The need for an Acceptable Use Policy is high

The swelling trend of working from home coupled with the growing impact and frequency of cyber-attacks and data breaches has left organizations of all sizes searching for ways to improve their IT resilience and recovery capabilities from cyber threats. One of the leading causes of cyberattacks is employee negligence. A single negligent employee can be the weak link in any organization’s IT infrastructure, information systems, and network resources. This can lead to many types of security issues such as data and network access breaches, malware, and phishing attacks. One simple step to improve an organization’s security posture is for management to create and adopt an Acceptable Use Policy.

An Acceptable Use Policy (AUP) is a set of rules established by an organization’s management and IT teams that dictate the ways employees interact with the company’s data and network, all for creating a more secure IT environment. An AUP defines the way your company’s resources may or may not be used by your employees.

Acceptable Use Policies are a foundational tool for an organization and its employees to continue business operations responsibly and safely. Here are some examples of how IT Security leaders define the best practices for their IT infrastructure.

What does an Acceptable Use Policy look like?

Employees of all roles and backgrounds are encouraged to use and consult the document, and therefore it needs to be approachable. Cybersecurity experts prescribe an Acceptable Use Policy that is short, easy to read, and organized into sections.

What does the Acceptable Use Policy apply to?

Simply stated, the document should apply to all interactions an employee has with the organization’s network. Here’s an excerpt from the Acceptable Use Policy at Brown University:

“Computing resources (covered by the Acceptable Use Policy) include all company and employee-owned, licensed, or managed hardware and software, the use of the company network via a physical or wireless connection, and all applicable company-owned data stored or accessible on employee’s personal hardware.”

What security standards are set for corporate and employee-owned hardware?

The security standards are up to the discretion of the organization. We’ve seen security policies vary in strictness, but it’s important to use verbiage consisting of absolutes to convey the importance and encourage standardization. Here’s an example from the SANS Institute, a global leader in cybersecurity training:

“You may access, use or share proprietary information only to the extent it is authorized and necessary to fulfill your assigned job duties. All computing devices must be secured with a password-protected screensaver with the automatic activation feature set to 10 minutes or less. You must lock the screen or log off when the device is unattended.”

What vulnerabilities do remote workers create that an Acceptable Use Policy can mitigate?

• Exponential Endpoints: Despite many organizations issuing company hardware to their employees, there are plenty of reasons that an employee would choose to use their personal device instead of the company-issued equipment (i.e., device power, extra monitors). This preferential choice creates a nearly unquantifiable number of endpoints that could be used to access company data or networks without the same security standards as the organization’s machines. The average home in the U.S. has two personal computers and two cell phones. These endpoints are not secure by default, and the addition of these devices into operations must be viewed as a data security risk. An acceptable use policy could have provisions ensuring no personal devices are used, or certain standards required to use a personal device. A simple example is: a VPN is required to access the organization’s network.
• Network Vulnerability: Even if employees’ personal devices are secured to company standards, there is more to worry about than two phones and two computers. The average U.S. home has ten devices connected to its home network. The interconnectivity of the Internet of Things (IoT) coupled with work-from-home has led to the adverse side effect of a device as simple as a printer being a threat to an organization’s entire network. If a hacker was able to pull company data logs from an employee’s home printer, it could lead to the exposure of all locally stored data and data shared on the company network.
• Culture Desynchronization: A possible side effect of work-from-home are the negative impacts of employees’ lack of opportunity to develop relationships among themselves. Without the water cooler, employees may use their downtime to browse the web or otherwise entertain themselves at home. Unfortunately, this can present a host of security concerns. Some comprehensive acceptable use policies also include an Internet Usage Policy, which firmly outlines what websites are acceptable to peruse on company equipment, or company networks. An expressly clear internet usage policy helps dispel ambiguity and creates a culture of security – uniting employees under the same standards.

Business Continuity Considerations

An Acceptable Use Policy is an effective preliminary tool in designing a comprehensive business continuity plan. It’s recommended – especially with today’s data landscape – that when BC Planning, you put your people first. Today’s employees face many COVID-related challenges, from establishing a stable home office to concerns about family’s health and safety. Organizational policies and plans shouldn’t complicate the lives of already disrupted employees. Instead, when possible, make your acceptable use policy as easy for your employee to adopt as you can. Here are some examples of tools that can be embraced without shifting significant responsibility on your team.

A secure, encrypted, file-sync and share tool with the ability to create shares at an individual, team, and organizational level streamlines operations and makes collaborating easier out of the office.
Point in time, offsite backups for Microsoft 365 are essential for organizations that rely heavily on the Microsoft software suite for operations and communication.

Cybersecurity training is of course core to building a more aware organization, and the less it feels like homework the more receptive your employees will be. Look for cybersecurity training that includes short videos and quick comprehension tests, but also includes tools that an employee can look upon when trying to decipher the legitimate from the phishing scam.

Design a phased policy publishing schedule that will allow users to adapt slowly over time- this applies when policies result in significant changes to business activities.
Keeping the policy current is important as technology changes and shifts in threats evolve, so too must your company’s AUP. At a minimum, these policies should be reviewed at least once a year or when something changes like Covid-19 that forces workarounds and adjustments.

Get Help

Business Continuity Plans (and even smaller projects, like Acceptable Use Policies) can seem incredibly daunting for an IT department to dive into. Don’t tackle it alone. RenovoData specializes in helping organizations protect their data, create plans, and recover in case a disaster strikes.

The first stages of the post-pandemic future are already here, and we are rapidly reshaping our lives and our businesses in response.

Despite the downsides, the global health threat gives our companies a rare opportunity for innovation, growth, and improvement. Organizations that manage the turbulence well can emerge from the crisis stronger and more dynamic than before.

Now that we have been living with the worldwide crisis for a while, it is important to look at what we have learned.

Pandemic-era experiences are different for every company, but the following elements should be assessed by all:

• Ask all departments and workgroups what they have learned so far. Which business processes work well and which do not? Which have changed and why? Decide which recent changes are working and keep them going.
• At this point, a comprehensive Business Continuity Plan is essential. The plan documents prevention strategies and workaround processes to counter threats to all departments and IT systems, supporting a company’s ongoing operations before and during a disaster.
• Be prepared to make changes to your business model. Reexamine everything about the company’s activities, with all previous methods and procedures open to challenge.
• Anticipate future obstacles. These could be caused by the pandemic or by unrelated events that could impact operations.
• Your people come first. Their well-being is paramount. Take special care of employees who may be suffering from COVID-19, be mindful of the presence of families in remote workers’ homes, and understand that with so many isolated employees, new customs and behaviors will emerge spontaneously.
• Survey individual employees at every level for new ideas. Do not listen only to management and key staff. People in the trenches understand your company’s operations in deep detail and can be counted on to come up with improvements both great and small.
• Strive to strengthen your remote workforce. Major vendors like Microsoft and trusted sources such as LinkedIn are moving quickly to provide useful online tutorials covering subjects such as VPN, available devices, versioning, and meeting strategies.
• Stay abreast of new products and services for remote workers. These include sophisticated video telephony solutions as well as new workstation gadgets, dashboards, performance-enhancement tools, and more.
• With working remotely having become mainstream, the evaluation of each worker’s value and abilities takes on a new dimension. This can lead to some realignment of responsibilities.
• Keep employees, customers, vendors, strategic partners, and the trade press well-informed about your company’s activities. In this rapidly evolving business environment, people need to know what you offer, how you are now doing business, and how you expect to move forward.
• Our growing understanding of the new landscape is a goldmine of information. Take note of potential modifications and always be open to new ideas.
• If you have not done so already, shore up your security and boost efficiency with a resilient, multi-feature file-sharing package. Collaborative file-sharing and backup solutions deliver enterprise protection for remote workers by backing up content each time they save their work. Endpoints are protected because users are able to roll back to previous versions when their systems are under attack.
• Accept that your company’s goals and priorities are changing, and may not change back. Substantial realignments are in the cards. The new landscape causes us to see job assignments, core business objectives, and even corporate missions in a new light. When we get the all-clear, will the adjustments continue or revert to their former state? The question is, what parts of the new normal work? Another factor will be the cost of returning to past methods.
• Evaluate existing security measures and identify potential improvements. Vital safeguards such as cybersecurity, data backup, and disaster recovery may need to be enhanced. This is particularly important because remote workplaces are more vulnerable to malware than established office ecosystems.
• Count on new ideas to improve your company’s agility. Even minor improvements contribute to operational speed and efficiency.
• Focus energy on developing new vertical markets. Where possible, seek out niche sectors that are emerging because of today’s business landscape.
  With more employees working remotely, some companies will be able to reduce their office space without diminishing the business.
• Establish plans for possible future disasters. The novel coronavirus underscores the need for companies to continuously improve processes in preparation for unforeseen events.If you do not have one already, establish a fully functional alternate location. We emphatically recommend being able to duplicate your physical and virtual presence at a separate site. This allows you to continue production if your main site is compromised.

RenovoData can be your guide to your company’s new normal. The opportunities for innovation and growth are out there, and our expert assistance can help you find them.

Because we don’t know how long the pandemic will last, it would be a mistake to think of having employees working from home as a momentary stopgap measure. As long as the quarantine is in place and staff members are widely dispersed, our mission is to keep our companies as productive and safe as possible.

Key steps include:

• Careful construction of a pandemic-oriented Business Continuity Plan
• Close examination of every area and process of our companies, in search of effective workarounds
• Alteration of established procedures
• Reduction or elimination of some functions
• Realignment of duties
• Revised training methods
• New ways of holding meetings
• Documentation of new processes and procedures
• Modification of communications at all levels

Cyberthreats on the rise

The growth of remote workforces has weakened many organizations’ normal protections, resulting in a new generation of malware and cyber threats. New varieties of fraudulent clickbait appear in the form of fictitious cures and bogus pandemic services, along with the usual scams.

Home workplace defenses

• Whenever possible, remote workers should take home the devices they use in their offices. These machines are already set up with requisite functions, from firewalls to corporate policy features to malware defenses.
• If people must use their own equipment, these personal devices should be equipped with the same types of protection utilized in the office.
• Strong and up-to-date firewalls are a must.
• No home PC should go into service without solid antivirus resistance.
• Employees working with their own PCs should make certain that their network connections are secure.
• A VPN adds an extra layer of safety by protecting passwords and other individual information.
• All updates and patches should be installed to ensure that home PCs can deliver optimum performance.
• Employees should be kept aware of the latest cyber threats.
• Because cybercriminals are now working overtime, workers should be especially vigilant regarding iffy links and unrecognized emails.
• Personal details should never be shared.
• Remote employees should keep an eye on network traffic and be wary of presences that appear suspicious. A widely dispersed workforce can make it easier for bad actors to invade networks.
• The safety of all endpoint devices should be verified because they are among the most inviting targets for cyberattacks. These include computers, smartphones, tablets, USB drives, and any other hardware attached to the system.
• All data must be frequently backed up and safely stored, and bolstered with strong disaster recovery capabilities. This is especially important in remote environments where interruptions, spilled beverages, rambunctious kids, and equipment failures can cause damaging data losses.
• Security-assured solutions should be used when sharing files. Negligent file-sharing can be as damaging as outright file theft.
• Thorough backup is needed for rolling back to previous versions or times.
• When video cameras are not in use, they should be blacked out to prevent hackers from spying.
• Employees must be sure that no one else uses computers that have been pressed into service. Games, private emails, remote schoolwork, and other online content can pose severe dangers.

This is a lot to take in, and conducting business when your workforce works remotely is a tremendous undertaking. But you need not face the task alone. RenovoData can provide solutions that assure your remote users of solid defenses against disaster as well as effective recovery when problems do occur. To learn more about powerful protection against threats posed by the effects of COVID-19, call us at 1.877. 834.3684 or email us at info@renovodata.com.

Small to medium-sized companies may want a comprehensive Business Continuity Plan to withstand the pressures created by COVID-19, but who has the time or resources, and where to begin? Simply maintaining operations is challenging, especially since no one can say with certainty how long the pandemic will last or what its long-term effects will be. Few if any businesses have ever made plans to confront a crisis of this magnitude. The best that the majority of organizations can do now is to devise workaround procedures based on their existing plans, to implement the most creative thinking they can muster and the best guidance they can obtain.

There are steps to be taken to build effective Business Continuity Plans, steps that allow the most essential functions to continue while recognizing and accommodating the many ways in which our daily lives are being battered.

Every business activity and process must be evaluated afresh. Some new directions will require improvisation and ingenuity while others need no more than a shift in management’s point of view.

Meanwhile, reliable cybersecurity, data protection, backup and disaster recovery planning capabilities are no less crucial than before. We face extraordinary new threats to our IT structures, but the familiar ones – malware, weather events, and the like – have not gone away. In fact, cybercriminals are taking advantage of the current disruption to design advanced attacks.

At RenovoData, one of our core missions has always been to help businesses survive and prosper when disaster strikes. Based on our experience, we offer the following recommendations for Business Continuity Planning in today’s landscape.

Put your people first.

• We are all affected by the pandemic, so be sure to acknowledge that human factors can sometimes outweigh business considerations.
• Remember that many remote workers are responsible for their families’ health and safety. Parents and caregivers will experience pressures that are likely to impact how they handle their duties.
• Be prepared for the spontaneous evolution of new customs and corporate cultural norms spurred by an abruptly changed environment.
• When possible, let people know if their jobs are secure or in jeopardy or if management has not yet decided.

Assess your business’s functions.

• Begin by identifying the ways in which business continuity will be influenced by new realities.
• Assess all your tools, techniques, and procedures in light of current conditions.
• Look for nonessential tasks that can be diminished or suspended for the duration.
• Determine if your existing IT resources are adequate for effective telecommuting.
• Appoint leaders to head up planning efforts and establish clear chains of command. While people can be understandably shaken by events, they should understand that planning must take place.
• Decide which people – IT staff in particular – need to be onsite, and look for ways to reduce that need.
• Establish policies for how employees connect with customers, vendors, and other outside entities. This includes both technical and personal perspectives.
• Set guidelines for how business materials should be handled by remote workers. This includes printing documents, downloading files, and other tasks normally performed only on-site.
• Establish rules regarding the use of personal email and other external links. There will be circumstances in which employees need more time for interaction with loved ones than usual.
• Be sure that you have full-featured and reliable technology for video conferencing, and that your employees know how to use it.

Communicate.

• One of the dangers of this crisis is a constant barrage of false and misleading information coming from every direction. Help employees distinguish fact from fiction.
• Make firm rules about necessary actions like hand washing and social distancing.
• Disseminate guidance from the most authoritative sources possible. These include the World Health Organization (WHO), the Centers for Disease Control (CDC), and other knowledgeable sources, not just cable news, politicians, or assorted celebrities. Be aware that expert recommendations may not always agree with company policies.
• Tell your entire organization about major plans, events, and decisions.
• See to it that new and revised duties and policies are clear to everyone.
• Let your customers, vendors, strategic partners, and your industry’s trade press know how your company is doing.

Get help.

The COVID-19 outbreak may have caught the world off guard, but expert guidance is available. At RenovoData, an important part of our work is understanding how and why catastrophes can devastate IT systems, how to prevent damage, and how to remedy the harm that has occurred. We are ready to lend our knowledge and experience to your planning initiative.

For guidance in planning your company’s powerful response to the pandemic, call us at 1 877 834 3684 or email us at into@renovodata.com. Remember that the pandemic will end one day and the actions your company takes now will affect its future.

It is axiomatic that every organization with an online presence needs a solid Disaster Recovery Plan. This blueprint shows you what to do and how to do it when hacker assaults, weather events, or other catastrophes threaten your data and systems.

Effective planning incorporates system-wide protection, thorough backup capabilities, and timely data recovery procedures. Human factors are equally important. These include:

• Clearly established rules regarding day-to-day handling and management of data
• Well-rehearsed action assignments for protection and recovery
• Ongoing training for everyone who has any role in those processes
• Periodic drills and testing to keep everyone on their toes and for tools and procedures to be deployment-ready always
• Rapid responses to constant changes in IT environments, requiring equivalent changes in protection, backup, and recovery methods, as well as training components

Other important though often-overlooked elements are the psychological reactions of the team members who must deal with disasters. When emergencies arise, people are thrust into fight-or-flight mode. At these times the speed, accuracy, and thoroughness of the team’s responses can mean the difference between a company’s survival and its destruction.

By their very nature, disasters strike when they are unexpected, so no matter how well-prepared your people are from a technical perspective, they will inevitably experience acute stress, which triggers the fight-or-flight response. This is completely natural and instinctive, so we can expect it to kick in whenever a threat appears. The fight-or-flight motivation is so deeply programmed in all of us that we sometimes experience it even when there is no danger at all. In cases where the menace is real and urgent, it can be overwhelming.

Choosing to fight or flee makes sense when lions are after us, but not when challenges demand informed, cool-headed, and rapid action. The best plans in the world will fail if the people who are charged with implementing them are emotional basket cases.

Fight-or-flight is essentially an automatic reaction of the sympathetic nervous system that prepares us to deal with extreme peril. We instinctively focus on our own survival, which can distract us from dealing with a disaster.

Nerves of steel and strong self-discipline certainly help, but when the heat is on, the fight-or-flight compulsion is inescapable. None of us is immune, nor do we know exactly how some will react, yet for any organization’s response to disaster to be effective, every team member must be a fully functioning participant.

Overcoming fight-or-flight reactions must be part of your Disaster Recovery Plan.

• Throughout the training process, remind all team members that disasters usually come as shocking surprises, and that there will not be time to contend with the emotional jolt.
• Everyone must understand that the moment a disaster is known to have occurred, the fight-or-flight impulse will interfere with problem-solving abilities, so remaining focused and on-task may be difficult.
• Let everyone know that the only way to overcome fight-or-flight is to follow established procedures to the letter.
• It is absolutely imperative that all team members be so well-practiced in disaster-recovery procedures that they can perform their assigned tasks even under intense stress.
• Disaster-response duties should be presented in clearly defined steps so that people see their responsibilities as a checklist rather than an amorphous collection of goals.
• Set up regular DR drills so that team members not only know what they have to do but, through practice, develop the automatic muscle memory needed to make each step easier and quicker.
• Make tabletop exercises part of the drill program. These are meetings in which team members discuss and analyze simulated disaster situations to spot potential flaws in the DR Plan. These exercises serve to sharpen participants’ understanding of their responsibilities.

Remember that effectively countering fight-or-flight responses is as essential as any element in your DR Plan.

RenovoData provides top-flight tools and techniques for disaster recovery as well as expertise in handling threats to data and systems. We can help prepare your team for attacks and other crises, enabling them to overcome problems and return to normal productivity as quickly and painlessly as possible.

Established standards can guide you.

Every organization with an online presence is in danger of attack, and effective protection against it must be well-planned and thorough. The cloud is an important part of your defenses, but even with it, you are responsible for safeguarding your systems and your data. But the process of building solid security does not mean that you need to think up every element and process yourself.

It takes time to build the best possible defenses, but Rome wasn’t built in a day. Instead of hurriedly cobbling something together, begin with a structure based on reliable and readily available cybersecurity standards. A good place to start is with a framework such as provided by the National Institute of Standards and Technology (NIST).

A premier science and technology laboratory, NIST is an agency of the U.S. Department of Commerce charged with promoting innovation and competitiveness. The NIST Framework provides organization and structure to today’s multiple approaches to cybersecurity by assembling highly effective and widely used standards, guidelines, and best practices without regulatory burdens.

This empowers organizations of any size or level of technical sophistication to impose strong protection for systems and data as well as superior recovery capabilities.

The Framework consists of three parts:

1 – The Framework Core presents industry standards, guidelines, and practices and comprises five key functions:

• Identification
• Protection
• Detection
• Response
• Recovery

2 – Framework Implementation Tiers

Framework Implementation Tiers outline a range of approaches, from the informal and reactive (often the most effective for SMBs) to the most sophisticated and detailed. When assigning Tiers to the various sets of cybersecurity processes, a company must evaluate its current practices, threat levels, regulatory requirements, business objectives, and organizational constraints.

3 – The Framework Profile

The Framework Profile looks into how the standards, guidelines, and practices of a given scenario align with the Framework Core. The Profile considers important issues such as costs, future business plans, ongoing assessment, and both internal and external communications.

The NIST Framework requires communicating to the entire organization the reasoning behind the cybersecurity program, how it works, and how all employees can participate in its implementation.

The body of technical information available through NIST is vast, covering everything from the characteristics of cybersecurity components to remote access to recovery-plan testing. An excellent example of the specifics presented is a NIST standard that all service providers should use. The Advanced Encryption Standard (AES) is employed along with FIPS 140-2 certification to provide the highest level of third-party validation, ensuring that the encryption is virtually invincible. This is a good example of how reliance on an established standard can guarantee top performance.

Another premier framework source is the Center for Internet Security (CIS), a nonprofit organization that helps its members “identify, develop, validate, promote, and sustain best practice solutions for cyber defense.” It is a crowdsourced entity that follows a consensus development model that invites input from a broad range of users in order to better inform its solutions and processes. CIS members include corporations, government agencies, and academic institutions.

CIS goals are clear and practical:

• Leveraging cyber offense to inform cyber defense, focusing on high payoff areas
• Ensuring that security investments are focused on countering the highest threats
• Maximizing the use of automation to enforce security controls, thereby negating human errors
• Using the consensus process to collect the best ideas

CIS Controls and CIS Benchmarks are globally respected standards for cybersecurity. CIS Controls are a group of 20 best practices for defending against malware. These cover every area of cybersecurity, from planning to implementation to testing. CIS Benchmarks encompass frameworks for secure configuration, automated assessment tools and content, security metrics, and applicable software certifications.

Using a framework when developing cybersecurity processes has significant advantages:

• Reduces confusion and eliminates unproductive initiatives.
• Takes advantage of the combined knowledge of many experts and user organizations.
• Sets warning guardrails for potentially expensive and destructive errors.
• Ensures that every important step will be taken.
• Recommends only proven best practices.

The fact remains that even with a solid framework in place, creating strong, nimble, and constantly current cybersecurity capabilities requires the kind of individual guidance. This is the kind of consultancy RenovoData provides. Companies benefit when experienced experts are available to help guide decisions and the know-how to put the whole system together. These are among our greatest strengths.

To discuss how you can benefit from a well-established framework and how it could work best for you, contact us.

The need for effective disaster recovery planning is a crucial segment of today’s IT security practices.

There are many potential causes for disasters, with cyber-attacks being the most prevalent. Every organization with an online presence is vulnerable to this kind of criminal activity and the numbers tell a grim story. Gartner research found that more than 80% of organizations have been successfully attacked, more than half have experienced four or more such events, and just under 40% have had five or more. Small businesses are especially susceptible.

Cyber threats are only one category of disasters. Other types are less frequent but can inflict as much or more devastation. New threats appear continually and every company’s IT setup evolves over time, so even the best recovery plans need frequent and regularly scheduled reevaluation.

The business world is more IT-sophisticated than ever, and companies expect the organizations with which they interact to keep up with the times. With the perpetual advancement of IT tools, trends, and techniques, businesses are increasingly pressed to deliver goods and services quickly.

So, unless you are on top of every aspect of your IT recovery processes and have created and continued to maintain a plan to support them, a refresher may be in order.

Why IT recovery plans matter

• Disasters happen.
• Shutdowns are expensive. No matter why or how your IT functions freeze up, high downtime costs are always possible, from data loss to diminished IT capabilities to a damaged reputation.
• Your disaster affects your customers and vendors. If orders go unfilled, communications become disrupted, or your performance is impaired, your most important contacts can be seriously harmed, without warning. If your system is hacked, the infection can spread to every entity to whom you are connected.
• Regulators can require IT recovery plans.
• To an increasing extent, insurance coverage can demand demonstrable IT recovery capabilities.

Disaster takes many forms

As mentioned, the most prominent of such challenges are cyber-attacks, which grow in number as new IT developments arise. New technological advances often carry new risks.

Similarly, single points of failure in a company’s security armor allow even the strongest defenses to be penetrated. A good plan identifies those vulnerabilities and takes steps to eliminate them. In addition, an emergency recovery plan clearly delineates procedures and responsibilities so that everyone knows where everything is, what to do in any emergency, and who is responsible for what. This way, the entire organization is on the same page throughout the disaster recovery process.

Some of the most easily overlooked malware entry pathways are created by the small devices and programs that users casually attach to systems, often without the knowledge or approval of IT staff. Mobile devices can create endpoints vulnerable to attack, and users may be unaware that their devices are not secure by default. As a Forsythe Solutions Group, Inc. article entitled Mobile Device Security in the Workplace: 6 Key Risks & Challenge points out, “With the right (inexpensive) equipment, hackers can gain access to a nearby mobile device in less than 30 seconds and either mirror the device and see everything on it, or install malware that will enable them to siphon data from it at their leisure.”

In addition, innovations like digital transformation, as much of an advance as they may be, can add to problems of this kind by introducing potential penetration points. Another risk is data leaks. Such problems require close attention and an understanding of how to prevent them. Besides cyber-attacks, other significant threats are posed by completely different causes. These are generally hard to anticipate.

Natural disasters include hurricanes, earthquakes, and, increasingly, floods. Others are manmade, such as highway and railway accidents, utility failures, and chemical and oil spills. Of course, fires can be caused by natural events or human activity.

At the most extreme end of a disaster, possibilities are events that make it impossible for work to continue at your usual location. The only solutions to such disasters are offsite capabilities that enable you to restart operations rapidly. This can be achieved by exploiting the possibilities of cloud storage and working with a trusted vendor to set up a functioning alternate physical site.

Among potential risks, day-to-day operator error is in a class by itself. Employee mischief is always possible, but a person need not be disloyal or incompetent to cause major damage by making a small mistake. The most effective safeguards against both sabotage and human error are good communication, employee education, and training.

Planning the plan

Begin by thinking about where your company is now. Do you have IT recovery processes in place? Are those processes the result of careful planning? How well do your tools and solutions fit your company? Is each component the best choice for its function? Does each meet the needs of your current business model and IT environment?

Calculate your costs of downtime and review the fundamentals that every recovery plan should contain. Then look at potential threats to identify the key steps in developing and refining your plan. Determine the level of detail a plan requires, who should be responsible for what, and a schedule for ongoing testing of the plan. We cannot overemphasize this last point.

The tools and solutions you select need not to be the most complex, expensive, or feature-rich, but they should be the right choices for your company. Be prepared to consider fresh options and alternative possibilities.

Always keep in mind that the best plan and the best implementation with the best tools and solutions can become outdated and vulnerable with a single change to the system, even a minor one. The same is true for ongoing developments in the wider IT world, so stay abreast of new products and conditions that might have an impact on your disaster recovery capabilities. Once again, remember to reexamine your plans in deep detail on a frequent, regularly scheduled basis.

Planning for IT recovery is a complex endeavor that requires a serious time commitment, highly focused attention, investment, and most importantly, expertise. That’s what RenovoData can provide, throughout the whole IT recovery planning process.

In recent years, the cloud has become a major part of the IT landscape, bringing many benefits and a wide variety of options. In addition to virtually unlimited data storage, the cloud imparts improvements in speed, availability and user mobility. It carries significant financial savings as well, including cost cuts, on-demand capacity, and reduction of resources previously allocated to infrastructure and operations.

But for all its advantages, the cloud is not without potential challenges, and the picture is further clouded by a number of widespread misconceptions. No surprise, since every major breakthrough comes with new and unexpected obstacles as well as gaps in public understanding.

Users often assume that the protections the cloud provides give license to relax established safety practices, but cyber threats are still on the prowl. A main reason for this false sense of security is that in the past, companies’ critical data and services were more or less safely contained in their own servers. Now, with cloud storage and ever-greater reliance on Internet services, organizations present more-inviting targets and more opportunities for single points of failure.

There is a tendency on the part of some users to blame the technology itself for difficulties that arise from the use of the cloud. More commonly, however, problems are the result of avoidable human error – failure to implement basic security procedures. So even with solid cloud implementation, protective measures are as essential as ever. While effective data protection is highly complex, careful attention to the possibility of simple mistakes is as important as understanding the technicalities.

Here is a typical example

Masses of private and commercial data can be made vulnerable simply because systems’ web addresses have been left unguarded and thus easy for hackers to obtain. This enables invaders to capture encryption keys, which is all they need to be able to pillage an organization’s data. Attacks of this kind can severely cripple companies, all because an elementary safeguard was ignored.

The solution is simple enough:

Every aspect of credential protection, every user ID and password, must be made secure, with emphasis on every. It is estimated that more than half of the companies that use cloud systems have allowed potentially lethal exposure of their cloud-stored data as the result of this kind of easily avoidable mistake. And any time a system is open to attack, the company’s customers and vendors are at risk as well.

Another frequent error is failure to encrypt sensitive data. It is estimated that well over half of companies fall into this category, despite the fact that implementing encryption software and infrastructure is universally understood to be a key element in an organization’s data security.

There are other types of vulnerabilities that, while basic, can be hard to detect. It only takes one crack in your defenses to open your system to attack. If you have any doubt in your procedures, take the time to have your defenses thoroughly audited.

We have the expertise and experience to help you identify security vulnerabilities such as have been described, and are always available for advice and guidance. Feel free to call us at 1.877.834.3684 or email us at info@renovodata.com.

Please follow our company page on LinkedIn to get the latest information and news on Data Protection and Disaster Recovery.

At RenovoData, we care about our customers, especially keeping their data safe and protected.

We work tirelessly to ensure that crucial business data is backed up and recoverable in the event of a disaster or data loss event. We stay ahead of the curve when it comes to the latest developments and trends in cloud computing. Still, in this day and age it does come as a bit of a surprise that some people are using weak passwords like “password” or “123456”! Most people know that the more common or weak a password, the higher the chances someone could hack into personal accounts… and yet, these weak passwords continue to be used A LOT.

Recently SplashData released its annual list of the year’s worst passwords. Among the top-ranked terrible passwords were: “qwerty”, “baseball”, and “football”. Numerical sequences also dominated the list including “111111” and “123123”. Changing things up are “abc123” and (somewhat ironically) “trustno1”.

In order to help you make your passwords more secure, we’ve gathered a few tips and suggestions:

• Don’t use the same password for all of your accounts.
• Don’t skimp on the character count. Unless otherwise directed, passwords should be at least 14 characters long.
• Avoid words with personal information, for example, your name, your pet’s name, your child’s name, the name of your favorite sports team, etc. This kind of information can be relatively easy to find and in turn, guessed.
• Scatter numbers and symbols throughout your password. Having them at the end or replacing an E with a 3 is just not secure enough.
• Pick random word combinations (like cheese-shoe-rain).
• Pick the first letter of each word in a sentence from a poem or song. (For example, “Let it go, let it go, Can’t hold it back anymore” would translate to “l-i-g-l-i-g-c-h-i-b-a”)
• Use a random password generator. (Example: http://passwordsgenerator.net/)
• We hope this post will get you thinking about the security of your passwords. Forgetting a password is a pain, but dealing with the aftermath of unauthorized access is much worse. Protect yourself!