Data Loss Disasters Come in Many Forms

Data Loss Disasters Come in Many Forms

If we’ve learned anything from the COVID-19 pandemic, it’s that we don’t have it all figured out. Not only are we vulnerable as a species, but so are the systems, processes and devices we’ve built. Natural and human-made disasters as well as other contingencies can still cause significant damage and bring businesses to a grinding halt.

 

Now is the time for companies, both big and small, to take steps to ensure business continuity and natural-disaster resilience. In this increasingly digitized world, backup and disaster recovery (BCDR) must be a top priority for businesses because the repercussions of even a single data loss incident could be fatal.

 

Imagine if you were a health service provider, for example, and you ended up losing all patient data after a fire burned away your on-premises backup device. An incident like that could cause irreparable damage to your business.

In this post, we will break down different types of data loss disasters, how to prepare for them and how to leverage BCDR to meet and maintain regulatory compliance obligations.

 

The Many Forms Data Loss Can Take

From natural disasters like hurricanes and floods, to cybersecurity threats such as malware infections, data loss disasters come in many forms. Let’s analyze each type and learn how to plan and prepare for them.

 

Natural Disasters

This covers everything from storms, hurricanes and floods to fires, tsunamis and volcano eruptions. In most cases, you can expect infrastructural damages, power failure and mechanical failures, which could then lead to data loss.

 

Hardware and Software Malfunctioning

Software and hardware failure can cause data loss if you don’t have BCDR measures in place. It could be due to bugs, glitches, configuration errors, programmatic errors, component failures or simply because the device is at its end of life or the software is outdated.

 

Unforeseen Circumstances

Data loss can happen due to random, unexpected scenarios. For instance, a portable hard disk held by one of the employees could get stolen, your server room may have a water leak because of a plumbing issue or there could even be a pest infestation in one of your data centers.

 

Human factor

Aberdeen Research found that everyday human errors cause nearly 64% of data loss incidents.[1] These errors range from accidental file deletions and overwriting of existing files, to naming convention errors, forgetting to save or backup data, or spilling liquid on a storage device.

 

Cyberthreats

Your business may fall prey to malware, ransomware and virus attacks, which could leave your data and backups corrupt and irrecoverable. Additionally, data loss could be caused by malicious insiders with unauthorized access, which often goes under the radar. A recent study shows that employee action is involved in up to 23% of all electronic crime events.[2]

 

How to Plan and Prepare for Data Loss Disasters

As you can see, data loss disasters can manifest in a wide variety of ways. The key is to be proactive and plan for these disasters. Don’t wait for disaster to strike. Here are a few tips to help you get started:

 

  • Perform a business impact analysis and draft a plan on how to recover key functions in the event of a disaster.
  • Define an acceptable Recovery Point Objective and Recovery Time Objective.
  • Set up a business continuity team that will take charge during a disaster.
  • Train your staff in backup management and data recovery.
  • Back up critical business data off-site and on the cloud.
  • Conduct threat analysis and define recovery steps for each threat.
  • Perform frequent security audits and mock drills to review the efficiency of your disaster response.
  • Keep the plan up to date and make sure everyone on the team knows their role.
  • Banking information should be stored in a way that it can be accessed quickly and securely in the event of a disaster.
  • Invest in a robust backup and disaster management solution that is frictionless, secure, offers SaaS data backup and doesn’t require extra hardware or network bandwidth.
  • Make sure you have a remote monitoring tool.
  • Employ waterless fire protection systems, moisture sensors, surge protectors and backup battery systems.

 

Leverage BCDR to Achieve and Maintain Regulatory Compliance Obligations

Data loss prevention is not the only advantage of taking backup and disaster recovery seriously. Getting a robust BCDR solution that offers constant monitoring of backup activity, advanced threat detection, immutable audit logs, access control requirements, data retention rules, and infrastructure or storage controls will make it much easier for you to meet compliance obligations applicable to your business.

Data loss disasters are inevitable. But you can minimize their impact by making BCDR a critical component of your business continuity and resilience plans. Not sure how to get started? We can help. Contact us to get more information on how to build a reliable disaster recovery plan.

 

[1] Everyday human errors account for up to 64% of data loss incidents. Employees inevitably delete the wrong email, contacts, or critical configurations. [Source: Aberdeen research]

 

[2][Source: the CERT Insider Threat Center at Carnegie Mellon University]


Get-AzVM: The current subscription type is not permitted to perform operations on any provider namespace. Please use a different subscription.

Get-AzVM: The current subscription type is not permitted to perform operations on any provider namespace. Please use a different subscription.

You receive the following error message once you have connected to your Azure Tenant and try to run a basic command like Get-AzVM.

A screenshot of a computer Description automatically generated with medium confidence

How to resolve this error?

To resolve this error, we simple just have to change the subscription where we have all our resources located in.

If you notice when your PSSession was setup it connected to a different Azure Subscription. So we basically just have to change the subscription

Example of the wrong subscription.

A screenshot of a computer Description automatically generated

As you can see from the above warning, because the tenant has more than one subscription it will automatically connect to the first subscription and in this case the first subscription is the wrong one so we need to change it to the right one.

How to change to the correct subscription?

We need to run the following cmd to change the subscription.

Set-AzContext -Subscription "xxxx-xxxx-xxxx-xxxx"

(the xxx-xxx represents the subscription object id)

If you do not know the subscription object id, you can run the following to get a list of your subscriptions.

Get-AzSubscription

Hope this helps the next person and saves some time.

#ThatlazyAdmin


Making Security Awareness Second Nature

Making Security Awareness Second Nature

Your business’ security program must start with your employees and strong security policies rather than entirely depending on your IT team or the latest security solutions. You can significantly reduce the likelihood of a data breach by combining a well-drafted cybersecurity policy with comprehensive security awareness training.

It is your responsibility to implement security training for all your employees so that your organization can withstand cyberattacks and carry out business as usual. Regular training will also help you develop a security-focused culture within your business and make cybersecurity awareness second nature to your employees.

Cybercriminals can target your employees at any moment to gain access to sensitive business data. However, if your employees receive regular security awareness training, their calculated decision-making and quick response can effectively block deceiving threats.

Security Culture and Its Influence on Employees

Conducting a one-time employee training session for the sake of compliance does not adequately benefit your business’ cybersecurity posture. It is regular security awareness training that can truly protect your business from looming cyberthreats that are constantly on the rise.

The following statistics throw light on why security awareness training is essential in today’s threat landscape:

  1. Human errors cause 23 percent of data breaches1.
  2. Over 35 percent of employees do not know about ransomware2.
  3. Nearly 25 percent of employees have clicked on malicious links without confirming their legitimacy3.

 

The aim of developing a security-focused culture is to nurture positive security habits among employees. For example, the simple habit of locking one’s computer screen when leaving the workstation unattended can prevent data from being accessed by unauthorized users.

Once you properly train your employees, they will be more aware of the business’ security policies and will realize that their employer’s cybersecurity is their responsibility as well.

 

Tips to Implement Effective Security Awareness Training

Until recently, companies would impart security awareness training as lectures using a slide deck. Businesses conducted these training sessions once a year or once during induction. However, these sessions proved ineffective because of their uninteresting nature and lack of follow-up sessions.

If you intend to develop a security-focused culture, implementing robust security awareness training is crucial. Here are a few tips that can help you effectively implement security training:

  1. Make the training sessions interactive – Your employees will show more interest if you deliver training in high-quality video format since it grabs more attention. Add text content only as a complementary piece to the video. Ensure that the presentation is appealing to your employees so that they do not miss out on important details. Also, make sure your employees can clear their doubts through face-to-face discussions or virtual conversations with subject matter experts.
  2. Break the training into smaller modules – Since the attention span of your employees will almost certainly vary from one to another, breaking training sessions into smaller modules will help them retain information faster as a whole. You can regularly send training modules to your employees to ensure they are up to speed on the latest security topics. Smaller units have a better chance of retention than lengthy pieces of content.
  3. Facilitate self-paced learning – Give your employees the freedom to learn at their convenience. This, of course, does not mean deadlines should not be set either. Make sure you give your employees sufficient time to complete each training module based on its complexity.
  4. Training must include relevant material – The training material must not contain any outdated information. Given how quickly the cyberthreat landscape is changing, the training must be updated regularly and must cover new cyberthreats so hackers don’t end up tricking your employees. Please remember that the content should not be overly technical. The training material must be imparted in an easy-to-understand manner, so employees have no trouble applying it in daily work scenarios.
  5. Conduct reviews with quizzes and mock drills – To assess your employees’ preparedness, you must conduct regular tests, including mock drills, that assess alertness based on their response to simulated scams.

 

Transform Your Weakest Link Into Your Prime Defense

Regular security awareness training can help develop a transformative security culture within your business, thus enabling your employees to detect even sophisticated cyberthreats and undertake adequate action.

 

We understand that implementing robust security awareness training can be a bit challenging. However, you have nothing to worry about. We can help you seamlessly integrate security awareness training into your business operations to make your employees the first line of defense against existing or imminent cyberthreats. Get in touch with us today and let us get started.

Article curated and used by permission.

Sources:

  1. IBM 2020 Cost of Data Breach Report
  2. Opinion Matters Survey
  3. Help Net Security Magazine

Post created by ThatlazyAdmin


Callout External Senders in Outlook

What is External Sender Callouts?

External Callouts is what some organizations use to inform their staff that an email is coming from outside of their environment. IT Admins has created transport rule like this one http://www.thatlazyadmin.com/how-to-prepend-office-365-email-subject-when-email-is-received-from-external-sender/

The transport rule approach has some limitations which has been listed by Microsoft based on feedback from customers.

  • You can end up with duplicate [External] tags in subject line if external users keep replying to the thread (some of our customers use customized solutions to remove the duplicates).
  • Adding things to subject line breaks Outlook conversation threading, as the subject line is modified, so messages no longer “belong” to the same conversation.
  • Changed subject (or message body) stays as a part of the message during reply or forward, which leads to confusion if the thread becomes internal.
  • There can be localization issues, as transport rules have no knowledge of client language that end-users are using.
  • Those additions might take a lot of space in the subject line, making it hard to preview the subject on smaller devices.

Based on the feedback from different customers Microsoft has decided to make the functionality available in Exchange Online. We will look at who we setup this feature in Exchange Online.

How to Implement?

To get started we will launch the Exchange Online Management PowerShell Cmdlet.

Connect-ExchangeOnline

Complete the sign-in process.

We will enable the “Set-ExternalInOutlook” feature by running the following cmdlet.

Set-ExternalInOutlook -Enabled $true

You can also exclude users in the environment so that they dnt get the icon in their Outlook profiles. You can use the “Allowlist” to exclude certain email addresses.

Set-ExternalInOutlook -AllowList info@thatlazyadmin.com

Which Outlook Version are Supported?

  • Outlook on the web: available now
  • Outlook for Windows: available in May 2021 (starting with Insider Fast)
  • Outlook mobile (iOS & Android): version 4.2111.0 and higher
  • Outlook for Mac: version 16.47 and higher

If you are using a Transport rule like mentioned in the above post, then you need to disable the Transport Rule, this rule will create duplicate marked as [External] in the subject line.

One thing to note, once the feature has been enabled for the tenant it might take 24 -48hours before the users start seeing the [External] tag in email messages they received from outside senders.

Here is an example of what it looks like on Outlook, OWA and Mobile device. (these images are from Microsoft techcommunity)

Outlook on the web view of External sender:

In Outlook for iOS, External sender user interface in the message list, External tag when reading chosen email and view of sender’s email address after tapping External label:

Post created by ThatlazyAdmin

Original Post by: TechCommunity


How to Configure Azure Sentinel to collect data from Office 365

What is Azure Sentinel:

 

https://www.youtube.com/watch?v=XXZp6LQZSJU

 

How do you connect Office 365 to Azure Sentinel? By connecting Office 365 to Azure Sentinel you can view all events in a single console.

 

From your Azure Sentinel Dashboard, click on Data connectors

From the data connectors overview page click on Office 365.

From the connector page, you will see the following configuration settings.

Expand Configuration and click on “click here to install solution”

The solution will install, to continue expand connect tenant to Azure Sentinal.

 

Click on +Add tenant you will be prompted for your Global Admin credentials.

Login with your administrator credentials.

Once you have provided your login credentials, you will be promoted to accept the permission request for your Office 365 organisation. Azure Sentinal will read health and activity data from your organisation.

Now that your Microsoft 365 organisation has been added to your Azure Sentinal, expand stream Office 365 activity logs. Click on select to select which logs you want to view in sentinel.

Select Exchange and Sharepoint.

Then click apply changes at the bottom

On the Next section you need to select which dashboard you want to install.

Click on “Recommended dashboards” and click on Exchange Online.

On the left-hand sider click on install.

Do the same for Office 365 Dashboard.

To view the newly installed dashboard, from the Azure Sentinel Home Dashboard click on Dashboards.

Then select the dashboard you want view. In this example I will select Office 365 Dashboard and then click on “view dashboard” from the right-hand slider.

From the Office 365 Dashabord, you can view the following:

 

  • Activity by workload
  • Admin Activity by Type
  • Update, Create and delete activities
  • Group activities

 

These are just some of the activities you can view from the Office 365 Dashboard in Azure Sentinel.