Securing your Browser.

With the security issues involving your web browser these days, such as drive-by downloads, and other malicious attacks, it is important to do as much as you can to secure your browser. One thing that can be done, to help block a common avenue of attack, is to install a JavaScript blocker.

While it used to be that one could disable JavaScript, so many sites these days rely on it, that disabling it is no longer feasible. By using a blocker, one can selectively enable JavaScript only where needed. The methodology is to install the blocker, which normally disables JavaScript at all sites. Of course, you then start seeing sites that are not functioning properly due to JavaScript blocking. When that happens, you can enable JavaScript only for that site. Or, more to the point, only for the scripts on that site that are required. You will be surprised at the number of JavaScripts that many sites run, which are not directly related to what that site is doing.

A site may be running 10, 15, 20, or more, JavaScripts, of which only one or two may need to be enabled to get the site functioning. The rest are feeding your data to ad sites, and other data trackers, all without informing you.

Adding a JavaScript blocker to your browser varies by the browser you use. You may find it by looking at the available plugins for your specific web browser, or you may need to use a search engine to find one that works for your browser. It is worth it to spend a bit of time searching out, and implementing, a blocker. Once you get used to it, it only takes a few seconds to grant the needed functions on a web site, while leaving non-essential scripting blocked.

Dave.

Administrative access is often Overused.

Administrative access, root access in the Linux world, is often overused. For the most part, these super-user level logins should only be used for system setup and administration, and not for everyday use.

Most of the packages that allow remote access, at least in the Linux world, such as ssh and Samba, do not allow the root account to be used by default. While they can be configured to allow access for the root account, they require that it specifically be setup to do so. While it may be tempting to set them up, it should be considered whether or not it is needed. There are very few cases where such a need can be justified.

In the majority of cases, it is better to leave root access disabled. Of course, access for regular users should be thought out and implemented only where needed. When root access is needed in the Linux world, it can usually be handled with much finer control via such things as sudo. For example, the ability to do a system shutdown can be granted to specific users through sudo (sudo shutdown), without giving them access to other superuser level functions.

While the sudo approach takes a little time for planning and implementation, it is much more secure. Far better to spend a little time, than have to recover from a user mistake where they have unlimited access. Or, a malicious, disgruntled employee, which we all hope never happens.

Dave.

Social Media is used by Bad Actors also.

The rise in social media, often means that you have to take part, to a degree, to help your business grow and prosper. Most businesses have at least some social media presence. It is another method to promote your business, by at least making others aware that it exists. Many of you, I am sure, take a more aggressive approach using social media to promote your business actively.

One thing to keep in mind, however, is that social media is used by the bad actors, also. It is quite common, for them to try to “connect” with a business, often by sending “friend” requests. Accepting such requests should not be the automatic process that many use. By that, I mean that they accept any, and all, such requests.

There have been many cases where “friend” requests on sites such as Facebook, and LinkedIn was not from people wishing to support your business. Requests were used for more nefarious purposes. They may be trying to use the status of your “friend” to get access to other information, such as who else is on your friend’s list.

There have been cases, also, of using those that have accepted friend requests to leverage their position. By that, I mean that they use those on their friend list, to bolster their position when contacting others, by claiming to have contact sources (or influence) with you or your business. Think of the implications of someone saying “As you can see, I know the CEO of XYZ company, and they said…”, and they can then claim whatever they want.

Like many other things, a little time, and thought should go into your social media presence, like any other aspect of your business.

Dave.

Counterpoint Performance Tuning

The performance of your Counterpoint can usually be helped, with some tuning of the SQL server. Among the items that can impact performance, are memory allocation, file settings, indexing, and statistics.

When the SQL server is installed, the setting for memory is to be dynamically allocated, and the upper limit is way beyond the amount of memory you have in your machine. Left this way, memory swapping can occur. The upper limit should be reduced to a realistic level, at a minimum. Ideally, the lower and upper values are the same, so that no dynamic allocation occurs, which reduces overhead.

The file growth setting can have a significant impact at times.
Particularly during posting in various places, when large numbers of records are being created. When file growth does need to occur, it is better to allocate a significant new amount, rather than continually adding small amounts.

Finally, over time, as records are added and updated in a table, SQL server will eventually stop using indexes and start doing large sequential reads. This greatly affects performance! Performance can be restored by rebuilding indexes and updating statistics.

We would be happy to help you adjust your SQL server settings, to get the best performance from your system.

Dave.

Securing Your Network

Securing Your Network

One of the things that you should do in securing your network, is to limit internet access to only the sites that a particular station needs. For example, a Point-Of-Sale workstation usually only needs to be able to access the internet in order to validate credit and debit transactions. When that is the case, then your firewall should be configured to only let those stations through to the sites they need for authorization.

By limiting the access of those stations to only the card processor site, it prevents users from randomly browsing web sites during slow times. Thus, they cannot be checking their personal email or checking out the latest funny videos. This is not to punish them, but rather to eliminate those common vectors of attack. It prevents those viruses and malware-bearing emails from being read, and their payload potentially being unleashed on your workstations. It also prevents those drive-by downloads from malicious sites, from doing the same.

Obviously, there will be stations that need to access additional sites. However, if these sites can reasonably be limited to just those sites that need to be accessed, they should similarly be limited. It may be possible to limit those stations to only your company email, vendor sites, your store web site, etc. Additionally, those stations should be restricted to use by only those users that need to be accessing the sites that the stations are being allowed access to. Those users should also be trained on what to be aware of when accessing outside sites. In particular, the user or users that are accessing the company email should be trained on how to recognize potential phishing, or other malware, type emails.

Limiting the avenues that expose your network to outside contact, can go a long way towards preventing the network from being compromised. Such limits are often evaluated from the perspective of limiting outside access in. Access restrictions should be evaluated, and restrictions imposed from your network out, as well.

Dave.

Granting Administrator Privileges to users

Granting Administrator Privileges

Granting administrator privileges to users is one thing that I often see, that is done much more than it should be. The reason given is this simplifies those occasions when software needs to be installed or updated. However, in general, this is a bad practice.

The simplification of installing legitimate software will be exploited if you are ever the victim of malware or viruses. Since the user that the infection uses already has administrator privileges, the malware does not need to find anything to exploit for it to have access to your entire system. If the malware already has inherited the privilege from the user login and can wreak whatever havoc is in its payload.

On the other hand, if the user is given basic user privileges, and the malware is unable to find any way to exploit the system to increase its privileges, then the damage is contained to what the captured user can modify. While that is still upsetting, having to restore some documents, and change user settings is more desirable than having the entire computer system corrupted and compromised. Not to mention, the potential effect on other computers on your network, if administrator-level privileges can be leveraged against them.

With properly set permissions, users can do everything that they need, without elevated privileges. It can take some extra time to setup the appropriate permissions, but not nearly the time that it takes to recover from a malware attack that could have been limited in scope by a simple restriction of administrator level privileges.

Dave

Signs Your System Has Been Compromised

Signs Your System Has Been Compromised

Users need to be on the alert for signs that your system has been compromised. Let us look at some of the signs. One that often occurs is that icons on the desktop have been moved, or new icons have appeared. If new icons have appeared, and no software has been installed, as far as is known, it is a red flag that the system has been compromised.

Hackers will often install new software when they gain access to a system, to give them further control, or the ability to gather additional information from the system. Most times, there is no obvious trace of this additional software, but many times they are sloppy, and those surprising new icons are an indication.

Icons being moved is often also an indication. This is often due to the hacker going through and clearing those new icons. However, those icons moved some of your old icons when they were installed, and the hacker does not know exactly where the old icons were on the desktop. Or, the icons were subsequently auto-arranged, and are thus not in the location on the desktop that users had moved them to.

Another big indicator is that your system suddenly slows down. The screen may lag when you are typing, or processes that used to take a second or two, now take many seconds, to even minutes. This is due to the system having an increased load, due to the additional software that has been installed, and what it is doing to steal information or use the computing power for other nefarious activity, such as cryptocurrency mining. Cryptocurrency mining is using computing power to unlock cyber currency, such as Bitcoin. This takes a great deal of computing power, cybercriminals are farming this activity out to compromised systems, rather than using their own.

Basically, be alert to any change in the way that your system looks, or responds. While it may be due to legitimate changes, often it is a sign that unwanted people have gained access to your system.

CCS provides IDS products.  Contact our Sales Department to discuss the right solution for your operations.

Dave.

The threat of Attack on Point-Of-Sale (POS) systems

The threat of Attack on Point-Of-Sale (POS) systems

In the retail world, the threat of attack on Point-Of-Sale (POS) systems is always high, as they are a prime target for the bad actors trying to get credit card information. There is always new malware being created to try to get that information. There are, however, steps that can be taken to reduce the risk, even with regards to the latest attack software.

The best thing that you can do is to isolate your servers and workstations as much as possible. In an ideal world, these would be completely isolated, and not interact with any other systems. The reality is that this is very rarely the case. With that in mind, let’s look at some things that can be done.

The first step is to make sure that your firewall is as restrictive as possible. Your POS workstations and server if needed should only be restricted to accessing what is absolutely needed. In most cases, this is only your credit card processor. In no case, should your firewall allow either the workstations or the server, unrestricted access to the internet? The firewall will eliminate the chance for drive-by downloads, or users browsing to malicious sites.

Along those lines, any computers that are used for general internet browsing, and also email, should be on a separate network. If it is not possible to implement workstations on a separate physical network, at least use a different logical network as in a different network address range. Even just the different logical network, will stop the majority of malware infections.

If remote access is needed, and it should be restricted to those cases where it truly is needed such as your support company, then it should be restricted to only those addresses that have a legitimate reason to connect. Also, any such connections should be closely monitored. One such method is to disable the remote access software, and only enable it when your support personnel is actively connecting. Of course, it is again disabled as soon as they are finished.

Those cover the basics of securing your POS system. It is a good place to start, but it is only a start. Keeping software updated, training personnel, and keeping vigilant are always key components, also.

Dave

Keeping Systems up-to-date

Keeping Systems up-to-date.

Everyone should know the importance of keeping your operating system, and software, up-to-date. Even with the amount of information on the subject, there are still many that allow this task to slide for excessively long periods of time. That is a very, very, bad thing to do, given the volume of malicious software that we are constantly bombarded with.

While I am not personally a fan of automatic updates, that is a far better choice than not installing updates at all. If you find that you are not taking the time to apply the patches and updates, then, by all means, configure automatic updates, and let the system do it for you.

While automatic updates involve an amount of risk, it is much less than the risk run by not having current fixes and patches applied. My preference is to periodically (and frequently) manually install the updates. Manually installing allows me to check for known issues regarding those updates, and make the decision to install a particular patch, or not. This approach does take some dedication on your part, though, and as such is not for everyone.

Whichever method you choose, be sure that your systems are updated with the current patches and fixes. Otherwise, you are running the very big risk of waking up to a nasty situation, in which your computers have been compromised, or are being held for ransom.

Dave.

Testing Updates and Changes

Testing updates and Changes.

With the recent changes in requirements for credit card processors, NCR Retail Online going away, and others, there are a large number of people going through updates and changes. Many of these changes are quite significant. With that in mind, a word about testing those changes is in order.

The most common thing that I see is a lack of sufficient testing. For example, if you are changing your web store provider, there will be changes in how orders flow in and out of your ticketing system. It is not enough to test that orders come into your system. You also need to check that you can process those orders. It does not do any good to receive orders, and then not be able to process and complete them. The testing process needs to incorporate all aspects of the workflow.

  • Does the order come in with the correct information?
  • How about taxes?
  • Are the tax amounts correct when appropriate?
  • How about when taxes do not apply so that there is a zero
  • tax amount?

Those are all important, but that is just the beginning.

If that information is importing correctly, what about going forward.

You should test printing picking tickets, generating invoices, and everything all the way through posting those invoices. When that all goes through without a hitch, there is still more to do. Test canceling orders, and partial shipments. If you ever edit orders to add or remove lines, change a line quantity, or anything else, then those functions need to be tested also.

It takes some time and needs to be included in your schedule for everything else, but the more time spent testing changes and updates ahead of time, the smoother it will be when it comes time to implement those changes in your live system.

Dave