before 3.11.4, where attackers could bypass blocklisting methods by supplying a URL that starts with blank characters, has been resolved.
• CVE-2023-32067 – The c-ares DNS resolver library contained a vulnerability enabling attackers to launch denial-of-service attacks on affected systems is now resolved.
• CVE-2023-37201 – Provides fixes for vulnerabilities found in Firefox, including where an attacker could trigger a use-after-free condition when creating a WebRTC connection over HTTPS.
• CVE-2022-3564 – Patch for a vulnerability within the Linux kernel, preventing attackers from gaining unauthorized access to vulnerable systems.
• CVE-2023-2828 – Addresses vulnerability in BIND DNS server exploited to conduct denial-of-service attacks on affected systems.
• CVE-2023-32435 – Addresses a memory corruption issue with improved state management.
• CVE-2023-2269 – A denial of service problem, resulting in a deadlock in table_clear in drivers/md/dm-ioctl.c in the Linux Kernel Device Mapper-Multipathing sub-component.

Non-Critical Updates

We’ve also identified multiple non-critical updates. Specifically, a security and bug fix update for Java (CVE-2023-22045) addresses a potential unauthorized access vulnerability. A similar update now exists for Samba (CVE-2023-3347). Lastly, a security update for Emacs (CVE-2022-48339) is available, addressing a similar vulnerability for unwanted access. While these vulnerabilities are not considered critical, we recommend applying these patches to maintain a secure environment.

Microsoft Office Updates

OneNeck does not patch Microsoft Office products during scheduled patching. We recommend all customers apply Microsoft Office updates to their environment immediately. If you have questions about how OneNeck can assist you in your environment, don’t hesitate to contact the Service Desk.

Exchange Updates

OneNeck encourages all customers to upgrade to Exchange Server 2019. OneNeck will apply the August Exchange Security Update (along with the additional actions) under separate Change Requests for customers contracted with OneNeck for Exchange Management. For customers not contracted with us for Exchange Management services, don’t hesitate to contact the Service Desk if you have any questions on how OneNeck can assist you in your environment.

Please note our engineers base the information provided here on reviews of the information provided by the vendors at the time of the release. Please see the vendor’s website or contact us for the latest patching details.

Keep an eye out for next month’s blog, and as always, feel free to contact us with any questions or concerns. Stay secure and stay patched!

Each month, OneNeck engineers review newly released updates from vendors, like Microsoft, to understand any known issues, actions required and understand the priority of each. This is done immediately following Patch Tuesday releases, and we monitor for adjustments to patches throughout each month.

The information below is gathered monthly during this review and posted for awareness to our customers. This information is generally updated only once per month and is based on our engineers’ review of the information provided by the vendor at that time. As always, for the most up-to-date patching information, please see the vendor’s website or contact us.

Note: If OneNeck actively manages a device or software that is impacted by any of these vulnerabilities, when necessary, OneNeck will be in direct contact with you regarding remediation.

Collaboration Solutions Keep Your Remote Team Happy, Engaged and Productive

A few years ago, remote work was something of a novelty. That changed in 2020 when the need for remote collaboration burst to the forefront of many organizations’ minds. Now, after a few years of implementing and improving processes, remote work seems here to stay.

Both employees and businesses are on board with the idea of remote or hybrid work — working outside of the office at least part of the time. When given the chance to work remotely at least part of the time, 87% of workers say they’ll do it. An AT&T report predicts that by 2024, hybrid work models will grow to 81% of the workforce.

What is a Collaboration Solution?

A collaboration solution is a type of software that allows employees or teams to communicate with each other and share information in real time, no matter where they are. The right solution for your team can help employees stay productive and focused while working toward the company’s goals.

Collaboration: The Key to Success in Remote Work Environments

It’s common for employees to work 100% remotely or in a hybrid environment, splitting their work time between the office and other locations. Without collaboration solutions, employees can be frustrated by digital barriers that hinder communication and creativity and lead to duplicate work — two or more employees working on different parts of the same project without realizing it.

However, using the right collaboration solution provides many benefits for remote employees.

Collaboration solutions enable strong team communication.

When all your employees use a collaboration solution, it ensures that everyone can access the same information and is on the same page. This also cuts down on duplicate messages through multiple channels, such as an employee sending an email, instant messaging and calling to try to reach someone.

Collaboration solutions build team cohesion.

A cohesive team doesn’t result from having everyone together in one building. Rather, teamwork grows from strong communication and trust. Collaboration solutions foster teamwork with face-to-face communication through video, messaging and information sharing. In addition, a digital space for socializing — a virtual water cooler or digital break room — helps build camaraderie and trust.

Collaboration solutions speed the pace of work.

Real-time information sharing and feedback cut down on distractions by diminishing the need for meetings, emails and calls. Face-to-face and instant communication, even virtually, eliminates delays and bottlenecks and helps speed up work.

Cisco Collaboration Solutions

Cisco has bundled together voice, video, data, security and mobility into a single solution called Cisco Unified Communications (UC). Along with UC, Cisco offers these cloud-based Webex solutions:

• Webex is a complete, cloud-based app-centric collaboration suite that allows teams to create, meet, message, call, whiteboard and share in one continuous workstream from anywhere.
• Webex Calling is a cloud-based phone system for global calling from any location.
• Webex Meetings offers online, face-to-face meetings with high-definition video from a web browser, mobile phone or tablet.

Microsoft’s Tools for Collaborative Success

Microsoft offers a suite of collaboration tools designed to enhance productivity and teamwork. Microsoft Teams, part of the Microsoft 365 suite, is a hub for collaboration that integrates with other Microsoft apps and services. Features include:

• Chat and instant messaging
• Video conferencing
• File sharing and collaboration
• Integration with Microsoft Office apps like Word, Excel, and PowerPoint
• Customizable and extendable with third-party apps and integrations

Microsoft’s collaboration solutions are designed to meet the diverse needs of modern workplaces, providing seamless communication and collaboration across devices and platforms.

Technology brings teams together.

The reality of today’s workplace is that remote work is here to stay. Even employees who routinely work from the office will occasionally find themselves working from home or other locations. As a result, every organization needs to invest in collaboration solutions to help their teams stay productive, no matter where they are.

To help, OneNeck IT Solutions has partnered with both Cisco and Microsoft to provide leading-edge collaboration solutions for the remote and hybrid workplace. Both Cisco Unified Solutions and Microsoft Teams are smart, affordable ways to keep your employees happy while encouraging them to give their best work. Together with OneNeck’s continuous monitoring, management and support, your organization will be ready to face the challenges of a hybrid work environment.

Endpoint Security is Essential to Protecting Your Network and Your Remote Workforce

You may not realize it, but one of the biggest threats to your network could be lurking in a coffee shop or someone’s pocket. Today, 70% of breaches originate on endpoints like desktops, laptops, mobile phones or tablets. Endpoint security is essential to protecting your organization’s network and data from threats and malicious attacks.

The Evolution of Endpoint Security

It used to be that all of your network users sat in the same building and used the same computers to access on-premises data. All you needed to protect your network was a simple antivirus program that could detect known threats.

That’s not the case anymore.

In recent years, most organizations have not only changed how their employees work—with many different devices, cloud and SaaS applications—but also where they work. Employees are just as likely to work remotely as they are to be in the office. With the increase in remote and hybrid work, we’ve gone from the office to working from anywhere, including home, the local coffee shop or on an international flight. Users can be on devices and networks that you can’t control or secure.

Why Do I Need Endpoint Security?

Endpoint security helps organizations protect critical systems and sensitive data from cyberattacks like phishing, malware and ransomware. Sixty-eight percent of companies say they’ve had their data or IT infrastructure compromised through endpoint attacks. The endpoints on your network may reside outside of your office building, but they are vulnerable to attackers and frequently targeted.

Your employees may not know if the Wi-Fi they’re using right now is secure or not. Or if the network is running out-of-date antivirus software or unpatched operating systems, which can increase the risk of security vulnerabilities. That’s why it’s vital to have an endpoint security strategy that will prevent attacks before they happen, as well as detect and respond to attacks as they’re happening.

How to Protect Your Assets with Endpoint Security

When your users and devices are off-network, they are the most vulnerable. Endpoint security measures protect your assets while still allowing employees easy access to your organization’s network.

Three ways to keep endpoints secure without compromising employee productivity are:

1. Verify—Establish that your users are who they say they are before you grant them access to the network. Do this by using multi-factor authentication (MFA), so your users are required to provide a second source of validation, like a phone or a token, to verify their identity.
2. Access—Provide a secure access point for remote workers with a Virtual Private Network (VPN). No matter where your users are, a VPN provides a secure connection to your network.
3. Defend—No matter what actions you take, attacks are still going to happen. Be ready for the inevitable by using DNS and endpoint security to block, detect and respond to attacks before they compromise your network.

Security Starts with OneNeck

Endpoint security isn’t something to leave to chance. As malicious attacks continue to rise, protecting your remote workers and securing endpoints is your first line of defense against a network breach.

At OneNeck IT Solutions, we’ve partnered with Cisco to provide a simple, effective security solution designed for your remote workers. Cisco’s Endpoint Security solution protects your remote workers by blocking endpoint attacks and helping you respond quickly to threats. OneNeck can help you protect your network with holistic security solutions that keep pace with the ever-changing cyber landscape.

Learn more by reading about endpoint security in this helpful guide from OneNeck and Cisco, Protecting Your Endpoints the Right Way.

When it comes to identity management, Microsoft’s Active Directory has become nearly ubiquitous, allowing organizations to manage multiple on-premises environments using a single identity per user. However, with the shift towards cloud-based solutions, Azure Active Directory (Azure AD) has emerged as a powerful solution for hybrid and cloud-based environments.

Evolution of Identity Management

Introducing Active Directory Domain Services was a significant milestone in identity management. Before its invention, managing multiple on-premises infrastructure components and systems was daunting, often requiring separate identities for each system. Active Directory transformed this process, allowing organizations to address these diverse systems using a single user identity, thus not only streamlining the management process and enhancing security by providing a unified approach for controlling user access and permissions.

However, a more flexible and scalable solution became needed with the shift toward cloud-based environments. Enter Azure Active Directory. This solution elevates the concept of a unified IAM system by offering an Identity as a Service (IDaaS) solution. Azure AD can be utilized by cloud-based organizations or via a hybrid deployment on-premises workloads are present. Azure AD improves management of on-premises Active Directory-integrated applications through secure remote access and Conditional access. This capability benefits organizations utilizing hybrid environments, providing a unified system for managing access across all apps. Moreover, through additional features such as multi-factor authentication, advanced threat analytics and seamless integration with other Microsoft services Azure AD is a powerful solution for modern IAM needs.

Key Concepts: Active Directory vs Azure Active Directory

Active Directory and Azure Active Directory (Azure AD) both serve as identity and access management solutions, however they cater to different environments and have distinct features. Both allow user provisioning, group and entitlement management and administrative rights delegation. Though, Azure AD extends these capabilities with automatic user creation from cloud systems, dynamic group inclusion and built-in roles with Azure AD role-based access control.

Azure AD also includes features such as intelligent password protection, multi-factor authentication and native support for mobile devices through Microsoft Intune. It can access cloud-based and on-premises apps via Azure AD application proxy agents, including traditional and legacy apps. It is worth noting that while Active Directory support multiple domains on a single tenant and includes features like organizational units and group policy objects, these capabilities are not present with Azure AD.

Active Directory and Azure AD Feature Comparison:

• User Provisioning – Both Active Directory and Azure AD allow user provisioning. In Active Directory, this is done manually or through an automated system like Microsoft Identity Manager. Azure AD, however, supports automatic user creation from cloud HR systems and can provision identities in SCIM-enabled SaaS apps.
• External Identities – Active Directory requires manually creating external users in a dedicated external AD forest. Azure AD simplifies this process by providing a special class of identity to support external identities and managing the link to the external user identity to ensure they are valid.
• Entitlement Management and Groups – Both solutions allow administrators to make users members of groups and grant groups access to apps or resources. Azure AD offers additional features like dynamic inclusion based on a query and Entitlement management to give users access to a collection of apps and resources using workflows and time-based criteria.
• Admin Management – Active Directory uses a combination of domains, organizational units and groups to delegate administrative rights. Azure AD provides built-in roles with its Azure AD role-based access control system. It augments role management with Privileged Identity Management (PIM) to provide just-in-time, time-restricted or workflow-based access to privileged roles.
• Credential Management – Active Directory credentials are based on passwords, certificate authentication or smartcard authentication. Azure AD uses intelligent password protection, including smart lockout, blocking common and custom password phrases and substitutions, and boosts security through multi-factor authentication and passwordless technologies such as FIDO2.
• Application Management – Active Directory forms the basis for numerous on-premises infrastructure components. LDAP, Windows-Integrated Authentication or Header-based authentication are primarily utilized to control user access. Meanwhile, Azure AD can access both cloud-based and on-premises apps, including traditional and legacy apps, via Azure AD application proxy agents while simultaneously supporting SaaS apps. Conditional access policies establish rules for controlling access.
• Device Management – Active Directory provides strong management capabilities for on-premises Windows servers and can domain join Windows devices to manage them. However, it does not support mobile devices without third-party solutions. Azure AD supports mobile device management natively through integration with Microsoft Intune. Furthermore, Windows devices can be joined to Azure AD, and their compliance checked as part of the Conditional access authentication process.

Extending Capabilities with Azure Active Directory

Azure AD introduces several additional features and utilities, extending its capabilities beyond traditional Active Directory. One such utility is Azure AD Connect, which allows organizations to synchronize data from their local Active Directory to Azure AD. This tool effectively extends an organization’s on-premises AD into the cloud, providing a seamless hybrid environment that leverages the benefits of both on-premises and cloud-based IAM.

Azure AD Domain Services provides a managed Active Directory domain on virtual domain controllers hosted in Azure. This offers many aspects of Active Directory that are not natively present in Azure AD, such as organizational units (OUs) and group policy objects (GPOs), meaning businesses get familiar functionality and structure of their local Active Directory combined with cloud-based scalability and flexibility.

The Next Steps

Active Directory and Azure AD play pivotal roles, each catering to unique organizational needs and environments. Active Directory has long been a trusted solution for on-premises management, while Azure Active Directory offers a flexible solution that meets the demands of modern, cloud-based and hybrid environments.

Choosing the right solution is about both meeting current needs and future-proofing your organization’s security and operational efficiency. As an experienced Microsoft CSP, OneNeck helps guide your organization through these critical decisions, ensuring selection and implementation of solutions that best aligns with your business needs.

Ready to get the most out of your identity and access management? Our team of experts is ready to assist. Contact us today to discover how we can help with your IAM solution or any of your Microsoft related needs.

Instead of maintaining costly on-premises data centers, many organizations leverage colocation to house their servers and networking equipment. Colocation services have numerous benefits, including greater control over infrastructure costs and equipment, better security and increased bandwidth.

What Is the Difference Between a Data Center and Colocation?

A data center is a facility where organizations store and manage their computing resources, including servers and networking equipment. On the other hand, colocation is a rental service offered by third-party data center providers that allows organizations to house their servers and equipment in leased space.

Organizations that operate their own data centers are responsible for all aspects—infrastructure design, maintenance, security and power supply. However, organizations using colocation services outsource facility management to the colocation provider, while retaining ownership and control over their servers and data.

Some colocation providers deploy both cloud and colocation solutions.

Why Do Companies Invest in Colocation?

Colocation services provide organizations access to state-of-the-art infrastructure without any upfront costs. This results in significant cost savings—the primary reason 10% of organizations migrate to a colocation environment.

Here are some of the other key reasons why organizations invest in colocation:

• Scalability and flexibility – Organizations can easily expand or shrink their IT infrastructure based on their evolving needs. This allows organizations to adapt to growth, seasonal fluctuations or sudden spikes in demand more efficiently.
• Enhanced connectivity – Colocation facilities typically offer high-speed, redundant network connections that enable low-latency, high-bandwidth connectivity. This is crucial for industries that require uninterrupted data access.
• Expert support and management – Colocation services often include support from experienced technicians. Companies can free their IT teams from mundane tasks like monitoring, maintenance, security and backup management.
• Robust disaster recovery – Organizations gain access to redundant power supplies, backup generators and disaster mitigation measures. This ensures continuity of operations, even in the event of man-made or natural disasters.

Top 4 Use Cases for Colocation Services

Owning Infrastructure Without Any Upfront Costs

In regulated industries where compliance and data security are critical, owning your own infrastructure is a necessity. However, building and maintaining a data center can be complex, expensive and resource-intensive.

Colocation allows organizations to navigate regulatory challenges efficiently while ensuring the security, availability and integrity of their sensitive data. Colocation facilities offer stringent security measures, like physical security controls and video surveillance. They often also work with regulatory bodies to ensure that organizations meet the necessary compliance requirements effectively.

Scaling Infrastructure for M&A and Business Growth

Scaling IT infrastructure for mergers and acquisitions (M&A) or rapid business growth can be challenging. However, colocation services enable organizations to accommodate evolving demands.

During M&A, organizations can use a shared facility where equipment from different entities can be colocated to streamline the consolidation process and expedite system integration. Similarly, when experiencing rapid growth, organizations can quickly expand their infrastructure.

Renting space within a colocation facility gives organizations the flexibility to add servers, storage and networking equipment as needed.

Supporting High Bandwidth and Extremely Low Latency

Colocation services allow organizations to provide high-quality, uninterrupted experiences in bandwidth-intensive applications—crucial in industries like media, distribution and retail.

Colocation facilities are designed with robust network connectivity that supports high-speed data transfer and extremely low latency. Organizations using these facilities gain access to dedicated, high-bandwidth connections that result in optimal network performance and minimal latency-related issues.

Colocation providers often also have strategic partnerships with major network providers and close proximity to key network exchange points, which further reduce latency.

Operating in Hybrid Environments with Sensitive Data

With colocation services, organizations can operate in hybrid environments while maintaining stringent security and compliance standards for their sensitive data.

Colocation allows organizations to securely store and process sensitive data on-premises, ensuring compliance with privacy regulations and internal security policies. In addition, colocation providers offer robust physical and digital security measures that help organizations maintain control over their sensitive data.

Colocation facilities also enable seamless integration of hybrid environments, ensuring efficient data transfer, reduced latency and enhanced security for sensitive workloads.

Is Colocation Right for You?

Data center colocation is a viable option for organizations thinking of expanding their cloud or on-premise infrastructure or de-risking their operations. To determine whether your organization should follow suit, you may want to consider the following questions:

• Does your organization want to own and manage its computing infrastructure while cutting down the costs of a data center?
• Is your organization increasingly experiencing periods of growth, mergers or acquisitions?
• Are your organization’s revenue and reputation affected by regular data center outages?
• Are efficiency and sustainability critical to your organization’s competitive differentiation?

If you answered in the affirmative to most or all of these questions, then it’s time to consider colocation. OneNeck’s top-tier data centers provide organizations with cost savings, round-the-clock support and protection from unforeseen events. Learn more by reading about our Data Center Colocation Services.

Welcome to OneNeck’s monthly patching blog for July 2023. We aim to keep you informed about the latest patches and updates that may be affecting your systems. This month, we have identified several zero-day vulnerabilities or actively exploited bugs that require attention.

Windows Patching Highlights

Here are the most significant patches for July:

• CVE-2023-32046 – Windows MSHTML Platform Elevation of Privilege Vulnerability Potentially allows attackers to gain elevated privileges, thus compromising system integrity.
• CVE-2023-32049 – Windows Smart Screen Security Feature Bypass Vulnerability. This exposure could allow attackers to bypass security features, potentially leading to unauthorized access.
• CVE-2023-36874 – Windows Error Reporting Service Elevation of Privilege Vulnerability. Could allow an attacker to elevate their privileges, potentially leading to unauthorized system changes.
• CVE-2023-36884 – Office and Windows HTML Remote Code Execution Vulnerability. Attacker could remotely execute arbitrary code, potentially leading to unauthorized access and data compromise.
• CVE-2023-35311 – Microsoft Outlook Security Feature Bypass Vulnerability. Allow for bypass of security features in Outlook, potentially leading to unauthorized access to sensitive information.
• ADV230001 – Guidance on Malicious Use of Microsoft Signed Drivers. This advisory guides the handling of situations where Microsoft-signed drivers are being used for malicious purposes.

While Microsoft has not yet released any updates related to CVE-2023-36884, they have provided mitigation advice, which, if applied, might cause certain issues with regular functionality. We will be watching for an out-of-band update this month and may add to our deployments if determined necessary. We will also consider circling back to update devices patched before the out-of-band update release.

Microsoft Office Updates

Be aware that there have been reports of ‘External Email’ banners, which many companies use to identify messages sent from an external sender, stopping functioning after office updates are applied this month. A reported quick fix for the issue is to change the color used in the banner.

Please note that OneNeck does not patch Microsoft Office products during scheduled patching. We recommend that all customers apply Microsoft Office updates to their environment immediately. If you need assistance with this in your environment, don’t hesitate to contact our Service Desk.

Additional Patching Highlights

In addition to the previously mentioned patches, we have identified several other important security updates:

• CVE-2023-24329 – A security update for python3 is available. It addresses an issue in the urllib.parse component of Python before 3.11.4 that allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters.
• CVE-2023-32067 –This addresses a vulnerability that could potentially allow an attacker to cause a denial of service.
• CVE-2023-34416 –A security update for Firefox. This update addresses a vulnerability allowing an attacker to execute arbitrary code.

Non-Critical Updates

While updates are available for Emacs (CVE-2022-48339) and open-vm-tools (CVE-2023-20867), it’s worth noting that these are categorized as non-critical. Our primary focus remains on addressing vulnerabilities of higher severity to ensure the utmost security of your systems.

Active Directory Federation Service Security Feature Bypass Vulnerability

Upon application of July updates to all Active Directory Federation Service servers, Microsoft recommends enabling a setting on the primary AD FS server. OneNeck will investigate this for any customers contracted with us for Active Directory Management. For customers not contracted with OneNeck for Active Directory Management: please contact the Service Desk if you have questions about how OneNeck can assist you in your environment.

Other Important Notes

Deployment of the Initial Enforcement phase for CVE-2022-37967 regarding Kerberos protocol changes is occurring in July. Additionally, this month, the enforcement phase for CVE-2022-38023 regarding Netlogon protocol changes is being deployed. The Initial Enforcement for this was deployed via last month’s patches.

Keep an eye out for next month’s blog, and as always, feel free to contact us with any questions or concerns. Stay secure, and stay patched!

Each month, OneNeck engineers review newly released updates from vendors, like Microsoft, to understand any known issues, actions required and understand the priority of each. This is done immediately following Patch Tuesday releases, and we monitor for adjustments to patches throughout each month.

The information below is gathered monthly during this review and posted for awareness to our customers. This information is generally updated only once per month and is based on our engineers’ review of the information provided by the vendor at that time. As always, for the most up-to-date patching information, please see the vendor’s website or contact us.

Note: If OneNeck actively manages a device or software that is impacted by any of these vulnerabilities, when necessary, OneNeck will be in direct contact with you regarding remediation.

Shadow IT, you’ve probably heard the term thrown around in tech circles and IT departments. It likely conjures images of something from a spy novel. However, it is real, affecting businesses across all industries. Shadow IT refers to IT applications, solutions, services or other technology used within a company without explicit organizational approval. This unauthorized use could include a team opting for a file-sharing app or an individual downloading software not supported by the IT department.

Today, the upswing of Shadow IT stems both from the pursuit of convenience as well as the rise of generative AI. As this innovative technology becomes more accessible and widespread, employees may be tempted to utilize AI tools and applications without official approval, adding another level to the Shadow IT landscape. Ultimately, Shadow IT is a concern that most companies must address, with a recent report showing that 77% of IT Professionals believe that shadow IT is a major issue.  Managing it effectively is key to organizational success.

Understanding the Appeal of Shadow IT

To effectively manage Shadow IT, it is vital to grasp why it appeals to employees in the first place. Shadow IT often emerges when employees perceive the officially approved tools and processes as cumbersome, slow or inefficient. A recent study from Beezy shows that 58% of employees aren’t satisfied with their company’s technologies. The allure of a more user-friendly tool or a platform offering greater functionality, such as generative AI tools, can be a strong incentive to bypass official channels. As these AI tools become more sophisticated and intuitive, they can seem attractive alternatives to traditional systems, further fueling their appeal.

Understanding the allure of Shadow IT also means acknowledging the resourcefulness of your employees. Faced with challenges or roadblocks, they seek solutions that enable them to do their job effectively. In the era of artificial intelligence, this might mean turning to advanced AI models like Chat GPT to streamline workflows or improve productivity. While this can pose risks when it leads to the use of unauthorized tools, it also indicates a proactive workforce. Recognizing this mindset can help channel innovative thinking toward safer, more compliant solutions.

In some cases, Shadow IT can highlight gaps or inefficiencies in current IT offerings. If a significant number of employees are turning to the same Shadow IT solution, this may indicate that existing tools aren’t fully meeting their needs. Rather than seeing this as a problem, consider it a source of important user feedback. It provides an opportunity to understand how IT offerings could be improved or expanded, thus fostering an environment of continuous improvement. By seeing Shadow IT as not just a risk but also a signal, you can better align IT strategy with employees’ actual needs, turning a potential threat into a tool for improvement.

The Risks

In many cases, Shadow IT may seem benign or, as mentioned above, a potential productivity booster, but it is critical to acknowledge its substantial risks. The most glaring risk is the potential for security breaches. Unsanctioned apps and services frequently do not adhere to the same stringent security protocols as officially approved tools. This discrepancy creates weak points in the security framework, leaving businesses vulnerable to data breaches.

Shadow IT solutions’ lack of stringent security protocols has real-world implications, the most notable being the loss of critical data. Unauthorized platforms may not be backed up properly or incorporated into an organization’s data recovery plan. Companies may suffer damages if these platforms experience a system failure or a cyber-attack, leading to significant setbacks, as lost data could include client information, sensitive employee details or even proprietary business data.

Furthermore, using Shadow IT raises serious compliance issues, especially in heavily regulated industries. Industries like healthcare, finance and education have strict security, privacy and data handling protocols. If employees are using non-approved software or services, it can inadvertently lead to compliance violations. Non-compliance can result in substantial fines, litigation costs or severe reputation damage. Shadow IT, thus, poses risks that extend far beyond immediate IT concerns, potentially impacting a business’ entire operation.

Managing Shadow IT: A Balancing Act

Managing Shadow IT isn’t about allowing a free-for-all or enforcing a strict ban; instead, it’s striking an appropriate balance:

• Discover Existing Shadow IT– Recognize existing Shadow IT within your organization. Utilize tools designed for this purpose, which can help you detect and catalog unauthorized software and services used by your employees.
• Assess Risks and Benefits– After identifying Shadow IT, thoroughly assess the associated risks and benefits. Consider conducting a security review for some tools categorized as Shadow IT, as they may benefit your organization’s workflow and could potentially be officially adopted.
• Formulate Clear IT Policies– Develop and implement a comprehensive policy that governs the use of IT resources within your organization. This policy should outline what is allowed and what isn’t. Once created, ensure these policies are effectively communicated across the organization to maintain clarity and transparency.
• Educate and Train Your Employees– It’s crucial to ensure all employees know the risks associated with Shadow IT and the importance of adhering to the set IT policies. This is not a one-off effort. Continuously incorporate this process into your regular training schedule to keep pace with changes in policy or technology.
• Block Questionable Applications– For any apps or services deemed a possible threat, block their usage and require employees to justify potential approval before granting the ability to download or install.
• Monitor Regularly– Implement a regular monitoring process to check for occurrences of Shadow IT within your organization. This continuous vigilance will help enforce your IT policies and help you stay aware of the use of new tools or applications outside approved channels.

How OneNeck Can Help

When appropriately managed, Shadow IT can spark growth and innovation while simultaneously mitigating risks and potential compliance issues. It’s about striking an equilibrium between security, flexibility and adapting to your employees’ needs.

Navigating the Shadow IT landscape can be challenging, but you don’t have to face this task alone. OneNeck offers services to secure, manage and transform your organization’s apps effectively. By viewing Shadow IT as an opportunity for continuous improvement and strategic advantage, we can help make sure your IT infrastructure is safe, efficient and tailored to your organization’s needs.

Contact us today to bring Shadow IT into the light and turn it from a cause for concern into a pathway toward innovation and growth.

Today’s modern workplace has ushered in a new reality where safeguarding digital assets is as crucial as protecting our physical ones. Safeguarding digital assets is particularly critical for organizations of all sizes, from small businesses to enterprises. Enter cybersecurity insurance, a specialized form of insurance designed to mitigate financial risks associated with cyber threats. What exactly is cybersecurity insurance? Why does your business need it? And how difficult is it to obtain?

What is Cybersecurity Insurance?

The Department of Homeland Security states that cybersecurity insurance, sometimes known as cyber liability insurance, is a measure designed to mitigate losses from cyber-incidents such as data breaches, business interruption, network damage and cyber extortion. Ultimately, it’s a risk transfer mechanism, allowing businesses to reposition some financial risks associated with data breaches and other cyber threats to an insurance company.

This insurance typically covers a range of expenses such as notification costs, credit monitoring, costs to defend claims leveled by regulators, fines and penalties, and loss resulting from identity theft. It’s a safety net to help organizations weather the storm of cyber threats.

Why Do You Need Cybersecurity Insurance?

Let’s look at the current cyber-threat landscape to answer this question. It is estimated that organizations currently suffer a ransomware attack every 11 seconds, and it is expected that there will be attacks on consumers and businesses every two seconds by 2031. As companies become increasingly reliant on digital technology, the risk of cyber threats escalates exponentially.

A cyberattack can result in significant financial losses due to business interruption, data recovery and reputational damage. Without a cybersecurity insurance policy, the cost of a data breach can be devastating. According to a recent IBM study, the global average price of a data breach in 2022 was $4.35 million.

Having cybersecurity insurance provides a financial buffer, allowing businesses to recover and bounce back faster. It’s not just about managing risk – it’s about resilience.

The Cost of Coverage

Cybersecurity insurance costs differ appreciably from one company to another based on numerous factors. Still, increasing numbers of businesses of all sizes are investing in this coverage to circumvent the burden of hefty immediate expenses in a cyber crisis.

The pricing of cybersecurity insurance takes into account several critical aspects of your business, including:

• Organizational scale and industry sector
• Quantity of sensitive information
• Annual earnings
• Efficacy security protocols and compliance measures
• Geographical location
• Nature of handled data
• Cyber incident history
• Current risk management practices
• Coverage limit and selected deductible
• Use of third-party services

It is important to note that costs are on the rise. To date, cybersecurity insurance has been relatively inexpensive. However, that low price point has begun to disappear. Insurers are raising rates dramatically and adding additional requirements for coverage, making it harder, if not impossible, for some to get. Higher premiums for public and private organizations result from the rising demand for coverage due to the frequency and higher costs of cybercrime incidents.

Cybersecurity Insurance: A Worthwhile Endeavor

Obtaining cybersecurity insurance isn’t inherently problematic, but it does require a thorough understanding of your business’s cyber risk profile. Insurance companies will often assess an organization’s cybersecurity posture before offering coverage. They consider factors such as the type of data you store, your industry sector, your company’s size, your existing cybersecurity measures, and your history of cyber incidents.

This assessment can pose a challenge for businesses without a robust cybersecurity framework. However, working with an experienced IT partner can help make this process smoother. They can assist in identifying and mitigating cyber risks, thereby improving your chances of securing suitable coverage.

In the end, while getting cybersecurity insurance might require some effort and investment, it’s a small price compared to the potential financial impact of a cyber-attack.

Securing Your Digital Future

In the digital age, cybersecurity insurance is not just an option anymore; it is a necessary part of any business risk management strategy. Just as businesses insure physical assets, it’s equally important to consider protecting digital assets. After all, in the modern workplace, a cyber-attack is not a matter of if but when.

For those who may find the process challenging, remember you do not have to navigate it alone. OneNeck is here to help guide you through the complexities of security and obtaining cybersecurity insurance. Our team has your back and will do whatever it takes to ensure your business has the protection it needs.

Contact us today and embark on your journey toward enhanced cybersecurity. Let us help you ensure a resilient business that is built for the digital challenges of today and future.

Database management is becoming increasingly complex due to growing data volumes and security concerns, which require significant infrastructure investments and specialized skills. Many organizations rely on the guidelines provided by ITIL (Information Technology Infrastructure Library) as a framework to manage their database environment effectively, deliver services efficiently, and optimize overall performance.

However, more organizations are going one step further to employ database managed services—the adoption of managed services is growing steadily with a compound annual growth rate of 12.44%.

What are database managed services?

Database managed services are cloud-based offerings that handle the administration, monitoring, and optimization of databases, allowing organizations to focus on their core operations. These services often include patching, security management, and incident diagnosis.

The unique value of database managed services

Organizations primarily invest in database managed services to offload the operational complexities of database management, and there are numerous benefits. Overall, these services enhance efficiency, reliability, and scalability while freeing up valuable time and resources.

Managed services providers (MSPs) offer deep expertise and dedicated resources to ensure optimal performance, high availability, and data security. With automated backups and disaster recovery mechanisms, organizations can safeguard their data without manual intervention.

Additionally, organizations gain the ability to seamlessly scale their database resources based on demand, allowing them to handle varying workloads effectively. Managed services also reduce the need for upfront investments in hardware and software, resulting in cost savings.

Companies with an SQL, PostgreSQL, or Oracle environment further benefit from advanced querying capabilities, robust security features, and comprehensive ecosystem support.

Key aspects of database managed services

Database MSPs provide organizations with access to a team of experts that handle database tasks, ensure optimal performance, safeguard data, and minimize downtime. Some of the key aspects of database managed services include:

Upgrades and patches

Database MSPs handle the responsibility of installing updates, upgrades, and security patches for the supported database systems. They stay current with the latest releases and ensure that databases are running on the most secure and efficient versions. This minimizes the risk of vulnerabilities and security breaches.

These upgrades and patches also save organizations time and effort by eliminating the need to track and implement updates themselves. Regular upgrades and patches also help optimize database performance, introduce new features, and ensure compatibility with evolving technologies, enhancing the overall stability and reliability of the database environment.

Security management

Protecting sensitive data from breaches is another critical aspect of database managed services. Database MSPs leverage encryption to safeguard data at rest and in transit, and implement authentication mechanisms to prevent unauthorized access. They also monitor databases for vulnerabilities, perform regular audits and apply necessary patches.

Moreover, database MSPs employ intrusion detection and prevention systems to detect and mitigate potential threats. With proactive measures in place, database managed services enhance data security, ensuring compliance with industry regulations.

Incident diagnosis and resolution

A database administration team monitors for any performance issues or anomalies and when incidents occur, they promptly identify the root cause of the problem. Once the issue is identified, the team works diligently to resolve it and ensure minimal downtime, lowering the impact on business operations.

This often involves troubleshooting, performance tuning, and implementing necessary fixes or optimizations. With their specialized expertise, managed service providers can efficiently handle complex database issues, ensuring prompt incident resolution.

Performance tuning

Database MSPs optimize performance and ensure fast query execution time by analyzing database performance metrics, identifying bottlenecks, and fine-tuning configurations, indexes, and query plans. Additionally, they monitor resource utilization—such as CPU and memory—and scale them as needed.

Performance tuning also involves database schema optimization, query optimization, and implementing caching mechanisms. By continually optimizing and fine-tuning the database environment, database MSPs help organizations improve user experience and support critical operations efficiently.

24/7 support

With round-the-clock support, database MSPs ensure prompt assistance in the event of database-related issues or emergencies. Their support teams are available at all times to address queries, provide troubleshooting guidance and resolve critical incidents.

The support includes monitoring systems for potential issues, responding to alerts, and offering timely resolutions. Businesses can rely on the expertise of database MSPs, and 24/7 support means that assistance is readily available regardless of the time zone or the nature of the problem. This ensures minimal downtime and uninterrupted access to critical databases.

Get started with OneNeck’s Certified DBAs

Database managed services allow organizations to offload the operational complexities of database management. Due to growing data volume and security concerns, and the rising workload of IT departments, the reliance of organizations on database managed services will continue to grow.

You can trust OneNeck’s certified database administrators with performance tuning, database optimization, security implementation, and proactive monitoring—regardless of whether your environment is SQL, PostgreSQL or Oracle. Companies of all sizes rely on OneNeck to ensure reliable, efficient, and secure database operations.

Read more about our Managed Database Services and learn how OneNeck’s experts can help you maintain and protect your databases.

In today’s interconnected digital ecosystem, fortifying endpoint devices is no longer a luxury—it’s an absolute necessity. Every work-enabled laptop, mobile device or home desktop represents a potential gateway for bad actors. This situation amplifies the need for businesses to bolster their defenses and secure every endpoint.

The expansion of the work environment has dramatically increased the number of possible entry points for potential attackers. This change in the threat landscape has highlighted the vulnerabilities in many traditional security models. Protecting the new “borderless” network requires a more comprehensive approach. Endpoint security solutions have emerged as key players in providing robust protection, among which Microsoft Defender for Endpoint® has become a potent deterrent against advanced threats. Microsoft’s offering has earned respect throughout the industry, where Gartner has rated Defender for Endpoint as a “Leader” in its Magic Quadrant for Endpoint Protection Platforms (EPP) report, demonstrating its high ability to execute and a compelling vision for the future of endpoint security.

Unraveling Defender for Endpoint

Defender for Endpoint is an enterprise-grade platform designed to help businesses prevent, detect, investigate and respond to advanced threats. It showcases Microsoft’s commitment to providing wide-ranging protection for diverse digital environments. Initially exclusive to Windows, the solution now extends its security capabilities across macOS, Android and iOS mobile devices (managed by Intune) and servers powered by Windows or Linux. This breadth of coverage allows businesses to achieve comprehensive protection across their entire device ecosystem.

The value Defender for Endpoint extends beyond multi-platform compatibility and includes a proactive approach to threat management. It’s not about addressing vulnerabilities after an attack; it’s about fortifying defenses, anticipating threats and developing robust responses. This strategy is implemented through various aspects, each addressing a specific part of endpoint security. These components include asset discovery, threat and vulnerability management, attack surface reduction, next-generation protection and endpoint detection and response.

How does Defender for Endpoint accomplish this task? Its advanced security features and how it harnesses cloud security analytics turns endpoint behavioral signals into actionable insights, detections and responses. Built into Windows 10, Windows 11 and Server 2019+, these behavioral sensors collect and process signals from the operating system, while cloud security analytics add an extra layer of protection.

Defender for Endpoint Purchase Options

The platform offers two distinct purchase options, catering to the unique security needs of businesses of all sizes and scopes: P1 and P2. The P1 package is fundamentally centered on prevention, forming the backbone of your security infrastructure. It provides a robust and reliable foundation for your security needs, helping businesses fortify their digital assets and reduce their susceptibility to cyber threats. By investing in a solid preventive framework, companies can reduce the potential attack surface, making it harder for malicious entities to breach their defenses.

Alternatively, the P2 package delivers advanced capabilities beyond simple prevention. It incorporates critical features such as endpoint detection and response (EDR) and automated investigation and remediation (AIR). Additionally, P2 includes incident response and Threat and Vulnerability Management (TVM), enabling effective and timely responses to security incidents and providing vulnerability insights. The comprehensive nature of P2 makes it an optimal choice for businesses seeking robust, layered protection. The P1 and P2 options empower businesses to tailor security solutions to their specific needs, guaranteeing powerful protection.

Integrated Security: A Unified Experience

Defender for Endpoint isn’t a standalone product—it’s an integral part of a comprehensive security ecosystem. This ecosystem approach to security is a strategic move that underlines Microsoft’s commitment to providing businesses with a holistic security solution. Instead of viewing each aspect of cybersecurity as a separate entity, Microsoft has created an interconnected suite of tools where each component plays a critical role in maintaining the overall security posture of an organization.

One of the key strengths is the seamless integration of Microsoft Defender for Endpoint with various other Microsoft solutions. These solutions include Microsoft Defender for Cloud, Microsoft Sentinel, Intune/ Microsoft Endpoint Manager, Microsoft Defender for Cloud Apps, Microsoft Defender for Identity and Microsoft Defender for Office. This deep integration ensures a seamless security experience across all Microsoft solutions. It simplifies the management of security protocols and enhances the effectiveness of threat detection and response. By integrating these different tools, Microsoft provides businesses a unified platform to handle various security tasks, from endpoint protection to cloud security.

With a unified security experience, IT teams can easily navigate between different tools within the Microsoft suite, significantly reducing the time and effort spent on managing security protocols. Furthermore, the integration allows for more efficient threat intelligence and response strategies sharing across different tools. This means that a threat detected by one tool can be quickly communicated to the rest, facilitating a rapid and coordinated response. Defender for Endpoint plays a central role in fortifying businesses against a complex landscape of cyber threats through this comprehensive and interconnected approach.

The Components: A Closer Look

Defender for Endpoint isn’t just a single, one-size-fits-all solution. Instead, it’s a carefully assembled collection of components, each with its unique function, designed to bolster your overall endpoint security. Like puzzle pieces, these elements work together, creating a comprehensive, multi-angle approach to security. Some of the most important aspects include:

• Next-Generation Protection (NGP)– Going beyond the traditional MS Defender Antivirus measures, NGP provides robust real-time protection against sophisticated malware and zero-day exploits. Additionally, cloud-delivered protection delivers near-instant detection and blocking of new and emerging threats.
• Attack Surface Reduction (ASR)– Minimizes the potential entry points for threats, making it harder for attackers to infiltrate your systems. It’s a proactive measure to keep threats at bay via components such as ASR rules that target suspicious software behavior, hardware-based isolation, controlled folder access and device control removable storage protection.
• Endpoint Detection & Response– EDR uses machine learning, behavioral analysis and threat intelligence to provide real-time visibility into endpoint activity, identification and detection of abnormal activities or potential dangers and rapid response to minimize the impact of an attack.
• Automated Investigation and Remediation–AIR uses AI and machine learning to streamline the investigation of alerts, identify causes of potential threats and can then take remediation actions to contain an infected device or quarantine malicious files, thus automating tasks that typically require human intervention.
• Comprehensive Reporting and Alerting– Provides comprehensive reporting and alerting capabilities that give crucial visibility into an organization’s security posture and enable rapid response to potential threats.
• Microsoft Secure Score for Devices– This powerful tool helps organizations assess their security posture and identify areas where proactive improvements can be made to security defenses.

OneNeck and Microsoft: An Investment in Security

In an era defined by digital transformations, ensuring the security of endpoint devices is paramount. Defender for Endpoint stands as a powerful ally in this endeavor. Its wide-ranging compatibility across different operating systems and seamless integration with a host of Microsoft solutions make it a vital part of a comprehensive security strategy.

Ready to enhance your organization’s digital security posture? As an experienced Microsoft Cloud Solution Provider (CSP), OneNeck possesses extensive knowledge of Microsoft Defender for Endpoint and the Microsoft ecosystem. Our team can help you harness the power of these advanced tools, tailoring them to meet your specific needs. Don’t wait for a security breach to take action. Contact our team today!

Welcome to OneNeck’s monthly patching blog for June 2023. Our aim is to keep you informed about the latest patches and updates that may affect your systems. This month saw the release of several important patches but, thankfully, no zero-day vulnerabilities or actively exploited bugs.

Patching Highlights

Here are the most significant patches for June:

• CVE-2023-20867 – An authentication bypass vulnerability in VMware Tools has been identified. This vulnerability could potentially allow unauthorized users to gain access to sensitive information.
• CVE-2023-29357 – Pertains to an elevation of privilege vulnerability in the Microsoft SharePoint Server. If exploited, this vulnerability could grant an attacker higher-level privilege, thereby compromising the integrity and confidentiality of your data.
• CVE-2023-32031 – A remote code execution vulnerability in Microsoft Exchange Server that is particularly concerning as it could potentially allow an attacker to remotely execute arbitrary code and gain unauthorized access to data or services.
• CVE-2023-33131 – This vulnerability is being addressed within a broader set of updates for Microsoft Office. If exploited, it could lead to the execution of malicious code when a user opens a specially crafted file or program.

VMware Tools Updates

At OneNeck, we regularly update virtual machines (VMs) in managed environments. VMware Tools contains an Authentication Bypass vulnerability (CVE-2023-20867) in the vgauth module. A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine. This month, we will work to apply the latest version of VM Tools to remediate CVE-2023-20867 for customers contracted with OneNeck for support of their VMware environment.

Microsoft Office Updates

Please note that OneNeck does not patch Microsoft Office products during scheduled patching. We recommend that all customers apply Microsoft Office updates to their environment as soon as possible. If you need assistance with this in your environment, don’t hesitate to contact our team of Microsoft experts.

Exchange Patching Updates

Important news for Exchange users: Exchange Server 2013 has reached End of Life, and Microsoft will provide no further patches for this version. Exchange Server 2016 has reached the end of Mainstream Support and is now under Extended Support. We will continue applying Security Updates Microsoft released for customers contracted with OneNeck for Exchange Management.

Moreover, we strongly encourage all customers to upgrade to Exchange Server 2019. A new Security Update has been released for Exchange Server 2019, which we will apply for customers contracted with OneNeck for Exchange Management and running a supported version of Exchange.

Windows 10 & 11 22H2

OneNeck recommends updating Windows 10 & 11 devices to Feature Update version 22H2 to ensure future security updates will install on your systems. This upgrade is not automatic via standard patching. Additionally, Windows 10 & 11 devices using BitLocker will require a manual update to the Windows Recovery Environment. Please contact our Service Desk if you need assistance with these processes.

Secure Boot Security Bypass Vulnerability

We do not enable Secure Boot on OneNeck- build servers. As a result, we will not be taking any manual action for this update. However, if you have enabled Secure Boot on your servers, we encourage you to review the documentation and take all necessary actions. Our Service Desk is available to assist you with this should you have questions or concerns surrounding your organization’s environment.

OneNeck Has Your Back!

Stay tuned for next month’s patching blog, and as always, feel free to reach out with any questions or concerns. Stay secure, stay patched!

Each month, OneNeck engineers review newly released updates from vendors, like Microsoft, to understand any known issues, actions required and understand the priority of each. This is done immediately following Patch Tuesday releases, and we monitor for adjustments to patches throughout each month.

The information below is gathered monthly during this review and posted for awareness to our customers. This information is generally updated only once per month and is based on our engineers’ review of the information provided by the vendor at that time. As always, for the most up-to-date patching information, please see the vendor’s website or contact us.

Note: If OneNeck actively manages a device or software that is impacted by any of these vulnerabilities, when necessary, OneNeck will be in direct contact with you regarding remediation.

The need for robust endpoint protection cannot be overstated. As network boundaries continue to blur with increases in remote work and the proliferation of mobile and IoT devices, endpoint protection has emerged as a critical aspect of network security. In this blog, we explore this process and examine two of Microsoft’s primary solutions: Microsoft Defender for Endpoint and Microsoft Intune.

Understanding Microsoft Defender for Endpoint

Microsoft Defender for Endpoint® is a platform designed to safeguard your organization’s endpoints, essentially any devices connecting to your network. These can range from traditional computing devices like desktops and laptops to modern smart devices and IoT gadgets.

Defender for Endpoint serves as a protective shield for your network by offering real-time threat detection, prevention, and response capabilities. But that’s not all it does. It also provides automated investigation capabilities, helping IT teams promptly detect and respond to threats, reducing time and resources spent on investigations.

Moreover, it facilitates threat intelligence sharing across platforms, enhancing an organization’s ability to proactively defend against potential threats. By harnessing artificial intelligence (AI) and integrating it with other security solutions, Defender for Endpoint ensures that your network remains resilient.

The Microsoft Defender Family: A Holistic Approach

The term “Microsoft Defender” often sparks confusion due to its broad scope. Contrary to what one might intuitively think, Microsoft Defender is not a single application but a family of interconnected security solutions designed to take a holistic approach to address digital protection. Given this complex arrangement, businesses often find it challenging to determine which specific product from the Defender suite best suits their needs.

While our focus here is on Defender for Endpoint, understanding what the entire MS Defender family brings to the table is important.  Some of the more prominent applications and add-ons include:

• Microsoft Defender for Office 365– Prevents volume-based and targeted attacks, phishing, ransomware and advanced malware with its robust filtering system. It uses AI to detect malicious and suspicious content and provides capabilities for identifying, prioritizing and investigating threats across Office 365.​
• Microsoft Defender for Identity– Helps Security Operations identify configuration vulnerabilities and prioritize the riskiest users in an organization. It also provides real-time analytics & data intelligence to threats​.
• Microsoft 365 Defender– Part of Microsoft’s XDR solution, it automatically analyzes threat data across domains, building a comprehensive picture of each attack in a single dashboard​​.
• Microsoft Defender for Cloud Apps– Acts as a cloud access security broker (CASB), providing multifunction visibility, control over data travel and sophisticated analytics. It helps organizations elevate security posture by combating cyber threats across all their cloud services​​.
• Microsoft Defender Vulnerability Management– Bolsters security and IT personnel by filling workflow gaps, enabling prioritization and remediation of critical vulnerabilities and misconfigurations throughout an organization.

These applications work in concert, providing an integrated, multi-layered defense strategy. This interconnectivity creates a centrally managed environment where endpoint protection is integral to your network security strategy rather than an isolated, independent function.

The Role of Microsoft Intune

Microsoft Intune®, a vital component of the Defender ecosystem, deserves special mention. Intune is a cloud-based service that provides comprehensive device and application management capabilities. It’s a tool that simplifies device management and establishes a secure foundation for your endpoint protection strategy.

Intune provides granular control over how devices access corporate data, allowing you to enforce compliance policies and regulate device access based on predefined rules. This ability to control device access is critical to any endpoint protection plan, as it ensures that only authorized devices are allowed to interact with your network.

In addition, Intune facilitates mobile application management, allowing you to control how corporate data is accessed and shared on mobile apps. This ability means protecting your data even when accessed from personal devices, ensuring that your business information remains secure, no matter where it’s accessed.

Interplay Between Intune and Defender for Endpoint

Intune and Defender for Endpoint are not standalone solutions; they work together to provide a comprehensive endpoint protection strategy. Intune sets the stage by establishing basic security controls and compliance policies, while Defender for Endpoint builds upon this foundation to provide advanced threat protection.

This interplay between Intune and Defender for Endpoint allows for an integrated and dynamic defense strategy. Defender for Endpoint and Intune ensure protection for both devices and data from threats by managing your endpoints and controlling their access to your network.

Why Organizations Need to Use Defender for Endpoint

The benefits of using Defender for Endpoint are numerous. It leverages advanced technologies, such as behavioral sensors and cloud-delivered security, to guard against known and unknown threats providing robust protection for your endpoints. This protection includes Zero Day attacks, ensuring your network remains protected even when new threats emerge.

In addition to securing devices, Defender for Endpoint provides application-level protection. It ensures that critical business software is protected from potential vulnerabilities, minimizing the exploitation risk to your applications. This level of security is essential as applications often serve as entry points for attackers.

Furthermore, Defender for Endpoint offers advanced threat-hunting capabilities. Using a rich data set collected from your endpoints it can uncover hidden breaches that traditional defenses might miss. This proactive approach to threat detection and response can significantly reduce the impact of security incidents.

Key Considerations for Implementation

First, it’s essential to understand Intune’s role in optimizing Defender’s effectiveness for endpoints. By leveraging Intune’s capabilities, you can manage antivirus, endpoint detection and response, and firewall policies from a single view, enhancing your organization’s security posture.

Integrating Intune and Defender for Endpoint also provides opportunities for automation, reducing manual tasks and freeing your IT team to focus on strategic initiatives. Furthermore, the rich reporting capabilities of both solutions provide valuable insights into your security posture, helping you make informed decisions and continuously improve your endpoint protection strategy.

Strengthening Your Endpoint Protection Strategy with OneNeck and Microsoft

As digital threats evolve, so must your endpoint protection strategy. Consider how Microsoft Defender for Endpoint and Intune can enhance your approach. By proactively managing and securing your endpoints, you can protect your network, data and, ultimately, your organization. Start your journey with Microsoft Defender for Endpoint and Microsoft Intune today and step up your endpoint protection game.

As an experienced Microsoft CSP and IT security provider, OneNeck is positioned perfectly to be your trusted partner. We specialize in deploying layered security strategies that provide comprehensive protection, from the DNS layer, through the network to the endpoint. We leverage the power of Microsoft Defender for Endpoint, Microsoft Intune and other essential security tools to ensure your digital assets are well-protected.

Ready to boost your organization’s defenses? Contact us today for a personalized consultation on how Microsoft Defender for Endpoint and Microsoft Intune can protect your digital assets.

ITIL (Information Technology Infrastructure Library) is nothing new to IT departments. For decades, organizations have followed the best practices outlined in the ITIL framework to deliver high-quality and cost-effective IT services.

In the search for a managed services provider (MSP), you might find it difficult to discern the value of one provider over another. To receive the best services, today’s organizations should engage an MSP that follows the ITIL framework.

The Value of ITIL to Today’s Organizations

The importance of ITIL has only grown as IT environments have become more complex and distributed. Today’s organizations use ITIL to align their IT services with their ever-evolving business needs and customer expectations.

The primary focus of ITIL is to automate processes, improve service management, and integrate IT departments. The ITIL service lifecycle comprises five main stages:

• Service Strategy focuses on understanding the business objectives and customer needs by defining a strategic approach to IT service management.
• Service Design means designing new services or modifying existing services based on the defined requirements and strategies.
• Service Transition involves implementing new or modified services in the operational environment of the organization.
• Service Operation refers to the actual delivery of services to customers, including incident and problem management.
• Continual Service Improvement aims to optimize service delivery through performance assessment and change implementation.

These five stages provide today’s organizations with a structured framework for managing IT services and improving service quality on an ongoing basis.

ITIL has gone through several revisions and consolidations since it was introduced in the late 1980s to accommodate new technology developments. ITIL 4, the latest version of the framework, was released with updates that help IT departments like yours foster greater agility and flexibility.

What is a Managed Service in ITIL?

A managed service for ITIL is the outsourced delivery and management of an organization’s IT services by a third party known as a managed service provider. They support the IT infrastructure and systems of their clients based on the optimized processes outlined in ITIL.

Top Reasons Companies Invest in ITIL-based Managed Services

You might engage an ITIL managed services provider for a number of reasons. You might want your employees to focus more on your organization’s core functions and strategic initiatives. You may be looking for opportunities to achieve greater scalability, flexibility, and cost advantages through economies of scale.

Here’s a closer look at some of the primary reasons companies use ITIL managed services providers.

Streamlines customer onboarding.

When a managed services provider uses the ITIL framework, they build standardized procedures for customer onboarding, ensuring that the process remains consistent and efficient. From there, they work with you to define roles and responsibilities within the onboarding process, which eliminates confusion and enables coordination between all teams involved—ultimately leading to a better experience for your team.

MSPs may also use ITIL to build a knowledge base for customer onboarding based on best practices and lessons learned. This knowledge can be shared throughout your organization to further improve consistency.

Helps MSPs deliver excellent customer service.

MSPs can use ITIL to align their service offerings with your business requirements, which ensures that the services they provide are valuable and relevant. With Service Level Agreements that establish clear expectations, metrics, and targets for service delivery, you and your MSP will have a basis for measuring and reporting service performance. Moreover, ITIL provides MSPs guidelines for effective incident management so your issues are resolved promptly with minimal impact on business operations.

Increases the value your MSP can deliver.

ITIL allows MSPs to implement well-defined processes, which minimizes errors in service delivery. It also provides guidelines that enable MSPs to manage incidents systematically, allowing errors to be detected and resolved faster—which means fewer fires for you to worry about. In addition, ITIL lowers the risk of disruptions during change implementation so MSPs can deliver more stable and reliable IT services.

Includes process review cycles for continuous improvement.

ITIL provides MSPs with a structured approach to constantly update their IT service delivery. The process review cycles involve periodic assessments of service management processes, which help MSPs to pinpoint areas that require improvement—within their organization and within yours—including bottlenecks and inefficiencies.

With this information at their fingertips, MSPs can work with you to define key performance indicators (KPIs) based on ITIL’s standards to track performance and gain insights into the gaps in service delivery.

Engage with a Leading ITIL Managed Services Provider

Organizations are embracing ITIL managed services because MSPs establish a robust framework that guarantees service quality and reliability when managing and delivering IT services. This significantly lowers the risk of disruptions and improves customer satisfaction for your organization.

OneNeck is a leading ITIL managed services provider with an extensive portfolio of managed services, including managed database services. OneNeck’s experienced database administration team proactively monitors systems to ensure peak performance at all times, while standardizing and optimizing routine tasks to reduce costs.

Learn more by reading about our Managed Services.

Microsoft recently unveiled its latest innovation, Microsoft Fabric®, an integrated data and analytics platform constructed on the robust foundation of the company’s OneLake data lake. Users should experience several interesting benefits, including easier data integration and platform-independent data analysis.

So, what exactly is Fabric? According to the overview provided by Microsoft, “Fabric is an all-in-one analytics solution for enterprises that covers everything from data movement to data science, Real-Time Analytics, and business intelligence. It offers a comprehensive suite of services, including data lake, data engineering, and data integration, all in one place.”

The beauty of Fabric is that it eliminates the need to piece together different services from multiple vendors. Instead, businesses can employ a highly integrated, end-to-end, easy-to-use product to simplify analytics. This capability is further supported by the platform being built upon an established Software as a Service (SaaS) foundation.

– Source: Microsoft

Microsoft Fabric and Power BI: Cut from the Same Cloth

Current Power BI® users will likely notice an inherent familiarity with Fabric. The SaaS foundation used to build Fabric is what Power BI utilizes today. While Fabric offers a plethora of new features, the fundamentals of Fabric and Power BI are in most cases indistinguishable.

Shared features and experiences include, but are not limited to:

• Workspaces– Fabric workspaces behave like Power BI workspaces only with increased availability of item types.
• Navigation– If you understand how to operate the Power BI portal, you know how to move around Fabric. They work the same.
• Collaboration and Content Management– You can collaborate and share with Fabric items and workspaces like you do with Power BI.
• Capacities– New Fabric workloads utilize the capacity-based compute model used by Power BI Premium.
• Administration– Fabric administration works like Power BI administration, and the Fabric admin portal is just an evolution of Power BI’s portal.

OneLake, the OneDrive for Data

OneLake® is a SaaS data lake that is a fundamental element of the Fabric SaaS foundation. Each Fabric tenant involves a single OneLake instance, and every Fabric experience works natively with data in the lake. Microsoft is christening OneLake, the OneDrive for data.

Like OneDrive, OneLake is included with every Microsoft Fabric tenant, designed to be the solitary destination for all analytics data. OneLake provides companies with a single data lake for the entire organization and a copy of data to use with various analytical engines.

Microsoft Fabric: Core Components

Fabric provides an exhaustive set of features, ranging from integration tools, a Spark-based analytics platform, to a real-time analytics tool, all boosted by an upgraded Power BI. This facilitates user-friendly visualization and AI-based analytics. Furthermore, Fabric presents a no-code developer interface, enabling users with various experience levels or programming to monitor real-time data.

Fabric offers comprehensive analytics experiences designed to work together seamlessly. Each experience is tailored to an individual user and a particular task. Microsoft Fabric’s core components include:

• Power BI– A Business Intelligence platform that permits organizational users to access all data in Fabric quickly and intuitively, aiding in data-informed decision-making.
• Data Engineering– Provides a Spark platform designed for data engineers to transform large-scale data and democratize data using the lakehouse. Integrating Microsoft Fabric Spark with Data Factory allows notebooks and Spark jobs to be scheduled and orchestrated.
• Data Factory– Integrates the user-friendly Power Query with the scalable Azure Data Factory. This combination provides over 200 native connectors to data sources on-premises and in the cloud.
• Data Science– Facilitates creation, deployment and operational management of machine learning models within the Fabric environment. Integration with Azure Machine Learning includes built-in experiment tracking and model registry. This integration allows enriched organizational data with predictions and business analysts to combine those predictions into their Power BI reports, allowing for the transition from descriptive to predictive insights.
• Data Warehouse– This feature provides SQL performance and scalability, separating compute from storage for independent scaling of both components. It also includes native data storage in the open Delta Lake format.
• Real-Time Analytics– Observational data collected from various sources like apps, IoT devices and human interactions is an expanding data category. Real-Time Analytics manages high volumes of semi-structured data with shifting schemas.

It is important to acknowledge that most of these new features are still currently in preview. In this phase, the features afford an exciting glimpse into the future of data integration, management and analysis, providing the potential to redefine the handling of large-scale data operations.

OneNeck, a Microsoft CSP for Today and Tomorrow

At OneNeck, we’re proud to be an experienced and trusted Microsoft CSP. Our partnership aims to bring the best technology and services to our clients, helping organizations navigate the world of data more efficiently and effectively.

Don’t wait to leverage the Microsoft suite of cloud services, including innovations such as Fabric, in your data operations. Connect with OneNeck to learn more about how we can help you excel in the Modern Workplace and stay ahead of the curve in this ever-evolving digital landscape.

Contact us today to speak to one of our experienced Microsoft experts.

5 IT Solutions to Automate Your Production Facility

The latest phase in manufacturing, known as Industry 4.0 or the Fourth Industrial Revolution, refers to the use of smart automation and connectivity in a production environment. By utilizing the Internet of Things (IoT) to connect computers to machines, facilities can automate production while leveraging data and analytics, enhancing human interaction with machines and improving efficiency and productivity.

What are Industry 4.0 Solutions for Manufacturing?

Industry 4.0 IT solutions for manufacturing are cutting-edge technologies that enable data sharing and automation by connecting machines and computers — leading to today’s “smart factories.”

Along with improved robotics and IoT connectivity, smart factories may employ additional digital solutions. These may include automated diagnostic tools, remote monitoring, predictive maintenance, augmented reality (AR) and virtual reality (VR), and mobile and web apps.

Automation and connectivity in smart factories lead to improved production reliability and precision, and a more agile, flexible, and efficient production environment.

5 Foundational IT Solutions for Manufacturing

Implementing Industry 4.0 smart manufacturing processes can help companies achieve continuous improvement goals such as reducing downtime, improving supply chain traceability, and increasing speed to market. However, Industry 4.0 doesn’t just happen. Management must identify opportunities, choose from various technological and digital solutions, and implement the ones that address the highest priority functions.

Here are five foundational IT solutions for manufacturing to consider as your organization prepares to implement Industry 4.0 in your factory.

1. Cloud & Hybrid IT: Cloud computing enables manufacturers to store and access data and applications on remote servers. This internet-based solution eliminates the need for on-premises infrastructure, providing an affordable, flexible, and scalable solution. Combining cloud and on-premises systems results in a hybrid IT solution, allowing organizations to leverage the benefits of both.
2. Colocation: Manufacturers can rent servers and other hardware space at a third-party provider’s facility, allowing them to outsource physical infrastructure while retaining control over their IT systems. Colocation can also assist manufacturers by providing redundancy for disaster recovery.
3. Application Modernization: In manufacturing, application modernization is the process of updating or replacing legacy software and systems to ensure compatibility with modern technology. This can include migrating on-premises software to the cloud, implementing software-as-a-service (SaaS) solutions, and using technologies like artificial intelligence (AI) and machine learning (ML). Application modernization enhances the functionality and efficiency of equipment, frontline workers, and supply chain while optimizing processes.
4. Virtualization: Virtualization technology enables manufacturers to use a single physical server to run multiple virtual machines or operating systems. This reduces costs while improving hardware utilization and scalability. Virtualization also helps support flexible work arrangements by enabling the creation of virtualized desktops, allowing employees a secure way to remotely access applications and data.
5. Digital Transformation: Digital transformation is the integration of digital technologies across all aspects of a manufacturing organization, fundamentally changing how it operates. It can cover many different initiatives, such as adopting Industrial Internet of Things (IIoT) devices for real-time data collection and predictive maintenance, leveraging analytics for informed decision-making, and implementing automation and robotics to streamline processes and increase productivity.

The Future of Manufacturing Starts with OneNeck

These foundational IT solutions for manufacturing are a starting point when planning for the digital transformation necessary to thrive in today’s technology-driven landscape. Moving to Industry 4.0 offers enticing long-term benefits including continuous improvement and cost savings.

Don’t walk this path without a partner that can guide you through the journey. At OneNeck, we have helped manufacturing companies like yours jump into action with innovative solutions.

• Migrations to cloud, multi-cloud, and hybrid environments
• Colocation for managing the cost of expanding data centers
• Cybersecurity products and services to reduce downtime and risk
• Digital transformation and application modernization
• Connected machines and devices

In today’s competitive, rapidly evolving manufacturing environment, organizations that embrace digital solutions are better able to weather any storm. Let OneNeck IT Solutions help you navigate your organization’s transition to Industry 4.0.

Read more about IT solutions for the manufacturing industry, and learn how OneNeck can help provide solutions right for your factory.

You’ve likely recently come across a warning from the FBI about the risks of using public USB ports. It is a healthy reminder of the ever-present threat of hackers and the need to practice good general security habits, especially when traveling. In this blog, we’ll discuss crucial tips for maintaining digital privacy and data security while traveling, whether at an airport, coffee shop hotel or any public setting. After all, protecting personal and business data is always a shared responsibility.

Public USB Port as a Risk to Data Security

The specific FBI caution against using public USB ports centered around “juice jacking.” While juice jacking is just one method for the corruption of USB ports, it is a particularly deceptive technique in which hackers use public charging stations to access a device’s data or install malware. Connecting a device to a compromised charging port or using a tampered charging cable allows attackers to potentially access the device’s data, passwords and other sensitive information. In some cases, they might even install malware that can remotely control the device, monitor activities, encrypt data and demand a ransom.

So, what can you do to protect yourself from these attacks? The most straightforward practice is always to carry a wall port to plug your USB cable into. This basic precaution can go a long way in helping you avoid potential breaches and compromised devices.

There are still options when traveling internationally or if you cannot access a plug-in power source. You can bring a USB battery pack or use a personal USB cable to charge directly from another of your devices. Another option is a charge-only USB cord, known as a “USB condom.” These protective items are an affordable and effective solution that significantly reduces the risk of compromising your data while charging devices.

One other essential note, it’s crucial to keep your device’s software up to date since outdated software is more vulnerable to attacks. Installing security patches and system updates as soon as they become available safeguards your device against known vulnerabilities.

Data Security While Traveling

It’s important to note that public USB port risks are not the only data security threats faced when traveling or in public settings. In addition to these threats, other potential risks exist, such as shoulder surfing and cyber-attacks through seemingly trustworthy Wi-Fi networks.

As a traveler or someone frequently in public settings, it is essential to be aware of these diverse risks and adopt a comprehensive approach to protecting data. These precautions include being careful about the networks you connect to, the information you share and how you handle devices in public spaces.

VPNs and Wi-Fi Security

Free Wi-Fi networks, often found in airports, hotels and coffee shops, pose significant problems. These networks frequently lack proper management, making them vulnerable to security threats from bad actors waiting for easy targets. Additionally, they likely don’t encrypt or protect browsing traffic, and might require the sharing of some personal information to gain access. If possible, consider using a personal hotspot from mobile device to ensure the greater security. Using a personal hotspot lets you control the network you’re connecting to, making it less likely for hackers to intercept data.

Using a virtual private network (VPN) to secure your internet connection is essential when away from home or office networks. A VPN establishes an encrypted tunnel between your device and the internet, protecting data from potential eavesdroppers and hackers. When selecting a VPN service, choose one with a strong reputation, end-to-end encryption and a no-logs policy. “No-logs” means the VPN provider doesn’t store information about online activities, ensuring your privacy remains protected even if the provider is compromised.

Privacy Screens

Physical security is also essential while traveling. You never know who might be looking over your shoulder in crowded places like airports or busy coffee shops. A skilled attacker can capture astonishing amounts of information by observing your screen.

To protect privacy, consider using a privacy screen on your devices. These screens make it difficult for others to see your screen from an angle, helping to prevent unwanted snooping. Privacy screens offer a relatively inexpensive and easily available solution that provides further security for your devices.

Protecting Sensitive Company Information

Your company’s security protocols, domain names, email addresses, applications and intellectual property are potential cyberattack targets. When traveling, it’s essential to stay vigilant in safeguarding this information, as it can be used to craft targeted attacks against your business or colleagues.

Exercise additional caution when using devices in public spaces, as cell phones with high-quality cameras can easily capture images of your screen or record conversations for later review. Always be mindful of your surroundings and take extra precautions to secure your company’s sensitive information.

Follow Company Protocols

Always follow your company’s guidelines for accessing and storing sensitive data while traveling. These procedures may include using encrypted devices or secure cloud storage services to protect your files. It’s also important to keep track of any physical documents containing sensitive information, as they can be easily lost or stolen during transit.

Ensure the use of strong, unique passwords for all accounts and enable multi-factor authentication (MFA) whenever possible. MFA adds an extra layer of security by requiring additional verification methods, such as a fingerprint or a one-time code sent to your mobile device.

If your devices are lost or stolen, enable remote wipe capabilities. This feature lets you erase all data from your devices remotely, preventing unauthorized access to sensitive information. Many organizations will require this as a standard component of device setup.

Protecting Personal Information on the Go

Ensuring data security while traveling is a shared responsibility that requires vigilance and good habits. You can better protect personal and business data from potential threats by following the tips outlined here. Always use your charging equipment, connect to secure networks through a VPN, use privacy screens and be cautious with sensitive information. By adopting these everyday security practices, you can enjoy peace of mind and focus on making the most of your travels. Stay safe and make digital security a top priority.

Data Security with a Trusted Partner

Protecting your personal or company data is always more effective when collaborating with a trusted partner. OneNeck offers a comprehensive approach to security services, ensuring the safety of your organization’s data in the cloud, on-premises, or within a hybrid environment. In addition, we provide practical security awareness training through extensive collaborations with trusted partners. This training educates users, effectively reducing risk and enhancing your organization’s security culture.

Ready to enhance your personal and organizational security? Contact us today to speak with a OneNeck security expert and take the first step toward a more secure future.

Secure Boot Security Bypass Vulnerability:

May greeted us with a significant security vulnerability concerning Secure Boot. As a critical security feature, Secure Boot ensures that machines boot using only software trusted by the Original Equipment Manufacturer (OEM). This month brought the identification and subsequent patching of a security bypass vulnerability (CVE-2023-24932) that could compromise the integrity of devices with Secure Boot enabled.

Our standard practice does not involve enabling Secure Boot on OneNeck-built servers. As such, our team is not planning on providing manual action for this update. However, customers who have enabled Secure Boot on their servers should take this vulnerability seriously. We strongly recommend reviewing the related documentation and taking any necessary actions to safeguard your systems. Our Service Desk is readily available to assist our customers with any questions or assistance in their environment.

Exchange Server Updates and EOL Announcements:

This month also brought important updates for Microsoft Exchange Server.

Firstly, Microsoft has released a new Cumulative Update for Exchange Server 2019. For customers contracted with OneNeck for Exchange Management and running this version of Exchange, we will apply this update on your behalf.

In other news, Exchange Server 2013 has now reached End of Life. This designation means that Microsoft will no longer provide patches for this version of Exchange. Thus we recommend customers move away from this version to avoid potential security risks.

Meanwhile, Exchange Server 2016 has transitioned from Mainstream Support to Extended Support. While it is still receiving security updates from Microsoft, starting to plan for the future is essential. We will continue to apply these security updates for customers contracted with us for Exchange Management.

At OneNeck, we encourage all customers to upgrade to Exchange Server 2019 to benefit from the latest features, improved security and continued support. For those unsure how to proceed with the upgrade, our Service Desk will guide you through the process.

Introducing the New Local Administrator Password Solution (LAPS)

Lastly, we’d like to highlight the release of a new version of LAPS last month. This latest iteration extends support for Windows 10 & 11 and Server 2019 & 2022 and introduces new features for Azure Active Directory.

LAPS provides a simple, automated solution for managing local administrator passwords, reducing the risk of security breaches resulting from compromised credentials. If you want to deploy LAPS in your environment or have any questions about its features, please contact us at any time for assistance.

OneNeck Has Your Back!

As always, our goal at OneNeck is to help you navigate the ever-changing landscape of IT. We remain committed to providing you with the latest updates and ensuring your systems are secure, reliable, and optimized. Thank you for your continued trust in OneNeck.

Stay tuned for more updates next month!

In a time where digital transformation often determines the course of business, efficiency and agility take center stage. Today, companies worldwide aim to streamline operations, heighten productivity and foster collaboration. In this fast-paced, ever-evolving landscape, businesses continually seek for innovative tools to keep them ahead of the competition and aligned with strategic objectives. Enter Microsoft Power Pages.

Microsoft Power Pages®,  is a dynamic component of Microsoft’s Power Platform®. This formidable yet accessible tool enables businesses to generate custom web pages swiftly and intuitively. It facilitates a streamlined workflow and democratizes the web application development process. Read on to discover how you can leverage the transformative power of Microsoft Power Pages to drive your business forward.

Microsoft Power Pages: What’s in It for You?

Power Pages is a web-based, low-code platform that offers a user-friendly solution for individuals to create, share and collaborate on custom web pages within their organization. It bridges the gap between IT and non-IT staff, fostering innovation and agility throughout your business. This inclusive approach facilitates innovation and agility in your business, making adaptation to new challenges and opportunities easier.

A principal feature of Power Pages is its seamless integration with the broader Microsoft Power Platform, including Power Apps, Power Automate, Power BI and other Microsoft applications such as Microsoft 365, Dynamics 365 and Azure. This integration allows businesses to create comprehensive solutions that help improve efficiency and streamline workflows. Power Pages helps reduce bottlenecks and enhances productivity by enabling smooth data and process flows across platforms, supporting your organization’s digital transformation efforts.

Key Benefits of Power Pages

• Accelerated Development– The low-code approach enables the rapid creation and deployment of web applications. Users can drag and drop elements into a web page, reducing the need for extensive coding knowledge, thus accelerating development.
• Enhanced Collaboration– Multiple users can work on different aspects of a single site. While one member is creating a data source, another adds content and a third works on the site’s workflow. This collaborative approach breaks down silos and enables a more unified approach to problem-solving.
• Streamlined Workflows– The seamless integration with other Microsoft applications enables end-to-end solutions that automate processes and reduce manual tasks. Whether using Microsoft 365, Dynamics 365 or Azure, Power Pages tap into these platforms to improve workflows.
• Reduced IT Burden– Empowers non-technical employees to create custom web applications, reducing the reliance on IT departments. This democratization of development helps organizations save time and resources, freeing IT professionals to focus on more complex tasks.
• Improved Data Management– Integration with tools like Power BI and Dynamics 365 centralize and streamline data handling processes, allowing for a more unified approach to data analysis. This integration makes it easier for organizations to glean insights and make data-driven decisions.

The Practicality of Microsoft Power Pages

Power Pages offers a platform tailored to diverse organizational needs, serving as a flexible tool for a variety of processes. For instance, it can assist in creating customized web pages that serve specific purposes, such as data collection or customer interaction. By integrating with Dynamics 365 or other CRM solutions, automation of routine tasks such as updating information can be accomplished, reducing manual input and the potential for errors.

Furthermore, Power Pages can assist in automating internal processes. This could involve creating web applications that handle specific tasks, like onboarding new team members or managing various organizational tasks. Power Pages helps ensure data accuracy and streamlines processes by integrating with existing software tools.

Through OneNeck, I was personally involved in a use case that illustrates the practical benefits Power Pages provides. My team at OneNeck successfully utilized it to create a request portal for our parent company, TDS, delivering customers a seamless and personalized support experience. The integration with Power Automate enabled the automation of support ticket routing, ensuring quick and efficient resolution of customer inquiries.

Users submit requests to TDS employees using a customized form on a Power Pages site.

Unleashing the Full Potential of Power Pages

To maximize the app’s potential, here are some additional tips:

• Frequent Training and Development– Regular training sessions help your team stay current on the latest Power Pages features and capabilities. Encourage your employees to experiment and explore the tool to identify new strategies within your organization. Need a place to start? Microsoft provides extensive documentation.
• Collaborate Across Departments– Foster cross-departmental collaboration using Power Pages. Teams within your organization may find different uses for the tool. Sharing these insights and applications can lead to innovative solutions.
• Leverage Microsoft Integrations– Fully integrate Power Pages seamlessly with other Microsoft tools. This integration can streamline workflows and processes across your entire organization.
• Stay Updated– Microsoft frequently updates Power Pages with new features and improvements. Ensure you are up-to-date with these developments to harness the tool’s full potential.

Driving Business Success 

Microsoft Power Pages provides a robust, low-code platform for businesses to create custom web applications that improve efficiency, streamline workflows and enhance collaboration. By leveraging the capabilities of Power Pages and its seamless integration with other Microsoft applications, organizations can drive growth in an increasingly competitive landscape.

Whether you are a small business looking to maximize its resources through streamlined processes or an enterprise seeking to enhance collaboration, Power Pages offers a flexible, robust solution tailored to your needs. If you’re ready to experience the benefits of Microsoft Power Pages, don’t wait. Our experienced team at OneNeck is ready to help you unlock its potential. Contact us today and learn how we can help you make the most of your Microsoft investment.

Just a decade ago, IT professionals were abuzz about “the cloud.” Today, more than 60% of corporate data is stored in the cloud, and by 2025, research suggests that more than 200 zettabytes of data will be stored in the cloud — roughly half of all the world’s data.

Managed cloud storage solutions can help organizations safely, securely, and efficiently house their data without requiring additional staff or expensive capital expenditures (CapEx).

In this blog post, we’ll explore what managed cloud storage is and provide some examples of how businesses can use it.

What is managed cloud storage?

Managed cloud storage is a service provided by a third-party organization in which the provider manages the entire storage infrastructure — including hardware, software, and data management responsibilities. Common cloud management operations include cloud migration, service optimization, and security monitoring that help companies offload the responsibility of installing and maintaining storage infrastructure so they can focus on core business activities.

What’s an example of managed cloud storage?

Many well-known companies offer managed cloud storage services on a subscription basis in which the provider charges a fee based on the amount of storage used. Popular managed cloud storage services include Google Cloud Platform, Amazon Web Services (AWS), Microsoft Azure, and Oracle Cloud.

These services enable an organization to conveniently and securely store important information such as data from their customer relationship management (CRM) or enterprise resource planning (ERP) platforms off-site and managed by someone else.

Managed vs. Unmanaged Cloud Storage

Unlike managed cloud storage, unmanaged cloud storage is the sole responsibility of the company that owns the data. With unmanaged cloud storage, an organization is responsible for selecting a data center and deploying the storage array. The company is also responsible for increasing storage capacity, updating and upgrading infrastructure, and troubleshooting any issues that arise.

How to Choose the Best Cloud Storage Management Solution for You

As cloud storage continues to gain popularity, businesses have a wide range of cloud storage options available. Determining which is the best for your business frequently comes down to a handful of specific factors. Here are some steps to take when choosing a cloud storage management provider.

Determine the location of the data center

Cloud-based storage solutions require a data center to house the physical infrastructure upon which virtualized infrastructure can be run. Choosing the right data center is often a matter of its location.

A data center’s proximity to sufficient power and connectivity services is an important consideration when choosing a location. Having adequate power helps to ensure that storage systems can run uninterrupted as expected, while proximity to public cloud provider availability zones is necessary for maintaining a strong, stable connection to cloud resources.

Evaluate the provider’s security features

Data privacy and security are paramount in today’s high-risk, data-driven business landscape. Cyber attacks continue to increase in frequency and sophistication, causing an average of nearly $4.5 million worth of damage per incident, leading governments to impose regulations such as GDPR in Europe and CRPA in California to compel organizations to bolster their data security efforts.

For organizations using managed cloud storage, it’s important to evaluate the various security safeguards the provider has in place. These measures include physical security at the data center site to prevent unauthorized access to storage hardware, as well as software-enabled security like network intrusion detection, built-in firewalls, and advanced data encryption.

Look at performance data

Like other areas of a business, managed cloud storage should be evaluated with measurable performance data. Cloud storage systems are typically measured by the data transfer rate to and from storage media, which is an indication of the overall performance of the system.

It’s also important to look at broader performance metrics such as service availability (measured in “nines”) and how quickly the storage system comes back online following an outage or interruption, called recovery time objectives (RTOs).

Assess integrations and APIs

One of the biggest benefits of managed cloud storage is that it enables any user to access information from virtually anywhere. But for that to happen — accessing, adding, updating, or deleting data from cloud storage — applications must connect to the data store via an Application Programming Interface or API.

APIs typically come in either a REST (Representational State Transfer) or SOAP (Simple Object Access Protocol) architecture. Regardless of the design, it’s important that your managed cloud storage provider offer a wide variety of APIs, as each storage system must be connected by purpose-built APIs for that storage unit.

In general, a managed cloud storage service provider with a broader range of APIs will offer a more flexible and robust suite of solutions for your business.

Forward-thinking Infrastructure for Growing Organizations

Managed cloud storage is an excellent way for businesses to offload their storage infrastructure management tasks and focus on their core business activities. Managed cloud storage providers can help businesses reduce operating costs while improving scalability and data security that enable greater and more sustainable growth.

Download our Ultimate Buyer’s Guide to Managed IT Services to learn more about managed cloud storage and other essential solutions.

The Internet of Things (IoT) has become a vital part of the healthcare industry, greatly impacting patient interaction and treatment. These connected devices collect and transmit patient data, allowing providers to monitor and manage patient health more effectively. However, the widespread adoption of IoT in healthcare exposes the industry to new risks, leading to a surge in security threats.

A 2023 SonicWall Cyber Threat Report shows that malware attacks against IoT in the medical field increased by 123% in 2022. The result is a significant threat to the privacy and safety of patient information.

Data Collection Through IoT in Healthcare

IoT devices are now nearly ubiquitous in the medical field, collecting patient information to improve diagnosis, treatment and overall care. Some of the most common types of data collected are:

• Vital signs– IoT devices can continuously monitor patients’ heart rate, blood pressure, oxygen saturation and other vital signs, allowing healthcare providers to track real-time health status.
• Activity levels– Wearables and sensors track patients’ movements and activities, providing insights into daily routines, exercise habits and sleep patterns.
• Medical device data– Connected devices, such as insulin pumps and pacemakers, transmit data on their operation and status, enabling doctors to monitor performance and make necessary adjustments remotely.
• Health history– Electronic health records (EHRs) store patients’ medical histories, including previous diagnoses, treatments and medications. Providers can access and update this information, improving care coordination and decreasing the risk of errors.

Healthcare IoT Security Risks and Protecting Patient Data

This significant increase in IoT malware attacks against the healthcare sector is particularly concerning when viewed in the context of a Cynerio 2022 State of Healthcare IoT Device Security report. This study revealed that 53% of hospital IoT devices have security vulnerabilities. Devices that fell into the most vulnerable category included IV pumps, VoIP phones, ultrasounds, medicine dispensers and IP cameras.

These weaknesses pose significant risks to both patients and healthcare providers. One primary risk is data breaches. Cybercriminals exploit IoT security vulnerabilities to gain access to sensitive patient data, leading to identity theft, fraud or other malicious activities.

Another risk is ransomware, where attackers can encrypt patient data and demand payments in exchange for release. These attacks can disrupt healthcare operations and in extreme cases potentially endanger patients’ lives.

Device manipulation is an additional security risk. Cyberattackers can compromise IoT devices, altering their functionality and putting patients in jeopardy of receiving incorrect treatments or experiencing adverse health events. This type of threat not only endangers patient safety but can also undermine faith in the healthcare system as a whole.

Safeguarding Patient Information with Security Best Practices

To safeguard patient data and maintain the advantages of IoT devices in healthcare, healthcare providers must take a proactive approach to implementing security measures. These include:

• Periodically reviewing IoT devices to identify potential vulnerabilities and prioritize security updates.
• Encrypting patient data at rest and in transit to safeguard it against interception and unauthorized access.
• Implementing robust authentication methods, such as two-factor authentication, helps protect IoT devices and ensure only authorized personnel access patient data.
• Healthcare providers should work closely with IoT device manufacturers and software vendors to promptly apply security patches and updates.
• Providers must ensure staff are well-versed in cybersecurity best practices. Knowing the risks associated with IoT devices is crucial in creating a culture of security awareness.
• Developing a comprehensive incident response plan helps healthcare organizations quickly identify, contain and remediate security breaches, minimizing their impacts.
• Healthcare providers must comply with industry-specific regulations, such as HIPAA, which sets strict criteria for safeguarding patient data and protecting privacy.

Building a Secure Future for IoT in Healthcare: Partnering for Success

IoT devices have transformed the healthcare sector, providing real-time data that enables providers to manage patient health more efficiently and effectively. However, the growing reliance on connected devices presents unique challenges in ensuring the privacy and safety of patient information. By implementing robust security measures and maintaining a proactive approach to risk management, healthcare organizations can harness the benefits of IoT technology while safeguarding the trust and well-being of their patients.

Securing your IoT devices, while extremely important, is just one part of healthcare security. OneNeck recognizes the critical nature of securing patient data and is dedicated to offering holistic security services that adhere to the strictest compliance standards. By partnering with OneNeck, healthcare organizations can update legacy systems, implement securely architected cloud solutions, design and implement robust backup and DR services, develop incident response plans and ensure continuous alignment with regulatory requirements.

Ready to talk to a security expert? OneNeck is here to help. Contact us today to discuss how you can better protect sensitive patient data and maintain a secure and healthy environment.

As of October 10, 2023, Microsoft is retiring support for the following platforms (both physical and virtual):

• Windows Server 2012 x64 (all editions)
• Windows Server 2012 R2 x64 (all editions)

So, what does this mean for you and your organization? There are potentially serious impacts if you opt to skip the upgrade:

• Microsoft will no longer release security or quality updates for these platforms after October 10, 2023, which affects monthly patching.
• Cloud Solution Providers (CSPs) like OneNeck will no longer be able to provide support escalation to Microsoft, which reduces support SLAs and the level of urgency to “best effort” support.
• Third-party applications used for endpoint management, monitoring and backups may drop support for these platforms and, as a result, your CSP may be unable to provide these third-party applications to support your Windows 2012 servers.

Bottom line: Windows Server is too important to risk downtime, so it’s time to migrate.

Windows Server Migration Options

Microsoft has advised that the following Windows Server platforms are suitable upgrade/migration replacements for these end-of-life platforms .

• Windows Server 2016 x64
• Windows Server 2019 x64
• Windows Server 2022 x64

Below is a summary of the Support Lifecycle for these supported platforms:

We can help!

At OneNeck, we know migrations can get complex fast, but we’ve pretty much seen it all and would love to help you determine your ideal-fit option and build an actionable plan to get your Windows Server current. So, contact us or your account rep today, and let’s help your Windows Server 2012 off the stage…

In today’s fast-paced business environment, data is golden. Businesses need to manage their data and provide advanced analytics in real-time. Enter the Microsoft Intelligent Data Platform, a unified solution that transforms data into insights and helps businesses succeed. The best part is that you likely have access to much of it already.

Nearly one year ago, Microsoft introduced its Intelligent Data Platform. The platform was designed to integrate their database, analytics and data governance offerings, bringing different types of operational and analytical data together while allowing for greater understanding and discoverability of organizational data. This is accomplished as end-users work together on shared data, primarily using tools with which they are already familiar.

What Is The Microsoft Intelligent Data Platform?

The Intelligent Data Platform is a comprehensive suite of services and tools that empower organizations to manage, analyze and derive insights from their data by offering a unified approach to management, analytics and AI. The platform consists of several key components, including Azure Synapse Analytics, Azure Purview, Azure Machine Learning, Azure Cognitive Services and Power BI. These tools and services create a seamless data experience, enabling businesses to ingest, prepare, manage, analyze and visualize data across various sources.

Microsoft: https://news.microsoft.com/build2022/

Operational Databases

• SQL Server 2022– SQL Server is a powerful, scalable, and secure relational database management system. It offers advanced analytics, high availability and robust security. SQL Server is designed to efficiently handle mission-critical workloads and can be deployed on-premises, in the cloud or in a hybrid environment. Integrating SQL Server 2022 with the Microsoft Intelligent Data Platform allows organizations to manage and analyze their relational data effectively and efficiently.
• Azure SQL Services– A cloud-based relational database service, Azure SQL Database provides built-in intelligence, scalability and high availability. Azure SQL Managed Instance is a fully managed instance of SQL Server that provides near 100% compatibility with on-premises SQL Server. Azure SQL Edge is an optimized, small-footprint version of SQL Server designed for edge computing and IoT scenarios. The Azure SQL services seamlessly integrate with the Microsoft Intelligent Data Platform, enabling organizations to leverage the power of SQL Server in the cloud and quickly scale data workloads.
• Azure Cosmos DB– A multi-model database service designed for building highly available, scalable, and responsive applications. It supports various data models, such as document, key-value, graph, column-family and multiple APIs. By integrating Azure Cosmos DB with the Microsoft Intelligent Data Platform, businesses can easily manage and analyze their data across various data models and APIs, ensuring a versatile and robust data management solution.
• Azure Arc Data Services– Extends the capabilities of Azure data services to hybrid and multi-cloud environments. Azure Arc Data Services simplifies the deployment, management and monitoring of data services across environments with a unified control plane and consistent management experience. Organizations can implement governance policies, security configurations and monitoring solutions consistently across all their data workloads, regardless of where they are deployed.

 Analytics

• Azure Synapse Analytics– Azure Synapse Link for SQL, added in SQL Server 2022, provides a seamless data pipeline to Azure Synapse Analytics. This service allows organizations to ingest, prepare and manage data for immediate business intelligence and machine learning needs. With its serverless SQL pools, Azure Synapse Analytics enables businesses to query data on their terms. In addition, Azure Synapse Analytics supports real-time data processing, allowing companies to analyze data and gain insights, which is crucial for making data-driven decisions.
• Power BI– A business analytics tool that enables users to visualize and share insights from their data. With its easy-to-use interface and customizable visualizations, Power BI allows businesses to create interactive reports and dashboards, shareable across the organization. Power BI connects to on-premises and cloud-based databases, files and APIs, providing a seamless experience for data analysis and visualization. Furthermore, Power BI integrates with Azure Synapse Analytics, enabling businesses to gain insights from their data and make data-driven decisions more efficiently.
• Azure AI– A collection of artificial intelligence (AI) services designed for developers and data scientists. The portfolio includes Azure Machine Learning (a comprehensive service that allows organizations to build, train and deploy machine learning models) more efficiently. Automated machine-learning capabilities streamlines model selection and hyperparameter tuning, making it easier for data scientists and developers to collaborate on AI projects.

Governance

• Microsoft Purview– A data governance service that helps organizations discover, understand and manage their data across on-premises, multi-cloud and SaaS environments. With its automated discovery, classification and management capabilities, Microsoft Purview (formerly Azure Purview) enables businesses to comprehensively understand their data landscape, ensure compliance with data protection regulations and reduce the risk of data breaches. Azure Purview also integrates with Azure Synapse Analytics, providing a seamless experience for data discovery and governance.

Bringing Together Data Services

The Microsoft Intelligent Data Platform brings together all of Microsoft’s key data services, creating a unified solution for managing, analyzing, and deriving insights from your data. Services such as SQL Server 2022, Azure SQL, Cosmos DB, Azure Synapse, Power BI, Microsoft Purview and more may already be a part of your data ecosystem. However, using these services together effectively is often a challenge.

The primary goal is to simplify the process of integrating databases and operational data store, analytics and data governance. Sharieff Mansour, General Manager of Microsoft Data, AI and Mixed Reality, states, “Historically, customers have been thinking about each of those areas independent from one another, and what the Intelligent Data Platform does is bring all these pieces together.” Microsoft accomplishes this through a data experience that allows organizations to ingest, prepare, manage, analyze and visualize data across multiple sources and services more efficiently.

In addition to its integration capabilities, the Intelligent Data Platform enables organizations to deploy and manage data services across various environments, including on-premises, hybrid and multi-cloud. This flexibility ensures that businesses can choose the most suitable deployment options for their specific requirements: compliance, latency or cost.

Operational Benefits of the Microsoft Intelligent Data Platform

• Unified Data Management and Analytics– Businesses can manage and analyze data across different sources. This unified approach eliminates data silos and enables faster, more accurate decision-making.
• Advanced Analytics and AI Capabilities– Allows businesses to tap into the power of AI and machine learning for advanced analytics, predictions, and insights.
• Scalability and Flexibility– Designed to grow with your business by providing the scalability and flexibility needed to handle increasing data volumes and changing business requirements.
• Seamless Integration– Integration with other Microsoft products and services, such as M365, Dynamics 365, Power Platform and Azure, creates a cohesive data ecosystem that drives efficiency and collaboration.
• Enhanced Data Governance– Robust data governance capabilities enable businesses to discover, understand and manage sensitive data while ensuring compliance with data protection regulations.

Maximize the Benefits of Microsoft Intelligent Data Platform with OneNeck

The Microsoft Intelligent Data Platform offers organizations an all-in-one solution for managing, analyzing and deriving insights from their data, enabling them to make faster, data-driven decisions and stay ahead of the competition. Its unified approach to data management, analytics and AI empowers businesses to unlock the full potential of their data estate and transform operations.

As an experienced and knowledgeable Microsoft CSP, OneNeck IT Solutions can help you harness the power of the Microsoft Intelligent Data Platform, delivering performance benefits across your entire organization. So, if your business is looking to stay ahead in the data-driven world, considering adopting the Microsoft Intelligent Data Platform or simply interested in implementing M365 as a part of your modern workplace, Contact Us today to speak with one of our Microsoft experts.

As organizations embrace cloud services and remote work to fuel business growth, they must reassess conventional security measures to safeguard sensitive data, applications and resources. Microsoft Azure Active Directory (Azure AD) offers Conditional Access as a powerful security solution, allowing companies to control access through user identity, device, location and other contextual variables. This blog delves into Conditional Access policies, examines their significance for cybersecurity and discusses how they can enhance an organization’s security posture.

Understanding Conditional Access Policies

Conditional Access policies, at their most basic, are if-then statements; if a user desires to access a resource, they must complete an action. Example: A remote employee wants to access the company’s intranet portal and is required to connect through a secure VPN.

Conditional Access policies are rules and conditions within Azure AD that help organizations manage access to resources, applications and data. They enable administrators to enforce granular access controls based on the user’s access requests context, such as their device, location or risk level. The policies consist of several components, including assignments that specify the users, groups and applications to which a policy applies. Conditions determine the circumstances for policy enforcement, while access controls define the actions taken when a policy is triggered.

Once first-factor authentication is complete, the system applies Conditional Access policies. While Conditional Access does not serve as an organization’s first line of defense for scenarios like denial-of-service (DoS) attacks, it can utilize signals from these events to determine access. – Microsoft

Importance for Cybersecurity

Conditional Access improves an organization’s cybersecurity posture for several reasons:

• Context-Aware Security – By considering user identity, device and location factors, organizations can make informed decisions about granting access and minimizing the risk of unauthorized access to sensitive data.
• Adaptive Authentication – Implementing adaptive authentication mechanisms, like multi-factor authentication (MFA) when necessary, provides an additional security layer, especially during access to crucial resources, by adjusting authentication requirements based on contextual factors such as user behavior, device, location, time and other risk indicators.
• Simplified Management – Azure AD’s centralized management console allows administrators to easily create, modify, and enforce organizational policies. This ability streamlines the process of managing access controls and reduces the likelihood of misconfigurations or security gaps.
• Compliance Assurance – Organizations with strict compliance requirements can enforce specific access controls for regulated data and applications, thus meeting regulatory obligations and reducing the risk of fines or penalties.
• Improved User Experience – Dynamically enforcing access controls based on context helps balance security and usability, allowing users to access resources seamlessly while protecting sensitive data and systems.

Implementing Conditional Access Policies in Your Organization

To effectively deploy Conditional Access policies within your organization, start by assessing security needs. Identifying critical applications, data and resources requiring enhanced security helps prioritize the policies to create and apply.

Next, establish access requirements for each sensitive resource, taking into account factors such as user roles, device compliance and geographic location. Create Conditional Access policies based on the defined requirements and test them in a controlled environment before deploying them across the organization. This approach ensures the policies function as intended and do not inadvertently disrupt access for legitimate users.

Regularly monitoring and adjusting your policies is essential to address new risks, changes in the threat landscape or evolving business requirements. Additionally, educating users is crucial. Inform them about the importance of Conditional Access policies and their role in resource protection. Encourage users to follow best practices for secure access, such as using MFA, keeping devices up-to-date and reporting suspicious activity.

Finally, integrate Conditional Access policies with other security solutions in your organization, such as threat intelligence, data loss prevention (DLP) and identity and access management (IAM) tools. This integration delivers a more comprehensive security approach.

Break the Glass Account

A “Break the Glass” account is an emergency account created within an organization’s IT environment to ensure continued access to critical systems and resources in case of unforeseen events. These emergencies could include a significant security incident or a misconfiguration in Conditional Access policies. These accounts must be created with highly privileged access and strong security controls.

The necessity of a Break the Glass account when using Conditional Access lies in the possibility of accidentally locking out administrators or users from essential resources, applications or services due to policy misconfigurations or unexpected changes in the organizational environment. In such situations, the Break the Glass account serves as a failsafe that allows designated personnel to regain access and rectify the issue, ensuring business continuity and minimal disruption. These accounts are also crucial to an effective incident response plan, enabling organizations to respond quickly to and recover from security breaches or other critical incidents.

Final Thoughts on Conditional Access Policies

Conditional Access is a basic and necessary component of modern cybersecurity strategies. By implementing context-aware access controls and adaptive authentication mechanisms, organizations can balance security and usability, allowing users to access resources when needed while protecting sensitive data and systems. As a fundamental aspect of access management, Conditional Access policies should be a priority for organizations looking to strengthen their security infrastructure.

While Conditional Access policies effectively help combat cyberattacks, they are only one aspect necessary to protect your data. OneNeck understands a holistic approach to security is essential for protecting your organization and its precious resources. As a skilled IT security services provider, we are here to help. Our team can assess your security posture, develop a protection strategy and help better leverage your security investments.

Contact us today to speak with a OneNeck security professional.

As we move into the second quarter of 2023, several important patching updates have been released that warrant attention. These updates include critical Windows 10 & 11 changes, Netlogon Protocol and more. Here are the key updates from April.

Windows 10 & 11 22H2:

Feature Update version 22H2 for Windows 10 and 11 is in its final rollout phase. Microsoft is offering this update to an expanded set of eligible devices running Windows 10, version 20H2, and later versions​. We at OneNeck recommend updating your devices to ensure future security updates install on your systems. This upgrade is not automatic via standard patching, so manual installation is necessary.

Devices that utilize BitLocker require a manual update to the Windows Recovery Environment for Windows 10 & 11. We recommend manually applying this update wherever applicable. If you have questions about how OneNeck can assist you with these processes, please contact the Service Desk.

Netlogon Protocol Changes – CVE-2022-38023:

Windows has released significant updates to address the Netlogon protocol vulnerability (CVE-2022-38023). This security patch for Domain Controllers was first included in the November 8, 2022, and later Windows updates, with the initial enforcement phase starting on April 11, 2023. Beginning in June 2023, Enforcement mode will be enabled on all Windows domain controllers and will block vulnerable connections from non-compliant devices. By July 2023, the ability to set the Compatibility mode setting will be removed​.

We recommend auditing for events related to this update. If you have contracted with OneNeck for Active Directory Management, we will notify you if we suspect you might be affected by these changes.

Please note that NetApp has provided guidance regarding the impact of the upcoming patch on ONTAP 9.

Active Directory Permission Updates – CVE-2021-42291:

The final deployment for the Active Directory Permission Updates (CVE-2021-42291) is now scheduled for January 2024, pushed back from the original date of April 2023. If you have questions about how OneNeck can assist you with enabling Audit Mode and monitoring for Events related to this vulnerability, please contact our experts.

Certificate-based Authentication Changes on Windows Domain Controllers:

The final deployment of updates related to certificate-based authentication changes on Windows Domain Controllers is now set for November 2023, moved back from the initial May 2023 date. The initial deployment of this patch for Domain Controllers began in May 2022. If you have questions regarding enabling Audit Mode and monitoring for Events related to this vulnerability, OneNeck is ready to assist.

OneNeck Has Your Back!

As always, we at OneNeck are here to support you through these changes. Reach out to us if you need assistance or have any queries. Stay safe and secure!

Why You Should Stay on Top of Microsoft 365 Data Backups

Businesses everywhere rely on Microsoft 365 for its cloud-based design and advanced collaboration. It is integral to many organizations’ services and workflows.

Sometimes, however, core tools like this can lull customers into a false sense of security. Over 40% of IT organizations say they no longer backup their Microsoft 365 data with third-party applications, even though Microsoft itself stresses the importance of Microsoft 365 data backups. This article discusses six important reasons organizations should always back up their Microsoft 365 data.

Do I need to back up Microsoft 365 data?

Backing up your Microsoft 365 data ensures that no matter what happens, you’ll always be able to recover your important files. Microsoft has some catastrophic guardrails in place in case your entire system crashes, but they don’t protect against accidental deletion or overwriting.

A regular backup schedule based on the frequency you create and update your documents and media will give you more control over your files — and give you significant peace of mind. Performing your own backups also allows for granular recovery, so you can restore a single file or email, rather than overwriting all data.

How often should I do a Microsoft 365 data backup?

Your backup schedule will depend on your organization’s compliance requirements, how often you access and make changes to your data, and how much downtime you can afford in the event of data loss. Downtime cost organizations an estimated $84,650 per hour in 2021. Organizations may need to perform data backups several times a day or as frequently as every five minutes to stay protected and in compliance.

Frequent backups give you up-to-date data recovery in the event of accidental deletions, as well as a recent restore point if a large part of your data is compromised by a ransomware attack.

Who is responsible for a Microsoft 365 data backup?

Microsoft 365 documentation states that Microsoft maintains the 365 application and infrastructure, while the customer is “…responsible for protecting the security of your data and identities, on-premises resources, and the cloud components you control.” That means you’re responsible for data backup and retention.

6 Important Reasons to do Microsoft 365 Data Backups

Here are six important reasons for regular Microsoft 365 data backups in your organization.

• Microsoft 365 Data Backup Reason 1: Accidental Deletion
  We’ve all had that moment when we accidentally hit the “delete” button on a document — and then panicked. Regular backups make it simple to recover accidentally deleted files or emails so you don’t have to start an extensive project from scratch.This is especially important if you’ve accidentally deleted a Microsoft 365 user. Deleting a user account automatically replicates across the network, along with their personal SharePoint site and OneDrive data. Once the account is deleted, it’s gone from the entire network. You can only get user account data back by restoring it from a backup.
• Microsoft 365 Data Backup Reason 2: Internal Security Threats
  Threats from inside the organization may be intentional, such as a disgruntled employee, or unintentional, such as an employee who clicks on a link in a phishing email. In the event of data loss from internal threats, backups let you restore files necessary for daily operations.
• Microsoft 365 Data Backup Reason 3: External Security Threats
  External threats include malware, viruses, and ransomware. These malicious programs can corrupt or delete data and applications, bringing business to a halt. The importance of a Microsoft 365 data backup is that you can restore a clean copy of your data and cut your recovery time.
• Microsoft 365 Data Backup Reason 4: Legal Compliance
  Certain industries and locations require data to be stored for a specified amount of time. For example, the U.S. financial regulation Sarbanes-Oxley has specific data retention rules. Organizations that fail to meet these regulations can be subject to fines and penalties.
• Microsoft 365 Data Backup Reason 5: Outages and Shutdowns
  Off-site data backups are extremely important when organizations experience an unplanned outage or shutdown due to hardware or software failure, or after a natural disaster. Terabytes of data that might have been lost can be restored quickly, getting everyone back on the task of building the business.
• Microsoft 365 Data Backup Reason 6: Overall Business Continuity
  Business continuity is incredibly important for growing businesses with an expanding technology portfolio. Backups let you remain in control of your data and lower your downtime in the event of a data loss due to deletion, threats, or outages.

Does Microsoft 365 Recommend Backups?

Microsoft highly recommends backing up your 365 data. You don’t necessarily need to back up every file but prioritize content that can’t be easily replaced.

Microsoft does back up Microsoft 365 data every 12 hours and keeps it for 14 days. However, if you need to restore from their backup, it will be a full restore — everything will be overwritten. You can’t recover a single data point, like a file or an email.

Safeguard your Microsoft 365 Investment: Backup your Data

No one plans to lose files. But when you need to restore lost data, you’ll be glad you have a robust backup plan.

The importance of Microsoft 365 data backups cannot be overstated. That’s why OneNeck has partnered with Commvault to bring you Metallic^® Microsoft 365 backup to help protect your documents, emails, and conversations.

Metallic backup offers powerful, enterprise-grade Microsoft 365 data protection across Exchange, Teams, OneDrive, and SharePoint data. With Metallic backup, you’ll get seamless SaaS data protection and hassle-free deployment, with 24/7 Microsoft expert support provided by OneNeck (with optional monitoring available).

Learn about how OneNeck and Commvault Metallic keep Microsoft 365 data safe from deletion and attack, with the simplicity of SaaS. Read about our Microsoft 365 backup solution here.

Artificial intelligence (AI) has become indispensable in today’s fast-paced digital world. It permeates virtually every industry, driving innovation, efficiency and transformation. Generative AI, such as the increasingly prevalent ChatGPT, is revolutionizing customer support and engagement, streamlining communication and providing valuable insights. Launched on November 30^th, ChatGPT alone has over 100 million users, making it the fastest-growing application of all time. Not to be outdone, Microsoft and Google have also recently unveiled generative AI tools designed for business.

AI continues to grow in significance and complexity, becoming increasingly integrated into various aspects of business operations. Companies need to invest in educating their workforce, from the CEO to entry-level employees, to ensure they have a solid comprehension of AI technologies. Understanding AI’s uses, limitations and ethical applications is crucial for successful and safe integration. By doing so, organizations can harness AI’s full potential for a more efficient, innovative and responsible future.

Benefits of a Well-Rounded AI Education

Enhancing Team Competence and Confidence

A primary reason to educate your team on AI fundamentals is to enhance their competence and confidence when working with AI technologies. As AI increasingly integrates into diverse business processes, a company-wide understanding of AI basics will undoubtedly be more effective. This knowledge improves productivity and innovation while ensuring the organization can utilize AI fully.

Comprehensive AI education covers aspects such as machine learning, natural language processing, computer vision (including object recognition, facial recognition and video analysis) and deep learning. Providing your team with this foundational knowledge better equips them to use and understand the technology’s complexities.

AI Education Promotes Responsible and Ethical Adoption

Educating your staff is crucial for responsible adoption. A thorough understanding of the potential risks, limitations and ethical considerations enables your team to make informed decisions about when and how to use AI. By fostering responsible adoption, your organization can avoid pitfalls and negative consequences, ensuring successful and sustainable long-term integration.

As the ethical use of generative AI becomes a growing concern, organizations must address the potential consequences of biased or unfair AI systems. Educating your team helps them grasp the ethical implications of AI decisions and actions, ensuring responsible and principled usage. AI instruction should contain principles like fairness, accountability and transparency. By integrating these principles, your team will be more likely to consider the ethical ramifications of AI projects, ensuring decisions align with organizational values and mission.

Mitigating Risks and Ensuring Safe AI Integration

AI, particularly generative AI, has limitations and risks, including biased algorithms, security vulnerabilities and potential data misuse. Education helps employees recognize and address these issues, mitigating risks and ensuring safe and secure integration.

Employees must understand data privacy, security and the potential risks of AI-driven decision-making. This understanding helps ensure the implementation of appropriate safeguards, such as data anonymization and encryption, to protect sensitive information and maintain compliance with applicable regulations.

Fostering Collaboration, Decision-making and Innovation

AI education encourages cross-functional collaboration, innovation and decision-making. A shared understanding enables teams to work together more efficiently and effectively, combining their unique perspectives and expertise.

For example, marketing and sales teams can work together to analyze customer data using AI tools, enabling the development of more targeted campaigns and improved lead conversion rates. Meanwhile, product development and engineering teams can collaborate on AI-driven solutions that enhance product functionality and user experience, accelerating development. Even human resources and management can utilize AI-driven tools to analyze employee performance and engagement data, identifying opportunities for staff development.

Additionally, AI-driven analytics tools help identify patterns and trends in large datasets, enabling companies to make informed decisions about resource allocation, pricing strategies and product development. Moreover, organizations can identify potential bottlenecks and areas for improvement, allowing for more effective problem-solving and optimized workflows.

Attracting and Retaining Top Talent

Organizations that invest in AI education are more attractive to top talent in the industry. In today’s competitive job market, professionals seek companies that provide growth and development opportunities. Offering AI-focused educational opportunities demonstrates a commitment to a culture of continuous learning and staying at the forefront of technology.

Providing access to AI training and resources not only helps to attract new talent but also aids in retaining existing employees. Those who feel supported and encouraged to learn and grow are likelier to stay with an organization, reducing turnover rates and improving performance. Investing in AI education sends a powerful message about the importance of continuous learning and professional development, encouraging employees to stay curious, seek new knowledge and continue growing in their roles.

Preparing for Future Innovation

The world of AI is constantly evolving, with new technologies and applications continuously emerging. Investing in AI education helps prepare your workforce for tomorrow’s technologies, providing them with the foundational knowledge needed to adapt to future developments. This proactive approach will keep your organization at the cutting edge of technology, helping you stay ahead of the competition.

Regularly updating AI education is crucial to keeping your organization up-to-date on recent breakthroughs and trends. This knowledge empowers your company to spot new opportunities and helps leverage emerging technologies. A proactive approach to AI education significantly drives business success, fosters innovation and maintains a competitive edge.

Embracing an AI-powered Future with AI Education

Educating your team on AI fundamentals is an essential investment for any organization looking to thrive in the digital age. This training enhances competence and confidence while promoting collaboration, innovation and safe AI integration. It also helps ensure ethical AI use, attracts top talent and prepares for future developments. Investing in AI education better positions your organization for long-term success in an increasingly competitive and complicated landscape. Don’t wait – empower your team with AI knowledge today and lay the groundwork for a brighter, more innovative, ethical future in artificial intelligence.

Are you interested in learning more about emerging technologies, data modernization or how your organization can thrive in the modern workplace? Check out OneNeck’s Resources for IT Professionals, or Contact Us today to find a hybrid IT solution built for you.

In today’s fast-paced business world, time is of the essence. Whether running a small business or a large enterprise, scheduling appointments, meetings and events can be cumbersome. Fortunately, Microsoft has developed a solution that can help streamline the process – Microsoft Bookings-and it’s likely already included in your licensing.

What is Microsoft Bookings?

Microsoft Bookings is an online scheduling tool that allows businesses to schedule appointments, meetings, and events more efficiently. Bookings is designed for small businesses, but larger companies with multiple employees can also take advantage of it.

Bookings allows businesses to create customized booking pages that are easy to use and accessible from any device. Customers can schedule appointments or make reservations directly from the booking page, which helps to reduce administrative overhead and saves time for both businesses and customers.

Once an organization has enabled Microsoft Bookings, users can set up a Bookings page and share a simple link for creating new meetings while keeping their calendars private.

Why Microsoft Bookings is Useful

A valuable tool for your users and small teams for several reasons. Here are just a few:

• Streamlines Appointment Scheduling– With Bookings, users and small teams can simplify scheduling appointments, saving time and making people happy. Customers like it too – they can schedule appointments online, see your available time slots based on parameters you control, keeping your calendar private without having to spend time on the phone or exchanging emails to set up appointments.
• Improves Customer Experience– Allows businesses to customize appointment types, duration and availability, ensuring customers can easily find a time that works for them. Automatic reminders and appointment confirmations are sent, keeping the customer engaged throughout the process while reducing no-shows.
• Integration with Other Microsoft Products– Bookings integrates seamlessly with Exchange Online and other Microsoft products, such as Outlook and Microsoft Teams. For example, you still view all appointments in your Outlook calendar – requiring no change or additional steps from what you already do today.
• No Time Delays – One of the most significant benefits of using Bookings is the ability to schedule appointments 24/7. Making an appointment can be done anytime, even outside regular business hours. This ability makes sense when you work with partners or clients in different time zones or those with busy schedules who often need to make appointments outside of regular business hours.
• Customization– A customizable tool that tailors itself to what you need to do. You can modify a booking page with branding, service offerings, and basic availability. You can also set up appointment types, duration, and pricing, meaning businesses offer customers a personalized experience that increases satisfaction and loyalty.

Getting Started with Bookings

Microsoft Bookings is part of Microsoft 365 and accessed through a web link. Once your organization turns on Bookings, it doesn’t take long to get a new page set up:

1. Setup a Main Page
2. Create a Calendar
3. Setup Your Service
4. Staff Your Service
5. Customize and Publish Your Booking Page

Congratulations! You now have a personalized page to handle your scheduling needs.

Use Cases for Microsoft Bookings

End users in virtually any industry can find value in Microsoft Bookings by utilizing it to streamline appointment scheduling processes and improve their customer experience. Here are just a few examples:

• Healthcare Providers– Providers can customize their booking page with availability, service offerings and pricing, allowing patients to easily schedule appointments or consultations while reducing wait times. Patients can select a date and time that works best for them and receive a confirmation email with all the necessary details. This customization helps boosts efficiency and allows the provider to keep their focus on providing quality care and creating stronger patient connections.
• Consulting & Sales– Businesses can easily set up and manage client meetings, customizing appointment types, duration, and pricing to suit their needs. Features like automatic reminders and appointment confirmations help to reduce no-shows and increase efficiency, allowing sales professionals to focus on building relationships and closing deals.
• Education and Training– A useful tool for educational institutions and training centers, permitting them to schedule appointments for visitors, students, or trainees effortlessly. Teachers can present office hours in a format that is easily accessible and understood. At the same time, students can conveniently set up appointments with tutors and classmates or coordinate group meetings.

Ready to Simplify Your Scheduling?

Microsoft Bookings is a helpful tool that can help businesses streamline appointment scheduling, improve customer experience, and increase efficiency. The tool is easy to use and can be accessed from any device, making it convenient for employees and customers.

An experienced Microsoft CSP OneNeck can guide you on how to best utilize Microsoft Bookings and other M365 tools to improve your business’s productivity and efficiency. Whether you are trying to find hidden gems in your existing M365 licensing, need to adjust a current licensing subscription or are considering adopting M365 as your productivity tool of choice, contact us today.

Or you can always Book some time with me.

How Incident Response Planning Helps Contain Cyberattacks

Despite businesses pouring resources into cybersecurity, breaches aren’t going away — or even slowing down. In 2022 alone, companies reported a near-record 1802 breaches, affecting 422.1 million people.

Unfortunately, it’s not a matter of if your data will be breached, it’s a matter of when.

Incident response planning helps your organization prepare for security incidents by outlining objectives, processes, and evaluation criteria your team can follow every step of the way. Your organization’s custom plan will guide you through the aftermath of a breach, assist in recovery, and help you fix the vulnerabilities that led to the incident.

What is incident response planning?

Incident response planning means taking the time before a breach occurs to write down the actions you’ll take after it occurs. The Cybersecurity and Infrastructure Security Agency (CISA) describes an Incident Response Plan as a written strategy, approved by your organization’s senior leadership, that guides your organization before, during, and after a confirmed or suspected security breach.

Why do you need an incident response plan?

Once a breach happens, time is of the essence. You need to stop the attack, minimize the damage, and fix the problem quickly so that you can return to work. That’s why pre-planning is essential. By determining your incident response plan before a breach occurs, you’ll know which employees are responsible for which actions, when, and how they will complete them — speeding up your recovery time.

Having a written incident response plan and securing leadership approval tells your team exactly what to do and who will do it.

How do you write an incident response plan?

Starting your incident response plan with a blank page can be difficult. Instead, begin with the guidance the National Institute of Standards and Technology (NIST) issued for computer security incident response. The NIST Special Publication 800-61, Rev. 2 provides a framework for creating your own plan.

Along with NIST’s guidance, customize your incident response plan for your organization by assessing your:

• assets and their level of risk
• priorities
• potential vulnerabilities
• communication methods
• incident response team members
• distribution of responsibilities

And, of course, once you write your plan, you’ll need to train your team members so they can effectively communicate and mitigate when the next incident occurs.

The 6 Incident Response Phases

At a minimum, your plan should cover these phases of incident response and recovery:

• Incident Response Planning Phase 1: Prepare
  During the first phase of incident response, ensure that your employees understand their roles and the steps they must take to respond. Practice your response procedures with exercises designed to simulate a breach. You’ll also use this phase to determine how you’ll identify breaches through testing, logs, alerts, or other procedures.
• Incident Response Planning Phase 2: Identify
  You can receive an immediate alert that an attack may be taking place by implementing a monitoring tool or partnering an MDR provider. You may also be notified by receiving communication from another organization, law enforcement, or a customer. Once your team has evaluated the alert and determined that an attack is taking place, you’ll kick off the remainder of the incident response phases.
• Incident Response Planning Phase 3: Control and Contain
  You know you have a breach; now it’s time to do something about it. Prevent further damage by isolating the network segment or infected servers. Document exactly what happened and the extent of the damage. If possible, preserve forensic data so you can analyze it in the Review phase.
• Incident Response Planning Phase 4: Resolve
  Fix the vulnerability that caused the breach by removing malware, hardening and patching systems, and applying software updates.
• Incident Response Planning Phase 5: Recover
  Return the isolated systems to regular operation and restore normal business processes.
• Incident Response Planning Phase 6: Review
  Gather the incident and the forensic evidence you documented for the incident response team. Analyze the breach, and the team’s response, and discuss the lessons learned from the process. Revise your incident response plan based on what worked and what didn’t so you’re fully prepared for the next incident.

Protect Your Network with Incident Response Planning from OneNeck

Incident response planning can make the difference between a quick recovery from a data breach and a long, painful one. That’s why OneNeck’s security experts can work with you to prepare an incident response plan and recover from breaches faster — so you can get back to business.

OneNeck has your back. Read more about our incident response services here.

Anyone who watched TV in the 90s will undoubtedly remember the NBC PSAs with the catchy jingle, “The more you know…”. It was sage advice then, and in today’s modern technological world, where cybersecurity is paramount, it still holds true. As such, businesses are increasingly embracing education related to cybersecurity. These organizations realize that there must be a focus on both external and internal threats, with increased awareness of the defenses that staff can employ.

Simulated Phishing Campaigns

Many businesses find that training services like those offered by OneNeck partner, KnowBe4, are effective options to protect both data and personnel. One specific strategy employed is to simulate common threats that focus on the human element through phishing campaigns. This approach is particularly valuable since, according to Verizon’s 2022 Data Breaches Investigations Report, 82% of data breaches involved a human component.

Through these simulated phishing attacks, end users can increase awareness of the methods used by attackers and the proper procedures to follow upon identifying such an attack.

Pushback Against Simulated Phishing Attacks

I recently listened to a podcast where a story was shared about an arguably ill-timed simulated phishing attack that a company ran against its employees. This particular business was in the process of rolling-out organizational-wide Multi-Factor Authentication. The simulated phishing attack – allegedly not coordinated on purpose to coincide with the MFA effort – implied that recipients needed to follow the email link to complete an MFA task. The podcaster – who works from home and has youngsters at home – was among those inside the company who fell victim to the simulated attack.

As they shared the events, they placed some blame for falling victim to the attack on outside distractions – notably balancing work and home life with littles. (Whether it’s children, pets, mobile devices, etc., we all know distraction far too intimately.) While admitting ultimate responsibility for falling victim to the simulation, they expressed significant frustration surrounding the timing. They decried the simulated attack as counter-productive when the organization’s goal was to get employees to buy in and support the MFA effort.

The Perfect Time

While I appreciate the expressed frustration, there are a few reasons that I believe the timing was not only excellent but should, in fact, be coordinated to align with company initiatives, such as the implementation of MFA.

1. Attackers and bad actors don’t exactly work within a system of morals and ethics. They will exploit as many opportunities and weaknesses as they can find. Testing employees using guerrilla-style tactics theoretically serves to better educate and prepare users within the target audience.
2. Multitasking (read: distraction) is an attacker’s best friend. Most of us have our attention divided by at least a few things at any given moment. When we make snap judgments or act without thought or careful review of what we are looking at, the odds of making a costly mistake skyrocket.
3. Security in layers is critical for any organization. Educating users is a significant step in the right direction, but as we’ve seen, other factors come into play – and ultimately, we’re only human. IT organizations should employ overlapping solutions that prevent a distracted mistake or clever attack vector. Policy and procedure should be augmented by solutions like MFA, email filtering, and DNS filtering, to name a few. Layers of human and technical defenses together are key.

The More You Know with OneNeck and KnowBe4

Cyberthreats remain highly dynamic and ever-changing to adapt to defenses and human nature. Proactive measures such as education and coordinated campaigns help condition users on what to look for and can be highly effective tools. Simulated phishing campaigns stand out as a particularly successful method to train employees and raise awareness about the importance of cybersecurity. By simulating common threats that focus on the human element, end-users can become more accustomed to the methods used and the proper procedures to follow when discovering such attacks.

However, it’s important to note that educating users is just one step in reducing the likelihood of a cybersecurity breach. Investment in procedure/planning and defensive technical solutions is crucial in adequately protecting your business. Organizations should employ overlapping solutions that prevent a distracted mistake or clever attack vector.

In today’s fast-paced technological world, businesses must take cybersecurity seriously to avoid costly and damaging breaches. By incorporating education, training, and defensive technical solutions, organizations can significantly reduce the likelihood of a breach and protect their data and infrastructure.

Have questions about awareness, training or any aspect of cybersecurity? Contact us today to speak with a OneNeck security expert.

Microsoft has significantly changed its licensing subscription services by moving to the New Commerce Experience (NCE) platform. The old rules still apply to a few subscriptions, and the latest rules apply to new subscriptions. This change has created confusion among Microsoft clients as there are now two rule sets for CSP licensing to follow: one for legacy subscriptions and another for those converted to NCE.

We will likely live in both worlds for a while. Microsoft originally planned to retire Legacy subscriptions upon expiration and only provide NCE subscriptions upon renewal. However, Microsoft retraced its steps and allowed existing Legacy subscriptions to renew indefinitely. Currently, academic, nonprofit and government/GCC licensing remain on Legacy subscriptions, with no specific dates for when they may be compelled to convert to NCE.

Managing CSP Licensing with NCE and Legacy Subscriptions

Let’s examine what is essential to know about managing Microsoft CSP licensing and working with Microsoft’s NCE cancellation policy.

• Cancellations– Legacy subscriptions may be canceled or reduced at any time. Under NCE policy, subscriptions are cancelable with a prorated refund within the first 168 hours of any term. After the 168-hour window, cancellation is no longer available. The client will be billed for the entire duration, even if the customer stops using the subscription (applicable to any billing plan).
• Adding Subscriptions– For legacy subscriptions, you can add anytime, whereas, for NCE subscriptions, you may also add anytime, but the cancellation policy clock starts ticking. After 168 hours, users may not cancel until the term expires.
• Upgrading– Legacy subscriptions are not capable of receiving an upgrade. NCE subscriptions allow upgrades to qualifying packages and can cancel included add-ons through a qualified CSP, such as OneNeck, via a support ticket to Microsoft.
• Auto-renew– Automatic renewal occurs for Legacy subscriptions until cancelation. NCE subscriptions will also, by default, auto-renew. However, to cancel the subscription at the end of the term, one only needs to uncheck the auto-renew option.
• Alignment of Subscription End Date– Aligning with a subscription end date is not possible for Legacy subscriptions. With NCE subscriptions, you can pick an end-of-term date when ordering that matches an existing subscription.
• Schedule Changes– Legacy subscriptions can make changes at any time and are not tied to an end-of-term. NCE subscriptions have some limitations in their ability to change during the term. However, customers can schedule many changes, including quantity modifications, term date alignment and term change to occur at renewal.

Strategy for Managing CSP Licensing

Managing CSP licensing is a daunting task for any organization. Knowing the best strategy to manage licensing and improve productivity can be challenging with so many options and promotions available. Fortunately, OneNeck provides a comprehensive plan for managing CSP subscriptions that helps businesses navigate this complex landscape.

Maintaining Legacy Subscriptions

One of the components of the OneNeck CSP licensing strategy is to advise organizations to consider keeping Legacy licensing until they feel it is necessary to move to NCE. While Legacy licensing might not seem as appealing as newer options, in many cases, it may be helpful to maintain until Microsoft further incentivizes clients to move. For example, organizations can reduce or add to the quantity of Legacy licensing whenever needed. OneNeck’s self-service portal allows clients to make these changes quickly and easily. Organizations with a regular need for licensing fluctuation would be wise to maintain their Legacy subscription.

Moving to NCE Subscriptions

There are several reasons for organizations to consider the move to NCE licensing, including upgrading to a higher-level package, taking advantage of promotions and moving to OneNeck CSP.

Upgrading Licenses– If an organization needs to upgrade to a higher-level package, Legacy licensing won’t be sufficient. Customers will need to order new NCE subscriptions for commercial or corporate clients. Microsoft is currently offering promotions for first-time subscribers to Microsoft 365 Business Premium. This subscription includes basic security functionality, such as MFA, conditional access policies, endpoint management and protection. If an organization currently uses Legacy Microsoft 365 Business Basic or Microsoft 365 Business Standard licenses, this promotion may be a reason to convert. While the current promotion is good until June, other incentives will undoubtedly be forthcoming.

Moving to OneNeck as your Microsoft CSP– OneNeck’s Microsoft CSP Program delivers superior support, customer success, advanced managed service options, and a focus on security and productivity for clients. If an organization is not a client of OneNeck, they will need to order new NCE subscriptions through OneNeck and cancel their Legacy subscriptions with their old provider.

Adoption Score– OneNeck’s CSP licensing strategy includes turning on Adoption Score, a free tool provided through Microsoft 365 Admin. This tool recommends how to use licensing to improve user experience and productivity. After a listening period, Adoption Score gives feedback based on the organization as a whole rather than singling out individuals.

The information provided gives businesses a holistic view of how their organization utilizes Microsoft licensing and highlights areas where they can improve. Adoption Score allows companies to understand which licenses are used most and which are underutilized. Based on this data, they can make informed decisions about reallocating licenses to improve user experience and boost productivity.

Aligning subscription end dates– Organizations can align subscription end dates, making it easier to renew all subscriptions simultaneously. By doing so, businesses can manage licensing more efficiently and effectively.

One way to achieve good alignment is to request that subscriptions be aligned to existing ones at order or renewal time. This approach ensures the management of licenses from a central location and eliminates overlap or duplication. It also streamlines the management process by allowing businesses to simultaneously change and update all licenses.

License Assignment Hygiene– One essential part of good hygiene is periodically unassigning licenses from old users who no longer require them. By doing this, businesses can avoid wasting licenses and reduce their overall cost. An apple a day, …

In addition to unassigning licenses, it is also important to establish reasonable account control. Businesses can achieve this by implementing group-based licensing assignments through Active Directory. This approach reduces the number of steps and possible mistakes when assigning licensing while simplifying provisioning and making licensing management easier.

Annual Renewal Cycle Planning– Finally, participating with OneNeck in the annual renewal cycle is crucial for organizations that want to be as efficient as possible with their Microsoft licensing usage. This annual planning process, determined by when your subscriptions expire, can help organizations stay updated with the latest licensing rules and ensure they take full advantage of all available options.

OneNeck, A Microsoft CSP That Has Your Back

Managing CSP licensing can be a complex and challenging task. As a Microsoft Gold Cloud Service Provider OneNeck offers a broad range of solutions for organizations looking to optimize their use of M365. Our services include consulting, implementation and ongoing support to help organizations maximize their M365 investment.

Our experienced team is ready to assist you throughout your Microsoft licensing experience. Through our work with hundreds of customers, we know the ins and out of M365 and use that hands-on expertise to help our customers save time, reduce costs and get maximum value from their M365 subscriptions.

Contact a OneNeck Microsoft expert today to discuss a CSP solution tailored to your organization’s needs.

If you’ve ever used Microsoft 365, you’ve likely encountered multi-factor authentication (MFA). And if you’re like most, you probably find it a bit of a hassle. But the truth is that MFA is essential today, where cyberattacks are becoming increasingly common. In this blog, we’ll explore the importance of MFA and other steps to keep your accounts secure.

The Problem with Passwords

Passwords are the most common form of authentication. And while better than nothing, they’re not particularly secure. One of the most significant issues is their vulnerability to being compromised. Cyber-attackers employ various methods to obtain passwords, including phishing, keyloggers and dictionary attacks. Additionally, many users choose weak passwords, such as “123456,” “password,” or “guest,” making it simple for hackers to access accounts and steal sensitive information, putting users’ data at risk.

However, using passwords that are not easily guessable creates challenges in password retention. With numerous accounts and logins to remember, it can be challenging to track them all. As a result, people often reuse passwords across multiple accounts or write them down, leaving them vulnerable to security breaches.

Even with best practices in place, there are still risks. If an organization’s password database is compromised, all its users’ passwords are exposed. Several high-profile breaches have compromised millions of passwords and associated user IDs.

Better Passwords

Passwords are the first line of defense against unauthorized access to accounts. Therefore, it’s essential to make them as secure as possible. Complex passwords should include letters (upper and lowercase), numbers and symbols. By using a mix of characters, passwords become more challenging to crack.

According to Microsoft, passwords should be at least 14 characters long. Lengthier passwords make it harder for attackers to use brute-force methods to crack them. However, longer passwords can be harder to remember. One way to manage password length is to use passphrases. A passphrase is a sentence or combination of words that are easy to remember but difficult to guess.

Microsoft also recommends users change passwords periodically. Over time, passwords can become compromised. Organizations can reduce this risk by compelling users to change their passwords regularly. However, it’s important to note that changing too frequently can be counterproductive, creating weaker passwords or resulting in the user writing them down.

Finally, using a good password manager is helpful. Password managers can generate strong passwords, store them securely and automatically fill them in when needed. By employing a password manager, users do not have to remember every password while still keeping them safe from prying eyes.

Better Accounts

Creating a “break-the-glass” account is a critical security measure every organization should consider. In a security breach, having an emergency account with the highest level of access can be a lifesaver. However, it’s crucial to remember using this account should only occur in extreme situations. Companies must store these account credentials securely and make them accessible only to a limited number of individuals.

Assigning roles and permissions to security groups is another worthwhile step in securing your accounts. Limiting resource access is vital so users can only access what they need to do their job. Separating admin and user accounts is also critical and reduces the risk of security breaches. Admin accounts should only be used when necessary and assigned on a limited basis.

When it comes to admin accounts, it’s essential to have control over them. Privileged Identity Management (PIM) and Privileged Access Management (PAM) are two solutions that can provide the necessary controls. PIM allows you to manage, monitor, and audit the use of privileged accounts and resources. PAM isolates privileged accounts to reduce the risk of stolen credentials and helps re-establish control over a compromised Active Directory environment by maintaining a separate bastion environment unaffected by malicious attacks.

MFA and Conditional Access Policies

Microsoft recommends using conditional access policies to enforce layers of control around admin and user accounts. These policies often require MFA and specify where, when, what, and how users can access specific resources. Additionally, they log the use of privileged accounts to track who is accessing what.

Conditional access policies also provide an extra control layer to secure admin and user accounts. Conditional access policies allow organizations to set specific rules around access to resources based on conditions, such as user location, the device used and even the time of day.

For example, you could create a conditional access policy that requires MFA for any user attempting to access your company’s financial data outside of regular business hours or from an unrecognized device. This example ensures only authorized individuals access critical financial information under specific circumstances that meet your organization’s security standards.

Implementing MFA and conditional access policies strengthen your organization’s security posture and reduce the risk of security breaches. As always, it’s essential to work with a trusted IT partner like OneNeck to ensure security measures are correctly implemented and maintained.

The MFA Difference

So how much of a difference does MFA truly make? According to Microsoft and the Cybersecurity and Infrastructure Security Agency (CISA), MFA can prevent 99.9% of hacks. Even if a cyber attacker compromises your password, they won’t be able to meet the second authentication requirement, which ultimately stops them from gaining access to your accounts.

MFA is not a one-size-fits-all solution but rather an essential step in securing your accounts. While it may seem like a hassle to set up MFA and follow password management and account protection best practices, it is important to remember that the consequences of a data breach or account compromise can be far-reaching and costly. In addition to the potential loss of sensitive data, there can be legal and regulatory ramifications, reputational damage, and financial losses. It is much better to take proactive measures to prevent these outcomes than to deal with the aftermath of an attack.

Another benefit of MFA is that with a bit of finesse and conditional access, it can improve or at least minimally impact the user experience. While the initial setup and authentication process may take a few extra seconds, users feel more secure knowing that an additional layer of security protects their accounts. Additionally, many MFA solutions offer the option for “remembered devices” or “trusted locations” where the user will not be prompted for an MFA login. This automation makes the process smoother and less disruptive while maintaining security.

It is worth noting that while MFA is highly effective at preventing most types of account attacks, it is not the end of your security journey. Some attacks, such as phishing or social engineering, can bypass MFA by tricking the user into providing their credentials to a malicious actor. Additional layers, such as Endpoint protection, will be the next step on your path to a more secure environment.

Get the Most from Microsoft 365 with OneNeck

Whether you need support securing Microsoft environments, backing up M365 data or maximizing your licensing investment, OneNeck is here to help. We are a skilled Microsoft Cloud Service Provider with wide-ranging experience assisting hundreds of clients throughout their M365 adoption journey. Let us help you find the right-fit solutions for your organization’s productivity needs.

Contact us today to speak with a member of our team.

In the ever-evolving digital landscape, maintaining the security and integrity of your systems is not just a necessity; patching is a commitment we at OneNeck IT Solutions take seriously. This March, our attention is specifically drawn to a critical issue within Microsoft Office products: the Microsoft Outlook Elevation of Privilege Vulnerability (CVE-2023-23397).

Microsoft Outlook Elevation of Privilege Vulnerability (CVE-2023-23397)

A zero-day vulnerability, this particular security issue emerged without prior warning. Organizations should consider these vulnerabilities to be especially critical since cyber attackers can often exploit them before there is an opportunity to correct or even identify them fully. In the case of this Outlook vulnerability, a potential attacker could elevate their privileges within the system, leading to an increased level of access and control.

Please note as part of our standard procedure, OneNeck does not include Microsoft Office products during scheduled patching. OneNeck will not automatically distribute the zero-day patch for Outlook. Nevertheless, we strongly recommend all customers take immediate action to apply this important update to their environment as soon as possible.

Exchange Management and Patching

We are going a step further for those of you contracted with OneNeck for Exchange Management. We’re utilizing a script provided by Microsoft to determine if your organization is a target of malicious entities attempting to exploit this vulnerability. This assessment can be conducted for Exchange On-Prem and Exchange Online, providing a comprehensive safeguard regardless of your Exchange configuration. If you have questions about how OneNeck can assist you with either of these processes, don’t hesitate to contact the Service Desk.

Identifying and swiftly responding to such threats is fundamental to our service at OneNeck. In an era where cyber threats can arise and evolve rapidly, the ability to adapt and react quickly is not just an advantage; it’s a necessity. This Outlook Elevation of Privilege Vulnerability is an excellent reminder of the importance of vigilance and proactive actions in the face of cyber threats.

OneNeck Has Your Back!

While patching is essential to maintaining cybersecurity, it’s also a complex and continuous process. Each patch brings challenges and demands, and navigating this landscape requires a blend of technical expertise, industry knowledge, and a deep understanding of each client’s specific needs and contexts.

At OneNeck, our commitment is to support you through each update, each challenge, and each opportunity for improvement. We are not merely your IT solutions provider but your partners in navigating the dynamic landscape of IT security. We are dedicated to providing you with the best possible solutions for your IT security needs.

Stay safe, stay updated, and remember, OneNeck is here to assist you every step of the way.

Data backup and disaster recovery are two critical components of any business continuity plan. They are necessary for ensuring the safety and security of data and systems in the event of an unexpected interruption or disaster. However, backup and disaster recovery are different, and organizations need to understand their distinctions to develop an effective business continuity strategy.

Data Backup vs. Disaster Recovery

Data Backup– Backups refer to copying data and files to prepare for an event where the original data is lost or damaged. A backup system duplicates data and files, providing an on-site primary copy along with one or more off-site auxiliary copies. The goal is swift restoration in the event of a loss. Several backups exist, including full, incremental, differential and point-in-time.

A full backup includes all data and files, while incremental only copies the data that has changed since the last backup. Differential backups, however, copy all changes since the previous full backup. In comparison, point-in-time captures a snapshot of a computer system or application at a specific moment in time. Each of these backup types has its advantages and disadvantages. The best solution for a given organization depends on the size and complexity of the data, available storage space and desired recovery time.

Disaster Recovery– Disaster recovery (DR) refers to restoring systems and data upon a significant interruption or disaster. The goal of a DR plan is to minimize the impact of an interruption on business operations and to restore normal operations as quickly as possible. Disaster recovery is, by nature, more comprehensive and complex than data backup, as it involves reestablishing data and rebuilding infrastructure and systems.

DR plans often involve a combination of backup systems, redundant hardware and software and failover procedures. In addition, due to stringent RTO, technologies, such as replication and SQL AOAG, are used to instantiate a particular environment. The specific details of a DR plan depend on the nature of the organization’s operations and potential risks. A company with a mission-critical website may have a DR plan that includes failover to redundant servers in multiple locations. In contrast, a company with a small local network may have a more straightforward DR plan that primarily involves data backup to a remote location.

Important Differences

RTO and RPO– Backups and DR plans have significant yet distinct impacts on Recovery Time Objective (RTO) and Recovery Point Objective (RPO). RTO is the maximum allowable downtime, and backups are crucial in limiting RTO by enabling organizations to restore data quickly. A DR plan outlines the complete scope of restoration procedures extending beyond data recovery to ensure the speedy return of operations.

RPO is the maximum allowable data loss, and backups are essential in meeting RPO objectives by ensuring a copy of critical data is available. DR plans impact RPO in several ways, including defining the frequency of backups and their role in restoration.

Redundancy– Another difference between backup and disaster recovery is the level of redundancy and failover. Backup systems typically involve creating multiple copies of data, ideally storing them in separate locations. Many experts recommend adhering to the 3-2-1 backup rule. Simply put, this suggests organizations have three copies of data, on two different media types, with one copy residing off-site.

Disaster recovery typically involves redundant systems and failover procedures to keep operations running when a system or component fails. This level of redundancy is necessary to ensure the quick restoration of functions. The result is that resources and infrastructure requirements significantly increase over that needed for data backup. Additionally, while an off-site location is strongly recommended for data backup, it is an absolute necessity for a successful DR solution.

Planning Process– Planning a backup process is relatively simplistic compared to that of a DR plan. Typically, an organization first identifies the data requiring backup. The organization then determines the backup frequency, method and number of backup targets needed to avoid a sole point of failure.

A comprehensive disaster recovery strategy requires significant additional planning beyond just those concerning data. These steps include, but are not limited to:

• Determining which systems are mission critical.
• Prioritizing the importance of business applications and the recovery order of the systems running such applications.
• Establishment of a DR site to house backups and replicas ready for potential failover operations.
• Maintenance of the DR site to ensure it is fully operational.
• Design and creation of end-to-end DR processes, including active maintenance of blueprints and runbooks, as an organization’s environment evolves.
• Assembling clear communication steps, roles and access assignments for staff to follow upon a disruption.
• A DR plan is only ready upon the completion of extensive testing. Failure to execute during a disaster has dire repercussions. Regular testing must occur to ensure business continuity is maintained and discover potential gaps or weaknesses.

Data Backup vs. Disaster Recovery in the Cloud

Backup as a Service (BaaS) is a cloud-based backup solution that allows users to back up and restore data in the cloud. With BaaS, users store their data securely in the cloud and easily access it without worrying about maintaining a backup infrastructure. While some consider the inherent latency of data stored in the cloud a hurdle, the issue has largely been resolved through data locality considerations and the increasing variety of private cloud options, alongside high-speed internet bandwidth, becoming more affordable. BaaS providers typically offer multiple backup options, such as file-level, block-level, or image-level backups, and can also provide features like data deduplication, compression, and encryption.

Disaster Recovery as a Service (DRaaS) is a cloud-based solution that enables organizations to recover their IT infrastructure and data during a disaster, cyber-attack, or human error. DRaaS providers typically replicate a company’s entire IT environment to the cloud, allowing them to quickly failover and access their systems and data in case of a disruption. DRaaS also involves planning and testing to ensure the recovery process is smooth and efficient. Management of this service by the provider is also often utilized. This management is a desirable component as it performs regular testing and adherence to the provisions established in the DR runbooks.

Data Backup and Disaster Recovery: Working Together for Business Continuity

Organizations of all sizes benefit significantly from implementing backup and DR procedures as part of their business continuity plans. These measures protect vital data, minimize downtime, and reduce the impact of unexpected disruptions or disasters on the organization’s operations.

By having a reliable backup system, organizations can significantly reduce the impact of data loss or corruption on their business operations, quickly restoring lost data. While DR plans outline procedures to help an organization rapidly resume operations after a disruption, minimizing the impact on customers, employees and stakeholders.

In today’s technology-driven world, businesses must prioritize the protection of data and technology systems. Implementing reliable backup and disaster recovery measures can help organizations minimize the impact of disruptions and ensure business continuity. With these measures in place, businesses can continue to operate smoothly, meet their obligations, and maintain customer satisfaction even in the face of unexpected disruptions.

OneNeck, We’ve Got Your Back

OneNeck understands that every organization is unique regarding business continuity. Our experienced team works with clients to assess their data infrastructure and business requirements to develop the right-fit Backup and DR strategies to meet their needs.

Need assistance managing your organization’s backup and disaster recovery? OneNeck-managed data backup and disaster recovery services ensure you have a partner who truly has your back. We guide our clients through the initial setup and ensure that DR solutions are in place, maintained and regularly tested.

Free up your IT staff from the complex and time-consuming backup and disaster recovery aspects. Contact us today to speak with one of our experts.

Data modernization is vital for businesses to stay competitive and make informed decisions in today’s digital age. As companies generate, store, and analyze increasing volumes of data, effective management and protection have become significant challenges. Data management encompasses various activities, from collecting and storing data to analyzing and utilizing it to drive outcomes. But, with data growing exponentially, it can be difficult for businesses to prioritize what data is essential and how to manage it effectively.

Data management has become an increasingly important priority for leaders. However, achieving modern data management goals comes with equally modern hurdles and roadblocks.

According to a 2022 Deloitte survey, technology industry leaders listed three primary challenges when attempting to manage data effectively. While most of the leaders surveyed stated assurance in their ability to navigate these challenges, they nonetheless admitted organizational struggles to overcome them.

This blog will explore data leaders’ three common challenges and how data modernization services offer effective and efficient solutions.

Data Management Challenges

#1: Collecting and Protecting Data

Collecting and protecting ever-growing volumes of data is the top challenge for data leaders. As data volumes continue to rise, it can be difficult to prioritize which data is necessary to maintain. To tackle this challenge, data leaders call for better technologies to help collect data, make sense of it, and make it meaningful.

Achieving a holistic view of the enterprise’s data landscape and identifying sensitive information are significant challenges. With increasing amounts of data to handle, managing policy implementation and audits becomes harder. Data leaders must implement strong data management policies to protect their data from threats and ensure that it is neither breached by outside forces nor accessed internally by those that do not need to use it.

#2: Shifting Regulations

Shifting regulations are a significant challenge for data leaders. Regulations continuously change, making it difficult to maintain the latest requirements. Many leaders feel resigned that inconsistencies will arise and new data-related regulations will lead to higher costs, increased complexity, and challenges to software development.

As part of the broader regulatory landscape, cross-border transfers and data localization issues worry data leaders. Some businesses are trying to avoid or minimize transferring data out of the country while others are establishing additional cloud data centers worldwide and developing new preferred partners. In this ever-changing regulatory landscape, businesses must be vigilant and adaptable to avoid unintentional violations.

#3: Cost and Complexity of Data Privacy

The cost and complexity of implementing data privacy measures is the third significant challenge faced by data leaders. Many companies are facing increased focus on data privacy due to customer requests and requirements, regulations, and expanded internal access. Data breaches can result in significant financial and reputational damage to businesses, so leaders must prioritize data privacy as part of an overall data management strategy.

Employing data privacy measures can be costly and complex. There are several factors to consider, such as data classification, authorization and access controls, encryption, and data retention policies. In most cases, budgets aren’t rising to keep up with security maintenance costs, forcing data leaders to balance the need for privacy with available resources. Despite the challenges, businesses must prioritize implementation to protect customers’ personal information and maintain trust.

The Benefits of Solving Data Management Challenges through Data Modernization Services

If you ask twenty people in the tech industry what data modernization means, you will likely get twenty different answers. While no two companies use data precisely the same way, some concepts and philosophies do serve as foundations of data modernization and transformation.

OneNeck understands data transformation, when broken down to its most basic elements, centers around collecting, transforming and storing data through utilizing modern services and consuming it in an automated manner. To achieve this, we base our data modernization services on five necessary technologies: The cloud, active metadata, automation, advanced analytics and artificial intelligence (AI) and machine learning (ML).

Businesses must ensure their data is accurate, reliable, and easily accessible. Data modernization enables organizations to improve data management practices and make better-informed decisions. Microsoft Azure offers a variety of services and solutions to help companies address the afore-listed critical challenges.

Data Collection and Protection Solutions

In today’s digital era, data is arguably a business’s most valuable asset. It is essential to ensure data collection and protection solutions are in place to manage it efficiently.

Azure’s data storage solutions, such as Blob Storage, Data Lake Storage, SQL Database, Cosmos DB (NoSQL) and Azure Synapse Analytics, provide scalable and cost-effective options for storing and analyzing large amounts of data. Blob Storage is ideal for storing unstructured data, such as images, videos, and documents, while Data Lake Storage is suitable for big data scenarios. SQL Database offers a fully managed relational database service that provides high performance and availability with built-in security features. Cosmos DB is a multi-model NoSQL store. Azure Synapse Analytics is a fully integrated service for ingesting and curating data, making it available for consumption via Power BI.

Besides data storage solutions, Azure offers robust data protection services to help businesses safeguard data against cyber threats. Azure Security Center delivers a centralized platform for managing and monitoring security across Azure, hybrid cloud environments, on-premises and various cloud platforms. Security Center also provides recommendations and threat intelligence to help organizations stay ahead of evolving threats.

Additionally, Azure’s sophisticated threat protection capabilities, such as Azure Advanced Threat Protection (ATP), help businesses detect and respond in real-time before they cause significant damage. Azure ATP provides cutting-edge security features, including behavioral analytics, machine learning, and threat intelligence.

Regulatory Compliance

Azure offers a range of compliance and governance tools to help businesses stay compliant and reduce the risk of penalties or legal action. Azure Policy creates, assigns, and manages compliance policies across Azure resources and ensures companies meet regulatory standards by automatically auditing resources for policy compliance and flagging violations.

Furthermore, Azure provides a range of compliance certifications, including ISO, SOC, HIPAA, and GDPR, that help organizations demonstrate compliance. Azure’s compliance certifications assure customers their data is managed and protected following regulatory requirements and industry standards.

Azure provides a single platform to amass data, ensuring data management practices comply with the latest regulations and standards. Businesses can streamline their compliance efforts and reduce the complexity of managing regulatory requirements. This all-in-one solution reduces the risk of costly penalties, legal action and damage to a company’s reputation.

Ensuring Privacy

Privacy-enhancing technologies are a staple of Azure. Utilizing Azure organizations can better protect sensitive data, prevent data breaches and leaks, and comply with privacy regulations, all while leveraging big data analytics and machine learning benefits.

One of the critical privacy solutions is Azure Information Protection (AIP). AIP enables businesses to classify, tag, and protect data. With AIP, companies apply labels to sensitive data that determine who can access it and how it can be used, enabling controlled access to sensitive data and preventing breaches and leaks.

Additionally, Azure Purview provides advanced data governance capabilities. Purview enables businesses to discover, classify, and manage data assets across hybrid cloud environments. Purview creates a comprehensive inventory of data assets, allowing organizations to protect sensitive information more efficiently, comply with regulations, and optimize data storage and usage.

Partnering for Success: Meeting Your Modern Data Management Challenges

Data modernization is a critical process for any organization looking to unlock the full potential of its data assets. Effective execution requires extensive planning, expertise, and the right tools. Through Microsoft Azure’s comprehensive suite of data management and analytics tools, combined with the knowledge and insights of an experienced cloud solutions provider like OneNeck, your organization can accelerate modernization and transformation initiatives, enabling greater efficiency, agility, and competitiveness.

At OneNeck, we are a trusted partner with extensive experience in data architecture and a Microsoft Gold-level Cloud Service Provider. Our IT proficiency ensures your organization navigates complexities, reduces technical commitments, and achieves maximum ROI from your data. If you’re ready to unlock the power of your data and modernize your data management infrastructure, contact us today to schedule a consultation and see how we can guide you to data modernization success.

The Microsoft Adoption Score helps organizations understand how effectively their employees use Microsoft 365 (M365) tools. The score measures the level of adoption of M365 products and services and provides a data-driven view of how well employees use the tools to get work done. We’ll explore the Microsoft Adoption Score and how to interpret the results to find available hidden gems already waiting for utilization.

What is the Microsoft Adoption Score?

Microsoft Adoption Score is a productivity and collaboration analytics tool measuring employees’ adoption of M365 products and services. The score is based on predefined parameters that track engagement and usage of M365 tools such as Outlook, Teams, SharePoint, OneDrive and more. Microsoft explicitly states that all insights are calculated using data at the organizational level, NOT the individual level.

To enable the Adoption Score, perform the following steps:

1. Sign into the Microsoft 365 admin center as a Global Administrator and go to Reports > Adoption Score
2. Select “Enable Adoption Score.” It can take up to 24 hours for insights to become available.

The score presents itself in a graphical form, with a maximum score of 100 points. The higher the score, the more effectively employees use M365 tools to collaborate and complete work.

Microsoft Adoption Score Calculation

Calculated based on a set of eight parameters, split into two categories:

People Experiences​

Focuses on five categories that quantify how effectively an organization works​ with M365.

1. Communication– Assess how users find and share information through emails, chats, and shared community posting to unify an organization, regardless of location.​​
2. Content collaboration– Learn how organizations create, read, and collaborate on cloud-based content.
3. Mobility– Get insights into how employees access files and utilize Outlook and Microsoft Teams across all platforms.
4. Meetings– See how an organization leverages meeting best practices to help improve the quality of discussions and what types of meetings.
5. Teamwork– Examine uses of shared workspaces like SharePoint team sites, group mailboxes, and Microsoft Teams to collaborate and share information.

Technology Experiences

Focuses on three categories to help enable user experiences and achieve digital transformation goals.

1. Endpoint analytics– Examines how performance and health issues with endpoint hardware and software impact an organization while providing recommended actions for remediation.​​
2. Network connectivity– Gain visibility into factors affecting networks, paired with suggestions to address problem areas, enabling organizations to identify quickly and remedy network issues.
3. Microsoft 365 apps health– Get insights into how many devices have the latest productivity and security features by being on the recommended monthly channels for M365 Apps.

Why is the Microsoft Adoption Score Important for Businesses?

The Adoption Score provides a data-driven view of how effectively employees utilize tools to get their work done. Some of the benefits provided by the Adoption Score include:

• Measure ROI– Gauges organizational ROI of Microsoft 365. By tracking how effectively employees use the tools, businesses can determine whether they are getting value for their investment.
• Identify Adoption Challenges– Assists organizations in identifying where users may need more training or support, allowing for targeted training and support.
• Improve Collaboration and Productivity– Providing insights into how employees use Microsoft 365 and identifies areas where cooperation is low.
• Increase Security– Helps organizations ensure that employees use MS365 securely by providing targeted training and support.
• Enhance User Experience– Identifies tools causing user frustration or being utilized ineffectively, allowing organizations to address these issues.
• Drive Digital Transformation– Drive digital transformation via the adoption of MS365 tools. Organizations can set adoption goals and track progress.
• Facilitate Decision-Making– Provides insights into how employees collectively use MS365 tools. Organizations can use this data to decide which tools to invest in, which to retire and how to allocate resources.

Maximize the Microsoft 365 Experience

Ultimately the point of the Microsoft Adoption Score is not to maximize the results simply for the sake of achieving a high score. Rather, the intent is about genuinely finding the value in your licensing.

Altering user behavior is hard, very hard. Microsoft would undoubtedly like an organization to view its Adoption Score and attempt to improve across the board. Changing anything is difficult. Changing everything is impossible. The most effective way for an organization to use the Adoption Score is to analyze the data and determine one or two areas where it can focus on positively impacting productivity and efficiency. For example, while saving a couple minutes on meetings by better-utilizing Teams may seem like an insignificant improvement, the benefits quickly add up when applied organization-wide.

Saving Your Organization 5 Minutes with OneNeck

OneNeck is a Microsoft Gold Cloud Service Provider offering a broad range of solutions for organizations looking to optimize their use of Microsoft 365. Our services include consulting, implementation, and ongoing support to help organizations maximize their M365 investment.

OneNeck’s value is in its ability to help organizations identify “hidden gems” within their M365 then translate that knowledge into actionable improvements. We are looking at adoption scores across hundreds of our customers, seeking nuggets of information and common themes, to help you save five minutes a day or more! Our experienced team is designed to help organizations save time, reduce costs, and get maximum value from their Microsoft 365 licenses.

Are you ready to get the most from your M365 investment? Contact us today to speak with one of our Microsoft experts.

Data modernization— specifically, data-first modernization—is central to successful digital transformation. With data growing at an explosive rate, businesses need more efficient ways to manage it and new ways to use it to glean deeper insights that can help fuel growth.

Organizations that adopt a data-first approach and harness the power of today’s new technologies are 20 times more likely to beat their competitors and 11 times more likely to exceed their revenue goals by 10% or more. Here’s why.

Why Is Data Modernization Important?

Data modernization is the process of converting data into a form that is easier to access, manage, and use. It eliminates silos and unlocks the value of data to enable faster decisions and better insights. Data modernization helps businesses achieve the scalability, agility, and speed they are looking for in cloud solutions.

Data modernization involves migrating data from legacy systems to a modern, often cloud-based, solution and merging data from disparate sources into one database to create a single source of truth. First, the data must be cleaned up, unified, and normalized across all fields and records. Then, it can be imported into the new system.

What Is Data-first Modernization?

Data-first modernization is a business strategy rather than a process. An organization that takes a data-first modernization approach understands that data is its primary asset. Putting data at the forefront generates valuable insights that drive better decision-making.

With data-first modernization, businesses can extract value from all their data, regardless of where it lives—whether on the edge, in a data center, or in the cloud. Companies can then leverage technologies, such as advanced analytics, to generate intelligence that accelerates business.

5 Important Technologies for Achieving Data Modernization

Many new technologies are driving data modernization in today’s business landscape. This shortlist summarizes the top five.

The Cloud

The Cloud offers a golden opportunity for businesses looking to move away from legacy technologies and on-premises data centers. Companies that adopt cloud solutions not only reduce the total cost of ownership (TCO) associated with IT infrastructure but also gain tremendous flexibility and scalability.

Modern cloud providers offer a full range of services that include Software-as-a-Service (SaaS) solutions, cloud-based storage and processing, and data modernization capabilities. The cloud enables businesses to take advantage of powerful new technologies, such as big data, advanced analytics, and artificial intelligence (AI).

Active metadata

If metadata is data about data, then what is active metadata?

Active metadata provides context that gives details about everything that is done to the data. It provides additional information that enables organizations to discover, categorize, maintain, use, and govern their data.

Metadata must be generated, assembled, and indexed continuously whenever data is created, updated, or moved. As the volume of data grows, so does metadata. This makes it crucial for businesses to replace traditional metadata management tools with a modern active metadata management solution that continually collects and analyzes metadata and creates intelligence from it.

Automation

Manual routine tasks make employees’ jobs boring and lead to fatigue, which increases the chance of human error. But with modern digital tools, businesses can automate those repetitive tasks and ensure greater accuracy. Automation frees up time, allowing employees to focus on more critical endeavors like business intelligence and data analysis.

But automation isn’t just for routine tasks. Companies can also automate complex business processes. For example, active metadata management can be automated using APIs.

Advanced analytics

Advanced analytics is a broad term that refers to three separate, but related, technologies: predictive analytics, prescriptive analytics, and artificial intelligence.

Predictive analytics uses data to create models of possible future scenarios. Leaders can then use these models to choose the best course of action, whether immediate or long-term. Prescriptive analytics uses algorithms to evaluate data and recommend ways to optimize business processes to achieve desired outcomes. It can identify the cause of bottlenecks and other problems and show how making strategic changes would improve various aspects of a business.

Artificial intelligence and machine learning

The most advanced type of analytics—artificial intelligence—includes machine learning (ML). AI differs from predictive and prescriptive analytics in three ways: it is capable of learning, evolves over time, and understands natural language.

AI and ML work hand in hand to drive business by providing convenience, accessibility, automation, and efficiency—all of which lead to greater productivity and better user experiences. Together, AI and ML can rapidly analyze large volumes of data, find connections between multiple data sets, and identify patterns and anomalies. Because AI can make decisions faster and more accurately than humans, it saves companies considerable time and money.

Data Modernization Fuels Business Growth

Data modernization fuels every digital transformation initiative, enabling organizations to gain valuable insights from their data. OneNeck IT Solutions offers advanced technologies like Azure Data Analytics that can help your business achieve a competitive edge.

Contact us to learn more about how OneNeck can help you scale your business and maximize performance.

Frequently asked questions…

What is the goal of data modernization?

The goal of data modernization is to transform traditional data architectures and processes into modern, more agile, and efficient ones that can support the growing demand for data-driven insights and decision-making. Data modernization involves migrating data from legacy systems to modern platforms, implementing advanced data analytics and machine learning capabilities, adopting cloud-based technologies, and ensuring data security and compliance.

What is advanced analytics vs analytics?

Analytics refers to the process of examining data to draw conclusions or insights about past events or trends. Advanced analytics, involves using complex and sophisticated techniques such as data mining, machine learning, predictive modeling, and artificial intelligence to analyze data and make predictions or recommendations. Advanced analytics allows organizations to gain deeper insights and achieve more accurate predictions, optimize business processes, reduce risks, and identify new opportunities.

What is difference between machine learning and artificial intelligence?

Artificial intelligence (AI) involves creating intelligent machines that can simulate human cognitive processes such as learning, reasoning, and problem-solving. Machine learning (ML) is a subset of AI that involves training computer algorithms to learn patterns in data, make predictions, and improve their performance over time without being explicitly programmed.

What is Azure Data Lake?

Azure Data Lake is a cloud-based storage and analytics service provided by Microsoft that enables businesses to store and analyze large amounts of structured, semi-structured, and unstructured data. It allows users to store data of any size, shape, and speed easily and securely, and perform powerful analytics and processing tasks.

With 70% of breaches today originating at endpoints—such as servers, laptops, Internet of Things (IoT), and mobile devices—it’s increasingly important for organizations to implement a robust security strategy like managed threat detection and response to protect against threats. But navigating the threat detection and response solutions landscape can be confusing, especially for businesses that lack deep cybersecurity expertise.

This article describes two popular approaches to threat detection and response and helps you choose the right one for your business.

What Is Managed Threat Detection and Response?

Managed detection and response (MDR) is an outsourced cybersecurity solution offered by a managed security service provider (MSSP). MDR comprises a

comprehensive array of network, host, and endpoint security tools that perform ongoing monitoring to identify and respond to threats pre-emptively. MSSPs also provide specialized cybersecurity expertise.

What Is MDR vs. EDR?

Unlike MDR, which is a service, endpoint detection and response (EDR) is a cybersecurity platform that helps organizations identify and respond to threats that target vulnerable, network-connected endpoints. The biggest difference between EDR and MDR is scale.

Managed Detection and Response Addresses Common Security Threats

To manage threats effectively, organizations first need to know what kinds of threats MDR can help mitigate. This list covers the most common types.

Ransomware

Ransomware is malware that attacks a computer, network, or server. Malicious software locks the victim’s device, then a cybercriminal demands payment to restore it.

Phishing

Phishing attacks target individuals using social engineering methods, such as email, phone, texting, and social media. They aim to manipulate the recipient into revealing sensitive information like their password or credit card number. Some phishing attacks install viruses on the victim’s device.

Denial of Service

Denial-of-Service (DoS) attacks target organizations with the goal of disrupting business operations by inundating a network or server with spam requests. When the target becomes overwhelmed, necessary business services become unavailable, so employees can no longer perform their tasks. Although DoS attacks rarely exploit ransomware, the disruption they cause can be costly.

A Distributed Denial-of-Service (DDoS) attack is a more serious type of DoS attack. Here, multiple machines overload an edge network device—such as a router or switch—rather than targeting a server.

Man in the Middle

Man in the Middle (MitM) refers to a category of identity-based cyberattacks in which a bad actor surreptitiously eavesdrops on an online communication between a client and a server. The most common MitM attack exploits vulnerabilities in the victim’s browser to inject malware into their device. Cybercriminals commonly use MitM attacks to capture sensitive financial data in real time by intercepting traffic between a user and a banking website.

Other cybersecurity threats

Today’s cybersecurity environment includes many other dangers, including blended threats that leverage multiple methods and previously unseen zero-day threats.

As the IT perimeter continues to blur, organizations need to stay ahead of threats, such as

• Sophisticated mutating software
• Advanced persistent threats (APTs) that gather intelligence through surveillance
• Cloud vulnerabilities
• Web application attacks, such as a SQL injection (SQLI)
• Supply chain attacks that target trusted relationships and third parties
• Spoofing attacks disguised as legitimate websites and email addresses

How to Get the Protection You Need

OneNeck partnered with Fortra’s Alert Logic to bring together a powerful set of capabilities that ensure businesses get all the security protection they need:

• The Platform—Provides comprehensive security coverage, regardless of whether your workloads are in one or many clouds, containers, serverless, or on premises
• The Intelligence—Includes dozens of seasoned security researchers, data scientists, and engineers with vast industry experience
• The Expertise—Fortra’s 150 skilled security operations center (SOC) analysts partner with OneNeck’s security experts, who act as your point of contact. As your managed services provider, we understand your IT environment and are committed to keeping it safe.

Let Fortra’s Alert Logic and OneNeck Protect Your Network

No organization is too small to experience a breach. Make sure you don’t become a victim.

Do you need a better security strategy for the cloud or expert security talent to help protect your IT infrastructure? Or maybe you just want to reduce your total cost of ownership (TCO)?

Together, One Neck and Fortra’s Alert Logic can help you implement a managed threat detection and response strategy that provides comprehensive security in today’s risky IT landscape.

Contact us to learn how you can protect against threats in real time.

Frequently asked questions…

Does MDR replace SIEM?

Managed Detection and Response (MDR) and Security Information and Event Management (SIEM) are both security solutions, but they serve different purposes and are not direct replacements for each other. SIEM is primarily focused on log management, correlation, and event analysis to provide a comprehensive view of security threats, while MDR is a more proactive solution that combines threat intelligence, behavior analytics, and expert analysis to detect and respond to advanced threats.

What’s the difference between MSP and MSSP?

Managed Service Providers (MSPs) and Managed Security Service Providers (MSSPs) both provide managed services to clients, but their focus areas differ. MSPs primarily provide managed services for IT infrastructure and operations, while MSSPs specialize in managed security services, such as threat detection, incident response, and compliance management. MSSPs typically offer a broader range of security-focused services and have more specialized expertise than MSPs.

Is EDR the same as antivirus?

Endpoint Detection and Response (EDR) and antivirus (AV) software are both security solutions that protect against malware and other threats, but they have different approaches and capabilities. AV software uses signature-based detection to identify known threats and prevent them from infecting the system, while EDR is a more advanced solution that uses behavior-based analysis and machine learning to detect and respond to both known and unknown threats.

What is endpoint security?

Endpoint security refers to the practice of securing endpoints, such as desktops, laptops, smartphones, servers, and other network-connected devices, from cyber threats. The goal of endpoint security is to protect these endpoints from unauthorized access, data theft, malware, and other types of cyberattacks by using a combination of technologies, tools, and policies to detect, prevent, and respond to threats.

What is Patch Management?

Patches are software and operating system updates that address security vulnerabilities and are used to keep all digital assets up to date. On an individual level, patch management is fairly straightforward. A vulnerability is discovered, a patch is developed and then run by the end-user when time allows or performed via the system’s auto-update feature.

Scaling up to an organizational level, however, significantly increases complexity, and efficient patch management becomes a necessity. Systems today are interconnected, and changes or downtimes in one area can have unforeseen and unintended effects throughout an organization. Because of these factors, many businesses struggle to implement company-wide patching, leaving themselves vulnerable to cyber attacks or other disasters.

Importance of Patching

Patching foremost helps secure computer systems and servers against potential security threats. Cybercrime is a problem all organizations face, and malicious actors constantly search for new ways to exploit known vulnerabilities. A report from Positive Technologies shows 31% of companies have detected attempts to exploit software vulnerabilities.

Organizations can close security gaps by regularly applying patches and preventing attackers from accessing sensitive data or compromising systems. While neglecting to promptly patch systems leaves them vulnerable to cyberattacks, data breaches, loss of sensitive information or financial damage. According to a Ponemon survey, unpatched vulnerabilities were involved in nearly 60% of data breaches.

Patching also helps maintain the stability and compatibility of software systems. Many patches include fixes for bugs and other issues that can cause the software to crash or behave unexpectedly. Patching ensures that software remains functional and uninhibited by errors, reducing the risk of downtime and the need for costly technical repair.

In addition to resolving bugs and security issues, patching often provides access to new features and enhancements. Software vendors regularly release updates that add new functionality. Organizations can utilize these improved features to enhance their workflow.

Finally, patching is essential for compliance with various regulatory requirements. Many industries are subject to strict regulations and standards that require the protection of sensitive information and consistent maintenance of technical environments. By regularly patching systems and servers, organizations can demonstrate their adherence to these regulations and avoid potential legal penalties.

Common Problems with Patch Management

While the benefits of patching are pretty straightforward, many organizations face challenges in implementing a consistent approach to patch management. There are several reasons why system-wide patch management is problematic for businesses, including:

Complex IT Environments­­

Many organizations have complicated IT environments, with a variety of systems, servers, and applications running on multiple platforms. This inherent complexity makes tracking which systems need patching and when challenging. Additionally, older systems and applications may not be compatible with all patches, making it difficult for organizations to maintain security and stability.

Patch Testing & Review

Before applying any patch, organizations must review all new releases alongside their accompanying notes and run tests to ensure updates won’t trigger compatibility issues with existing systems. This process is time-consuming and resource-intensive, especially for larger organizations with expansive IT environments.

Downtime Concerns

Applying patches often requires systems to be offline for a period of time. This downtime can potentially lead to a temporary loss of productivity and revenue. Because of this concern, patching is often pushed to non-typical business hours, forcing IT staff to work overnight or during weekends.

Resource Limitations

Many organizations have limited IT resources, making it challenging to prioritize patching in the face of other pressing demands on time and within budget.

The difficulty in patching for businesses is often due to a combination of these factors, including the sheer volume of systems and applications that need to be maintained and the need to balance security and stability with the demands of day-to-day operations. Despite these challenges, organizations must prioritize patching and adopt effective strategies for maintaining their systems.

Outsourcing Patch Management

Outsourcing patch management can be an effective solution for organizations that lack the expertise or resources to manage this process in-house. By working with an experienced vendor, organizations can ensure their systems are secure and up-to-date while freeing up internal resources to focus on other important tasks and initiatives. A business might choose to outsource patch management for numerous reasons:

Lack of In-house Expertise

Organizations may not have the technical expertise or resources to manage patching effectively. By outsourcing patch management, a business gains access to the skills and know-how of a partner specializing in this area.

Reviews, Tests and Validation

Review of release notes for all pertinent information and testing the effects of each patch are essential steps. An organization tackling this on its own will undoubtedly find the process both demanding and laborious. Enlisting external assistance speeds up validation and likely reduces cost.

Time and Staff Usage Reduction

Outsourcing patch management helps organizations save time and reduce expenditures by eliminating the allocation of internal staffing resources, thus freeing their IT teams to focus on more strategic projects and initiatives.

Improved Efficiency and Security

Organizations can benefit from a partner’s streamlined processes and automated tools, helping to reduce downtime and ensure patches are applied consistently and punctually.

Access to Best Practices

An experienced patch management vendor can bring best practices and expertise that an organization might not have access to otherwise.

Compliance

Many industries have strict regulations regarding data and systems security. By outsourcing patch management, organizations can ensure that they meet these protocols and maintain compliance with industry standards.

The benefits, especially for small and mid-sized businesses, of obtaining outside assistance with patch management go beyond those listed above. Engaging a partner to perform patch management allows for a patching timetable that compliments an organization’s production environment. Additionally, an experienced partner works with multiple clients, meaning well-rounded, real-world experience and the ability to adapt whenever necessary.

OneNeck Has Your Back!

While patching may be time-consuming and complex, it is critical to ensuring your organization is safe and secure from cyberattacks. OneNeck is here to help with an experienced team that provides solutions for patching and any other aspect of systems management that your organization may require. We have extensive experience across multiple platforms and industries, allowing us to provide a right-fit solution for you.

Contact us today to speak with a member of our team, and learn more about our patch management services here.

Check out our Monthly Patching Blog series to keep up to date on the latest critical updates from our vendors.

Frequently asked questions…

Who is responsible for patch management? 

While patching is often the responsibility of the operations or infrastructure team, it is a process that involves everyone in the organization.

What is a patch management plan? 

Patch management is the process for identifying, acquiring, testing, installing and verifying software and/or firmware updates. An effective patch management plan ensures all identified system components are the latest version supported by a vendor.

How do I create a patch management plan? 

Creating a patch management plan is accomplished by developing a process that performs necessary patching in a consistent and timely manner. Organizations must identifies updates, review release notes, test for system compatibility and perform installs with minimal disruption to operations.

Is patch management a part of cybersecurity? 

Patch management is an essential aspect of an organization’s cybersecurity posture. Unpatched software applications or operating systems are a prime cause of security breaches.

ESXiArgs Ransomware – How to Protect Your Organization

In case you haven’t heard by now, the recently discovered ESXiArgs ransomware attack is quickly becoming a big deal. It has impacted thousands of servers worldwide, specifically targeting nearly ubiquitous VMware ESXi hypervisor and ESXi servers, and as such, VMware has issued a critical alert regarding this vulnerability.

The vulnerability allows attackers to execute malicious code on the affected systems and potentially compromise sensitive data. The attacks are purportedly targeting servers that have remained unpatched against a vulnerability first revealed in 2021. The vulnerability specifically affects the OpenSLP service in older versions of ESXi and can be exploited to enable the remote execution of code to enable Command and Control (C2).

VMware released a statement declaring they have found no evidence that the attack disseminating the ransomware is from an unspecified vulnerability (0-day). Rather, the attack bases itself on a previously known vulnerability (CVE-2021-21974) disclosed and addressed by VMware on 23 February 2021. They add that thus far, only significantly out-of-date products or those already reaching End of General Support (EOGS) have been affected or are believed to be potentially vulnerable.

VMware Recommendations to Protect Against the Vulnerability

VMware advises all customers to upgrade to the latest supported releases of vSphere components to address these currently known vulnerabilities. In addition, VMware has recommended disabling the OpenSLP service in ESXi. OpenSLP has been disabled by default since 2021, beginning with ESXi 7.0 U2c and ESXi 8.0 GA.

Long-term Protection Against Ransomware

Incidents involving ransomware continue to accelerate, doubling the number of attacks from 2021 to 2022. This trend is a cause for concern for businesses and organizations, as they risk losing sensitive information and experiencing costly downtime. The good news is that there are steps organizations can take to protect themselves against ransomware attacks. These steps include implementing an effective patch management system, having efficient and accessible Disaster Recovery (DR) backups and developing incident response (IR) plans.

• Patch Management– One of the principal ways organizations can protect themselves against ransomware attacks is by promptly patching and updating their systems. Upon identification, vulnerabilities in software become a target for cybercriminals, who can exploit these weaknesses to launch attacks. According to a study by the Ponemon Institute, 57% of cyberattack victims report their breaches could have been prevented by installing an available patch (i.e., ESXiArgs ransomware), with 34% of those victims knowing of the vulnerability but failing to take action. Organizations must keep their systems up to date with the latest security patches. Unfortunately, neglecting patching systems is an all too common practice, making it extremely important for organizations to prioritize this aspect of their IT hygiene.
• Disaster Recovery– Another critical aspect of protecting against ransomware attacks is having reliable DR backups. A robust DR plan helps companies mitigate the impacts of a ransomware attack by providing a roadmap for quickly and effectively responding to the incident. DR plans may also include steps to prevent the ransomware spread, restore data and systems from backups, and ensure business continuity. A well-designed DR backup plan can also provide companies with the means to recover their data and systems without paying the ransom, reducing the risk of becoming a repeat target for cyber-criminals. By neglecting DR, companies put themselves and their operations at significant risk, often leading to costly financial impacts.
• Incident Response– Having an IR plan is a fundamental component of cybersecurity protection. This detailed set of procedures outlines the steps a company should take in the event of a security incident, including ransomware attacks. IR plans provide a clear and concise roadmap for responding to security incidents, including guidelines for identifying and containing the attack, recovering data and systems, and preventing future incidents. Thus, companies can minimize the risk of confusion and delays, further exacerbating an already stressful situation. IR procedures also help ensure that all stakeholders, including IT and security personnel, management, and other key employees, are aware of their roles and responsibilities in the event of an attack.

Additionally, a detailed IR strategy helps companies quickly and effectively contain the ransomware attack and prevent its spread to other systems and networks. This decisive action helps reduce the attack’s impact and minimize the risk of data loss. The plan can also assist companies in reclaiming their data and systems via the above-mentioned disaster recovery backups, allowing for the restoration of normal operations with minimal downtime or financial impact.

Protecting Your Organization with OneNeck

Protecting your organization from cyberattacks, including ransomware, is a complex process that requires significant time, staffing and financial resources. For many, the most effective and cost-efficient way to meet these demands is by working with an experienced partner.

OneNeck’s managed backup and disaster recovery services guarantee quick recovery of critical data, minimizing downtime and, most importantly, keeping your business up and running. Our experienced team will monitor and manage your backup solution, protecting your data and ensuring it runs efficiently. Our DR services set up, manage and test recovery solutions to ensure your organization is fully protected when a disaster occurs.

OneNeck’s incident response plans are carefully designed, real-world-tested and updated to fit organizational needs. We help revise existing IR plans or write new ones from scratch, evaluate existing procedures, and lead tabletop exercises to test resiliency. Each engagement reduces the risk of confusion, delay, and further damage while ensuring a quick and effective response that protects your data, systems, and operations.

Patching is critical to ensuring any organization’s security and safety. Though simple in concept, the execution of patching activities is often neglected due to its complex and time-consuming nature. OneNeck’s experienced team provides patch management solutions alongside comprehensive systems management. We have extensive knowledge across numerous industries and platforms, allowing us to provide solutions tailored to your organizational needs and allowing your staff to remain focused on mission-critical business activities.

Contact Us today to speak with a member of our experienced team to help secure your organization against the ESXiArgs ransomware attack and ensure ample preparation for future incidents.

Frequently asked questions…

What is OpenSLP used for in ESXi?

In ESXi, OpenSLP is utilized to enable the discovery of other ESXi hosts and vCenter Servers, as well as for integration with various management tools that use OpenSLP for resource discovery and management.

Does ransomware affect ESXi?

ESXi, as a bare-metal hypervisor, is less susceptible to ransomware attacks compared to traditional operating systems as it has a smaller attack surface and lacks direct user access. However, ransomware attacks can still potentially compromise ESXi hosts through vulnerabilities in the management interfaces or by encrypting virtual machines running on the hosts.

Is ESXi secure?

ESXi is designed with security in mind and includes various security features, such as secure boot, lockdown mode, role-based access control, and encrypted VMotion, to protect against threats. However, as with any software, there may be vulnerabilities that could be exploited. It is crucial to regularly apply security patches and updates and follow security best practices to ensure the security of ESXi hosts and virtual machines.

Can ransomware affect VMware?

Yes, ransomware can affect VMware environments by encrypting virtual machines, disrupting operations, and potentially spreading to other hosts and VMs. It is crucial to have proper security measures, such as network segmentation, access control, and backups, in place to protect against such attacks, and to regularly update and patch VMware products to address any security vulnerabilities.

What the GLBA Audit Includes and How to Navigate the Pre-Audit Process

The  Gramm-Leach-Bliley Act (GLBA) is longstanding United States law that includes provisions protecting the privacy of consumers’ financial information. The GLBA applies to all institutions offering consumers financial products or services. The U.S. Department of Education Federal and Student Financial Aid Office has asserted that Title IV Institutions of Higher Education are considered “financial institutions” and thus subject to the GLBA.

In October 2021, the FTC announced revised provisions of the Safeguards Rule requiring non-banking financial institutions, such as institutes of higher education, to develop, implement and maintain a comprehensive security system to keep their customers’ information safe.

Successfully enacting these provisions is critical for passing a GLBA audit. Initially set to take effect on December 9, 2022, a six-month extension was granted, pushing the deadline to June 2023.

Safeguards Rule

The Safeguards Rule instructs organizations to implement administrative, physical and technical protections as safeguards against cyberattacks, email spoofing, phishing schemes and similar cybersecurity risks. These provisions are where educational institutions will likely struggle to achieve and maintain compliance. Identifying and assessing risks, developing and maintaining an information security program and creating detailed incident response plans are a heavy drain on time, staffing and a school’s limited resources. Obtaining outside assistance in these areas is often a necessity.

GLBA Audit for Educational Institutions

With the June deadline fast approaching for institutions of higher education, it is imperative that schools not only understand what provisions auditors are examining but also how to prepare for the GLBA audit process. A proper pre-audit assessment demands action and input from multiple staff members, including those in the financial offices (Financial Aid Office, Registrar, etc.), security (both physical and digital) and others in information technology. Coordinating and performing such an undertaking will likely involve teaming with an experienced outside partner.

Your organization may already be employing some provisions, such as encryption of sensitive data, limiting and monitoring information access, as well as staff training on security and information security. If not, these practices should be part of your institution’s overall security program.

Other provisions, such as the designation of a qualified individual to oversee an institution’s information security program and the training of security personnel, are aspects that organizations must plan out based on available personnel. While the Safeguards Rule does mandate a qualified individual oversees the GLBA-required security program, this individual may certainly receive assistance (internal or external) in this management.

The provisions for which educational institutions will likely require outside assistance are the performance of risk assessment and the development of an IR plan as part of a comprehensive security program. Even if some aspects already exist within an educational organization, the scope and complexity of the GLBA requirements will likely exceed the time and resources available to a school’s IT staff. Engaging a knowledgeable partner who can perform a comprehensive pre-audit assessment and communicate effectively on risk and mitigation steps is highly recommended – and by doing so – completes one of the audit requirements.

Pre-Audit Risk Assessment

Performing a Risk Assessment should utilize industry-standard security frameworks such as the Center for Internet Security (CIS) Controls or NIST SP 800-171. Use of these frameworks, while not currently obligatory, does represent a best practice when preparing for any cybersecurity audit. The Student Financial Aid Office has suggested Title IV institutions consider using the NIST SP 800-171 framework for risk self-assessment. However, the simplicity of the CIS Controls framework is a viable option that may be a better fit for organizations with less robust security staff. The CIS controls are a straightforward set of 18 controls that provide actionable steps for minimizing data breaches and significantly reducing the risk of cyberattacks.

Using a chosen cybersecurity framework, like NIST or CIS Controls, institutions must conduct a risk assessment across all covered organizational units. Upon risk identification, concise documentation for each safeguard employed is necessary for tracking implementation progress. Risk assessments that meet auditor requirements will address the following:

• Employee security training and management
• Organizational vulnerabilities
• Understanding of threats that might exploit those vulnerabilities
• Creating concise documentation for the actions taken to mitigate all discovered risk

Security Program’s Incident Response Plan

While self-assessment helps identify risks and creates measures for eschewing them, breaches are always possible. Constructing a response plan for security events is vital to passing the audit. In the unfortunate but likely event that a breach occurs, it is critical to have an established plan to handle communications and coordinate investigation, containment and rapidly eradicate the attack. Auditors are looking for institutions to have a security program that includes a written IR plan providing for the following components:

• Identification of types of incidents that could occur, such as data breaches, cyberattacks or natural disasters
• Establishment of an IR team with specific roles and responsibilities
• Procedures for identifying and responding to incidents, including steps for containment and mitigation, preservation of evidence, as well as notification to affected individuals, key stakeholders (including employees, students or parents) and regulatory authorities
• Testing of the IR plan through scheduled drills and exercises
• Periodic review and update of the IR plan that adapts to institutional changes or external threats
• Recording of incidents, responses, outcomes and measures to prevent reoccurrence

Beyond the Assessment

Ultimately the goal is not just to pass the audit through a series of ‘check the box’ exercises but to truly secure data and infrastructure. The GLBA audit process is not just a one-time action but rather a long-term commitment to a series of best practices. To be done correctly requires significant resources and time and involves constant reassessment and adjustments to meet current and future risks.

OneNeck’s experienced team is here to help prepare for GLBA audit compliance and continue working with your technology team to allow your security posture to mature. Our pre-audit services include a requisite risk assessment of security controls that fall under GLBA, assistance documenting your security program and review or development of an IR plan that assists in accurately identifying processes and procedures in the event of an incident.

Contact us to speak to a member of our experienced security team today.

Frequently asked questions…

What happens if you violate GLBA?

Violating the GLBA (Gramm-Leach-Bliley Act) can result in severe penalties, including fines and legal action. The exact consequences depend on the severity of the violation and can range from monetary penalties to imprisonment for individuals found guilty of criminal violations.

What are the three key rules of GLBA?

Firstly, financial institutions must provide customers with privacy notices explaining how they collect and share customers’ personal information. Secondly, customers must be given the option to opt-out of having their information shared with non-affiliated third parties. Thirdly, financial institutions must implement appropriate safeguards to protect customers’ personal information.

Who does the GLBA Safeguards rule apply to?

The GLBA Safeguards rule applies to financial institutions, including banks, credit unions, securities firms, and insurance companies, as well as non-financial institutions, that receive or maintain personal information about customers of financial institutions in connection with providing services to those institutions.

What is the goal of the FTC Safeguards Rule?

The goal of the FTC Safeguards Rule is to protect consumers’ personal information held by financial institutions by requiring them to develop and implement comprehensive information security programs. The rule aims to ensure that financial institutions are taking appropriate measures to safeguard sensitive customer information from unauthorized access, use, or disclosure.

Microsoft CSP Self-Service Portal for OneNeck Clients

Microsoft continues to evolve the rules for ordering and changing licensing. Changes such as moving clients to one-year terms, charging a premium for monthly flexibility and enforcing the cancellation policy (can’t cancel an order after 168 hours) require OneNeck and clients to up our Microsoft licensing game.

OneNeck continues to develop service offerings to help our clients navigate the world of Microsoft licensing and Azure. We have invested in a CSP self-service portal built on an industry-respected SaaS solution that gives our clients access to their licensing and enables them to see what they are using – whenever they want – following the Microsoft rules, of course.

CSP Self-Service Portal Basic Management Capabilities

The portal uses Azure Active Directory, so clients are in complete control of the usernames, passwords and permissions. OneNeck only needs to give access to the portal. The portal then uses Microsoft APIs to make changes to your subscriptions, following Microsoft rules. In the portal, clients can:

1. Review licensing usage and licensing assignments
2. Add additional seats to licensing subscriptions
3. Order new licensing subscriptions
4. Remove licenses for clients with Legacy subscriptions (nonprofit, government and academic)
5. Assign licenses to end users
6. Add admins to the portal with role-based access
7. Review Azure consumption data within 24 hours of usage
8. Review historical Azure consumption data 

Now Available for OneNeck Clients

Our CSP Self-service portal is now available for clients. If interested, please schedule an orientation meeting and get access today.

Frequently asked questions…

What does Azure directory do?

Azure Active Directory (Azure AD) is a cloud-based identity and access management service that provides authentication and authorization for users, groups, and applications across a variety of platforms and devices. Azure AD enables access external resources, such as Microsoft 365, the Azure portal, and thousands of other SaaS applications, in a centralized manner, providing a single sign-on (SSO) experience for users and enabling secure access to cloud-based and on-premises applications.

What is the difference between Active Directory and Azure AD?

Active Directory (AD) is an on-premises directory service used to manage user identities, computers, and other resources in a Windows domain environment, while Azure Active Directory (Azure AD) is a cloud-based identity and access management service that provides authentication and authorization for cloud-based and on-premises applications.

What is a Microsoft CSP?

A Microsoft Cloud Solution Provider (CSP) is a partner program that enables Microsoft partners to resell Microsoft cloud services such as Azure, Microsoft 365, and Dynamics 365 to their customers. CSP partners provide their customers with the services, support, and billing for Microsoft cloud solutions, allowing them to bundle Microsoft cloud services with their own offerings and provide a single point of contact for their customers.

What is the difference between Microsoft EA and CSP?

Microsoft Enterprise Agreement (EA) is a licensing program that allows organizations to license Microsoft software for multiple devices and users, typically for a three-year term, while the Cloud Solution Provider (CSP) program is a partner program that enables partners to resell Microsoft cloud services and provide services and support to their customers.

On January 13th, Microsoft released an update for Microsoft Defender that incorporated a change to the Attack Surface Reduction (ASR) rule known as “Block Win32 API calls from Office macro” in Configuration Manager and “Win32 imports from Office macro code” in Intune. The rule detects and blocks malware from using VBA macros to call Win32 APIs. However, an unplanned inclusion in the Defender ASR update caused Microsoft Defender to exhibit a series of false positive detections. These detections resulted in the deletion of files matching the incorrect detection logic, primarily impacting Windows shortcut (.lnk) files, including shortcuts from the desktop, the Start menu, and the Windows Taskbar.

Impacted users

Microsoft has stated that all users who updated to security intelligence builds between 1.381.2134.0 and 1.381.2163.0 face potential impact.

However, Microsoft adds that there is no danger of impact for users who do not have the “Block Win32 API calls from Office macro” rule turned on in block mode or did not update to security intelligence update builds 1.381.2134.0, 1.381.2140.0, 1.381.2152 or 1.381.2163.0.

Steps for those affected

Impacted users will need both the updated security intelligence build and to run a secondary script to recover the start menu shortcuts.

Firstly, all users should update to build 1.381.2164.0 or later. Users employing automatic updates for Microsoft Defender do not need to take any additional steps, as the updated security intelligence build will be pushed out to them. However, enterprise customers managing updates must download and deploy the latest update across their environments. One important aspect of which to take note, the security intelligence build does not restore deleted files.

How to recover deleted shortcuts

Microsoft swiftly established the steps necessary for users to recreate start menu links for a substantial subset of the affected applications. Detailed instructions can be found here.

Microsoft also has provided additional guidelines for deploying the script using Microsoft Intune.

The latest updated script (Version 3.0) includes restores from Volume Shadow Copy Service by default, recovery of “.url” files in a user’s profile’s favorites and desktop directories, improvements for non-English language machines, as well as enhanced error handling. At this time, the script does not currently restore taskbar shortcuts, though Microsoft is continuing to work on a solution.

Manual recovery

Customers preferring to employ manual steps to resolve the issue may run the Application Repair functionality for programs such as Microsoft 365, Microsoft Edge, and Microsoft Visual Studio.

Instructions for Windows 10 and Windows 11 machines are as follows:

Windows 10:

1. Start > Settings > Apps > Apps & features
2. Select the app you want to fix
3. Select Modify link under the name of the app if it is available
4. A new page will launch and allow you to select the repair

Windows 11:

1. Type “Installed Apps” in the search bar
2. Click “Installed Apps”
3. Select the app you want to fix
4. Click on “…”
5. Select Modify or Advanced Options if it is available
6. A new page will launch and allow you to select the repair

OneNeck, We’ve Got Your Back

If you have any questions on how to update, recover deleted links or are unsure if your organization has been affected, we’re here to help. Talk to one of our skilled team members today.

Frequently asked questions…

What does the Microsoft Defender do?

Microsoft Defender is a unified endpoint security platform that provides advanced threat protection to devices running Windows, macOS, iOS, and Android. It includes a range of security technologies, such as antivirus, firewall, and intrusion prevention, and uses machine learning and behavioral analysis to detect and respond to threats in real-time.

What is ASR in Microsoft?

Attack Surface Reduction (ASR) is a set of features in Microsoft Defender for Endpoint that helps organizations reduce their attack surface by blocking common malware delivery techniques, such as email and web-based attacks. It uses advanced heuristics and machine learning to detect and block suspicious activity, reducing the risk of successful attacks and improving overall security posture.

What is ASR advanced protection against ransomware?

This rule provides an extra layer of protection against ransomware. It scans executable files entering the system to determine whether they’re trustworthy. If the files closely resemble ransomware, this rule blocks them from running, unless they’re in a trusted list or exclusion list. You must enable cloud protection to use this rule.

Password Security Challenges

Passwords have long been the leading method of authentication and protecting sensitive information. However, as technology advances and the sophistication of cyber threats continue to evolve rapidly, the security of passwords is critical. Everyone must ask, “Is my password as safe as I think it is?”

The principal issue with passwords is that they can be easily compromised. Hackers use various techniques to obtain passwords, including socially engineered phishing attacks, keyloggers, and dictionary attacks. Additionally, many users employ weak, easily guessable passwords, some of the most common being “123456”, “password,” or “guest.” Using unsafe passwords makes it easy for hackers to access accounts and steal sensitive information.

Another challenge of passwords is that if users forgo short and obvious passwords, they often run into the issue of password retention. Everyone has multiple accounts and passwords, and it can be challenging to keep track of them all. As a result, people often reuse passwords across multiple accounts or write them down (monitor sticky-note, anyone?), thus compromising security.

Finally, even when following best practices, there are still risks concerning the security of password databases. If an organization’s password database is hacked, all of its users’ passwords face the potential of being exposed. These breaches have occurred in several high-profile instances, compromising millions of passwords and associated user ids.

So, are passwords as safe as most users think they are? Probably not. While passwords certainly provide some level of protection, they are not infallible, especially on their own. However, everyone can employ several tips and strategies that vastly decrease the likelihood of their accounts being compromised.

Ways to Protect Your Passwords

It should come as no shock that strong and unique passwords are safer and more challenging to crack. Even with this knowledge, many individuals still fail to put it into practice consistently. Length, complexity and account separation are all crucial factors to consider when creating strong passwords.

Password Length–

The length (total number of characters) is one of the essential aspects of password effectiveness. At its most basic, longer passwords are more difficult to crack because they have a larger number of possible combinations. Thus, it is harder for an attacker to guess the correct password through a “brute force” attack, which systematically tries many combinations of characters to guess a password. The attacker uses software to automate the process of trying different combinations and often starts with the most commonly used characters or words. More sophisticated brute force attacks can also include “password dictionaries,” lists of words and phrases of the most widely used passwords.

Each character increase in the length of a password exponentially adds to the possible combinations a brute force attack must try to compromise that password successfully. The generally accepted minimum password length by cybersecurity experts is 14 characters. A 14-character password made up of random letters and numbers has possible combinations of approximately four quadrillion (yes, with a “q”). The sheer volume of possible combinations significantly fortifies passwords against brute-force attacks.

Password Complexity–

A second vital aspect of password effectiveness is complexity. Ultimately complex passwords are more difficult to crack than simple ones and thus provide a more robust level of security. A complex password includes a mix of characters, such as uppercase and lowercase letters, numbers, and special characters – including spaces when permitted. Using a mixture of characters vastly increases the number of possible combinations.

Another reason why complexity is essential is that it makes it harder for an attacker to use the aforementioned “dictionary” attack. If your password is a complex, unique and random string, it is not likely to be found in the attacker’s pre-computed list. This complexity also makes it difficult for anyone, even individuals in direct contact with a user, to deduce or guess a password.

Password Separation–

Using separate passwords for different accounts is vital for security as it reduces the risk of compromising multiple accounts if a password is stolen or otherwise obtained by an attacker. If the same password is used for multiple accounts, and an attacker can obtain that password, they potentially have access to all associated accounts. Breaches like this can be particularly problematic if one of the accounts is sensitive, such as an organizational or financial account.

If an attacker obtains a password, when using separate passwords for all accounts, the attacker will only be able to access the account associated with that password. They will not be able to access any other accounts, limiting the damage they can do. This separation of passwords keeps individuals protected against automated attacks called “credential stuffing,” where attackers use lists of stolen usernames and passwords (often from another data breach) and try them on a variety of accounts (emails, credit cards, businesses, etc.). Using a unique password for each account reduces the possibility of a compromised password having a far-reaching negative impact.

How Long Does it Take to Crack a Password?

Here is an excellent visual representation that illustrates the above concepts. It shows how long, via today’s modern computing power, it takes for brute force attacks to crack passwords of various lengths and complexity. Many public email providers require a minimum 8-character password, which, even when using a combination of numbers, upper and lowercase letters and symbols, can be cracked in 8 hours—increasing this by one character ups the total to 3 weeks. Utilizing a password with 14 characters raises the estimate to 200 million years!

Creating a Strong Password

To review, a password must be long (preferably at least 14 characters) and complex (including numbers, letters, symbols and spaces when permitted). Additionally, each account should have a unique password. Since the average person has dozens of accounts, keeping track of and managing passwords can be challenging. There are recommended strategies to incorporate and some things to avoid that benefit not only strong password creation but also organization.

• Don’t use obvious details as passwords. Family members or pets’ names are among those most commonly associated with passwords. While variations of these names may be simpler to remember, this information is generally easy to find online as open-source intelligence (OSINT) and result in readily compromised passwords. The same holds for important dates (birthdays, anniversaries, etc.) and locations (addresses or hometowns).
• Instead of passWORDS, think more in terms of passPHRASES. Passphrases are typically longer than passwords and, therefore, harder to crack. A passphrase made of multiple random words can be more difficult to guess than a shorter, alphanumeric password, even if the password is considered complex. As with passwords, combinations of uppercase and lowercase letters, special characters and numbers are recommended.

Additionally, passphrases are often more memorable than random strings of characters, making it less likely that the user will have to write the passphrase down or store it in an unsecured location. They can also be harder to steal through phishing or social engineering tactics because, in most cases, they don’t contain personal information.

• Password managers are a great way to keep track of login credentials. These tools use encryption to store and generate complex passwords for all online accounts. Additionally, they are configurable to fill in login information automatically, eliminating manual entry of usernames and passwords. Thus, logging into accounts is more convenient and secure by making it less likely for accounts to be vulnerable via weak or reused passwords. Another benefit of password managers is minimizing exposure to phishing attacks. If a user unknowingly clicks a bad link, the password manager will not offer to fill in login credentials because it does not recognize the imposter website.
• Finally, whenever possible, use multi-factor authentication (MFA). MFA makes it considerably more difficult for attackers to gain unauthorized access to an account, even when they have access to an account password. MFA can help defend against phishing, keyloggers and malware attacks by requiring the attacker to steal or replicate a second factor (e.g., a phone) to pass the MFA check. Security in layers is a best practice, and while not foolproof, MFA provides an additional layer of security that can significantly reduce the risk of unauthorized access to your accounts.

OneNeck – A Security Partner You Can Trust

As an experienced IT security services provider, OneNeck is here to help. Our team can assess your current security posture, develop a defense strategy, and help you better leverage your existing security investments. Contact us today to speak with a OneNeck security professional.

Frequently asked questions…

What is the safest way to protect passwords?

The safest way to protect passwords is to use a strong, unique password for each account, and to store them securely using a password manager. A password manager encrypts and stores your passwords, making them accessible only with a master password or biometric authentication, and can generate strong, random passwords to help ensure maximum security.

What is a passphrase?

A passphrase is a series of words or other text used as a password or key to protect access to an account, device, or other resource. Passphrases are typically longer and more complex than traditional passwords, and can be easier to remember while also providing greater security against brute-force attacks.

Do security experts recommend password managers?

Yes, many security experts recommend using password managers as a secure way to manage passwords. Password managers can generate strong, unique passwords for each account, store them securely, and automatically fill them in for you, reducing the risk of password reuse, weak passwords, and other security issues. However, it’s important to choose a reputable password manager and follow best practices for password security, such as using multi-factor authentication and regularly changing passwords.

What is the difference between 2FA and MFA?

2FA stands for “two-factor authentication,” which requires users to provide two forms of authentication to access a resource, typically a username/password combination and a one-time code sent via SMS or generated by an app. MFA, or “multi-factor authentication,” is a more advanced form of 2FA that requires additional forms of authentication, such as a fingerprint or facial recognition, in addition to the traditional username/password and one-time code.

SQL Server Price Increase for 2023

Moving into a new year always brings about changes to business and technology, with pricing increases and adjustments often playing a significant part. The start of 2023 is no different. With the calendar turning to January 1^st, Microsoft introduced a pricing increase for SQL Server and implementation a global US Dollar price list for its Microsoft Cloud offerings.

As of January, Microsoft has increased the price of all Microsoft SQL Server on-premises licenses by 10%. The first increase in nearly a decade is across all licensing programs. It is also worth noting that these increases impact the cost of Software Assurance – which is a fixed 25% of the licensing price.

Microsoft Cloud and SPLA Service Providers are the notable exceptions to this new pricing structure. Providers saw matching 10% price increases on Standard and Web editions but face a slightly reduced rise of 8% on Enterprise editions. Currently, prices for SQL Server on Azure (Azure SQL Managed Instance, SQL Server IaaS and Azure SQL Database) remain unchanged.

Customers with existing subscriptions will see price changes once their current subscription has ended. At renewal, prices will be adjusted to the current US Dollar rate and locked in for the subscription duration. Updates for classic on-premises licensing reflect this new methodology.

SQL Server 2022 New Features

While an increase in pricing is seldom met with cheers by consumers, SQL Server customers are gaining several new features with SQL Server 2022 (16. x). Microsoft has introduced numerous new and improved functionalities, including noteworthy additions to performance, security and availability.

SQL Server 2022 enhances performance via a new feature known as Intelligent Query Processing. Customers can use this new feature not only to build better execution plans but also to perform multiple execution plans based on the parameters stipulated at runtime. Additionally, Query Store is now enabled for all new databases and now supports availability group read-only replicas and allows query hints within the Query Store, thus improving queries without needing to make code modifications.

Availability and continuity also saw improvements with the full integration of Managed Instance link into SQL Server 2022, enabling near real-time data replication from SQL Server to Azure SQL Managed Instance. This link provides hybrid flexibility and database mobility while allowing for features such as scaling read-only workloads, offloading analytics and reporting to Azure and migrating to the cloud. Furthermore, with SQL Server 2022 comes the addition of disaster recovery. Via the link feature, users can replicate data from SQL Server 2022 to Azure SQL Managed Instance, manually fail over to SQL MI during a disaster and back to SQL Server upon mitigation. This link runs as long as needed, potentially even for years.

“Microsoft SQL Server 2022 is a game changer when it comes to modern hybrid data systems,” says Lee Grant, Principal Application Architect and Certified Azure Data Engineer. “It is a key non-Azure component of the Microsoft Intelligent Data System. The inclusion of Azure Synapse Link to SQL 2022 makes getting on-premises data into Azure Synapse Analytics Dedicated SQL Pools a breeze. This and Managed Instance Link will help enterprises modernize their data systems to leverage advanced data services in Microsoft Azure.”

Security upgrades considerably in SQL Server 2022 via the Defender for SQL plan. Defender for SQL protects database estate wherever they live: on-premises, hybrid, or multi-cloud environments. Included functionalities are the ability to discover and mitigate potential database vulnerabilities and deliver the capacity to detect anomalous activities that indicate threats to your databases. (SQL Server Extension for Azure must be enabled.)

Another significant security addition is the new Ledger feature which provides tamper-evidence capabilities in your database. Ledger provides a detailed history of data modifications, which can be used internally or externally for reviews with auditors, business partners and clients.

With the aforementioned updates and the inclusion of several additional new and enhanced features, SQL Server 2022 delivers significant improvements over previous versions and supplies plenty of rationale for making the switch.

OneNeck – A Trusted Partner

Whether you are a current SQL Server subscriber or considering the switch, OneNeck can help you find the right fit for your organization. Ready to update to SQL Server 2022? Our experienced team will ensure that the upgrade is performed efficiently and that your data is securely protected. Contact us for more information.

Frequently asked questions…

What is SPLA Microsoft?

The Services Provider License Agreement (SPLA) is a licensing program offered by Microsoft that allows service providers to offer Microsoft software to their customers as a service. SPLA licenses are designed for hosting service providers who want to offer Microsoft software applications and services on a rental basis to their customers, rather than selling licenses directly to end-users.

What is the difference between Microsoft CSP and SPLA?

The Microsoft Cloud Solution Provider (CSP) program and the Services Provider License Agreement (SPLA) are both licensing programs offered by Microsoft, but they differ in their target audience and licensing models. The CSP program is designed for partners who want to resell and manage Microsoft cloud services for their customers on a subscription basis, while the SPLA program is designed for hosting service providers who want to offer Microsoft software applications and services on a rental basis to their customers.

What is query store?

Query Store automatically captures a history of executed queries, their performance metrics, execution plans and runtime statistics. It allows database administrators to separate data by time windows in order to see database usage patterns and understand when query plan changes happened on the server.

Change is a given with evolving technology, and more is coming with Azure Active Directory Connect. Here’s what you need to know to make sure you stay ahead of the changes…

On March 15, Microsoft will begin retiring past versions of Azure AD Connect Sync 2.0.x, 12 months from the date they are superseded by a newer version. This upgrade is especially important since Microsoft had to update their prerequisites for Azure AD Connect and you may need additional time to plan and update your servers to the newer versions of these prerequisites.

The following versions will retire on March 15, 2023:

• 2.0.91.0
• 2.0.89.0
• 2.0.88.0
• 2.0.28.0
• 2.0.25.1
• 2.0.10.0
• 2.0.9.0
• 2.0.8.0
• 2.0.3.0

If you’re not already using the latest release version of Azure AD Connect Sync, you should upgrade your software before the March 15 deadline.

What happens if you don’t upgrade your Azure AD Connect?

If you’re running a retired version, it might unexpectedly stop working. You also might not have the latest security fixes, performance improvements, troubleshooting and diagnostic tools, and service enhancements. If you require support, Microsoft might not be able to provide you with the level of service your organization needs.

What about auto-upgrade?

Not all releases of Azure AD Connect are made available for auto-upgrade. The release status indicates whether a release is made available for auto-upgrade or for download only. If auto-upgrade was enabled on your Azure AD Connect server, that server automatically upgrades to the latest version of Azure AD Connect that’s released for auto-upgrade. Not all Azure AD Connect configurations are eligible for auto-upgrade.

Auto-upgrade is meant to push all important updates and critical fixes to you. It isn’t necessarily the latest version because not all versions will require or include a fix to a critical security issue. (This example is just one of many.) Critical issues are usually addressed with a new version provided via auto-upgrade. If there are no such issues, there are no updates pushed out by using auto-upgrade. In general, if you’re using the latest auto-upgrade version, you should be good.

In conclusion…

For Microsoft’s detailed information on Azure AD Connect’s version release history, refer to their documentation here. And as always, if you’d like help getting it done, or need any other Azure related help, we are here to assist.

KEEP MOVING FORWARD. WE GOT YOUR BACK.

Frequently asked questions…

What is Microsoft Azure Active Directory Connect?

Microsoft Azure Active Directory Connect is a tool that allows organizations to integrate their on-premises identity infrastructure with Azure Active Directory. It provides health monitoring, synchronization of users, groups, and contacts, as well as authentication and authorization for accessing Microsoft cloud services such as Office 365 and Azure.

What is Azure AD portal?

The Azure AD portal is a web-based interface that allows administrators to manage and configure Azure Active Directory  resources, such as users, groups, applications, and devices. It provides a central location for managing identity and access in Azure, and includes features for managing authentication, conditional access policies, and security settings.

Low-code development is a phrase you are likely hearing a lot lately. Many organizations are already utilizing this form of application development, and the vast majority plan to increase its usage in the future. Let’s examine two important questions surrounding low-code application development, starting with, what  is low-code development? Secondly, is low-code truly the future of app development?

What is Low-Code and Its Future Impact?

The answer to the first question is fairly straightforward: low-code development is a method to build software applications faster by diminishing the need to write code. With a low-code application development platform, one uses visual development tools, such as drag-and-drop modelers, point-and-click interface creation, smart services, elements and pre-built connectors. They reduce the necessity to write code and facilitate business applications’ speedy design, deployment and maintenance.

The second question takes a little more consideration. According to a Gartner study, it is predicted that by 2024 more than 65% of all business applications will be built using low-code programming, with about 2/3 of enterprises employing a minimum of four low-code platforms. Based on these statistics, it is somewhat safe to say – yes, low-code is going to play a large role in the future of application development. Let’s assess in more detail exactly why low-code’s future appears so bright.

Benefits of Low-Code

The fundamental benefits of low-code solutions are speed and collaboration. The inclusion of pre-built components and integrations make it simpler to create sophisticated and powerful applications. More specific benefits include:

• Improved Agility– Low-code tools are designed to allow users to create and deploy applications fast and efficiently without extensive programming knowledge. Businesses gain the ability to be more agile, quickly developing and deploying the applications they need to support operations and respond to changing business needs.
• Lower Costs of Entry and Deployment– Low-code platforms often include pre-built components and features that can be assembled into complete applications. These features make it possible to develop apps in-house rather than paying for costly custom software development services.
• Small Business Staffing Issues– With little to no coding required, low-code tools are usable by a broad range of individuals within an organization, including those with no background in programming. Small businesses gain the ability to create the apps they need to support operations and respond to changing business needs, without the necessity of having a large IT staff.
• Higher Productivity– Low-code technology helps to streamline the development process and allows teams to be more productive and efficient. Development teams are able to focus on design and functionality, rather than spending time on the tedious and time-consuming process of writing code. Changes and updates that once took large chunks of time can now be nearly instantaneously implemented.
• Effective Risk Management and Governance– Organizations gain the ability to respond quickly to changing business needs or new regulatory requirements, reducing the risk of compliance issues. Additionally, built-in security controls help to protect sensitive information and reduce the risk of data breaches or other incidents. Furthermore, low-code platforms often include version control and other collaboration features, assisting in maintaining a clear audit trail and ensuring applications are developed, controlled and maintained consistently.
• Automation of Business Ideas and Processes– By offering pre-built workflow templates, low-code tools allow automation to be accessible to teams of all skill levels. Additionally, it permits these teams to handle related service requests independently without requiring more extensive involvement from IT staff.
• Democratization of Software Development– The addition of more people in the development process allows organizations to develop custom software quickly and efficiently. With the presence of enhanced collaborative features, it is possible for multiple individuals to simultaneously work on an application. This cooperation allows businesses to maximize limited staffing resources while fostering a more inclusive approach to software development.

Is Low-Code the Same as No-Code?

The term no-code generally suggests a platform is intended for non-professional developers. The reality is there is always code and software running someplace, but with these types of tools, the coding is hidden from the user. No-code solutions are typically marketed towards non-developers and small businesses as an approachable or entry-level option.

Due to their nature of not requiring the user to utilize any coding, customization is often relatively limited. However, it is worth noting that despite the lack of required programming language, some knowledge in development is often necessary to use the required visual modeling tools or if the organization wishes to make more advanced customizations via the addition of some code.

Example of Low-Code Usage in Business

Microsoft’s Power Platform is a low-code suite of applications that enables users to build custom applications, automate processes, and analyze data without extensive coding knowledge. It consists of four main components:

• Power BI– A business intelligence and data visualization tool that allows users to create interactive reports and dashboards from various data sources.
• Power Apps– A platform for building custom business applications without the need for coding.
• Power Automate– A tool for automating business processes by allowing users to create custom “flows” that are triggered and can integrate with other applications and services.
• Power Virtual Agents– Used to build chatbots and other conversational AI agents.

All organizations have bottleneck processes that slow everyone down. These procedures don’t add particular value but are ultimately necessary for operation. Such processes might include managing complicated Excel spreadsheets or approval processes that require constant emailing back and forth, resulting in digging through these emails for each request to get them to the right people. Power Platform’s low-code tools make it possible to build a better way to accomplish these tasks.

Another aspect worth pointing out is that for software an organization is already using, the Power Platform offers an extensive list of connections to those existing systems. If one is currently using a platform with specific APIs, chances are there is a connector already built into Microsoft’s Power Platform that allows access and interaction with that data. Ultimately, Microsoft’s Power Platform’s purpose is to fix processes minus the need for advanced coding expertise and is of particular value to smaller organizations that want to do things better without significantly draining limited resources.

What Does Low-Code Mean for Professional Developers?

With the exponential increase in low-code app development, it might be easy to assume that professional developers should be worried their value to an organization is decreasing. However, the reality is precisely the opposite. Low-code tools make experienced developers even more useful.

Low-code can be beneficial for professional developers for numerous reasons, including:

• Allows professional developers to be more productive. By permitting non-technical users to help create software applications, experienced developers can focus on complex tasks and on building high-quality software.
• Helps developers to stay relevant in a rapidly changing market. As the demand for software development continues to grow, low-code tools can help experienced developers quickly learn new skills and adapt to emerging technologies.
• Enables more collaboration with all stakeholders. Because low-code platforms allow non-technical users to participate in the software development process, skilled developers can more easily communicate and collaborate with other teams and departments within their organization.
• Assists experienced developers in creating more innovative solutions. Using low-code tools, developers can quickly prototype and test new ideas, helping them design creative and effective solutions to problems.

The aim of low-code platforms is not to cut out professional developers from helping an organization build its processes. Rather, it is about trying to make it easier for IT and business users to work together to create more efficient processes that work for everyone. Ultimately, low-code is valuable for professional developers, helping them to increase productivity, stay relevant and create innovative solutions.

Embrace the Low-Code Revolution

Low-code platforms will undoubtedly play an essential role in the future of software development. These tools not only save time and money but also allow more people to participate in the process, enabling businesses to be more agile and responsive. Low-code technology is revolutionizing the way software is developed and is poised to become a standard for application creation in the coming years. As it continues to evolve and improve, expect to see even more exciting and innovative applications built via these platforms.

Are you interested in finding additional information on Microsoft’s Power Platform and the broader applications of low-code tools? Sign up for a Free Power Platform Workshop led by Kaitlyn Montour, and see how the process automation apps already included in your M365 subscription can bring your big ideas to life.

Frequently asked questions…

Is low-code in demand?

The demand for low-code platforms has grown significantly as businesses look to digitize their operations and streamline their processes. The worldwide market for low-code development tools is projected to total $26.9 billion in 2023, increasing nearly 20 percent from 2022, according to the latest forecast from Gartner, Inc.

What is Microsoft Power Platform used for?

Microsoft Power Platform is a low-code development platform that enables organizations to rapidly build custom business applications, automate workflows, and analyze data using Power Apps, Power Automate, Power BI and Power Virtual Agents. Each area may be used independently or collectively.

What is the Power Platform admin center?

The Power Platform admin center is a web-based administrative console that enables administrators to manage the Microsoft Power Platform services. It provides a centralized location to view and manage environments, permissions, data policies, and more. Administrators can also access the Power Platform admin center through the Microsoft 365 admin center.

How does automation enable business services to support agility?

Automation helps businesses streamline and optimize their processes, reducing manual work and human error while increasing speed and efficiency. This allows organizations to respond more quickly to changes in the market and adapt services to meet evolving customer needs. By automating routine tasks, businesses free up their workforce to focus on higher-value work, leading to enhanced outcomes and increased innovation.

The end of the year is a time when businesses are wrapping things up. This sense of closure, coupled with the fact that people are taking time off, brings everyone’s guard down. While letting your guard down may be good for your family, it’s not the best idea when it comes to cybersecurity. 

Cybercriminals are savvy and look for opportune times to conduct their attacks. They know the holiday season is a great time to take advantage of people’s generosity and goodwill. The best defense for your business is to understand the tactics bad actors use to infiltrate IT security. To that end, we’ll consider seven best practices to protect your organization as the end of the year rolls around. 

7 Best Practices to Help Secure Your IT Infrastructure

1. Install software updates and patches promptly.

Security patches are created in response to developing threats and are usually released because the threat is deemed too serious to wait until a major software update. Installing patches as they become available helps businesses mitigate risk by ensuring vulnerabilities exist for as short a time as possible. Additionally, having policies to keep up with updates when employees are out of the office and during downtime (especially at the end of the year) helps keep your business systems running smoothly.

2. Use strong passwords and change them regularly.

It’s estimated that 81% of data breaches happen because of poor passwords. A seemingly small change can make a huge difference in your organization’s security. The end of the year is a great time to prompt employees to change their passwords. When doing so, encourage them to use 16 characters or more, as this strengthens password security.

3. Restrict access to sensitive data to authorized users only.

By restricting access to what’s strictly necessary, companies can reduce the risk of unauthorized users accessing and compromising that data. When attacks are likely, such as during the holiday season, reviewing your access policies helps ensure there are fewer people who can possibly mishandle sensitive data. Another reason is compliance. Many regulatory bodies require companies to restrict access to sensitive data in order to meet compliance requirements.

4. Educate employees on cybersecurity best practices.

Education is one of the best ways to defend against potential security risks. Training should be relevant to employee jobs to keep them engaged; the less generic, the more likely they are to heed the warnings. Training can include topics like the dangers of clicking on links, opening attachments from unknown sources, using strong passwords, and keeping their personal devices updated. Why not schedule training right before security is on high alert and send out a refresher when employees are more likely to let their guard down? 

5. Protect against phishing scams and malware attacks

New phishing scams and malware attacks arrive daily, so there’s no way you can train on the specifics. But you can help your employees practice good cyber vigilance to recognize the signs. For example, they should be aware of the red flags of a scam email or phishing call, such as poor grammar or requests for personal information from people they don’t know. They should also be cautious about approving application authorizations if they don’t have explicit knowledge of who’s requesting it. Tips like these could be included in the cybersecurity refresher we recommend sending out.  

6. Use two-factor authentication whenever possible.

Two-factor authentication is a cybersecurity best practice that requires employees to use two forms of identification to log in to their accounts. So even if a password becomes compromised, the hacker still needs a second authentication. In fact, a 2019 Microsoft report found that two-factor authentication blocked 99.9% of automated attacks.

7. Have a plan in place for dealing with a cybersecurity incident.

Whatever your efforts, no security plan is impenetrable. And a cybersecurity incident can have many negative consequences for an organization, including loss of data, decreased productivity, and financial damage. Having a plan in place will help you mitigate the effects in case of an incident. This plan should include steps for preventing and responding to incidents, as well as procedures for communicating with stakeholders.

Don’t Stress. Take the Proactive Approach Instead

At the end of the year, security isn’t always top of mind. By educating your organization on how to work securely, you mitigate many of the dangers hackers use during the holiday season.  

It’s also possible you’re looking for a partner to help fortify your security practices or provide needed security leadership. If that sounds like you, visit our IT security services page to learn more about what we offer. We’re here to help! 

Stay safe out there, and happy holidays! 

Frequently asked questions…

Why is patch management important?

Patch management is important because it helps to ensure that software and systems remain up-to-date and secure. By regularly applying patches, organizations can fix vulnerabilities and reduce the risk of cyberattacks or other security breaches. Additionally, patch management can help to improve system performance and reliability.

What is incident response in cybersecurity?

Incident response is the process of identifying, investigating, containing, and recovering from security incidents in order to mitigate the impact of a cybersecurity breach or attack. The goal is to minimize the damage caused by the incident, prevent it from spreading, and restore normal operations as quickly as possible.

What type of password are hardest to crack?

Having a long mix of upper- and lower-case letters, symbols and numbers is the best way make your password more secure. The safest way to protect passwords is to use a strong, unique password for each account, and to store them securely. Security experts recommend using passwords of at least 14 characters.

What is the difference between cybersecurity and cloud security? Which of these security aspects is appropriate for your organization? On their face, these two terms appear to cover similar topics. While there is undoubtedly some crossover, they are, in reality, distinct aspects of digital security and focus on specific and unique areas. However, due to perceived similarities, there can be confusion over each term. As we delve into these concepts, let’s first define each term.

• Cybersecurity is the art of protecting networks, devices, and data from unauthorized access or criminal use and the practice of ensuring confidentiality, integrity, and availability of information. –CISA
• Cloud security refers to the processes, mechanisms and services used to control the security, compliance and other usage risks of cloud computing. It specifically addresses the security of the cloud service and security within the cloud service. Still, the term does not encompass security services delivered from the cloud (security as a service) that are intended to be used outside the cloud. –Gartner

What do these definitions mean? At its core, cybersecurity ensures that end user devices stay free of compromise. Cybersecurity’s ultimate goal is protecting data belonging to an organization from unauthorized access, use or modification. In other words, it safeguards computer networks and the data stored within from being lost, corrupted or stolen.

While also focused on data protection, the purpose of cloud security is to ensure data stored in the cloud is inaccessible to unauthorized users or servers. Cloud security safeguards data in the cloud. This protection extends to unauthorized access attempts both through the cloud service provider and the end user. Rather than protecting data from unauthorized theft or modification, the fundamental concept of cloud security focuses on protecting data from ever being breached.

Critical Components of Cybersecurity and Cloud Security

Cybersecurity– The vital elements of cybersecurity incorporate:

• Application Security
• Network Security
• Disaster Recovery Planning
• Information Security
• End User Security
• Operational Security

Cloud Security– The fundamental aspects of cloud security include:

• Data Security
• Identity and Access Management (IAM)
• Governance (Policies on Threat Prevention, Detection and Mitigation)
• Data Retention and Resiliency
• Legal Compliance

Differences Between Cybersecurity and Cloud Security

While the intricacies of cybersecurity and cloud security can fill numerous pages of content, we will focus on areas where fundamental differences occur. Understanding these distinctions assists in determining the how, why, where and when of applying each security concept.

Security of Personal Information

Cybersecurity offers specific functionalities to protect computer networks and devices against potential threats on a network. It protects from viruses, malware, etc., on the server side. These measures often involve the end user utilizing protocols, such as avoiding suspicious links and deploying solid passwords or two-factor authentication to protect their personal information.

Cloud security filters all traffic trying to access data stored in the cloud by letting authorized users access information while blocking unauthorized traffic from gaining access. All authorized traffic is pointed directly to a specifically intended server instead of any other server where user data could be compromised.

Liability

Generally, an organization and its users are liable for protecting any data stored on their devices. Simply put, they must ensure unauthorized individuals do not gain access. While manufacturers of devices hold the obligation to provide appropriate patches and security updates, the cybersecurity responsibility ultimately falls to the organization to protect their clients’ data. Failure to do so can have severe financial and reputational consequences.

Within cloud security, cloud service providers and organizations share liability when using cloud services for data storage. The cloud service provider mitigates privacy breaches through both software and hardware by maintaining and upgrading security features and adding additional functionality to protect private information. Organizations are accountable for keeping their customer’s data confidential and may be held liable if they fail to follow required security protocols.

Responsibility for Security

Within cybersecurity, the device owner and the organization are responsible for maintaining the security of private personal information. Individuals, or IT Security, have the duty to monitor this data, with the responsibility ultimately resting on the device owner to follow appropriate best practices to secure data from being stolen by hackers.

Cloud security is generally a shared security model where any services provided fall under the service provider’s scope. However, how these services are configured and utilized is up to the customer using the cloud platform. For example, utilizing cloud services and setting up non-secure passwords would shift accountability to the user. In contrast, responsibility for a breach due to a faulty update would fall on the cloud service provider.

Threat Detection

Traditional cybersecurity methods employ antivirus software to find and eliminate security risks. The principal downside of antivirus technology is that it tends to lag behind ever-changing threats and must be updated frequently to continue its effectiveness. This maintenance requires buy-in from internal IT security to patch internal systems and distribute updates, as well as from end users who must install all updates promptly.

Cloud security uses Artificial intelligence (AI) to detect and interpret threats. This differs from cybersecurity methods in that it does not entail consistent organizational-initiated updates. AI discovers and monitors hacking efforts as they arise, keeping servers shielded from attacks and greatly diminishing the possibilities of a breach. Furthermore, advanced analytics are collected and examined through automated processes to determine if abnormal activity or protocol violations have transpired and, if discovered, send automated alerts to both the service provider and customer.

Backup and Recovery

Cybersecurity-based data backup is accomplished through physical and external storage media. This process is primarily conducted manually by either end users or security professionals. Restoration of damaged or lost data is performed via an organization’s predetermined recovery protocols. While this allows for tailor-made recovery solutions, it requires sizable organizational resources.

All data stored under the auspice of cloud security is securely and automatically backed up within designated servers. Backups are created for primary and secondary storage, allowing for rapid data restoration via assigned recovery methods. Cloud service providers generally offer built-in recovery methods, but depending on an organization’s size and specific needs, the deployment of 3^rd party recovery tools may also be applied.

Data Storage

With cybersecurity methods for backup and storage, organizations have strict control over who has access to data. Protocols for admission are determined based on organizational needs or regulatory compliance. Access must be granted and monitored via company IT security or a hired 3^rd party. Additionally, in most cases, backups will need to be manually maintained by the organization and can be both expensive and time-consuming. Scaling requires significant infrastructure investments as well as increased staffing.

The cloud provider categorizes all data traffic to protect sensitive information when utilizing cloud security for data storage. Here, multiple security layers, including data encryption, are used. Additionally, strict access control methods safeguard user privacy and information. Furthermore, with increasing numbers of cloud storage providers and various services, storage space is readily accessible and scalable, with relatively low investments necessary.

Conclusion

Both security aspects benefit organizations utilizing data in the modern workplace. For those storing data in the cloud, or hybrid environments, cloud security plays a crucial role in keeping threats at bay by ensuring data is safe from loss and unwanted access. The low infrastructure investment and 3^rd party security management will undoubtedly be attractive to small and mid-sized businesses and those new to utilizing data in the cloud.

While cloud security reduces the burden on companies and their end users, cybersecurity allows for the customization of security protocols, including configuring all organizational devices and systems to meet individualized requirements. Also important is the inherent agility to adjust protocols to meet challenges as they are presented. Additionally, deploying traditional cybersecurity methods is essential in securing physical assets and internal networks.

Any organization utilizing or storing data in the cloud must use both cloud security and more traditional aspects of cybersecurity, as these safeguards complement each other. Application and adherence to recommended cybersecurity and cloud security protocols strengthen overall security posture. Following proper cybersecurity measures will make it much more difficult for unauthorized actors to compromise your data and devices while employing strong cloud security, which blocks access for those seeking private information to utilize in an attack.

Recognizing that these specific safety measures enhance each other is why OneNeck employs a holistic approach to security. We build security solutions specifically for an organization’s needs. Our experience and attention to detail have made us a preferred security services provider for companies of all sizes in just about every industry from coast to coast.

If you would like to know how we can assist you with your security needs, please contact us to learn more.

Frequently asked questions…

Who is responsible for cloud security?

Cloud security is a shared responsibility between the cloud service provider and the cloud customer. The cloud vendor is responsible for the security of the cloud infrastructure, while the cloud customer is responsible for securing their data and applications running in the cloud.

When is cybersecurity awareness month?

Cybersecurity Awareness Month, launched in 2004, is observed every year in October, to raise awareness and promote best practices for staying safe and secure online. The Cybersecurity and Infrastructure Security Agency (CISA) and the National Cybersecurity Alliance (NCA) use the month to lead a collaborative effort between government and industry to raise cybersecurity awareness nationally and internationally.

What is threat detection and response?

Threat detection and response is the process of identifying, analyzing, and responding to potential security threats in a proactive manner. It involves the use of various security tools and techniques to monitor and detect threats, and the development of incident response plans to quickly contain and mitigate any potential damage. This is a critical aspect of cybersecurity, as threats are constantly evolving and becoming more sophisticated.

Work from home was trending before the pandemic, but since COVID, it has become the norm for many businesses. Now, as we come out of the pandemic, we’re entering another crisis: inflation. Companies that embrace remote work are being praised because it helps employees cope with the financial impacts of inflation. However, remote work has brought new challenges, like the need for more cloud computing tools.

Cloud computing is the most effective way to provide remote employees with the software they need to do their job. To give them access, companies must incorporate cloud applications into their tech stack. Many turn to software providers like Microsoft because they offer a plethora of tools that help businesses fill their digital gaps. These tools include Azure, Teams, and Office365.

However, teams often lack the digital expertise to deploy these applications at scale. A Microsoft cloud service provider (CSP) supplies the know-how and personnel needed to deploy with ease.

Give Up the Management Headache with a CSP

If you’ve ever watched a cooking show, you’ve undoubtedly noticed the speed and precision at which professional chefs work. But what happens when we try to copy their recipe? It usually takes us three times longer to recreate it, and if we’re being honest, it probably doesn’t taste as good. Similarly, while customers can set up Azure on their own, their success is often greatly improved with the help of a CSP. Consider seven benefits of working with a Microsoft CSP.

1. Support. Businesses that do it alone have to troubleshoot issues and ensure their installation is up to date and secure. A CSP provides a storehouse of experience and application-specific knowledge to help you resolve issues with minimal effort.
2. Deployment. It’s one thing to test new technology on a small scale and quite another to deploy it across your organization. If you don’t have the processes to deploy cloud applications at scale, you may find your deployment stalling at different stages as you figure things out. A CSP’s expertise will not only speed up deployment but can help roll out the software in predictable stages that simplify migration for your team.
3. Bundled applications. Cloud service providers often deliver configured or proprietary in-product features that help manage users and monitor and secure your applications.  They know how to package solutions because of their experience with other vendors – saving you the time and effort to develop your own software stacks.
4. Managed services. Microsoft partners are required to do more than resell Microsoft products; they must provide value on top of the service. For example, many CSPs manage your services, ensure security, and provide the support that eliminates the need to escalate issues to Microsoft.
5. Flexibility. Cloud solutions are inherently flexible, but scaling up and down services can still present administrative challenges. Your CSP can handle the complexities of scaling, like managing users, licensing, and resource allocation.
6. Licensing support. Identifying a single person’s subscriptions is enough to give you a headache, let alone your entire organization. A Microsoft CSP can manage all your Microsoft cloud licenses. And in addition to simplifying administration, your CSP can ensure you don’t have unused licenses sitting around and advise you on how to get more out of your subscriptions.
7. Control without management. Partnering with a CSP doesn’t mean you have to give up control. Your provider can still provide full admin control over your Office 365 and Azure subscriptions without the headache of managing everything else.

You can free up your team to focus on your company’s core mission by empowering them with cloud tools. A CSP can take over management so that your team only has to decide which tools to use and where you need them.

Partner With OneNeck for Microsoft Administration

OneNeck is a Microsoft CSP that provides a modern approach to software-as-a-service. We understand that the way companies use services is constantly evolving, so our offering is designed to adapt to those needs. With consolidated monthly billing, a simple subscription model, and no upfront costs, it’s easy to understand how your business uses its subscriptions. If you want to simplify your Microsoft services administration and gain world-class support, contact us.

Cloud computing solves a major challenge for many IT departments. It allows them to provide on-demand computing for their team, regardless of location or time of day. Teams are thus not limited to the capacity of an internal data center that may restrict usage to location or users. How does the cloud accomplish this feat?

It does so by providing ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources that can be rapidly provisioned and released with minimal management effort. Public cloud computing benefits from economies of scale, which allow it to draw from seemingly limitless resources.

While the benefits of the public cloud are considerable, teams may wonder about the benefits of choosing one provider over another. In this article, we’ll consider some specific ways Microsoft Azure is increasing the capabilities of many organizations.

Azure Extends Your IT Capabilities

Often, businesses look for more than simple cloud storage or computing power. Azure is an excellent option because it adds so many features and enhancements. For example, it offers a variety of pre-built applications that you can use to get started quickly. These applications are easy to configure and use, and they can help you get your business up and running quickly.

Another concern for business owners is security. Azure offers robust security features to keep your data safe. It has built-in firewalls that protect your data from unauthorized access and encrypts all data stored in the cloud, which adds redundant protection in case of a breach.

Lastly, Azure is backed by Microsoft and benefits from the scale of a global company. What does this mean for your company as a user?

• You can rely on Microsoft to provide world-class support for your Azure environment.
• You benefit from their large global footprint, with data centers in over 42 regions, ensuring that your applications are always close to your customers.
• Your apps and services are highly scalable, allowing you to scale up or down as needed.
• Your systems are highly reliable, with multiple layers of redundancy built in.

Azure’s features ensure that your computing infrastructure is always ready to meet demand and available to your entire organization. With that in mind, let’s look at a few specific applications of the technology.

No two companies are the same, and neither are their computing needs. Perhaps you’re interested in creating a modern workplace for your employees. Or maybe you want to improve the use of data in your organization. While we can’t cover every use case, let’s briefly consider how Azure fits into a few specific use cases.

Modern workplace. You likely already use Microsoft products in your operations. When using Azure, it’s easy to integrate and deploy Microsoft 365 tools like business-class email, collaboration tools including Microsoft Teams, and Office apps which are the standard in most businesses. The breadth of business applications makes it easy to create a holistic tech stack that supports your modern workplace.

Data and analytics. Learning from your data helps improve nearly every aspect of your business. However, collecting and managing large amounts of data requires powerful data tools. Microsoft Azure has many applications to help you analyze your data, like Azure SQL, Cosmos DB, Data Factory, Data Lake, Power BI, and more. These advanced tools plug right into your Azure environment, extending your IT data capabilities instantly.

Government agencies. Government organizations are subject to stricter data requirements, limiting their choices for cloud partners. Azure Government Cloud meets these rigorous requirements by completely separating your cloud data and providing enhanced security. It’s also compliant with regulations like HIPAA, FedRAMP, and IRS 1075.

Partner With OneNeck, a Certified Microsoft Cloud Service Provider

While reading about the advantages of using Azure, you’ve likely thought of a few applications for your business. As both a Microsoft cloud service provider and a hybrid IT solutions provider, we are uniquely qualified to help you leverage Azure to reach your business goals. For example, we help optimize your Azure spend, so you’re not wasting precious budget on unused resources.

Our goal is to provide value beyond just your Microsoft licenses, and help you make best-fit cloud decisions that fuel your business growth and while continually optimizing your current investments. And if your needs go beyond what Azure offers, we’ll help you make strategic decisions that benefit your company for the long haul. Do you want to find out which Azure applications are most suitable for your business needs? Contact us to learn more.

It’s October, which everyone knows means time for trick-or-treating, pumpkin-spiced everything and cybersecurity awareness. Ok, possibly you didn’t immediately think of that last part. However, October is Cybersecurity Awareness month and with it comes the announcement from the Cybersecurity and Infrastructure Security Agency (CISA) and the National Cybersecurity Alliance (NCA) that this year’s theme is “See Yourself in Cyber.” The goal is to highlight that whether one works in network security or is exclusively an end user, everyone has a role to play in strengthening cybersecurity.

After years of highly publicized ransomware attacks and expensive data breaches, it has become clear that organizations must allocate considerable resources for cybersecurity. This emphasis is necessary to protect company data, promote customer trust, and maintain compliance with the government and other regulatory agencies. Investment in secure and resilient infrastructure and applications such as next-generation firewalls, advanced backup and disaster recovery solutions, and utilizing IaaS and SaaS continues to significantly increase. However, broader cybersecurity awareness campaigns have yet to obtain such ubiquitous adoption status.

While most organizations acknowledge the importance of cybersecurity mindfulness, investing in and committing to cybersecurity awareness initiatives still lag significantly behind this stated recognition. This lack of prioritization, in many cases, is originated at the Board of Directors (BOD) level. There are many reasons for potential BOD hesitancy to support fully implementing cybersecurity campaigns, but some of the more common themes and means to address them include:

• Budgetary Concerns– All organizations have a limit to the resources designated for security. In many cases, it is often easier to convince board-level members to allocate these assets for infrastructure, applications or even additional staffing. Garnering support to assign these resources to less-tangible elements, such as security awareness training, is often challenging. Bringing to the BOD assessments that demonstrate how security training aids an organization while concurrently underscoring the costs of inaction can go a long way in convincing board members of the elevated ROI they will see from implementation.
• Lack of Cybersecurity Understanding– Education is vital. Company leadership will not support or approve campaigns they do not understand. It is common for leadership to view cybersecurity as an “IT issue” and not something that involves the entire organization. To raise the levels of understanding, one must ensure board members themselves are involved in cybersecurity training and are aware of not only the benefits of proactive company-wide approaches to cybersecurity but simultaneously understand the financial and reputational ramifications of breaches or attacks.
• Resistance to Change– Technology is evolving, and so are the threats. The modern workplace requires a modern approach where everyone is part of the solution. Ultimately individuals, including board members, don’t like change and often want to continue doing things as they have always been. A prospective way to combat this inertia is by increasing board member involvement in planning cybersecurity activities and training. When you have full board-level support for a cybersecurity awareness initiative, all employees and team members will eventually be able to “see themselves in cybersecurity” and recognize that compliance with training exercises or policies is a core component of their profession.

When asked about obtaining board-level support for cybersecurity awareness campaigns, Katie McCullough, Chief Information Security Officer at OneNeck, advised, “At its core, cybersecurity is about assessing, managing or removing risk to the availability of customer’s critical data and services. By ensuring cybersecurity is included as part of any Enterprise Risk Management (ERM), one can typically help drive the awareness and support of these campaigns through scheduled reviews of the ERM, by the Board of Directors.”

Clarification of why organization-wide cybersecurity awareness matters before successfully bringing cybersecurity campaign concepts to the BOD’s attention is imperative. Begin by stressing that critical concepts such as data protection and holistically solid security posture are at their core intelligent business decisions. This can be followed by emphasizing awareness training provides significant ROI, with expenses for designing and implementing awareness campaigns being greatly overshadowed by the cost of a breach. Finally, it is wise to highlight the short-term inconvenience of awareness training will materialize into significant long-term gains. Ultimately, the goal is to work with your BOD to answer questions and provide information, so they feel comfortable making informed decisions.

Another area to underscore to board members is that they are accountable for the organization’s cybersecurity. We see an extreme example of this accountability by analyzing the well-publicized breach of SolarWinds. In November of 2021, investors sued the BOD, claiming knowledge of cybersecurity vulnerabilities before a data breach and subsequent failure of action.

While a lawsuit may not be the most likely outcome of a cyberattack, it nonetheless serves as a stark reminder to board members that they are ultimately responsible for how organizations secure themselves. Having proactive board-level conversations about cybersecurity awareness helps protect the organization’s customers, profits, reputation and the Boards of Directors themselves.

Encouraging professional education for board members is another technique for getting board-level buy-in. Katie McCullough notes, “More and more companies are looking for Board of Directors to consider certifications such as NACD Certification program, which includes a certification for Cyber-Risk Oversight as an emerging area of board oversight.”  Board members can use training resources to:

• Learn foundational principles for board-level cyber-risk oversight.
• Increase comprehension of issues, including allocating cybersecurity responsibilities, legal implications, setting expectations about the organization’s cybersecurity processes and ways to improve employee engagement in security practices.
• Gain the ability to apply procedures and tools to improve organizational practices by focusing on specific risk components, including insider threats, third-party exposures, merger and acquisition due diligence, and adequate risk disclosure.

Board of Director buy-in is key to any organization having an effective cybersecurity awareness culture. For everyone in an organization to “see yourself in cyber,” the impetus must come from the top. Implementations of awareness campaigns, whether specifically designed to coincide with Cybersecurity Awareness Month or throughout the year, will only be effective if they are supported and promoted by company leadership.

While we have discussed several strategies and potential tools that can be used to secure top-level support, the essential thing to remember when dealing with board members is that despite their lofty positions, they are ultimately still just people. Effective communication, proper education and comprehensive information on the organization-wide benefits of cybersecurity awareness campaigns will go a long way in securing board-level support and approval.

In my last blog on Zero Trust (on June 6 of this year), I talked about the reasons why Zero Trust is becoming more popular and why the change is necessary.  In this blog, I want to delve more into what does a Zero Trust model buy you and what you still need to do in your security program alongside Zero Trust.

At its core, Zero Trust is making the decision that all access to applications, data and resources should be checked and strongly verified on a continuous basis.  This helps your organization in several ways…

Zero Trust helps provide a mechanism for strong identity protection. As protecting identities (both normal and privileged) has become one of the main focuses of security, more and more security tools and business processes hone in how to recognize how identities are being used and what access should they have.

This is really important because of the way applications and data are now dispersed. As security operation teams are trying to baseline access, it becomes instrumentally important to know the context of which identities are logging in, from where, and on what device.

One of the goals of Zero Trust should be to limit the number of people or identities that access your systems, data and applications, allowing you to watch possible compromised account activity and prevent compromises. Using strong authentication and just-in-time access, along with watching login activity, will greatly reduce the chance for compromised accounts. This makes life a lot simpler operationally and maybe in application development.

Now that you have a single method for access and are using a consolidated identity with strong authentication and baseline login activity, this allows organizations to expose resources internally as they would externally. Now internal applications and resources can feel like cloud applications and resources when it comes an employee access – the login method could be the same and the security can be the same. This innately helps with identity protection and gives flexibility to possible new ways for remote access for remote workers.

This also increases visibility with security operational staff, as security operations can now focus on less things to monitor and alert on. They can develop access polices that can be applied to more applications, data and infrastructure because the access method has be simplified, and reacting to compromised account indicators will be faster since logins have been baselined.

Additionally, the number of security tools might go down because access has changed and simplified. This is in contrast the older security model where access could wildly vary depending on endpoint network location and identity used.

What do you need beyond Zero Trust?

There are things that still need to be done beyond Zero Trust. While Zero Trust does help in many ways, it does not cover all aspects of what an effective security program still requires.

• Organizations still need to have strong policies and standards.
• They need to have a working vulnerability program that covers as many assets as possible.
• Remediation for found vulnerabilities needs to happen in a timely manner.
• Data protection has to be carefully planned and documented in case someone or thing has compromised the integrity of the data.
• Business continuity plans need to be in place and rehearsed.
• Endpoint security must works with your Zero Trust strategy.
• Security operations has to be built or outsourced to provide a response to security indicators.
• Tools have to be in place to take in those indicators and provide alerts.

In summary…

This is a high-level view of the benefits of Zero Trust and what other aspects of security must coexist alongside that architecture and solution for effective security strategy.  In my next post, I will go into more detail on the components of Zero Trust and things to consider to get started planning and implementing it in your organization.

In the meantime, if you’re considering Zero Trust in your environment and want to discuss,  just contact us, and one of our security experts is here to help.

If you were to survey your employees about aspects of their jobs that could be improved, you’d likely find better collaboration tools and meetings at the top of the list. In fact, in a PwC survey, 73% of respondents said they know of systems that would help them produce higher quality work.

While employees don’t always think executives listen to their concerns, that’s not often the source of collaboration problems. As your company grows, you’ve had to assemble your tech stack on the fly — trying your best to provide the tools employees need while staying focused on the company’s larger goals.

But eventually, you get to the point where your tech stack starts having a cumulative effect on productivity, whether for better or worse. In this article, we’ll consider some factors that can hinder or help your utilization of collaboration tools.

Under-utilization Leads to Fragmentation

The problem with collaboration tools not being used to their full potential is that it can lead to fragmentation. When employees don’t have the same tools, it becomes difficult for them to communicate and collaborate effectively. In some cases, this can even lead to employees working on different parts of the same project without realizing it.

Nowadays, there are many collaboration services available that can help your team work more effectively. These services can provide a common platform for employees to share files, communicate, and collaborate on projects. By leveraging a collaboration service, you can ensure that your team is using the same tools and is working together towards a common goal.

Choosing a collaboration service isn’t as simple as using a product the technical team finds appealing. It’s crucial to leverage data, employee input, and company goals to ensure you’re committing to the right platform.

1. Define your needs. To select the ideal collaboration service, you must first decide what you want it to do for your team. During the selection process, employee feedback is critical. Is executive opinion aligned with what employees actually need? From there, you can ask questions about your technical needs. Are you looking for something that will allow employees to share files and communicate easily, or are you looking for a service that facilitates meetings and client communication? You may also need a service that provides an all-in-one solution. Getting clarity on your actual needs will help you use your budget more effectively.
2. Research and test different services. There are many services available today, so it’s important to find one that fits your needs. In your previous analysis, you may discover that your team only lacks a rock-solid communication app. With that knowledge, you may decide to use a niche app that does the job superbly. However, it’s good to keep in mind that the biggest collaboration boosts will come from tools that allow you to do many jobs within the same ecosystem. So, while your needs today may not be as intensive, you may opt to choose your tools planning for future growth. Some popular communication apps include Microsoft Teams, Slack, and Zoom.
3. Deploy the collaboration service. Often, deployment can be the most challenging step since it requires training, technical capabilities, and administrative management. A solid transition plan will ensure that collaboration services are deployed uniformly across departments. Additionally, instituting a regular training program will help employees make the switch faster, increasing adoption rates.

Implementing new technology can be a phase that employees dread or are excited about. Much of their feelings will depend on the groundwork you do to get buy-in from your team. You can generate excitement by including your team in the decision-making process — clearly articulating why you’re making the change and providing training. When your team is excited about the change, you’ll have the momentum you need for successful integration.

Facilitate Deployment with a Collaboration Services Partner

Many businesses hit a roadblock when they get to deployment. Their team is excited about migrating to tools that provide a holistic collaboration experience. But they lack the technical expertise and migration experience to get started. If you feel stymied by the prospect of migrating your tools, we can help.

OneNeck offers managed collaboration services that give you the tools you need without the technical headache. We partner with companies like Cisco and Microsoft to provide complete solutions that cover the A to Z of your collaboration needs. And if you’re looking for something more streamlined, we can adapt our solutions to fit your needs. Contact us to learn more.

Government agencies impact the life of everyone in the country, so they must operate as efficiently as possible. Cloud tools increase the efficiency of large organizations by offering a way to collaborate and share data with ease, but government agencies must be cautious since they need to maintain a high level of security. These requirements make Azure Government the ideal cloud solution. It offers the same features and functionality as Azure but has been specifically designed to meet the rigorous demands of government organizations. This blog provides a brief overview of Azure Government and some of its key benefits.

A Quick Look at Core Features of Azure Government

While Azure Government operates similarly to the public version in many ways, it is subject to additional compliance and security requirements — providing government agencies with the needed security and cloud flexibility. Some of the key benefits of Azure Government include:

• Enhanced security and compliance. Azure Government includes built-in security and compliance features that ensure data is protected.
• Dedicated resources. Azure Government offers each client dedicated computing resources that are not shared with other customers. Providing each client with dedicated hardware ensures that government data is stored in a secure and isolated environment.
• Flexible deployment options. Azure Government offers both on-premises and cloud-based deployment options, so organizations can choose the option that best meets their needs.
• Scalability and reliability. Azure Government is a scalable and reliable solution that can meet the needs of even the most demanding or fastest growing workloads.

If you are looking for a cloud solution to help your organization meet its compliance and security requirements, then Azure Government may be the right choice. Consider some specific ways it provides government-specific security features.

Azure Government delivers a unique blend of standard cloud and advanced security features. It offers all that you would expect from Microsoft, including encryption, role-based access control, and activity monitoring. But Azure Government goes a step further by providing many government-specific features, such as:

• A segregated cloud environment that is separate from the public Azure cloud
• Dual data control, which means that both Microsoft and the customer have access to encrypted data at all times
• Compliance with a wide range of government security standards, including the Federal Information Security Management Act (FISMA), Federal Risk and Authorization Management Program (FedRAMP), and Criminal Justice Information Services (CJIS)

Compliance with government standards makes it easier for your agency to obtain an Authority to Operate (ATO) from the Designated Approving Authority (DAA). Additionally, these security features enable government organizations to store sensitive data securely while retaining all the flexibility of a cloud solution.

Azure Government’s segregated cloud environment is one of its most important security features. Since this environment is separate from the public cloud, government data is isolated from other customers’ data. As a result, government data is protected from cyber-attacks and unauthorized access.

Another reason government organizations leverage cloud solutions is to improve their scalability. How does Azure Government perform in this area?

Azure Government Makes Your Agency More Scalable

At its heart, Azure Government is a cloud solution. By giving you the ability to auto-scale applications and provision and scale services on demand, Azure makes your infrastructure more responsive to user needs. It also simplifies provisioning new services and managing applications through a self-service portal.

Azure Government enhances scalability by offering a cost-effective way to expand your agency’s resources. You pay for only the resources you use and can easily add or remove resources as needed. It also offers discounts for volume licensing and reserved instances which can help you save money when operating in a large organization.

Drive Your Organization Forward With the Cloud

When cloud tools align with your organization’s goals, they can help you boost efficiency, increase speed, and cut costs. The challenge is finding a partner to help you tailor Azure to your needs and deploy at scale.

As a Microsoft Cloud Partner, OneNeck is uniquely positioned to help you integrate Azure into your government agency. Our services enhance your IT capabilities while reducing the complexity of managing your Azure environment. If you’re looking for a way to make your agency more scalable, contact us to learn how Azure Government can benefit your agency.

For the past two years, Microsoft has been winding down the allowance of Basic authentication for its Exchanges services, and in September, Microsoft announced the altering of the authentication method supported by Exchange Online. As a result, Cisco Unity integrations to Exchange Online (M365) for Unified Messaging will be affected.

Traditionally, applications have connected to servers, services and API endpoints by sending a username and password via every request. Basic authentication is typically enabled by default due to its simplicity of setup. However, this authentication method is now viewed as an outdated industry standard and has become increasingly vulnerable to threats.

End of Microsoft Basic Authentication

On October 1, 2022, Basic authentication will be deprecated. As a result, support will only continue for applications using OAuth-based authentications. How does this affect those who utilize Cisco Unity? Simply put, it means that for any users of Cisco Unity Connection 11.5(1) SU7/12.5(1) SU1 and all older releases, Unified Messaging with Microsoft 365 will cease to work after the deprecation of Basic authentication.

Cisco Unity Connection Must Use OAuth-based Authentication

Cisco has stated that releases 11.5(1)SU8 / 12.5(1)SU2 and all newer versions of Cisco Unity Connection support both OAuth-based and Basic authentication for Microsoft 365:

Microsoft will support both types of authentications until the complete deprecation of Basic authentication. Upon completion of this changeover, users must exclusively utilize OAuth-based authentication.

Therefore, any customer currently using an earlier version of Cisco Unity Connection will need to update their deployment should they wish to continue using Unified Messaging with M365. Upon completing this upgrade, Cisco instructs that system administrators can configure the authentication method via the Unified Messaging Service Configuration page of the Cisco Unity Connection Administration.

Need More Time? What Can You Do?

For any organization that still requires updating its Unity Connection but needs additional time, Microsoft has announced there will be an opportunity to postpone this change. Customers can use self-service diagnostics to re-enable Basic authority for any protocols they need, once per protocol.

This postponement will be allowed between October 1 and December 31, 2022. However, it is critical to note that any protocol exceptions or re-enabled protocols will be turned off during the first week of January 2023, with no possibility of further use.

OneNeck, We’ve Got Your Back

If you have any questions or are unsure your Cisco Unity Connection is ready for OAuth-based authentications, we’re here to help.  Talk to one of our experienced team members today, and ensure your Cisco Unity Connection is future-ready.

OneNeck customers dealing with electronic private healthcare information (ePHI) often ask the question is Microsoft Teams HIPAA compliant? These customers utilize M365 and Teams within their organizations and value the easy and effective collaboration it brings. Still, they are concerned about the implications of using these services when PHI is so critical to their business.

So, is Microsoft Teams HIPAA compliant?

Absolutely. However, there are steps that every organization must take to establish and maintain this compliance.

The safeguards of the HIPAA Security Rule for compliance are broken down into three main sections: technical, physical and administrative safeguards. For our purposes, we’ll primarily focus here on the necessary technical safeguards.

One of the most important technology-related security HIPAA requirements is that all ePHI must be encrypted, so only authorized users can access the data or, in the event of a breach, compromised data will be indecipherable. Another crucial security requirement is that every authorized user with access to ePHI must have a unique user identification to monitor their use. As for physical devices, technology with HIPAA compliance must have an automatic log-off feature to prevent unauthorized access if said device is left unattended.

Microsoft Teams is developed with security at the forefront of its design and is well suited to meet HIPAA security requirements. Microsoft Teams has the following safeguards in place that assist in the securing of ePHI:

• Access Controls provide users with login credentials that are unique to them, ensuring that PHI is only accessible to authorized users.
• Single sign-on (SSO) enables users to secure access to related systems with one login credential (Microsoft Teams, M365, etc.).
• Multi-Factor Authentication (MFA) requires users to submit multiple credentials to access data (username and password, biometrics, security questions, etc.), thus certifying legitimacy.
• Audit Logs track access to ePHI to ensure observance of all the necessary standards.
• Encryption transforms ePHI into a format only accessible via a decryption key, preventing unauthorized access to data at rest and in transit.

It is essential to note that while Microsoft Teams does include the necessary security features for HIPAA compliance, in many cases, the organization and its users must properly configure specific settings along with the implementation of companywide policies ensuring the safeguards above are followed. Ultimately, your organization’s policies, IT department and users must actively work together to ensure compliance is not only initially attained but constantly maintained.

BAA (Business Associate Agreement)

Per HIPAA 45 CFR 164.504(e), a business associate agreement (BAA) is required for any organization that will process PHI on another company’s behalf. This agreement provides the required security controls, the responsibilities of the parties involved and how PHI can be used. Even with all necessary security policies and controls enabled in Microsoft Teams, it would not qualify for HIPAA compliance until a signed BAA is in place.

Fundamental aspects of a HIPAA BAA include:

• A description of how business associates are permitted and required to use PHI.
• A requirement that PHI only is used or disclosed as contracted or required by law.
• Business associates must utilize applicable security measures to ensure PHI is used in agreement with all contract terms.
• Requires reasonable steps be taken to resolve any breach as soon as one is detected.

Fortunately, Microsoft states on its website that it is willing to sign a BAA with organizations utilizing Microsoft Teams for PHI. It is important to note they also provide a disclaimer that the end user assumes the responsibility of ensuring that Microsoft Teams is configured for HIPAA compliance. Once this BAA is signed, an organization can process and store ePHI with Microsoft Teams. One additional important aspect of which to take note, is that even if an organization already has a signed BAA with Microsoft for M365 or other services, they must confirm that Microsoft Teams is specified; if not, an additional Microsoft Teams BAA is required.

Organizational Responsibility for Maintaining Teams Compliance

Even with Microsoft Teams’ built-in security controls and a signed BAA, every organization must understand that they ultimately bear the responsibility of ensuring their use of Microsoft Teams is HIPAA compliant. Organizations must place a priority on practicing the appropriate security hygiene necessary to minimize security risks.

To remain HIPAA compliant, your organization must make the security and safety of PHI paramount. This requires top-down buy-in from the entire organization. Not only must HIPAA policies and procedures be established, but appropriate security awareness training must be routinely conducted, so everyone involved understands these best practices.

Ultimately, Microsoft Teams is capable of meeting all security features and legal agreements of HIPPA compliance. Nonetheless, whatever tools are used, maintaining compliance relies on your organization and its ability to establish and enforce HIPPA policies and procedures.

Small businesses are the backbone of the American economy, yet they are often neglected when it comes to information security. While large businesses can afford to hire a chief information security officer (CISO) full-time, small businesses often cannot, leaving them vulnerable to data breaches and other cyberattacks.

However, there is a solution: hiring a virtual CISO (vCISO). A vCISO is a professional who provides information security leadership to an organization remotely. They are typically part-time and work with the business owner to advise on the business’s security. Is a virtual CISO right for you? In this article, we’ll look at the benefits of hiring a virtual CISO, their limitations, and what to look for when hiring.Virtual

Why Consider Hiring a Virtual CISO

Ideally, every company would have experienced in-house information security leadership. However, even when a business has the budget, talent can be hard to come by. Virtual CISOs are a great solution to budget and talent concerns. They typically cost less than half of what a full-time CISO costs and are available when you need them.

That said, it’s important to understand what a virtual CISO brings to the table. Virtual CISOs serve as advisors that can help you develop and implement a security plan that meets your business needs. You can often find someone who has experience in your specific industry and can take into account regulatory standards like HIPAA.

Virtual CISOs also focus on bringing the right people on board and designing processes that keep your business secure. While an engineer can help you with the tactical implementation of your security program, people and processes are key to protecting data long-term. This focus is the sweet spot for CISOs.

The Limitations of a Virtual CISO

Since they are not a permanent member of the team, virtual CISOs serve as advisors rather than project owners. Therefore, a vCISO does not have the same level of authority as a full-time CISO. This difference can lead to communication issues between the virtual CISO and other team members.

Another difference between a virtual and full-time CISO is that your team will ultimately be responsible for the implementation and management of the budget. These limitations may cause problems for businesses with extensive attack surfaces or those who operate in heavily regulated industries. A final consideration is cost. While a vCISO is significantly cheaper than a full-time employee, the cost may still be too high for smaller firms to take on.

However, security is something businesses of all sizes need to take seriously. So, while the cost of information security leadership may seem steep, data breaches and legal action are much higher. That’s why many businesses bolster their organization’s security through CISO leadership. The key is analyzing your company’s needs and finding the right talent.

When hiring a virtual CISO, consider the individual’s experience and qualifications. The virtual CISO should have a deep understanding of information security in your industry. A CISO like that is more likely to be proactive and think outside the box when creating solutions to novel security challenges.

A vCISO should also be able to communicate effectively with employees at all levels of the organization. Since the virtual CISO will be working with your team closely in a leadership role, they must be able to build relationships and establish trust. Hence, a virtual CISO should be a good fit for your company culture.

Ultimately, hiring a virtual CISO is an important decision that can help protect your business’s data and reputation. But finding the right person can be an intimidating task. Our team at OneNeck can help you analyze your security needs and advise you on the best options available to you. Contact us to learn more.

Ten questions to ask before hiring a vCISO:

1. What is your company’s budget?
2. What are your company’s security goals?
3. What is your company’s current security posture?
4. What are your company’s compliance requirements?
5. What is your company’s threat landscape?
6. What experience does your vCISO need to have?
7. What availability do you need from your vCISO?
8. What services are necessities, and which are nice to have?
9. What rates and pricing model are you comfortable with?
10. How will you work with your vCISO?

The concept of managing storage is simple: as computing needs grow, you should add more storage. But doing this in a business is anything but simple. That’s because factors like speed, location, type, data architecture, access requirements, and, yes, size are all important to your storage infrastructure decisions.

On top of choosing the proper storage solutions for your current business needs, you must also plan for the future. Will the storage solution you implement today be viable in three years? How soon will it be before you need to scale your infrastructure once again? These are just a couple of questions that give your IT team nightmares.

Managed storage is when an organization outsources its storage management to a third-party provider. Depending on the organization’s needs, this may involve cloud storage, offsite storage, onsite storage, or a combination of the three.

Leverage the Benefits of Managed Storage

With a traditional storage setup, once you run into the limits of your capacity, it’s time to upgrade or add to your hardware. As your organization grows, adding to your infrastructure becomes more complex because you must fully integrate new resources and make them accessible to your team. In contrast, a managed storage provider lets you scale storage resources on demand and only pay for what you need. How does managed storage benefit availability and scalability?

• Dedicated storage administrator. One of the challenges of IT infrastructure is procuring the talent to manage essential components. Working with a managed storage provider allows you to leverage their team’s storage administrators for an instant injection of storage expertise.
• Scale with advanced hardware. When managing hardware in-house, the goal is to get the most ROI out of every component. Reaching this goal often requires teams to use hardware for as long as feasible. A managed storage provider will have access to modern infrastructure with low latency capabilities. They can also provide node-based infrastructure, which is essential for scaling out your network.
• Scalable security. Security is another concern when scaling resources since your attack surface grows as your business grows. Many teams lack the internal expertise to ensure systems stay secure. But working with a managed storage provider gives you access to their security team and partners. Your provider should also be able to adapt and secure onsite and offsite storage to fit your needs.
• Near zero downtime. Managed storage providers have the infrastructure to provide redundancies at a level that’s hard to emulate for those doing it independently. Additional redundancies make possible techniques like live migration, allowing you to move systems without taking them offline. Moreover, systems can be backed up and restored, and resources can be allocated to workloads without users experiencing a hiccup.
• Operational efficiencies. Working with a managed storage provider simplifies tasks like deploying additional resources and billing, providing an accurate view of existing storage resources. Since your storage provider takes care of management, you also remove this workload from your IT team’s plate so they can focus on company applications, services, etc.

Typical in-house storage infrastructure gets updated every three to five years, which likely happens when teams look at how well the previous system served their needs. Managed storage solutions are attuned to your business’s needs and can be optimized actively — leading to systems that perform better throughout their entire lifecycle.

Managed Storage for Your Evolving Infrastructure Needs

We don’t expect our personal computing devices to handle applications that come up five years from now (thus, the average replacement time is under three years). So, why should we expect differently from our business infrastructure where machine learning, computer vision, and blockchain applications are becoming more common?

Organizations are using their computing resources to power virtual desktop infrastructure (VDI), analytics software, private clouds, and more. Managed storage provides elastic infrastructure that allows you to allocate resources for a number of different needs and manage growing user bases. But how can you get started?

OneNeck is an IT solutions provider that offers managed storage services and more. We can help you use Azure, HPE, Cohesity, Commvault, NetApp and many more solutions in your storage strategy to ensure your data is always available. If you want to control your infrastructure and save money while harnessing deep storage expertise, contact us today.

A teammate who doesn’t work well with others is a liability, and the same is true of your business’s technology. When applications and systems can’t communicate, it creates all types of problems for your team. Disparate systems hurt productivity in many ways, like having to move data manually and getting an incomplete picture of your company’s data.

Companies recognize the issues with disparate systems and have responded with solutions to overcome these hurdles. These solutions include multi-cloud and hybrid cloud computing. How do these computing methods work?

A multi-cloud setup is a cloud configuration that includes more than one cloud deployment of the same type (private or public). For example, a company may leverage several public cloud services like AWS and Azure. A hybrid cloud setup includes multiple deployment types (private and public) and integrates these deployments to work together seamlessly. For example, a company may mix a private cloud hosted by their organization with a public cloud service like Azure.

The benefit of these technologies is that they allow different systems to communicate and share data, making your team’s life easier. Both cloud setups increase the flexibility of your network and your computing potential.

The Benefits of Multi-cloud and Hybrid Cloud Computing

Moving to the cloud can improve your computing reliability and agility. In what ways? To answer that, we’ll look at the benefits of hybrid cloud and multi-cloud computing.

Flexibility. Cloud solutions give companies additional options when they upgrade their infrastructure. The hybrid cloud lets businesses keep part of their infrastructure on-premises. As a result, businesses can transition to cloud solutions incrementally. Many teams find this incremental move more feasible and less daunting.

Multi-cloud computing provides flexibility by allowing you to leverage different cloud services simultaneously. This gives your team access to additional tools and cloud providers that serve specific regions — bringing data closer to users and improving network performance.

Reliability. Outages in your infrastructure can hurt performance, stall work, and even cause you to lose customers. A reliable network isn’t one that never has issues but rather a network with contingencies that protect users from the effects of infrastructure problems.

Multi-cloud and hybrid cloud computing help you create robust backups that allow for dynamic failover switching. So, even if your system experiences an outage, it won’t impact your users. The difference between hybrid and multi-cloud is that a hybrid cloud setup will use a combination of onsite infrastructure and cloud services. In contrast, multi-cloud computing will use a mixture of cloud providers to achieve the same result.

Security. Factors like shadow IT and security requirements for sensitive data can dictate the setup of your cloud computing. Sensitive data requires fine-tuned controls that allow your organization to control access to documents and where data is stored. A hybrid setup permits organizations to store sensitive data onsite while using the cloud for other services.

Multi-cloud setups help you better assimilate shadow IT applications. For example, it may be more cost-effective and productive to embrace a new cloud application and add it to your toolset instead of migrating data from shadow IT applications. Embracing the shadow application gives IT control and visibility over these previously unmonitored applications.

Scalability. The beauty of cloud computing is that it enables businesses to respond to business growth efficiently. Instead of purchasing new infrastructure every time demand spikes, you can quickly increase and decrease computing power based on usage — keeping resources aligned with needs and avoiding over-purchasing.

A hybrid cloud setup further allows companies to keep some infrastructure onsite for lower long-term costs while leveraging cloud computing for overflow and specific application use cases.

Use the Cloud to Plan Long-Term

We know that computing infrastructure is critical to the success of our applications and services. However, we don’t know what traffic and demand will look like tomorrow. The cloud gives companies the best of both worlds by providing them with the resources they need today and the flexibility to pivot to the needs of tomorrow.

The choice between multi-cloud and hybrid cloud computing depends on your business’s requirements. OneNeck can help you analyze those requirements and make a choice that will benefit your company long-term. Talk to our team today and learn how cloud computing can supercharge your IT infrastructure.

Cloud computing is an important business tool for companies that want to improve infrastructure flexibility and scalability. It allows them to easily share resources, such as servers, storage, applications, and services over a network.

In contrast to a public cloud, where multiple organizations share resources, a private cloud is one where resources are dedicated to a single organization. Businesses may choose the private cloud over the public cloud if they want more control over their hardware or need to meet strict security requirements. They may also want to avoid losing performance when another organization’s workload hogs the machine’s resources.

There are two main options when setting up a private cloud: setting up your own on-premise hardware or working with a provider to set up a hosted private cloud. Let’s consider the differences between each option.

Differences Between Hosted and On-Premise Private Cloud Solutions

The challenge with a private cloud is that the company using it is responsible for its hardware, security, and administration. Many businesses find this too much for their current team to handle but may still need the security and control that the private cloud offers. How can they gain control without infrastructure management?

A hosted private cloud is a private cloud that is maintained and operated by a third party. This third-party manages the infrastructure and ensures that the cloud meets the customer’s needs. Resources are isolated from other clients and dedicated to a single client — allowing for a private cloud experience.

Setting up the private cloud with a hosted service is a great solution for businesses who want to move away from on-premise hardware and software but still want some level of control over their data.

Benefits of a Hosted Private Cloud:

• Complete oversight of the network
• Hardware is managed by the provider who is more likely to keep pace with emerging technology
• Access to experienced system administrators
• Full control over security to maintain strict security standards for data protection like HIPAA and other government regulations
• Infrastructure that is ready to scale
• Controlled costs that are billed as an operating expense

On the other hand, on-premise private clouds offer more control over data and infrastructure but come with a higher upfront cost and require more maintenance. Additionally, businesses can get locked into using a particular hardware vendor’s technology if they choose this option. Lock-in can create compatibility and budget concerns during future upgrades. Choosing between an on-premise or hosted private cloud will typically come down to budget, control and future requirements.

Benefits of an On-Premise Cloud:

• Complete oversight of the network
• Full control over security to maintain strict security standards for data protection like HIPAA and other government regulations
• Ability to choose specific hardware based on computing workloads
• Authority to direct future hardware upgrades and management software decisions

Both on-premise and hosted private clouds offer isolated infrastructure that protects your data from the risks of shared hardware. However, by removing the burden of hardware management, hosted private clouds become much more accessible. How can you find the right private cloud partner?

Choosing a Hosted Private Cloud Partner

While choosing a hosted provider isn’t as permanent as on-premise equipment, making the right choice will speed up deployment and integration. There are a few key steps that can help you with your consideration.

1. Make sure that the provider has a solid track record in your industry and is able to meet your specific needs.
2. Ensure that the provider has the necessary resources and expertise to help you scale and help your organization leverage the available cloud tools.
3. Review the contract’s terms and conditions carefully to make sure that you are comfortable with them.

Hosting your private cloud with a reputable provider can offer many benefits, including support and guidance as you move to the cloud.

Leverage OneNeck to get access to ReliaCloud, a hosted private cloud that provides dedicated compute resources from a Nutanix hyperconverged (web-scale) architecture. These services run in OneNeck’s data centers, where you get a managed cluster solution containing common services like hardware, cluster software, network, AOS management, hypervisor management and more.

At OneNeck, our goal is to help you protect what’s working in your core infrastructure while helping you navigate your path to IT modernization. Talk to us today about how you can build a private cloud solution that meets the demands of your workload.

Citrix Security has discovered a vulnerability in Citrix ADC (formerly Netscaler) and Citrix Gateway, enabling an attacker to create a specially crafted URL redirecting to a malicious website. Citrix and OneNeck highly recommend that all customers utilizing these Citrix services take note of this vulnerability and determine if they are among those who may be affected.

Vulnerability Description

The vulnerability (CVE-ID: CVE-2022-27509 and CWE: CWE-345) is an unauthorized redirection to a malicious website. Additionally, two pre-conditions determine potential susceptibility. The first is that appliances must be configured and operating as a VPN (Gateway) or AAA virtual server. Secondly, the targeted victim must use an attacker-crafted link.

Affected Versions

According to Citrix, the following supported versions of Citrix ADC and Citrix Gateway have been affected by this vulnerability:

• Citrix ADC and Citrix Gateway 13.1 before 13.1-24.38
• Citrix ADC and Citrix Gateway 13.0 before 13.0-86.17
• Citrix ADC and Citrix Gateway 12.1 before 12.1-65.15
• Citrix ADC 12.1-FIPS before 12.1-55.282
• Citrix ADC 12.1-NDcPP before 12.1-55.282

A critical aspect of which to note is that organizations using Citrix-managed cloud services are not in danger of being affected by this vulnerability and do not need to take additional action. However, those with customer-managed ADC and Gateway appliances should take the following steps.

The Solution

Citrix recommends those who are currently affected or could potentially be in the future install all relevant updated versions of Citrix ADC or Citrix Gateway.

Updated Versions:

• Citrix ADC and Citrix Gateway 13.1-24.38 and later releases
• Citrix ADC and Citrix Gateway 13.0-86.17 and later releases of 13.0
• Citrix ADC and Citrix Gateway 12.1-65.15 and later releases of 12.1
• Citrix ADC 12.1-FIPS 12.1-55.282 and later releases of 12.1-FIPS
• Citrix ADC 12.1-NDcPP 12.1-55.282 and later releases of 12.1-NDcPP

OneNeck Can Help!

Based on the potential harm these vulnerabilities could cause an organization, OneNeck recommends installing updated versions immediately, and our experienced team is here to help. Through our long-standing partnership with Citrix, we will quickly and effectively assess your Citrix appliances and determine which units face the potential of being affected. We will install all necessary updates so that you can get back to doing what you do best, knowing that you and your clients are protected. So, please Contact Us or your account rep today and let us help you continue to run efficiently, effectively and securely.

Imagine that your network is experiencing a surge in activity. You decide to respond by investing in infrastructure. However, weeks later, the surge drops since it was an anomaly, and you return to normal activity levels. Your business is now stuck paying for an investment they didn’t really need.

Companies often face fluctuations in demand, forcing them to consider infrastructure investments long before they’re ready. That’s why many businesses are weighing the pros and cons of setting up their own on-premise network services or leveraging a managed service provider. Instinct tells us that it will be cheaper to run our own services, but the numbers tell a different story. A 2021 report by Mordor Intelligence found that businesses that use managed services can save between 25% and 45% on their IT budget. So, what contributes to the lower IT costs of managed services?

Save Money by Offloading IT Management

Every job in your company has an associated cost; it may come from employee time, hardware, software and other tools used to get the work done. IT management requires a combination of all these factors to operate smoothly, and teams that leverage managed network services can save money in seven key ways:

1. Less downtime. Managed network service providers have large amounts of IT infrastructure in addition to the people and processes to ensure system continuity. They also have system redundancies (a significant capital expenditure) that work seamlessly so that users don’t realize when a server or system crashes on the provider’s side.
2. Constant monitoring. In conjunction with redundant systems, these providers monitor their systems 24/7 using IT professionals and specialized software. For a company to achieve this level of monitoring would be costly and difficult given the market’s overall need for IT professionals.
3. Costs as an operating expense. Setting up your own network services requires substantial upfront hardware investments, which must also be maintained and secured. In contrast, managed services are charged as a flat fee in which the provider takes care of the people, power, hardware, and software required to provide the service.
4. Increased focus on the core business. Today most companies require some type of IT department, but running all your IT infrastructure on-premise will significantly increase hiring needs. Using managed services allows you to keep team efforts primarily focused on your core business, including the talent you try to acquire.
5. Scale with ease. Whether you are a small or large company, managed services can scale to your needs. You can scale up and down based on current demand without making costly changes to your infrastructure.
6. Speed of implementation. Implementing new technology takes research, time, and labor. All of which can slow down operations and distract from your team’s main tasks. Managed services can be implemented in a fraction of the time as on-premise solutions and be easily added to additional departments.
7. Unified software solutions. Mismatched software solutions limit the potential for sharing data and extracting insights within your team. They also often lead to duplicative work and lower productivity. Managed service providers offer unified software platforms that allow you to manage everything from a single place and upgrade solutions without needing to upgrade your underlying infrastructure.

Offload IT Management by Leveraging Managed Network Services

Your company’s network infrastructure should help your team get work done instead of hindering productivity and frustrating your people. You can use managed network services to offload your day-to-day network operations and maintenance responsibility. This includes installing, monitoring, and maintaining network hardware, managing security, and troubleshooting any issues that arise.

At OneNeck, we help our customers lower costs through managed network services. We provide the expertise you need to deploy efficient and fully secure network hardware — analyzing usage trends to help you plan for the future. If you’d like to learn more about the ROI of managed network services, talk to our team today.

So, how can business owners decide on the best IT strategy? It comes down to three requirements: administrative control, security and hardware. For example, if your business is in the healthcare or finance industry, you’ll have to abide by regulations that dictate how you handle customer data.

Additionally, if you operate in Europe, you’ll be under GDPR regulations, which may not allow you to store data on cloud servers outside of the region. As we’ll see, choosing between data center colocation and cloud computing solutions has a lot to do with how much control you need.

Cloud Computing Solutions Simplify IT Management

Cloud computing is a service typically provided by a cloud provider, wherein they offer computing resources located in their own fully managed data centers. Customers use the cloud provider’s servers, network and storage to host their data and applications — eliminating the need for IT management.

The cloud provides a low entry cost for businesses, especially smaller companies. It also facilitates scaling hardware up and down based on consumption, allowing businesses to meet fluctuating demands more easily. Cloud computing makes it easier for businesses to get up and running since they only have to worry about application and data management and can leverage the cloud provider’s support staff.

The cloud can have downsides when it comes to long-term costs and compliance. As a company’s data usage increases, its associated costs will rise. Eventually, it can reach the point where its data needs are no longer cost-effective. Furthermore, since data is stored with a third party, they may face compliance challenges. Some of which may make cloud computing unfeasible.

Data Center Colocation Provides Unparalleled Flexibility

Colocation data centers are facilities that allow companies to rent secure space for their IT resources. The colocation facility provides power, space, network connections and sometimes physical security. But the client is responsible for its own hardware, as well as its management and maintenance.

Colocation data centers help businesses expand IT infrastructure without building their own data center. Thus, companies can place computing hardware closer to users, tapping into the latency benefits of edge computing. Since they are in full control of their hardware, they can maintain compliance with regulatory and industry requirements.

Additionally, since the hardware is not shared among different companies, businesses have a smaller attack surface — improving security. However, it’s not all positive. Companies must provide their own hardware, taking care of deployment, maintenance and support. This job can be challenging if the data center is in a different region and may necessitate the hiring of remote staff.

Side-by-Side Comparison of Colocation and Cloud Computing

Work With a Partner Who Understands Cloud Computing and Colocation Requirements

Cloud computing and colocation data centers have an important place in modern business. They provide needed options for the unique requirements of different organizations. Consider a financial institution based out of California that needs to equip its office in New York with private cloud resources.

Industry regulations may dictate specific requirements on how they transmit data. Using a colocation in New York would allow the company to provide local IT resources, improving performance while maintaining control over the data. However, less stringent requirements in a different industry may make a company favor cloud computing.

A prudent computing choice will take into consideration costs, performance and accessibility. At OneNeck, we help our customers deploy both cloud and colocation solutions in their operations, as well as a myriad of hybrid solutions that bridge the gap between. Contact us to learn more.

Microsoft Announcement on Extending Audio Conferencing Capabilities

…today, we are announcing that we will add unlimited dial-in capabilities for Microsoft Teams meetings across our enterprise, business, frontline, and government suites over the next few months. Even as cloud connectivity increases, we know that people join Teams meetings while they are on the go or struggling with a bad internet connection. Currently included with Microsoft 365 E5 and Office 365 E5, we have come to see dial-in as an important part of the complete Teams experience. Available with subscription in over 70 countries and with interactive support in 44 languages and dialects, unlimited dial-in provides peace of mind that users will be able to join their Microsoft Teams meeting from virtually any device regardless of location.
(Source: Microsoft’s Aug 2021 Announcement)

With the offer, anyone who is assigned the license can use unlimited dial-in minutes. There is also 60 minutes of dial-out minutes included per license, which is pooled at the tenant level and can be used by everyone with a license. If you have some end users that require a lot of dial-out licenses, an additional subscription can be added for that user.

How to Take Action and Turn On Free Microsoft 365 Audio Conferencing

If you already have Microsoft 365 Audio Conferencing licensed and configured, making the switch is quite simple:

1. Work with your CSP to request their assistance.Or, if you’re a OneNeck customer, send a service request to servicedesk@oneneck.com for the quantity needed. The quantity should be the number of office licenses you have or less.
2. Assign a license to one user, and remove the old Microsoft 365 Audio Conferencing license from that user.
3. Finally, test the functionality. While we have not had issues with the new offer, we still recommend testing in your environment.
4. Roll out to other users as you are comfortable with the process.
5. Send a request/ticket to your CSP (OneNeck if applicable) to turn off auto-renew on the old M365 Audio Conferencing subscription.

If you do not have Audio Conferencing, in addition to adding the new subscription and assigning it to users, you will need to configure Audio Conferencing. Information on the configuration can be found on Microsoft’s site.

OneNeck – We’re Here to Help

If you are an existing Microsoft client and would like to enable Audio Conferencing in your environment, we can help with our Audio Conferencing Quick Start. Let one of our experienced Microsoft architects help you choose a right-fit subscription, configure the solution and then educate your team to manage your Audio Conferencing. Add-on hours can be scheduled for additional configuration if your Teams’ policies need to be addressed.

Common Questions We Get on Microsoft Teams Audio Conferencing

What is Microsoft Teams Audio Conferencing?

Audio Conferencing in Microsoft 365 and Office 365 enables users to call in to meetings from their phones. Audio Conferencing allows up to 1000 phone attendees.

What online services/office packages now qualify for MS Teams Audio Conferencing select dial-out?

Office 365 E5 and Microsoft 365 E5 already include Audio Conferencing and you don’t need to change or add anything for those licenses. Office 365 E1, E3, and F3, Microsoft 365 E3, F1, and F3 and Microsoft 365 Business Basic, Standard and Premium now qualify for free audio conferencing.

What is “Unlimited dial-in?”

Unlimited dial-in is the ability to assign a phone number to a Teams meeting so that roaming users can dial-in instead of using the Internet.

What is “Select dial-out?”

Microsoft includes 60 minutes/month/license of dial-out capability. This feature can be used when on a Teams call. For example: Jim and Mike are on a call and they decide they need Doug to answer a question. Jim and Mike can add a participant using Doug’s cell # and dial-out to get him into the call. Dial-out can also be used when you lose connection during a Teams meeting. If enabled, Teams will ask if you want a call back if you lose your meeting connection.

What if I need more dial-out minutes?

You can add the Extended Dial-out Minutes to USA/CAN ($4/user/month) license to a meeting organizer and they can schedule meetings with unlimited dial-out.

What is Operator Conferencing?

With Operator Connect Conferencing capabilities, organizations can use phone numbers from a third-party operator to join Microsoft Teams meetings. If your current operator is part of the Microsoft Operator Connect program, you can add phone numbers from your operator to your Audio Conferencing bridge and use them to join meetings. Without Operator Connect Conferencing capabilities, organizations can only use phone numbers provided by Microsoft for their audio conferencing bridge. To see if your operator participates in the Microsoft Operator Connect program, see the Microsoft 365 Operator Connect directory.

In conclusion, if you’re unsure of what to do next, remember OneNeck’s Microsoft experts are here to help!

The Zero Trust Network, or Zero Trust Architecture, model was created in 2010 by John Kindervag, who at the time was a principal analyst at Forrester. He defined it as a security concept centered on the belief that an organization should not automatically trust anything inside or outside its perimeters and instead verify anything and everything trying to connect to its systems before granting access.

Cisco lays out the original tenants of a Zero Trust network as follows…

At the core, even though Zero Trust has been defined by many in different ways, the message is always same – only allow “just in time access” to resources on premise or in the cloud in your organization, and treat all applications and resources as internet-facing. But this concept can send many an IT pro into a spiral. What about critical infrastructure? What about VPNs? How do you do this? Why is this better?

Why all the Zero Trust fuss?

Let’s take a step back and look at why Zero Trust is getting so much traction in the first place. This comes down to a few things – the growth and severity of security incidents in recent years, and how organizations are trying to stop and defend against those threats. The defending teams in organizations (aka “blue teams”) have been losing this threat war for a while now. It seems that breaches happen more and more, and the adage is not if but when.

So, why the increase in breaches? Security budgets are increasing. More professionals are being trained. More security products are available. So, it only stands to reason that blue teams should be seeing a decline in breaches, but we are not.

Possible reasons for the increase abound. Some see the security frameworks we use as the issue. Others blame the changes in access to IT resources since COVID. Now organizations have employees and customers access data, applications and infrastructure in both cloud and on-premises scenarios, accessing that data from anywhere. Our older security models made it harder to gain access to those things and maybe allowed too much access for too long, and our digital identities were not sufficiently protected.

This brings us back to Zero Trust. This new access need with data being in the cloud, via SaaS and on premise dictated a new security model to meet these new requirements. In future blogs, I will break down this Zero Trust more in-depth, helping you navigate the pros and cons of a Zero Trust approach in your organization. Stay tuned!

Analyzing the Pros and Cons of Cloud Storage

There’s no denying that cloud storage is convenient. The challenge is figuring out if cloud storage will provide the performance and security your business needs. Another consideration is whether your company will move 100% to the cloud or use a hybrid setup. Let’s consider a few pros and cons to help you decide which storage solution will satisfy your team’s requirements.

The Pros of Cloud Storage

• With physical infrastructure, you have to invest in hardware when you need to scale. These purchases can be costly, and they take time. Cloud storage allows you to scale up and down on-demand to keep your capacity aligned with your current business needs.
• Updated technology. It’s unlikely that your company updates its IT infrastructure very often. The competitive nature of cloud storage solutions forces providers to keep up with modern technology, giving you access to updated hardware without the costs.
• Storing your files in the cloud ensures that your people have access to important data wherever they have an internet connection. Accessibility is vital for teams with remote workforces and traveling sales people.
• Disaster recovery. Every business should have a plan for recovering its data when disaster strikes. A crucial part of these plans is an offsite location for storing data. Cloud storage is ideal for the job as it is often located in a completely separate region and providers have their own redundancies in place.

The Cons of Cloud Storage

• Security and privacy. Unless you host a private cloud, a third party will store your data. Their security policies and infrastructure will directly affect your complicity with regulatory and industry requirements. Additionally, some industries have more stringent rules for how you can store your data, like healthcare.
• Long-term costs. Depending on your storage needs, on-premise solutions can be cheaper in the long run. To understand the big picture, your procurement team needs to factor in hardware costs and upgrade frequency, bandwidth costs, and performance and accessibility requirements.
• Integration. Your systems may differ quite a bit from the data structure of some cloud providers, making integration difficult. You must make sure you have alignment beforehand to ensure a smooth transition.

Even though there are downsides to cloud storage, many solutions can be adapted to your needs — eliminating or mitigating these cons. For example, organizations that handle sensitive data can apply a hybrid approach to cloud storage. In this scenario, they may have a private storage infrastructure for data that isn’t uploaded to the cloud and use a cloud provider for other data needs. Additionally, many top-tier providers offer solutions that are compliant with strict industry regulations. How can you choose a storage solution for your company?

Tailor Data Storage to Your Needs

There is no one-size-fits-all solution for data storage. Some companies need ultra-low latency, others need scalability and accessibility, and yet others are just looking for a simple solution that can be implemented immediately. At OneNeck, we help our clients implement cloud solutions that range from a fully private cloud to a fully public cloud, and hybrid options in between.

Security and accessibility are crucial to getting the most out of your data. Our team can help you create a roadmap that prioritizes these qualities in your data storage solution. We’ll also analyze your business and technical requirements to ensure you have a final product tailored to your needs. Contact us to learn more.

SharePoint and OneDrive for Business are each great options when it comes to file-sharing software. Both are fully integrated into the Microsoft^® 365 ecosystem for easy collaboration and allow users to store, share and synchronize files across locations and devices. While they have many similarities, they also offer distinct differences. OneDrive vs SharePoint: which is the best option for your company? Can these applications be used interchangeably? Should we use them both?

These are questions raised in almost every organization.

Let’s explore how each of these applications operate and delve into some of their most common use cases.

The Similarities between OneDrive vs SharePoint

SharePoint and OneDrive both come fully integrated into the M365 environment. Each application stores files in the cloud and utilizes Microsoft’s data center infrastructure to securely store and move your files. As part of Microsoft 365, each application allows users to access their files from anywhere with internet access. Both can allow for access by other users to facilitate collaboration within a team. At their core, the two applications appear to serve very similar functions.

Common Features:

• Cloud storage: Both offer cloud storage via Microsoft cloud space environment, meaning data is securely stored in Microsoft’s geo-redundant network of data centers.
• Security: Both options enjoy the same enterprise level of security (SSL/TLS connection) guaranteed by Microsoft for all its M365 applications.
• Global access: As part of the cloud-based M365 suite, SharePoint and OneDrive are accessible from virtually anywhere connected to the Internet.
• Syncing to local storage: Both options offer the ability to sync to a local drive, either manually or via automation.

The Differences Between OneDrive vs SharePoint

While SharePoint and OneDrive share several characteristics, they also contain several distinct features that allow for significant differences in their usage.

The fundamental difference between SharePoint and OneDrive is the type of file being stored. OneDrive is primarily used for the storage of personal files. These could be early drafts, incomplete projects, or files that contain confidential information. By default, these files will be accessible only via an individual’s account. One does have the ability to make them available to share with select individuals at any point. Still, this permission needs to be given by the user before any others in the organization can access them. Collaboration can be easily accomplished within a team via OneDrive, but it will usually be on a more intentionally narrow scope.

SharePoint is Microsoft’s original workspace, designed for collaboration and productivity. Files placed here will immediately be accessible by an entire team. It is a content management system whose scope can range from small teams to an entire company and even those outside the organization. Accessibility to others is not just a feature of SharePoint; it is the goal. SharePoint is where content created within Teams and Outlook is stored. Users can see what other team members have opened and if anyone has updated a file. Team members can also easily track changes and quickly revert to previous versions of any file.

SharePoint has another unique aspect that differentiates it from OneDrive, the ability to create a modern intranet. This feature allows an organization to create a site that can only be accessed by its employees or on more minor scales to include select members of a particular team.

Common Organizational Intranet Uses:

• Human Resources (onboarding, payroll, benefits, etc.)
• Training
• DevOps
• Organizational specific applications

Determining Factors for Your Organization

Most organizations will decide on using both in some capacity. But for an individual or team choosing where they should store specific files, the answer will be determined by a few key aspects.

Purpose of the File ­­— Determining the purpose of the file will go a long way in deciding whether to use SharePoint or OneDrive. Why is the file being produced, and who needs to see it? The intended audience is critical. Is this meant to be viewed company-wide or sent confidentially to a customer?

Who is Working on the Project — Is the file produced by an individual, or is this a team project? A single user working independently on a project may choose to store the files in OneDrive until they are ready to be more widely dispersed. Files involving many users, or ones that require input from multiple sources, will be a more natural fit for the features found within SharePoint.

Workflow of the Team — Files should be saved according to how and where a team works! Ultimately, determining which application will be the most effective likely comes down to what team members are willing to use. SharePoint, in particular, requires a high level of buy-in from an organization and its teams to be effective. If all team members follow consistent procedures of uploading files to and editing documents within SharePoint, seamless collaboration can occur.

The Choice: Probably Both

Both SharePoint and OneDrive are robust cloud-based collaboration and storage solutions. OneDrive is a personal file storage solution where the individual to whom the drive belongs manages access. The user decides both the when and what of file sharing. Organizations use SharePoint for many purposes, from file storage to enabling intranet portals, pages and business applications.

In the end, it is impossible to say that one of these applications is better than another. It is more about an organization assessing their needs and workflow practices to determine where SharePoint or OneDrive will be most effective. Both, when used effectively, whether independently or in conjunction, are extremely powerful and productive collaborative tools.

OneNeck Has Your Back!

Need more information on SharePoint, OneDrive or any of the collaborative tools found in Microsoft 365? OneNeck can help. We are a Gold Certified Microsoft partner, and our expert team is here to help you choose, implement and optimize the right-fit M365 subscription plan for your business. We’ll help your organization thrive in the Modern Workplace with a secure, cost-effective solution that allows your team to be productive from anywhere!

Cyber insurance is getting harder for companies to find — and it’s likely going to get harder. While cyber insurance is becoming more of a must-have for businesses, the explosion of ransomware and cyberattacks mean it’s also becoming a less enticing business for insurers. (Source: Harvard Business Review)

This quandary is putting today’s business in a tough spot. Cyber insurance is important, but in order to secure a policy, premiums are steep (and climbing) and the requirements to qualify are also growing. To keep premium costs affordable, insurers are requiring a comprehensive list of good hygiene practices around security controls. These include:

• Multifactor authentication (MFA) for remote access and admin/privileged control.
• Endpoint Detection and Response (EDR).
• Secured, encrypted and test backups.
• Privileged Access Management (PAM).
• Email filtering and web security.
• Patch management and vulnerability management.
• Cyber incident response planning and testing.
• Cybersecurity awareness training and phishing testing.
• Hardening techniques including Remote Desktop Protocol (RDP) mitigation.
• Logging and monitoring/network protections.
• End-of-life systems replaced or protected.
• Vendor/digital supply-chain risk management.

While the list above may seem overwhelming, each one is key in maintaining a defense against attack, as well as providing a roadmap to more efficiently address the growing demands to maintain cyber insurance.

What if cyber insurance isn’t an option?

Having cyber insurance is always an important element to include in a company’s security program. However, we are also seeing situations where coverage may not be obtained because:

• Insurers are moving away from providing coverage for certain types of ransomware events and/or adding huge increases in deductibles to provide these types of coverage.
• Customers want to add or obtain coverage for the first time and can’t find an insurer willing to cover them.

When customers are faced with the option of not being able to obtain insurance, then the most important approach is to make investments in their security program.

An effective security program doesn’t always mean more tools.

At OneNeck, we take a different, “non-tool” approach to security first. Instead of starting with point solutions, we align with the Center for Internet Security’s Security Controls as a framework that provides a prioritized set of actions that address security gaps, which then later aligns with tools. In fact, we believe so strongly in the CIS Controls that we use them in our own business as a Managed Services Provider (MSP) that must pass rigorous annual compliance audits.

The CIS Controls allow our clients to understand where they are from a security risk perspective and then build out a step-by-step security plan that aligns to their unique environment.

OneNeck – We’ve got your back.

Whether it’s a service, an infrastructure solution or a cloud solution, we are here to help you decide what the best, most-secure course of action should be.

We proactively work with our customers to understand their current security controls, provide recommendations on how to better leverage the current investments in people, process, and tools. We then provide recommendations for the next investments, that will not only provide better security for their business, but also provide a roadmap to more efficiently and timely address the growing demands to maintain cyber insurance.

We live in an age when passive security isn’t enough to protect company infrastructure. Security solutions must seek out and respond to unknown threats. Managed detection and response (MDR) provides companies with the security capabilities they need for the modern era.

MDR is an outsourced cybersecurity solution that seeks out and remediates threats that standard security controls miss. There are two factors that make MDR services a must-have for organizations. One is the lack of available cybersecurity talent. According to the annual Cybersecurity Workforce Study by ISC, there were 2.7 million unfilled cybersecurity positions in 2021. The second factor is the abundance of collected data at the enterprise level and the need to protect it.

With that in mind, we’ll dive into the challenges MDR solves and the benefits of implementing it in your business.

Seek and Destroy Security Threats With Managed Detection and Response

New technology can make your business more agile, profitable, and capable. However, it can also make security increasingly complex. Since companies need new technologies to thrive, it’s essential to keep security robust enough to handle the change. Consider five challenges managed detection and response addresses.

1. Lack of cybersecurity talent. MDR counters the talent shortage by providing businesses with access to a fully-trained team of security experts. The outsourced organization handles talent acquisition and training. Thus, organizations get an instant injection of cybersecurity expertise.
2. Alert fatigue. Teams are often inundated with security alerts. The sheer volume of alerts makes it difficult to sift through the noise and find malicious threats. MDR lightens the load by using active scanning technology to detect and analyze threats automatically.
3. Protect against lateral movement. Once a bad actor gains access to your system, they’ll attempt to move deeper into your network and increase their control. MDR can detect this activity and limit the impact an attack has on your system.
4. An increasing number of endpoints. The amount of devices your organization has to protect continues to increase. From edge devices to remote work hardware, your organization needs a holistic approach to security. MDR uses a network intrusion detection system (NIDS) which employs signature-based behavioral analysis to filter through millions of connections. The NIDS then passes on the threats that need further inspection to the MDR team.
5. Access to advanced security technology. An MDR firm uses machine learning and AI technology to analyze and sift through massive amounts of data. This advanced technology is expensive and may be beyond the reach of many organizations. However, when working with an MDR firm, you get access to the advanced toolsets of a dedicated security company.

To sum up, managed detection and response gives teams of all sizes the security expertise and technology needed to protect against modern threats.

Leverage Partner Expertise for Enhanced Security

The security landscape continues to become more complex. Increasingly sophisticated attacks, more endpoints to protect, and talent shortages require innovative security solutions. You need cost-effective solutions that can detect intrusions, malware, and other malicious activity — helping you take rapid action to eliminate or limit the damage.

Finding technology partners to power your applications and protect your data is challenging. OneNeck provides services for your security needs, including MDR, endpoint protection, backup, disaster recovery, and more. For MDR, we partner with Alert Logic to provide you with advanced threat protection.

Here are four benefits you get from this strategic partnership:

1. Centralized platform. Alert Logic’s platform covers all of your workloads, wherever they may be. Everything is managed from a single location in the cloud.
2. Threat and response expertise. Work with a team of security researchers, data scientists, and engineers who have years of experience analyzing security threats.
3. 24/7 monitoring. Your network is being monitored constantly, and OneNeck security experts are alerted within 15 minutes of any critical incident.
4. Large talent pool. Alert Logic has 150 SOC analysts who partner with OneNeck’s security team to provide you with comprehensive coverage.

Our team helps manage security so you can focus on providing the best service to your customers. Through strategic partnerships, we ensure there are no gaps in your coverage. We have the experience to implement technology solutions for organizations of all sizes. Talk to our team about how you can implement MDR in your business today.

Want to learn more about MDR’s critical role in your cybersecurity strategy?  Check out the MDR Resource Library.