Cloudy with a Chance of Data Loss

What would happen if your company lost all of its email data? If you’ve yet to implement a backup solution for your Microsoft 365 data, you could be faced with that question if a cyber-incident occurs.

Over a million businesses use Microsoft 365 – chances are, you do too! By far the most popular productivity suite, this Microsoft product includes apps such as Outlook, Word, Excel, PowerPoint and others, depending on your configuration. But did you know that Microsoft is not responsible for backing up the data on in your Microsoft 365 suite?

Why Microsoft 365 Customers Need a Backup Solution

Many business owners using Microsoft 365 believe that their data is totally secure. The reality, however, is a different story. Although Microsoft offers many benefits in productivity, efficiency, and collaboration with Microsoft 365, the company doesn’t provide users with a comprehensive backup system for their underlying data.

Mechanical malfunctions and physical damage, hacking and theft, user error, and power outages all put user data at risk in the cloud. Protecting data has never been more important – hackers are now attacking computers and networks at a rate of one attack every 39 seconds. While companies do their best to prepare for these problems, no plan is foolproof, and stories of data loss are far from rare, with the average data breach costing small businesses $149,000. Furthermore, 60% of small businesses close their doors within 6 months of a data breach.

Cloud Backup Saves Data, Time, and Money

The fact is that having only one copy of important data is asking for trouble, whether it’s stored in the cloud or elsewhere. If your data isn’t backed up, you could be facing not only a loss of productivity as you scramble to rebuild, but also a loss in revenue and reputation.

Microsoft 365 is an excellent service that gives you access to your data from virtually any place at any time — and across many devices. As a software-as-a-service (SaaS) built on the industry-leading Azure public cloud, Microsoft 365 offers users high reliability, geographic redundancy, and secure connectivity.

This should not, however, be confused with a comprehensive data protection solution. Microsoft does not back up Microsoft 365 user data, so it recommends that customers use third-party solutions. Furthermore, Microsoft doesn’t protect data from common issues like file corruption or everyday human error. Nor does it offer a way to easily revert to older versions if something goes wrong beyond their normal data retention policy.

Back To Business I.T. can help you evaluate your options in addressing these shortcomings and specifically discuss how implementing a backup solution can be cost-effective and seamless and offer peace of mind.

Our Cloud Backup Service Is Easy to Use, and Recovery Is Fast

Not all backups are created equal, however. When looking into a solution that can protect your data stored in the cloud, there are a few fundamental questions you should be asking your vendor:

What data is actually being backed up?
How is the backup data being stored and protected?
How often is data backed up, and for how long?
How easy is the data restoration process?

Our Cloud Backup Service is a flexible, agile, and reliable solution that offers comprehensive data protection across the full Microsoft 365 tenant, unlimited storage and retention of user data, and a hassle-free setup and run experience. Better yet, data-recovery means you can have peace of mind that your company can be up and running with minimum downtime.

There are several things to consider when selecting a cloud backup solution – and our team of experts can help with that! Our team can customize an approach that works for the company data that should be protected as well as other business and budgetary needs.

Contact our team today to learn about our Cloud Backup solution for your Microsoft 365 data!

Back To Business I.T. to Participate in First-Ever Identity Management Day

Identity Management Day, founded by the Identity Defined Security Alliance, aims to educate and engage business leaders and I.T. decision makers on the intersection of identity management and security.

Beavercreek, OH — Back To Business I.T. today announced that it will participate in the first ever ‘Identity Management Day,’ an annual awareness event that will take place on the second Tuesday in April each year. The inaugural Identity Management Day will be held on April 13, 2021.

Founded by the Identity Defined Security Alliance (IDSA), the mission of Identity Management Day is to educate business leaders and IT decision makers on the importance of identity management and key components including governance, identity-centric security best practices, processes, and technology, with a special focus on the dangers of not properly securing identities and access credentials.

In addition, the National Cyber Security Alliance (NCSA) will provide guidance for consumers, to ensure that their online identities are protected through security awareness, best practices, and readily-available technologies.

To support this exciting initiative as a champion, Back To Business I.T. will be sharing information about ways to safeguard your identity online as well as resources available to individuals and organizations.

“Raising awareness around identity management is especially critical after a barrage of identity-based breaches made headlines in the past year, including Twitter, Marriott, and Nintendo. In fact, research by the IDSA reveals that 79% of organizations have experienced an identity-related security breach in the last two years, and 99% believe their identity-related breaches were preventable,” said Julie Smith, Executive Director of the IDSA.

Smith continued, “Compounding this, the ongoing pandemic has accelerated digital transformation initiatives that support changes in how we work and how we live day-to-day, putting organizations at greater risk. Our hope is that Identity Management Day will result in higher prioritization of identity security and, as a result, fewer data breaches in 2021 and beyond. We are grateful for all of the support from IDSA and NCSA member companies and the broader industry to further this mission.”

“Identity-related cybercrimes are nothing new, but the methods that hostile actors are using have changed tremendously,” said Tyler Greenwood, Vice President of Back To Business I.T. “Phishing and identity spoofing are tactics that cybercriminals are using to get people to give up information that’s then used to compromise systems. It’s happening everywhere and unfortunately many people and businesses aren’t taking proper precautions and are paying the price.”

“Identity management isn’t just about passwords anymore”, Tyler added, “It’s about people. Making sure users are trained to recognize maleficence is potentially the most critical factor keeping their identity and credentials safe.”

Back To Business I.T. offers customizable managed services designed to improve your business operations. Whether you have straightforward technology requirements or complex technical needs, Back To Business I.T. offers a full suite of managed services and solutions that can bring value to your operations and solve your technology challenges. One of our most popular services – Security Awareness Training – offers custom-built company-specific campaigns to train employees on cybersecurity risks. We craft and deploy simulated phishing campaigns to test employee awareness and provide resources to strengthen their understanding and increase cyber resiliency.

About the Identity Defined Security Alliance

The IDSA is a group of identity and security vendors, solution providers, and practitioners that acts as an independent source of thought leadership, expertise, and practical guidance on identity centric approaches to security for technology professionals. The IDSA is a nonprofit that facilitates community collaboration to help organizations reduce risk by providing education, best practices, and resources.

To learn more about and get involved in Identity Management Day 2021, please visit www.identitymanagementday.org and check out #IDMgmtDay on Twitter and LinkedIn.

Follow the IDSA

Join the Community: https://forum.idsalliance.org/

Twitter: www.twitter.com/idsalliance

LinkedIn: www.linkedin.com/company/identity-defined-security-alliance/

Blog: https://www.idsalliance.org/blog/

Follow Back To Business I.T.

Facebook: https://www.facebook.com/BacktoBusinessIT/

Twitter: https://twitter.com/Back2BusinessIT

Instagram: https://www.instagram.com/backtobusinessit/

LinkedIn: https://www.linkedin.com/company/back-to-business-it

YouTube: https://www.youtube.com/user/BacktoBusinessIT

Create a Disaster Recovery Plan to Protect Your Data

Your company’s most precious business resource is its data. What is your game plan for protecting it?

Data loss cripples businesses – studies show that over 50% of businesses hit by cyber-crime close their doors within 6 months. What measures are you taking while cyber-criminals step up their game? If your game plan doesn’t include backups, you’re effectively planning to lose when (not if) a cybersecurity breach occurs. Don’t like losing? Let’s go over some game plan essentials to get that win.

Consider the elements

Even with strict information controls and excellent maintenance of technology, avoiding data loss incidents is all but impossible. You can account for what you can control – and that’s about it. Aside from the usual suspects – ransomware, human error, and technology failure – there are other forces that could destroy your business if you don’t have proper backups. Don’t let other variables, such as natural disasters, structural fires, and theft, derail your business success. Create a Disaster Recovery Plan to use as your playbook for succeeding in less-than-ideal conditions, and position yourself to recover that data quickly.

A strong lineup

Not all backups are the same. Businesses have different needs and budgets and every backup strategy needs to consider both. Think of this as your line up. How long can your business afford to be “down” in the event of a disaster? What players need to stay in as long as possible? What data is affordable to lose? Priority should be given to the data essential to carry out your essential business functions. In the event of a breach, recovering that data quickly could spare you big losses.

Use a long term strategy

A winning game plan takes you all the way, right? Backups protect your data by ensuring you have a ‘copy’ of everything you need in case of compromise. How long should you keep those copies? The compliance and regulatory requirements for your industry should guide how long you keep data backups. A good long-term strategy accounts for not just unexpected events, but also compliance requirements to ensure your data is there whenever you need it.

Plan for the wildcard

People are a constant variable in the biggest upsets. In times of emotional distress, employees often make poor decisions. Almost 75% of departing employees admit to taking company data in some form. 70% of intellectual property theft occurs within 90 days of an employee’s resignation. Worse yet, even more malicious activity can occur and hostile actors inside the workplace, unfortunately, purposefully delete data. Plan for the wildcards by having timely backups and enjoying peace of mind knowing you can get back to normal after a compromise.

The competitive advantage

If a disaster were to hit your area, how quickly would your business recover? How quickly would your competitors recover? Implementing a disaster recovery plan through effective backups ensures quick restoration and minimizes down time. Make backups your competitive advantage by ensuring you can get back on your feet faster and more effectively than your competitors.

A strong game plan accounts for all known and unexpected factors. It includes an aggressive offense for the things we can predict, and a solid defense for the sudden and unexpected. Plan for the win – backup your data and get back to business.

Want to secure a win for your business?

Our team will work with you to create a custom disaster recovery plan that fits your business needs, the data you need to protect, and your budget. Contact us today!

What is a CMMC RPO?

Throughout 2020, the U.S. Department of Defense released details surrounding the Cybersecurity Maturity Model Certification (CMMC) requirements for companies in the defense industrial base (DIB). These new consolidated cybersecurity requirements are driving suppliers and contractors to dedicate time, money, and other resources to strengthen their cybersecurity strategy to meet compliance. Depending on the company’s existing cybersecurity posture, some will have much more work to do than others, and they will all need professional guidance.

It’s no surprise that the market has been recently flooded with consulting firms claiming to be experts in CMMC compliance requirements. Keep in mind that not all third-party consultancies are created equal. As a small business, we understand how important it is to properly vet vendors, and make sure you’re getting the most out of every dollar you assign to projects like these.

The CMMC Accreditation Body (CMMC-AB) has introduced five certifications and authorizations to differentiate entities offering CMMC compliance services. These are:

Certified Third-Party Assessor Organizations (C3PAO)
Registered Provider Organizations (RPO)
Registered Practitioners (RP)
Certified Professionals (CP)
Certified Assessors (CA)

We’re happy to provide some details regarding the RPO authorization, and what is involved.

RPOs like The Greentree Group are authorized by the CMMC AB to provide consulting services to government contractors and other companies in preparation for their CMMC assessments. We can also assist during these assessments if there is a finding that will prevent you from attaining your desired CMMC maturity level. However, we do not conduct certification assessments, and we do not grant certified status. Only C3PAOs are equipped to conduct these certification assessments. As an RPO, we are here to provide CMMC guidance and support to companies impacted by these new regulations. It’s important to remember that C3PAOs cannot provide guidance unless they’re also certified as an RPO – and even then, they cannot offer the same services (assessment + guidance) to the same company.

WHAT GOES INTO BECOMING AN RPO

A company must do the following to become certified as a CMMC RPO:

Be an entity owned by a “US person”.
Be registered with the CMMC-AB in order to receive authorization to use the official logo distributed by the CMMC-AB.
Sign an RPO agreement, reflecting a commitment to comply with the CMMC-AB Code of Professional Conduct.
Clear an organizational background check.
Have at least one Registered Practitioner (RP) on their team. An RP is specially trained and authorized by the CMMC-AB to deliver “non-certified advisory services informed by basic training on the CMMC standard” at all times.
Pay an annual registration fee.

These requirements put in place by the CMMC-AB are helpful for companies seeking certification because they provide a measure of legitimacy. As with any new regulations or rules, there will be many companies claiming to be experts in the field, and competing for your business. By selecting a company that has attained its RPO authorization, businesses can be confident that their choice is well suited for the job and committed to CMMC standards.

CHOOSING THE RIGHT CMMC RPO FOR YOUR COMPANY

RPO authorization is an important consideration when choosing a provider- but there are other things you should keep in mind. Other important questions you may want to ask –

How much experience does the RPO have in cybersecurity and maintaining compliance in highly regulated spaces?
- The Greentree Group has supported both DoD programs and DIB clients with obtaining and maintaining required cybersecurity compliance for over a decade

Do they have experience with other frameworks such as CIS CSC, NIST SP 800-53, NIST SP 800-171, and ISO 27001?
- Greentree has cybersecurity experts for the cybersecurity framework you require

How knowledgeable are they about the defense contracting environment?
- Greentree’s cybersecurity team has a combined 50+ years of defense contracting experience

How many years have they been in business? Are they well-established?
- The Greentree Group has been in business for 26 years with an established reputation for excellence in customer support

How easy is it for the provider to scale efforts appropriate to your business?
- We support clients of all different sizes and architectures, as your business grows our support for your cybersecurity needs can grow with you

Note: Back To Business I.T. is a service brand of The Greentree Group.

WHY IS THE RPO AUTHORIZATION IMPORTANT FOR YOUR BUSINESS?

The new CMMC-AB authorization process for RPOs is an effective way for companies to sift through the increasing chatter in the CMMC consultancy space. The RPO certification signals that a consulting firm is invested in the CMMC space, and has committed to cybersecurity best practices. By visiting the CMMC marketplace, companies can look for certified RPOs in their area and reach out on their own terms.

We are authorized by the CMMC-AB as an RPO, and ready to guide your business along in the CMMC journey. Are you ready to learn more? Fill out this form and one of our cybersecurity experts will be happy to provide more information about CMMC compliance.

The Greentree Group is a CMMC Registered Provider Organization (RPO)

We are now a Cybersecurity Maturity Model Certification (CMMC) Registered Provider Organization (RPO) authorized by the CMMC-AB.

This new achievement solidifies our position as a leader in CMMC compliance solutions and services meant to protect government data in defense contractor systems. According to the National Accreditation Board, CMMC-AB is an independent accreditation body “responsible for establishing, managing, controlling, and administering the CMMC assessment, certification, training, and accreditation processes for the Department of Defense (DoD) supply chain.” Our new Registered Provider Organization (RPO) status reflects our commitment to the CMMC Accreditation Body (AB) code of professional conduct. It allows our company to provide advice, recommendations, and consultation to our customers as they seek their own CMMC-AB certifications.

Since 1993, The Greentree Group has been providing comprehensive professional services and technology solutions to small and medium-sized organizations, including:

Cybersecurity solutions
I.T. Support
Cloud Solutions
Technology Strategy

We offer a suite of comprehensive business technology services to include solutions which support Cybersecurity Maturity Model Certification (CMMC) compliance. Our team of cybersecurity experts assist defense contractors in becoming CMMC audit ready by implementing technical solutions and developing documentation and policies required by CMMC. In addition, we provide options for ongoing services to maintain compliance after certification.

CMMC SUPPORTS IT MODERNIZATION AND SUPPLY CHAIN SECURITY

CMMC is a new cybersecurity compliance standard that will be required for contractors to bid and win DoD contracts. The Defense Federal Acquisition Regulation interim rule took effect on November 30, 2020 and initial assessments are expected to begin in calendar year 2021.

CMMC-AB authorized RPOs provide advice, consulting, and recommendations to their clients. They are the implementers and consultants, but do not conduct Certified Assessments. They understand the CMMC Standard, and are qualified as:

Aware – Employs staff trained in basic CMMC methodology
Registered Practitioner Staffed – Offers CMMC trained consultative services
Targeted – CMMC assessment preparation
Trusted – Bound by a professional code of conduct

View our listing on the CMMC-AB Marketplace!

Ready to learn more? Our team of cybersecurity professionals would be happy to provide more details about the CMMC requirements, and what they mean for your business. Contact us today!

7 Cybersecurity Tips for SMBs

7 cybersecurity tips for small and medium-sized businesses (SMBs), brought to you by Back To Business I.T.

Antivirus and Filters

Scanning your systems regularly to detect malware and potential vulnerabilities should be at the top of the list when it comes to cybersecurity measures. Putting web and email filters in place can help block nefarious traffic and messages from ever reaching your systems.

Restrict Access

Along the same lines of defense as Antivirus and Filters, use restrictions to limit staff access. The same way you restrict departmental access depending on where a person works, it’s a good idea to implement internet restrictions. This way employees are limited to the websites they can access on company computers – and thus lessen the risk that they’ll wander into some dark alley on the internet.

Train Your Staff

One of the biggest cybersecurity risks any company faces is its people. To err is human, right? And err we do. Phishing emails are the most common cyberattack, and how over 90% of successful breaches begin. Educate your staff on best cybersecurity practices. Our cybersecurity awareness training offers not only educational materials, but simulated training exercises to test employees’ preparedness in a safe sandbox environment. Contact us to learn more.

Step Up Your Authentication Game

Setting up multi-factor authentication means that system access has a two-layer protection. Requiring both a password and a pin, for example, will likely reduce your risk of unauthorized access. Much like having biometric and pin or pattern access on your phone protects your data from prying eyes – two-factor authentication on your systems can keep your data safer.

Patch and Update, Faithfully

Clicking that ‘update later’ button is usually a bad idea. Updates ensure your system has the latest information on potential vulnerabilities. Patching does just that – patches certain ‘holes’ or fixes bugs in the system. This is part of why it’s critical to use up to date hardware/software – so you can be sure the manufacturer is working constantly to keep it as secure as possible.

Back Up Your Data

In the case of a breach, having your data backed up can make the difference between paying the ransom or not. Cybercrime isn’t the only reason to back up your data though – as other events can affect system functionality and disrupt your business. In the context of cybersecurity, it can give you the upper hand. If your data is securely backed up, there’s usually less down time in the event of an attack.

Have a Cybersecurity Policy in Place

All the good intention in the world won’t take the place of a solid information security policy. Make sure your staff is aware of the processes and best practices for cybersecurity in your company. You’ve worked hard for your business, protect its future.

Here at Back To Business I.T., we’re a business too. We have the same concerns and face the same challenges. Our customizable solutions are meant to change as your business grows – fitting your needs, and your budget. Take your business to the next level with a technology partner you can trust. Contact us today!

Managing Your Digital Presence by Updating Privacy Settings

Do you still have a MySpace, or a Xanga? There are probably a few accounts out there that you no longer use – and probably didn’t remember you had. But they are still part of your digital presence and should be monitored. How do these old accounts pose a cybersecurity threat?

Easy Targets: Well, old accounts usually have outdated privacy settings. That means cyber-criminals could be using your personal information to build a social-engineering profile for you, making it easier to target you in phishing or spear phishing attacks. If they have info on your subscriptions, memberships, likes, affiliations, etc. they can make their phishing bait emails much more believable.

Data Leaks: Let’s say your privacy settings on those old accounts are locked down tight. How robust is that website’s security? How easy is it for cyber-thieves to break in and steal it? Chances are, websites or services that aren’t widely used anymore aren’t going to have the most up to date information security measures in place. Do you really want to risk it?

Optics: Another reason to clean up your old accounts may be simply to moderate the content that’s out there. As we all know, the internet is forever. When we post a comment, publish an article, or share a photo, our name is tied to that media until we delete it. Do you have accounts with NSFW photos, comments, or content? A quick search on any search engine should reveal content tied to your digital identity. Is there something you don’t want shared?

So go ahead, take a stroll down your memory lane on the internet and see what you find. Deactivate accounts you no longer need, manage old content and how it’s shared, and enjoy the peace of mind.