News

Microsoft has acted quickly in response to the recent WannaCrypt ransomware attack that has seen massive global infections and disruption to critical healthcare services.

If you have any concerns about your business systems or are unsure about how or if this might impact you, Cactus IT are offering a free backup audit* that you are welcome to contact us about.

Engineers at the company have been working through the weekend to better understand the virus and also to release a security patch for the retired Windows XP and Windows Server 2003 products.

The Windows XP and Server 2003 operating systems went end of life in 2014 but are still used in production in many organisations. No security updates have been made publicly available since 2014, but this large scale attack on a known vulnerability has seen a quick response. Microsoft released a security patch earlier this year that patched the vulnerability for Windows Vista, Windows 7, Windows 8 and Windows 8.1. Please run windows updates as soon as possible to make sure that the March update has been installed. The recent attack is reported to not be targeting the Windows 10 operating system.

If you are still using Windows XP or Windows Server 2003 and would like assistance in migrating over to new and fully supported operating system, please contact us at Cactus IT to discuss a migration strategy.

For additional information on this ransomware attack, and to download the Windows XP and Server 2003 patches, please refer to this article from Microsoft: Customer guidance article 

• Our free backup audit is for an hour of our time and is available for businesses in Yorkshire and surrounding areas- please contact us for more information

Will GDPR impact on your data residency requirements? 

Are you part of a United Kingdom business that subscribes to Microsoft Office 365 services? You may also have regulatory compliance’s that require your data to be kept within the United Kingdom?

If that is the case, then Microsoft now offers the option to relocate your data, but you need to act before the deadline of the 15th of September 2017.

EMEA (Europe, Middle East and Africa) Microsoft customers who subscribed for Office 365 services before the 2nd of September 2016 will have had their tenants created in EMEA and/or UK datacentres.

Microsoft services that can be relocated to the UK, currently include Exchange Online Mailbox Content (e-mail body, calendar entries, and the content of email attachments) and SharePoint Online site content and the files stored within that site, including Project Online and Access Online content.

Once relocated, Microsoft will not replicate the data outside of your region (the United Kingdom has its own region).

But there are some downsides to the move

Because moving mailboxes takes time, it is likely that you will have users with mailboxes in different regions at the same time. Some features involving accessing multiple mailboxes, won’t fully work during the move and some features like accessing shared calendars may only work in Outlook Web App. You will also have little control over when the move happens.. Anytime until 24 months after the request!

In summary, I would suggest that you only move if you have to. I would also suggest that if your organisation is small with less than 50 mailboxes, you should also consider creating a new tenant in the region of your choice and moving your own resources at a time that is suitable for your business.

Here are a few useful links that I have found relating to this:

Office 365 data centre locations:

https://o365datacentermap.azurewebsites.net

How to request a data move:

https://msdn.microsoft.com/en-us/library/dn879433.aspx

What to expect during and after the move:

https://msdn.microsoft.com/en-us/library/dn879434.aspx

If you need assistance relocating your data or assessing your needs, please contact us at Cactus IT where we would be happy to advise.

statement after receiving a demand for ransom from a group calling itself “Turkish Crime Family”. The $75 000 cryptocurrency (like Bitcoin) needs to be paid by Apple before the groups deadline of the 7th of April. The group claims to have access to nearly 600 million Apple email and iCloud accounts. Having this information could not only give them access to data, but they are threatening to remote wipe millions of iPhone’s.

Apple have responded to say

The News/Media website “Motherboard” contacted Apple who responded in an email:

“There have not been any breaches in any of Apple’s systems including iCloud and Apple ID. The alleged list of email addresses and passwords appears to have been obtained from previously compromised third-party services.
We’re actively monitoring to prevent unauthorised access to user accounts and are working with law enforcement to identify the criminals involved. To protect against these type of attacks, we always recommend that users always use strong passwords, not use those same passwords across sites and turn on two-factor authentication.”

So no breach at Apple, but an admission that account information may have been obtained from other sources.

Cactus IT recommends you take the following action

Passwords: At the very least, you should review your current password for your Apple account to make sure it is secure and not used across multiple sites. Take a look at our previous Blog for help and advice with that.

Two-factor authentication: This is where you still use your secure Apple password, but have another layer of security to ensure that you are the only person with access to your account. Take a look at this article from Apple for instructions on setting that up.

What we know

If you are in business, you will have looked to your IT department for help and advice on passwords. After all, your password is the key to your digital life and with it comes all of the intellectual property, documentation and wealth that you have accumulated over the years.

It is true to say that long, complicated passwords like “jv[G&)A#V7Py” are the safest to use and take the longest amount of time to crack. That is why your IT team recommend that you use these types of passwords, they have covered themselves by passing on this advice.

Whats the problem?

How on earth are we supposed to remember these ridiculously long and complicated passwords?

This has resulted in a trend where we are using predictable, everyday words like “football” and making a few obvious changes to turn them into a “compliant” password like “F00tbal!”. It’s easy to remember this password and it meets the requirements set out by my IT department… so it must be safe?

WRONG! The reason why this is not secure is because it is predictable. Substituting numbers or characters for common letters is a common trend that hackers are well aware of.

How can I fix this problem?

As we wait for the mainstream arrival of Biometric methods of authentication along with the wider adoption of Multi-factor authentication or Single sign-on, there is an another way of creating secure passwords that we can actually remember.

We should be adopting passwords that are random, long and complicated… but easy for US to remember and adapt for multiple uses.
• Sentences like this one that includes an emoji and punctuation “My first postcode was LS29 ABC, on 201 Fake Street :-)”
• or passphrases like “Rainbow shoes Computer marmite” with four or more words that are completely unrelated so as not to form a sentence

Try not to use the same passphrase or sentence multiple times, rather adapt it slightly to suite the use- “Rainbow shoes Computer marmite” for your PC, “Rainbow shoes Bank marmite” for your online account.

I would also suggest using a password manager like https://www.dashlane.com that can help maintain that ever increasing list of digital identities that more and more of us seem to be collecting. It has it’s limitations and while it can very easily create secure random passwords for you, they are almost impossible to remember and so not always practical.

As I work in IT….. and this is a document on advice for a secure password policy, I reserve the right to update this article at anytime and do another “U-Turn”!

Credit to XKCD for the image