MSPNetworks Blog

Would you feel safe staying at a hotel that, instead of unique locks, each door used the same key as all of the others? Probably not—because if someone got in, they could take whatever they wanted. That’s similar to how old-school cybersecurity worked. Once someone got into a company’s network, they could access almost everything, making it easy for hackers to steal information. But today, many businesses use a better security framework called zero-trust security. In today’s blog, we discuss what zero-trust security is and why it’s safer.

A business’ compliance with the regulations it operates under is a huge issue that many inside your organization won’t understand but has to draw some attention. Let’s look at some of the variables that go into compliance to outline just how important it is.

Your business is likely subject to certain compliance laws and regulations depending on the type of data you collect from your clients or customers. Today, we want to emphasize the importance of your business considering regulation and compliance when managing its data and IT resources, as without doing so, you run considerable risk.

While the word “audit” can easily be a scary thought for businesses, there are certain cases where an audit serves an organization’s direct benefit. Take, for instance, the ones that occur internally to identify and correct security issues and vulnerabilities. These audits are not only a positive endeavor for businesses; they’re extremely important to carry out.

Let’s talk about why this is and review a few standard practices you should prioritize as you go about this process.

Despite what detractors say, regulations are in place for good reason. They typically protect individuals from organizational malfeasance. Many of these regulations are actual laws passed by a governing body and cover the entire spectrum of the issue, not just the data involved. The ones that have data protection regulations written into them mostly deal with the handling and protection of sensitive information. For organizations that work in industries covered by these regulations there are very visible costs that go into compliance. Today, we look at the costs incurred by these organizations as a result of these regulations, and how to ascertain how they affect your business.

Perhaps predictably, the word “insure” has roots that tie it closely to “ensure,” as it is meant to ensure a level of security after some form of loss. Nowadays, that loss often pertains to data, making cyber insurance an extremely valuable investment for the modern business to make.

However, in order to obtain this kind of insurance, businesses commonly need to meet some basic requirements. Let’s go over some of these requirements now.

What Are Insurance Providers Looking for to Approve Cyber Insurance?

It’s important that your business is not only meeting the requirements that an insurance provider expects from you, but that you also have it fully documented. This helps make it easier for everyone to stay on the same page, as well as to evaluate how prepared the business is to protect its data. What follows are some of the preparations that many insurance providers expect to see from businesses seeking coverage.

Multi-Factor Authentication Protecting Email (at a Minimum)

It should come as no surprise that email is a major target for cybercriminal activity. It’s popular, it’s convenient, and—as countless attacks have proven—it works. If a cybercriminal manages to gain access to a target’s email account, they effectively have the keys to the castle, as any accounts tied to that email can then be altered and adjusted.

This is what makes it so important that if you have multi-factor authentication protecting anything, your email is a good candidate… although, we recommend that it’s implemented wherever it is available. Multi-factor authentication reinforces your security by adding additional requirements to a login process before access will be granted, ideally by also requiring a user to confirm their identity, often through a secondary key or by providing a generated code or biometric proof.

The long and the short of it is that MFA is a very effective means of eliminating unauthorized access, which is something that insurance providers want to see before they offer coverage.

Testing and Training for Cybersecurity Awareness

On a related note, insurance providers want to see staff engagement where a business’ cybersecurity is involved. After all, all the protection in the world won’t matter if one of your team members leaves the door open or allows an attacker in. This makes it critical that your team knows about the threats they face and—crucially—how to appropriately identify and react to these threats as they encounter them.

Due to the evolving nature of cybercrime, this needs to be an ongoing process. You should be regularly evaluating your employees with and without warning, providing immediate education to anyone who misses one of your simulated threats. Your potential insurance provider will likely want to see documented proof that these steps exist and are enforced as they consider your application.

Incident Response, Backup and Disaster Recovery, and Similar Defenses

In order for these policies to stay profitable, insurance companies will want to see that every precaution has been put in place. After all, the less likely a policyholder is to suffer the damages that their policy covers, the less likely it is that the insurer will have to issue a reimbursement payment. As a result, insurance providers like to see that businesses are as prepared as possible, so they don’t just want to see preventative measures, but mitigations as well.

Therefore, your insurance provider is going to want to see everything you have in place as a part of your incident response plan. They’ll want to see that your backups are situated and updated appropriately, they’ll want to see established processes and systems, and they’ll want to see that you have different people assigned to carry these processes and systems out.

Applicable Compliance Gap Assessments

Chances are pretty good that you process credit card information as part of your business operations in some shape or form. This means that you presumably need to align to the Payment Card Industry Data Security Standard (PCI DSS), which dictates what businesses need to do to protect the information of their cardholding customers. A gap assessment is a process that helps you identify anywhere that you fall short of true compliance, allowing you to more effectively resolve these issues to reach the standards expected. Because of this, insurance providers will want to see the results of your gap assessments and documentation of any steps that you’ve taken to fix the issues present regarding any applicable compliance requirements.

We can help you maintain the standards that an insurance company will be looking for to approve your business for cyber insurance coverage. Learn more about our managed IT services by giving us a call at (516) 403-9001.

When I was a kid, there was a Tex Avery cartoon where Droopy Dog was chasing down a crook who escaped from jail. There was a particular scene where the crook (I think it was a wolf in a black-and-white striped jumpsuit) takes a bus, a plane, a ship, and a taxi to a secluded cabin, and then closes a series of increasingly complex doors with a large number of locks, in order to hide away from the pursuing cartoon basset hound. 

Of course, when he turns around, exhausted by all the effort he puts in, he realizes that Droopy is standing right behind him, and greets him with a monotone “hello.”

I haven’t seen this cartoon since I was 7 years old, but I almost always think about it when I am using multi-factor authentication. 

Does Cybersecurity Feel Like It’s a Lot of Effort?

Strong complex passwords, multi-factor authentication, complex policies and rules, and not always feeling like you have total access to everything you need at any given time certainly can feel like a hurdle when it comes to getting stuff done.

Believe me, I get it. As a tech head, I love how secure my information can get, but as a business owner, as a person who just needs to get things done, it really can be just frustrating enough to make it feel like it isn’t worth it.

I’ll never stop advocating it though.

Sometimes, in my head, I might grumble and think to myself—this is stupid, I’m just trying to get into my Facebook account. But then I think, through my Facebook account, I have all of my contacts, many of which are people I do business with. I also own my business page, and a couple of groups that I rely on for networking, and my ads account, which has my business credit card…

You get the idea. It’s just Facebook, but it’s so wrapped around my life that if someone else were to get in there, it could get really messy and complicated.

The same goes for email accounts, bank accounts, and software that stores sensitive information for myself and my business. Basically, anything that you can lock down with multi-factor authentication, you really should, and your employees should all be doing the same.

The Password Just Isn’t as Secure as It Used to Be

Somewhere early on, when the world was figuring out what to do with computers and the Internet, a bunch of folks got together and decided that the password would be the ultimate authentication tool. You just type in your magic words, “open sesame!” and yep, that’s definitely you and can’t possibly be anyone else!

It wasn’t a bad idea back before we were doing banking and storing medical records and other sensitive information online, and before we were using online tools and databases to store tons and tons of client information about people besides just ourselves.

But the password just isn’t that secure. They are easy to crack, and it’s so easy to be lazy about them to the point where they don’t even offer any protection at all. A 12-character password can be cracked with password-cracking software on your average laptop in less than 14 hours, and that time could be much shorter if your password isn’t all that complex.

Plus everyone has the tendency to reuse passwords or establish a predictable pattern in their password-making behaviors… it’s a mess. It’s not a good way to rely on security.

That’s why we have things like multi-factor authentication. Yes, it adds an extra step and can be a little annoying, but it can be streamlined. Here are some tips.

How to Optimize Your Multi-Factor Authentication

• Try to stick to just one single authentication app, preferably one that can be backed up and synced between devices. Give us a call at (516) 403-9001 to help you pick one that works for you.
• Label your accounts in the app clearly, and try to organize them if you can.
• In your password manager, note how the multi-factor authentication works. If it has to come through SMS or email, it might feel a little more efficient if you noted that for yourself so you were prepared as you were logging in.
• Go into current accounts and check to see what your security settings allow you to do. When possible, use the authentication app so you aren’t relying on authentication information coming in from all different directions.

Cybersecurity is complicated, and it can feel like an overwhelming hurdle, but we can help you and your business use it effectively. It is important, and it is something that we should all be using as often as possible.

To get help, give us a call at (516) 403-9001.

Cybersecurity is important. Scroll through a few pages of our blog and you’ll see article after article talking about threats and ways to make yourself and your business less vulnerable to cyberthreats. As an IT professional, however, I’d be so much happier if the state of the world didn’t require such a massive effort just to protect oneself and we could just talk about cool stuff you can do with modern technology all the time!

But alas, strong cybersecurity is crucial to virtually any organization, and it’s becoming even more important by the month.

You Can’t Flub Your Cybersecurity Awareness

Cybersecurity is something that you can’t just ignore. It’s not going to ignore you—cybercriminals target the people who think they aren’t a target in the first place.

Most businesses these days have at least some level of cybersecurity-based compliance regulations to meet and follow. Some can come from the state, some can come from the industry you are in, some apply based on the type of information you work with, and some can come directly from your business insurance provider. 

One of the biggest mistakes I see business owners and C-levels make is that they have overconfidence in their own cybersecurity. Most business owners are the least secure people I know (and I don’t mean that in an insulting way; CEOs and entrepreneurs, in general, are just wired to be efficient, and cybersecurity practices can feel like a big roadblock to efficiency.)

Heck, I lose sleep at night when I suspect that the owner of a company we work with refuses to use multi-factor authentication, but I catch myself longing to turn that feature off because of the extra couple of seconds it adds to getting into an account every day. 

The point is, even as a leader, you can’t skimp on security. In fact, you should be the shining example of it in your organization.

You Have to Know If You Are Compliant or Not

Depending on the regulations your organization needs to meet, you likely have a laundry list of tasks to check off quarterly or yearly. For many organizations, a part of that might include a regular penetration test.

A penetration test is a very specific set of tasks that involve an ethical hacker attempting to break into your business network using a variety of different ways. 

There are multiple phases that include reconnaissance, scanning for vulnerabilities and other weaknesses, getting in and attempting to steal, change or delete data, staying within the network undetected for a period of time, and looking for non-technical ways to exploit your organization, such as social engineering.

It’s not a small feat, and it’s far from the typical quick network audit or port sniffer scan and things that a technician might do to solve a problem or investigate an issue.

Don’t confuse the small stuff with a penetration test. I’ve talked to business owners in the past who were convinced their network was secure because a third-party ran some network audit tools that came back with devices that were out of date and fixed them. While that’s important to do, and something we do regularly, and maintain for our clients, it’s a long way from an actual penetration test.

Let’s Make Sense of Your Cybersecurity, Together

Protecting your business from modern-day threats and meeting regulatory requirements is a challenge if you try to do it by yourself. Let MSPNetworks be your trusted IT partner and keep your business operating smoothly. Get started today by calling (516) 403-9001.

Cloud computing is a major growth industry as businesses and individuals look to use the computing strategy to either save money or get resources that they would typically not be able to commit to. With cloud computing becoming more and more integrated into business each year, it stands to reason that the once Wild West of cloud computing would start to see a lot more regulation. This week, we’ll take a look at how the cloud is regulated and what to expect out of cloud regulation down the road. 

The Wild West

The cloud has been growing for years. Currently it is a $450+ billion market that is growing at over 13 percent annually. That’s a massive increase. All this tells you is that it is quickly becoming the priority computing model for businesses and individuals of all types and sizes. This rapid growth has started to gain the attention of lawmakers who are looking to rein in the growing power technology companies are accruing. 

Recent events have made this relationship even more tenuous. The cloud, for all of its benefits, has had a checkered security history; and due to the reliance that organizations have on cloud computing, it has perked the ears of regulators that expect that these computing structures be extremely secure; a problem that has long been identified by IT security experts.

Cloud Security

The current regulatory landscape doesn’t currently have many mandates on it. Cloud providers like Amazon, Google, Microsoft, and Oracle have basically operated with very little governmental oversight. The same can’t be said for the users of cloud computing, who by-and-large all have some semblance of regulatory concerns. This creates a gap between what the cloud providers do in terms of cybersecurity, and what is the onus of the end user. Of course, regulators want to see the organizations raking in the huge profits from the use of these services do more, and that’s where this battle begins. 

The main point of contention seems to be that, since so many organizations rely on these cloud platforms for their central computing needs, that if full-scale regulation were to happen quickly, it could create problems for providers and thus have major effects on the economy. It stands to reason that regulation happens at some point, but many people in the industry are stumping for a more “light touch” approach, as the laissez-faire approach doesn’t really work for the national security of systems that are crucial to the sustainability of the world economy. 

Shared Responsibility

With security seemingly the hot-button issue, it’s important to understand where most of the cloud’s security comes into play. The provider is responsible for the security of the underlying infrastructure, while the customer is responsible for the security of their own digital resources. This can get a little hairy in terms of overarching regulation, as there are several issues that need to be addressed in order for both parties to keep their computing secure. They include:

• Larger attack surfaces - With more publically available surface area to your organization’s data (from use of shared physical resources), there is simply more that can go wrong.
• User error - With phishing attacks being the predominant way hackers gain unauthorized access to computing resources, the end user becomes the choke point for your organizational cybersecurity.
• Poor configuration - The less care that is taken when setting up public cloud resources, the more apt they are to be insecure. 

Regardless of how your organization will be impacted by the incoming regulation of cloud services: Rest assured it is coming. Let’s look at a couple of actions you can take to improve your cloud security:

• Deploy Multi-Factor Authentication - One of the best ways to secure your cloud endpoints is to enact a multi-factor authentication system. This system adds an extra step of security for any cloud-based resource, significantly reducing risk. 
• Manage access better - Not all of your employees need access to every cloud resource, especially if you plan on hosting a cloud platform yourself. Doing your best to restrict cloud access to users that need it, can reduce exposure to potential security issues.
• Train employees - Having a comprehensive security training program in place has been shown to cut your exposure to end-user risks by as much as 70 percent. 
• Sufficiently monitor end-users - One of the best ways to determine if you have intruders in your network is to use technology to consistently monitor it to see who is accessing resources and when. Sometimes unauthorized access will come at unusual times of the day. 

The cloud is going through a lot of changes, and time will tell whether or not widespread regulation will be in the cards in the upcoming years. The only thing you can do is strategically enhance your security posture so as to not be caught off guard. If you would like to talk to one of our security professionals, give MSPNetworks a call today at (516) 403-9001. 

The Health Insurance Portability and Accountability Act is a regulation passed by the US congress in 1996 to help streamline the healthcare system while maintaining individual ePI privacy over individuals’ health records. This regulation was put in place to allow people to transfer their health coverage, but also to minimize the risk individuals take on as far as fraud and abuse of their health records is concerned. This week we’d thought we’d discuss four ways your technology can help your organization keep its HIPAA compliance. 

Every organization that deals with healthcare information, whether they work in healthcare or just hold information on individual health insurance policies, needs to remain compliant with HIPAA. This can be a challenge for some companies, and that’s not a good thing. Fines can be massive for organizations that are found to be in breach of this mandate. That’s why it is essential your organization knows what to do and how to successfully deal with would-be patient data breach. 

The Role Technology Plays

Obviously, business success is largely contingent on their technology, and as far as HIPAA compliance is concerned, it’s mostly about keeping this type of data confidential. This becomes more of a challenge as organizations outsource their benefits and insurance to third parties. This is because this data, sent digitally, can be intercepted and therefore can cause major headaches for administrators. 

Let’s look at some easy-to-follow ways your organization can use its technology to maintain its critical HIPAA compliance:

• Secure communications - When sharing individual health information, you want to ensure you are doing it securely. This means no individual ePHI should ever be sent via text or instant message. These platforms simply don’t have the needed security and you can get yourself in hot water pretty simply by not considering what information you are sharing over certain platforms. 
• Use the cloud to your benefit - A lot of times people deride cloud platforms for not being as secure, but in the case of ePHI, cloud computing is generally thought of as one of the best platforms. This is because each user has secure access to the information without having to send it anywhere. This way there are no paper files to misplace (or get stolen) and there is very little risk of having the information intercepted in transit. 
• Keep passwords secure and updated - Passwords play a crucial role in the security of your business files, and play the same role for ePHI. You should implore your staff to routinely change their passwords, while creating complex passwords that use upper and lowercase letters, numbers, and symbols.
• Keep training - One way that businesses of all sizes can work towards data security is to keep training. Along with password hygiene, businesses should train on the best practices of data security, data privacy, and overall awareness. Keeping your staff trained up and aware is truly the only way that it is going to maintain the security needed to stay compliant with HIPAA or any other regulatory mandate your business operates under. 

Health information is some of the most sought-after by hackers and scammers. If you would like to learn more about implementing a comprehensive training platform for your business, or you would like to talk to one of our knowledgeable IT consultants about keeping your business compliant, give us a call today at (516) 403-9001.

2020 was, obviously, a challenging year for healthcare providers. In addition to the obvious issue of the COVID-19 pandemic creating serious operational, financial, and supply chain difficulties, cybersecurity concerns didn’t go away during this time. Let’s consider some of the additional stresses that IT security needs can, will, and have placed on healthcare providers.

The amount that healthcare practices invest in their cybersecurity services has been projected to exceed $65 billion in the span of time from 2017 to this year—but despite this, the industry isn’t improving. In fact, healthcare providers have had to turn away patients for these precise reasons… but the question remains: why?

There Are a Few Reasons that Healthcare Providers Have Had Problems As of Late

IoT Security Issues

Anyone who has been to a hospital in the past decade or so has likely noticed how connected many of these facilities have become. A nurse’s clipboard has been replaced by a laptop that they wheel around to input all information and logs into, while diagnostic equipment itself is now largely computerized.

This means that many of a healthcare provider’s tools can now be classified as Internet of Things devices, and as such, are prone to security inconsistencies and vulnerabilities as a result. Many IoT devices are notorious for iffy-to-non-existent security as it is.

Ransomware

While ransomware can be, and is, an issue in every industry, the healthcare industry is particularly susceptible to its impacts for obvious, life-or-death reasons. Ransomware has been responsible for many organizations actually closing their doors, unable to sustain the damages. This is largely due to the reliance that their organizations have on the data that they need to treat their patients and manage the business—without the support required to properly protect this data.

Insider Threats

Unfortunately, the employees in a healthcare organization are not infallible, which does sometimes lead to insider threats to data. In fact, some professionals have said that insider threats are the biggest challenge for hospitals and such right now.

New Threats May Be On the Horizon

Of course, cybercrime of all kinds constantly advances, and that which targets the healthcare industry is no exception. In healthcare, these threats can be downright frightening.

For example, a research team in Israel managed to develop a proof-of-concept computer virus that could artificially paste tumors into CT and MRI scans so that high-profile patients could be misdiagnosed by their physicians.

With ingenuity like that, it is terrifying to consider what cybercriminals may do moving forward.

Regardless of your industry or the size of your business, cybercrime isn’t something to be taken lightly. MSPNetworks is here to help prepare for it. Give us a call at (516) 403-9001 to learn more about the solutions we have to offer.

Despite what detractors say, regulations are in place for good reason. They typically protect individuals from organizational malfeasance. Many of these regulations are actual laws passed by a governing body and cover the entire spectrum of the issue, not just the data involved. The ones that have data protection regulations written into them mostly deal with the handling and protection of sensitive information. For organizations that work in industries covered by these regulations there are very visible costs that go into compliance. Today, we look at the costs incurred by these organizations as a result of these regulations, and how to ascertain how they affect your business.

Today’s world is driven by data. As a result, information systems have to be secured. That really is the bottom line. Business is all about relationships and without proper security protocols in place, there are some very serious situations that could completely decimate the relationships you’ve worked so hard to forge. While today’s hackers have a lot of different ways to breach an organization’s network, data breaches that occur as a result of lax security are unforgivable from a customer standpoint. Some organizations can spend more on security than others, but it with the landscape as it is today, it has to be a priority, no matter your IT budget.

Here are some of the regulations all business owners and IT administrators should know:

• GDPR: The European Union’s General Data Protection Regulation is as comprehensive a data protection law as there is. Its aim is to protect the citizens of EU-member countries from data breaches. The GDPR applies to every organization that processes personal information of people residing in the EU.
• GPG13: Known as the Good Practice Guide 13, it is the U.K.’s general data protection regulation for organizations that do business in the U.K.
• HIPAA: The Health Insurance Portability and Accountability Act puts several guidelines on how patients’ data is shared and disseminated by insurers and health maintenance organizations.
• SOx - The Sarbanes-Oxley Act requires corporate records to be kept for seven years to ensure that there is transparency in the accounting. For IT this means being able to have access to data to run reports when called upon.
• PCI-DSS - Payment Card Index Data Security Standard are regulations enacted to try and reduce fraud by protecting an individual’s credit card information.

That’s just a few of the regulations business owners and IT administrators have to be cognizant of. For business owners there are several more, like the federal and state tax codes, and the adherence to the Affordable Care Act. All these regulations seem pretty straightforward and necessary until you begin to roll them out for your business. Then they just get expensive. In the first-ever Small Business Regulations Survey conducted by the National Small Business Association, the numbers reported, although not comprehensive by any means, weren’t pretty. To put it frankly, the cost to the small businesses that reported, would sink as many or more new businesses.

“The average small-business owner is spending at least $12,000 every year dealing with regulations,” NSBA President Todd McCracken said, “This has real-world implications: more than half of small businesses have held off on hiring a new employee due to regulatory burdens.” The report goes on to state that the average regulatory costs to start a new business venture add up to a whopping $83,019. These figures don’t take in to account the dozens of man hours each year spent on these very complex problems. It should be stated that the NSBA has been a long-standing advocate of reducing regulations on small businesses.

Regulators are paid to be skeptical, but overall they are put in place for a purpose, as oversight to ensure sustained adherence to data protection laws. How much can they demand from a small business? The question begs for analysis, as to listen to entrepreneurs talk about them regulations are unnecessary, but as stated before, these regulations aren’t just implemented willy-nilly. They have empirical evidence of immoral or unethical wrongdoing attached to them. Moreover, it becomes clear that the financial pain these entrepreneurs are in is indefinite, which means that it is highly debatable. The truth is that each scenario needs to be seen in perspective in order to understand just how much certain regulations are costing a business.

One thing is certain: that the average small business pays more for their regulatory compliance programs than larger businesses in the same market do. That disparity is a main point of contention for many small business owners, as it directly affects a company's ability to compete. Some studies have seen organizations that have less than 20 employees charged nearly 60 percent more than slightly larger businesses. Getting into which regulations are onerous and which are necessary would take an examination of each one in detail, so it’s worth it to repeat that these regulations were bred out of situations where individuals were hurt, making them an important part of the oversight process.

To Comply or Not To Comply? That Is the Question Small business owners who have been reprimanded or fined as a result of a lack of regulatory awareness have a tendency to get the message, but if an organization is notoriously noncompliant and has slipped past regulators, there is a tendency for them to stay the course; and, that course is filled with nothing good. Many european and multinational corporations are expecting to invest $1 million toward their GDPR compliance. Obviously this figure, despite being higher per user, will be substantially lower for small and mid-sized businesses. The cost, however, remains significant, and while an organization could probably get around it for a bit, when it hits, it could just sink the whole business.

According to Infosecurity Magazine, the average cost of compliance with GDPR is costing enterprises and average of $5.5 million, which comes in about a third of the estimate cost of noncompliance, $14.82 million. That’s a lot of cheddar. It stands to reason that if you are going to spend upwards of 10 percent of your yearly IT budget on ensuring your organization is compliant, that you meet the criteria under the regulation. The best way to do that is by finding affordable solutions that wont take as big of a chunk out of your operational budget every year.

More than the capital, a business that doesn’t adhere to simple IT regulations probably isn’t adhering to other regulations. Would you want to do business with someone that you know won’t do what’s asked of them to protect YOUR data? Unreputable businesses that are looking to gain an edge by not meeting regulations will pay later for not spending now, end of story.

Compliance and Your Business

Finally, we get to your business. How are you going to plan for your compliance burden? The best way is to educate yourself on what exactly your business needs to plan for by looking at the regulatory mandates, sure, but more often seeking out organizations who have already insulated themself from the risks associated from noncompliance. This is where a managed IT service provider (MSP) can be a godsend. Since we take security compliance extremely seriously, and deal with multiple businesses that represent several vertical markets, we have the perspective that can provide a clear strategy on how to avoid problems staying compliant.

Moreover, MSPs like MSPNetworks use extremely sophisticated monitoring, management, and reporting software to reduce risk and put our clients in the best position to prepare for any audits or assessments that need to be completed by regulators. Since the regulatory landscape is constantly changing, our IT professionals are in a unique position to serve as both IT administrator and regulatory consultant.

If you are searching for a way to control your compliance situation, look no further than the IT professionals at MSPNetworks. We can deploy our strategies made up from tried and true industry best practices to virtually eliminate any risk your organization would have as a result of compliance concerns. Call us at (516) 403-9001 today to get started.

The days of the cash-only business are over. It doesn’t matter if your business is a multinational corporation or you cut grass for a living, accepting payment cards is not only convenient for your customers, most of the time it’s the most secure way to get paid. In an effort to protect the personal and financial information of consumers who have come to depend on their payment cards, the banks that back the credit card industry have developed a regulation that businesses who process cards need to adhere to. Today, we will go over this regulation and how it affects small and medium-sized businesses

Unpacking PCI 

What is known as PCI Compliance, is actually the Payment Card Index Digital Security Standard (PCI DSS). It was established in 2006 as an industry-wide standard, sponsored by what is now known as the PCI Security Standards Council made up of some pretty familiar names: Visa, Mastercard, American Express, and Discover. The council was established to regulate the credit card industry and manage the standards in which businesses would be held to improve consumer privacy. 

The first thing you should know is that PCI standards apply to all businesses that accept payment cards. If your business stores information or processes payment using digital payment, you have to maintain PCI compliance. Here are 10 actions every business that accepts payment cards needs to take:

1. Change passwords from system default
2. Install all sufficient network security tools (antivirus, firewalls, etc.) that will work to protect card data
3. Encrypt transmission of card data across public networks
4. Restrict the transmission of card and cardholder data to “need to know” basis
5. Assign user ID to all users with server or database access
6. Make efforts to protect physical and digital access to card and cardholder data
7. Monitor and maintain system security
8. Test system security regularly
9. Create written policies and procedures that address the importance of securing cardholder data
10. Train your staff on best practices of accepting payment cards

Again, every single business that accepts the use of payment cards needs to be sure to accomplish these 10 things. Many businesses already do these things in the normal course of doing business, but if you don’t, and you accept payment cards, you are not in compliance and face severe rebuke. 

PCI and Business Size

Once you understand the global actions your business needs to take to stay in compliance, you then need to understand what level of merchant you are. According to the PCI Security Standards Council there are four levels of businesses that process credit cards. They are defined as follows:

• Merchant Level #1 - A business that processes over six million payment card transactions per year.
• Merchant Level #2 - A business that processes between one million-to-six million payment card transactions per year.
• Merchant Level #3 - A business that processes between 20,000-to-one million e-commerce payment card transactions per year.
• Merchant Level #4 - A business that processes less than 20,000 e-commerce payment transactions, and fewer than one million overall payment card transactions per year.

Since a breach at level 1 will likely affect more consumers, the PCI regulatory body--that doesn’t have the means to constantly check every business--spends more time regulating larger organizations than it does smaller businesses. That’s not to say that small businesses can’t face hefty fines and consumer attrition if they are non-compliant. Each level has its own specific mandate. Let’s go through them now.

Merchant Level #1
Doing massive business online and otherwise brings with it more responsibility. To maintain PCI compliance, Level one merchants need to:

• Perform a yearly Report on Compliance (ROC) through a Qualified Security Assessor (QSA)
• Allow an Approved Security Vendor (ASV) to complete a quarterly network scan
• Complete the Attestation of Compliance Form for PCI Council records

Merchant Level #2
As transactions begin to decrease there are less stringent standards. Level two’s include:

• Perform a yearly Self-Assessment Questionnaire (SAQ)
• Allow an ASV to complete a quarterly network scan
• Complete the Attestation of Compliance Form for PCI Council records

Merchant Level #3
Many medium-sized businesses will fall under this level and need to:

• Perform a SAQ
• Allow an ASV to complete a quarterly network scan
• Complete the Attestation of Compliance Form for PCI Council records

Merchant Level #4
The majority of small business fall into level #4 status and like level’s two and three need to:

• Perform a SAQ
• Allow an ASV to complete a quarterly network scan
• Complete the Attestation of Compliance Form for PCI Council record

Businesses found to be in noncompliance will often be subject to review and are often fined, given extra scrutiny, or have their privilege to accept payment cards revoked. Don’t allow this to happen to your business. If you have any questions about PCI DSS standards, or how to keep your business in compliance, call the IT professionals at MSPNetworks today at (516) 403-9001.

When we write about Net Neutrality, we typically write about how it is designed to keep the telecommunications conglomerates, who make Internet service available to individuals on the Internet, honest when laying out their Internet service sales strategy. One way to put it is that without net neutrality in place, the Big Four (which are currently Comcast, Charter, Verizon, and AT&T) have complete control over the amount of Internet their customers can access.

In 2018, the Federal Communications Commission repealed the Net Neutrality laws that were in place for several years with a vote of 3-to-2. This has allowed the ISPs to control the Internet again. Today, we present you with a brief reminder, and update the situation as we roll into 2019.

Our Internet?
Commercially-available Internet services have been made available for the better part of 30 years. It is available and utilized almost everywhere in the U.S. As broadband began to take off, there was a very noticeable shift in the way that ISPs governed high-speed internet. Today, as most applications require the use of high-speed Internet, it becomes more important than ever for people to have access to affordable high-speed Internet.

For the past seven years, legislators have attempted to pass a law that would secure an open Internet in the future. These attempts have failed miserably. Cases like Verizon Communications, Inc. vs. FCC haven’t helped the cause much, as the attempts to make broadband Internet service a utility were thwarted in the courts. Today, nobody really knows who is going to control the Internet in the days to come. Currently it is in the hands of the ISPs, but that doesn’t seem likely to stay that way. It seems like an issue that is split down party lines, so the controlling factor seemingly depends on what party controls the executive branch of the government. Without legislative intervention, that likely won’t change anytime soon.

What Is Going on with Net Neutrality Now?
Almost immediately after the last shift in 2018, lawsuits were filed and they seem to keep coming. States, advocacy groups, neutrality lobbies, and companies have all started lawsuits against the FCC both for their handling of the situation and for the repeal of net neutrality itself.

To see if the repeal of net neutrality is working to benefit consumers, you simply have to consider the following two points:

1. Net Neutrality is hindering broadband investment. In 2018, the Big Four spent much less than it did prior to the repeal of the net neutrality laws. It was the first time in three years that investment has been reduced.
2. It doesn’t make sense for ISPs to throttle Internet traffic. These companies reportedly slowed internet traffic without telling customers as soon as six weeks after the repeal. Websites such as YouTube, Netflix, and Amazon Prime were the most targeted for throttling. Verizon, specifically, was put into hot water after slowing speeds that led to slower EMS response times in sections of California battling record forest fires last year.

Despite the political bickering, there are similar views on some issues. Most governing bodies would like to see fast, open, and unobstructed Internet. There are older FCC mandates that have worked to prohibit ISPs from creating anticompetitive and harmful practices in the past, but whether these mandates would be enforceable with current FCC investment thwarted is unknown.

Individuals roundly support net neutrality laws. They simply don’t like the idea that corporations, whose stated purpose is to make as much profit as possible, hold control over how bandwidth is utilized. Only time will tell who is right.

If you would like to do something about it, go to https://www.battleforthenet.com/ and sign up. Do you believe market forces will keep ISPs honest, and the Internet open? Leave your thoughts in the comments section below.