🌈Push Bombing หรือ MFA Fatique คืออะไร
- ถึง MFA จะเป็นวิธีป้องกันความปลอดภัยบนโลกออนไลน์ทีดีที่สุดในวันนี้แต่แฮกเกอร์ก็ยังมีวิธีที่จะหลอกล่อหาข้อมูลส่วนตัว หรือรหัสต่างๆ ของเราอยู่ดี - แฮกเกอร์จะพยายาม log-in เข้าระบบหลายรอบติดๆกัน - เหยื่อจะได้รับ push notification ถี่ๆ - เกิดความสับสน ลืมไปว่าตัวเองกดขอ OTP ไหม - และในที่สุดก็เผลอกดยืนยันไป 🌈เราจะป้องกัน Push Bombing หรือ MFA Fatique ได้อย่างไร - ให้ความรู้ทุกคนในองค์กร - เลี่ยงพฤติกรรม Application Sprawl หรือการมีแอพมาเกินความจำเป็น - มีโซลูชั่นป้องกัน Phishing - มีนโยบายตั้งพาสเวิร์ดที่รัดกุม - ติดตั้งโซลูชั่นจัดการอัตลักษณ์บุคคลขั้นสูงCloud account takeover has become a major problem for organizations. Think about how
much work your company does that requires a username and password. Employees end
up having to log into many different systems or cloud apps.
Hackers use various methods to get those login credentials. The goal is to gain access to
business data as a user. As well as launch sophisticated attacks, and send insider phishing
emails. How bad has the problem of account breaches become? Between 2019 and 2021, account
takeover (ATO) rose by 307%.Doesn’t Multi-Factor Authentication Stop Credential Breaches? Many organizations and individuals use multi-factor authentication (MFA). It's a way to
stop attackers that have gained access to their usernames and passwords. MFA is very
effective at protecting cloud accounts and has been for many years.But it’s that effectiveness that has spurred workarounds by hackers. One of these nefarious
ways to get around MFA is push-bombing.
How Does Push-Bombing Work?
When a user enables MFA on an account, they typically receive a code or authorization
prompt of some type. The user enters their login credentials. Then the system sends an
authorization request to the user to complete their login.The MFA code or approval request will usually come through some type of “push”
message. Users can receive it in a few ways: • SMS/text • A device popup • An app notificationReceiving that notification is a normal part of the multi-factor authentication login. It’s
something the user would be familiar with. With push-bombing, hackers start with the user’s credentials. They may get them through
phishing or from a large data breach password dump.They take advantage of that push notification process. Hackers attempt to log in many
times. This sends the legitimate user several push notifications, one after the other. Many people question the receipt of an unexpected code that they didn’t request. But
when someone is bombarded with these, it can be easy to mistakenly click to approve
access. Push-bombing is a form of social engineering attack designed to:• Confuse the user • Wear the user down • Trick the user into approving the MFA request to give the hacker accessWays to Combat Push-Bombing at Your OrganizationEducate Employees
Knowledge is power. When a user experiences a push-bombing attack it can be disruptive
and confusing. If employees have education beforehand, they’ll be better prepared to
defend themselves. Let employees know what push-bombing is and how it works. Provide them with training
on what to do if they receive MFA notifications they didn’t request. You should also give your staff a way to report these attacks. This enables your IT security
team to alert other users. They can then also take steps to secure everyone’s login
credentials.Reduce Business App “Sprawl” On average, employees use 36 different cloud-based services per day. That’s a lot of logins
to keep up with. The more logins someone has to use, the greater the risk of a stolen
password. Take a look at how many applications your company uses. Look for ways to reduce app
“sprawl” by consolidating. Platforms like Microsoft 365 and Google Workspace offer many
tools behind one login. Streamlining your cloud environment improves security and
productivity.
Adopt Phishing-Resistant MFA SolutionsYou can thwart push-bombing attacks altogether by moving to a different form of MFA.
Phishing-resistant MFA uses a device passkey or physical security key for authentication. There is no push notification to approve with this type of authentication. This solution is
more complex to set up, but it’s also more secure than text or app-based MFA.Enforce Strong Password Policies
For hackers to send several push-notifications, they need to have the user’s login.
Enforcing strong password policies reduces the chance that a password will get breached. Standard practices for strong password policies include: • Using at least one upper and one lower-case letter • Using a combination of letters, numbers, and symbols
11• Not using personal information to create a password• Storing passwords securely • Not reusing passwords across several accounts Put in Place an Advanced Identity Management Solution
Advanced identity management solutions can also help you prevent push-bombing
attacks. They will typically combine all logins through a single sign-on solution. Users, then
have just one login and MFA prompt to manage, rather than several. Additionally, businesses can use identity management solutions to install contextual login
policies. These enable a higher level of security by adding access enforcement flexibility.
The system could automatically block login attempts outside a desired geographic area. It
could also block logins during certain times or when other contextual factors aren’t met.Do You Need Help Improving Your Identity & Access
Security?
Multi-factor authentication alone isn’t enough. Companies need several layers of
protection to reduce their risk of a cloud breach. Are you looking for some help to reinforce your access security? Give us a call today to
schedule a chat.Article used with permission from The Technology Press.
"พาสเวิร์ด" คือระบบการยืนยันตัวตนที่ใช้งานเเพร่หลายมากที่สุด
แต่พาสเวิร์ดก็คือจุดอ่อนที่อาจจะเดาได้ง่ายๆ
61% ของปัญหาข้อมูลรั่วไหลเกิดจากการขโมยข้อมูลพาสเวิร์ด
ไม่นานมานี้ มีอีกวิธีที่ช่วยป้องกันความปลอดภัย ที่เรียกว่า "Passkey Authentication"🌈Passkey Authentication คืออะไร Passkey จะสร้างรหัสเข้าระบบที่ไม่ซ้ำกัน
เป็นรหัสที่ใช้ข้อมูลเกี่ยวกับผู้ใช้และเครื่องที่เขาใช้login
จะว่าไป Passkey ก็เป็นเหมือน Digital Credential
ที่ช่วยให้ยืนยันตัวตนผู้ใช้โดยไม่ต้องกรอกข้อมูลผู้ใช้หรือพาสเวิร์ด 🌈Passkey ดีกว่าพาสเวิร์ดทั่วไปอย่างไร 1) ปลอดภัยกว่า 2) สะดวกกว่า 3) ป้องกัน Phishing ได้ 🌈แล้วข้อด้อยของ Passkey ล่ะมีไหม Passkey ยังไม่ถูกใช้แพร่หลาย Passkey ต้องมีฮาร์ดแวร์และซอฟต์แวร์ต่างหากPasswords are the most used method of authentication, but they are also one of the
weakest. Passwords are often easy to guess or steal. Also, many people use the same
password across several accounts. This makes them vulnerable to cyber-attacks.
The sheer volume of passwords that people need to remember is large. This leads to
habits that make it easier for criminals to breach passwords. Such as creating weak
passwords and storing passwords in a non-secure way.61% of all data breaches involve stolen or hacked login credentials. In recent years a better solution has emerged - passkeys. Passkeys are more secure than
passwords. They also provide a more convenient way of logging into your accounts.What is Passkey Authentication?Passkeys work by generating a unique code for each login attempt. This code is then
validated by the server. This code is created using a combination of information about the
user and the device they are using to log in. You can think of passkeys as a digital credential. A passkey allows someone to
authenticate in a web service or a cloud-based account. There is no need to enter a
username and password. This authentication technology leverages Web Authentication (WebAuthn). This is a core
component of FIDO2, an authentication protocol. Instead of using a unique password, it
uses public-key cryptography for user verification. The user's device stores the authentication key. This can be a computer, mobile device, or
security key device. It is then used by sites that have passkeys enabled to log the user in. Advantages of Using Passkeys Instead of PasswordsMore Secure
One advantage of passkeys is that they are more secure than passwords. Passkeys are
more difficult to hack. This is true especially if the key generates from a combination of
biometric and device data.Biometric data can include things like facial recognition or fingerprint scans. Device
information can include things like the device's MAC address or location. This makes it
much harder for hackers to gain access to your accounts.More Convenient
10
Another advantage of passkeys over passwords is that they are more convenient. With
password authentication, users often must remember many complex passwords. This can
be difficult and time-consuming.Forgetting passwords is common and doing a reset can slow an employee down. Each
time a person has to reset their password, it takes an average of three minutes and 46
seconds.Passkeys erase this problem by providing a single code. You can use that same code
across all your accounts. This makes it much easier to log in to your accounts. It also
reduces the likelihood of forgetting or misplacing your password.Phishing-Resistant
Credential phishing scams are prevalent. Scammers send emails that tell a user something
is wrong with their account. They click on a link that takes them to a disguised login page
created to steal their username and password. When a user is authenticating with a passkey instead, this won’t work on them. Even if a
hacker had a user’s password, it wouldn’t matter. They would need the device passkey
authentication to breach the account.Are There Any Disadvantages to Using Passkeys?
Passkeys are definitely looking like the future of authentication technology. But there are
some issues that you may run into when adopting them right now.
Passkeys Aren’t Yet Widely Adopted
One of the main disadvantages is that passkeys are not yet widely adopted. Many websites
and cloud services still rely on passwords. They don’t have passkey capability yet. This means that users may have to continue using passwords for some accounts. At least
until passkeys become more widely adopted. It could be slightly awkward to use passkeys
for some accounts and passwords for others.
Passkeys Need Extra Hardware & Software
One thing about passwords is that they’re free and easy to use. You simply make them up
as you sign up for a site. Passkeys need extra hardware and software to generate and validate the codes. This can
be costly for businesses to put in place at first. But there is potential savings from
improved security and user experience. These benefits can outweigh the cost of passkeys.Prepare Now for the Future of Authentication
11
Passkeys are a more secure and convenient alternative to passwords. They are more
difficult to hack, and they provide a more convenient way of logging into your accounts.
But passkeys are not yet widely adopted. Additionally, businesses may need to budget for
implementation. Despite these challenges, passkeys represent a promising solution. Specifically, to the
problem of weak passwords. They have the potential to improve cybersecurity. As well as
boost productivity for businesses and individuals alike.
Need Help Improving Your Identity & Account
Security?
Take advantage of the new passkey authentication by exploring it now. It’s the perfect
time to ease in and begin putting it in place for your organization.
Give us a call today to schedule a consultation.Article used with permission from The Technology Press.
#Microsoft ได้หยุดให้บริการสนับสนุน Windows 8.1 ไปแล้วตั้งแต่ 10 ม.ค. ที่ผ่านมา ถ้าองค์กรไหนยังคงใช้ Windows 8.1 อยู่อาจมีความเสี่ยงเรื่องความปลอดภัย และอาจส่งผลต่อ Compliance ขององค์กรได้🌈เรื่องที่ต้องรู้
- ระบบ OS ของ Windows 8.1 อาจจะยังทำงานได้ต่อไป - แต่จะไม่มีการป้องกันใดๆ ต่อไป - สิ่งที่ควรทำคือการอัพเกรดเป็น Windows 10 หรือ 11 🌈ปัญหาที่ตามมาถ้าไม่อัพเกรด- เสี่ยงเรื่องความปลอดภัย และส่งผลต่อ Compliance ขององค์กร - ทำงานได้ช้าลง - เข้ากันไม่ได้กับเครื่องมือใหม่ๆCompanies both large and small share this one cybersecurity problem. They have
computers that are still running older operating systems. Staff might use these devices
only occasionally. Or the company may be running customized software that won’t run on
newer OS versions.
The problem is that when the OS becomes outdated, the system is open to cyberattacks.
When Microsoft or another developer retires an OS, it means that it is no longer
9
supported. No more feature updates and no more security patches for newly found
vulnerabilities.The latest operating system to lose all support is Windows 8.1. Microsoft released the OS
in 2013, and it was officially retired on January 10, 2023. Microsoft issued the following
warning for companies:“Continuing to use Windows 8.1 after January 10, 2023 may increase an organization’s
exposure to security risks or impact its ability to meet compliance obligations.”Here are a few facts you should know about what this retirement of Windows 8.1 means.The OS Will Still Technically Work When an operating system reaches its end of life, it doesn’t just stop working. Thus, many
companies go on using it without realizing the security risk. Technically, the OS will work
as it did the day before retirement. But it’s a lot less safe due to the loss of support.
Your System Will No Longer Receive Security Patches
Software and OS vulnerabilities are sought out and exploited all the time. This is what
hackers do for a living. The vulnerability cycle usually begins with hackers finding a
software “loophole.” They then write code to exploit it that allows them some type of
system access.
The software developer learns of this, usually once hackers start breaching systems. They
write code to fix that vulnerability. Developers then send the fix to users via an update that
they install. This protects the device from one or more hacker exploits.
When an OS reaches its end of life, these fixes are no longer made. The developer has
moved on to focus on its newer products. So, the vulnerability remains. It leaves a device
vulnerable to hacks for days, months, or years afterward.
Approximately 61% of security vulnerabilities in corporate networks are over five
years old.
Options for Upgrading
If you have a computer that is still running Windows 8.1, you have two options for
upgrading. You can opt for Windows 10 or Windows 11. If the computer is running such
an old OS, there is a chance your system may not meet the requirements for one or both.
In this case, you may need to buy a new device altogether.Microsoft states that there is no free option to upgrade from 8.1 to Windows 10 or 11.
Some of the advantages you gain when upgrading include:• Better built-in security • Faster processing
10 • Capability for more modern features (like facial recognition) • Improved accessibility features • Updated productivity tools (like snap layouts in Windows 11)
What Happens If I Don’t Upgrade?Security & Compliance Issues
Your data security is at risk if you stay on Windows 8.1. Without any security updates, any
vulnerabilities will stay unpatched. This leaves your system highly vulnerable to a breach.
One hacked system on a network can also cause the breach or malware infection to spread
to newer devices.
If you have to comply with a data privacy regulation, like HIPAA, you’ll also run into issues.
Data privacy rules dictate making reasonable efforts to protect data. Using a device with
an outdated OS jeopardizes meeting compliance.
Slowed Productivity
The older systems get, the slower they get. Staff that must work on outdated software
often complain that it hurts productivity. 77% of surveyed employees were frustrated with
outdated tech. Employees dealing with outmoded systems may also quit. They are 450%
more likely to want to leave and work elsewhere.
An outdated operating system can hold your staff back. They miss out on modern timesaving features. They can also run into problems with bugs that will no longer get fixed.
Incompatibility With Newer Tools
Software and hardware developers aren’t looking back. Once Microsoft retires an OS, they
aren’t prioritizing its compatibility. In fact, some may not want their product to be
compatible with it because of the liability.
When you have issues using modern software and hardware it hurts your business. You
become less competitive and begin to fall behind. Staying on an outmoded OS keeps you
stuck in the past.
Get Help With Your Windows Upgrades
We can help you upgrade smoothly from an older Windows OS to a new one. If you need
a new system, we can point you in the right direction for the best value. Give us a call
today to schedule a chat about upgrades and where your security stands.Article used with permission from The Technology Press.
Microsoft Forms เครื่องมือฟรี ที่ ตัวท๊อปที่ใช้คุ้มสุดใน Microsoft 365
🌈Microsoft Forms คืออะไร? - Microsoft Forms คือเครื่องมือทำแบบสอบถาม ข้อสอบ และฟอร์มที่เพียงพิมพ์หรือลากข้อความ ไม่นานก็ได้ผลลัพธ์ที่เวิร์คสุดๆ 🌈ข้อดีของ Microsoft Forms - ได้มาฟรี ใน Microsoft 365 - ประหยัดเวลา
- ได้ผลลัพธ์ทันที - ใช้ง่าย
🌈ตัวอย่างปรับใช้ Microsoft Forms - แบบสอบถามความพึงพอใจของลูกค้าประจำปี - แบบทดสอบการรับรู้เรื่องความปลอดภัยในกลุ่มพนักงาน - แบบสำรวจความพร้อมเรื่อง Change ในองค์กร - ลงทะเบียนงานอีเว้นท์
- ฟอร์มลงทะเบียนMicrosoft 365 is one of the most popular cloud platforms in the world, with about 345
million paid seats. Microsoft cloud tools numbers were up 32% in Q3 2022 compared to
the previous year.
One of the reasons for its continued growth is the suite of cloud tools offered in the
service. Users get a stable of over 20 different apps, including the core MS Office suite. With so many different apps, it’s not uncommon for some to go unused. Companies may
not even be aware they have access to these other helpful tools. One of the handiest apps
you get with a Microsoft 365 subscription is Microsoft Forms. From sending year-end customer surveys to assessing change readiness, Forms makes it
easy. This online survey and form-building tool has a lot to offer organizations. And if you
have a subscription to Microsoft 365, then you already get Forms included for free. What Is Microsoft Forms?Microsoft Forms is a drag-and-drop form, quiz, and survey creator. It’s simple to use and
allows you to send out surveys via a link. Recipients can fill out your form online from any
device.Once recipients fill out the survey, the results come into the software instantly. You can see
the collated results charted in the software. You can also export the results to Excel.How to Get Started in Forms:1. Visit Forms.office.com and log into your Microsoft account. 2. Choose “New Form” or “New Quiz: from the top menu3. OR you can choose to explore the built-in templates 4. Click “Add New” to add a new form field. You can choose from field types: • Choice (i.e., multiple-choice question) • Text • Rating • Date • Ranking • Likert (a scale that records attitudes/opinions about a topic) • Net Promoter Score® (a scale from “not likely” to “extremely likely”) • Section (separator that can include a title and image) 5. Enter your questions.6. Once finished, click “Send” at the top. You can distribute the survey using the
following options: • Link to a web form • Email • QR code • Embed in a web page • Via Facebook or Twitter7. View responses on the “Responses” tabAdvantages of Using Microsoft Forms
It’s Included in Microsoft 365 Subscriptions
If you already subscribe to Microsoft 365, then it makes sense to use Forms. It can save
you money if you’re using a separate survey tool, like Survey Monkey. It’s easily accessible
by signing in with your Microsoft account.
It Saves TimeSending a survey by email is time-consuming. You have to worry about emails bouncing
due to an attachment. You also need to spend time collating all the results as they come
in.
Using MS Forms can save you a lot of time. People don’t need to download anything or
open an email file attachment. They simply follow your link and fill out the form online. As
soon as they fill the survey out, you get the result. Forms also collates all the answers for
you.
Get Charted Results Automatically
You can quickly see the results of the survey in meaningful graphs. Forms makes it simple
to export to Excel if you want to upload the survey results into another platform.
On the “Responses” tab, you can hover over the result graphs to see the details.It’s Easy to Use
There’s a very low learning curve with Microsoft Forms. The interface is intuitive and
simple, so just about everyone can jump in and start using it.
What Are Some Ways You Can Leverage Microsoft
Forms?Annual Customer Satisfaction Survey
Using a web-based survey can increase your response rate from customers. They can fill
out your satisfaction survey from any device, making it quick and easy for them.
You can see results instantly. Then, chart them to gain insights into what your business is
doing right, and what you can improve upon.
Employee Security Awareness Quiz
Send a security awareness quiz to your employees using Forms. It can be easily integrated
into your cybersecurity awareness training. The platform also tells you the average
response time per person.
Change Readiness Survey
Change management is a growing focus of many organizations. This is due to the speed of
technology-driven transitions. You can use Forms to improve user readiness for change
adoption. Create and send out a change readiness survey to affected groups.
Event Registrations
Are you hosting an event? You can easily gather registration details. Send out a Forms link
via QR code, social media, text, or email.
Volunteer Registration Form
Embed an MS Forms registration form on your web page to sign up volunteers. The
platform will automatically collate different talents or other volunteer information. This
helps you better match people's talents to your needs.
And More
You’ll find more ideas from the Forms templates. Such as: • Competitive analysis study • Post-event feedback survey • Office facility request form • Employee satisfaction survey • Product pricing survey • Food catering request form • Save the date form • Course enrollment form Would You Like to Get More Out of Microsoft 365?
There is a good chance that your company may be leaving some value on the table with
M365. Give us a call today to learn more about our Microsoft 365 support services.Article used with permission from The Technology Press.
Squarespace Enters Definitive Agreement to Acquire Google Domains Assets
NEW YORK, June 15, 2023 /PRNewswire/ -- Squarespace Inc. (NYSE: SQSP), the design-driven platform helping entrepreneurs build brands and businesses online, announced today it has entered into a definitive asset purchase agreement with Google, whereby Squarespace will acquire the assets associated with the Google Domains business, which will be winding down following a transition period. This purchase includes approximately 10 million domains hosted on Google Domains spread across millions of customers."We are exceptionally proud to be chosen to serve the customers of the Google Domains business," said Anthony Casalena, Founder & CEO of Squarespace. "Domains are a critical part of web infrastructure and an essential piece of every business's online presence. We look forward to serving these new customers as we have served millions using our domain products and are committed to ensuring a seamless transition.""In keeping with our efforts to sharpen our focus, we have entered into a definitive agreement with Squarespace for the acquisition of customer accounts of the Google Domains registrar business," said Matt Madrigal, Vice President and General Manager, Merchant Shopping of Google. "Supporting a smooth transition for customers over the coming months, with the help of the Google Domains team, is our top priority. Squarespace can provide an integrated experience of purchasing and managing domains along with offering other tools that these customers may need to build their online presence."Under the terms of the agreement, Squarespace will honor all existing Google Domains customers' renewal prices for at least 12 months following the closing of the transaction, as well as provide additional incentives to encourage Google Domains customers to build a website with Squarespace and adopt other Squarespace offerings. Further, Squarespace will be leveraging Google's infrastructure powering the Google Domains product during the migration period in order to ensure the seamless transfer of domains.Upon closing, Squarespace, a long- time reseller of Google Workspace, will become the exclusive domains provider for any customer purchasing a domain along with their Workspace subscription from Google directly for a minimum of three years. Squarespace will also provide billing and support services to Google Workspace customers that signed up for the service through Google Domains. Customers will continue to have the option to make changes to their domains account at any time.The transaction is expected to close in the third quarter of 2023, and is subject to certain regulatory approvals and customary closing conditions. While the majority of the benefits of this deal will be realized in 2024 and beyond, Squarespace believes this deal will be meaningfully accretive to its business from both a revenue and free cash flow perspective over time.Squarespace management will host a conference call today, June 15th, at 5:00pm ET. A live webcast of the event will be available in the Events & Presentations section of the Squarespace Investor Relations website. An archived replay of the webcast will be available following the conclusion of the call.About SquarespaceSquarespace (NYSE: SQSP) is a design-driven platform helping entrepreneurs build brands and businesses online. Our products empower millions in more than 200 countries and territories with all the tools they need to create an online presence, build an audience, monetize, and scale their business. Our suite of products range from websites, domains, ecommerce, and marketing tools, as well as tools for scheduling with Acuity, creating and managing social media presence with Bio Sites and Unfold, and hospitality business management via Tock. For more information, visit www.squarespace.com.Forward-Looking StatementsThis press release contains forward-looking statements within the meaning of the Private Securities Litigation Reform Act of 1995. All statements other than statements of historical fact are forward-looking statements. These statements include, but are not limited to, statements regarding the proposed transaction, including statements regarding the benefits and impact of the transaction and the anticipated timing of the transaction. The words "believe," "may," "will," "estimate," "continue," "expect," and similar expressions are intended to identify forward-looking statements. Forward-looking statements are based on management's expectations, assumptions, and projections based on information available at the time the statements were made. In light of these assumptions and the risks and uncertainties that could impact Squarespace's business or this transaction, Squarespace's actual results could differ materially and adversely from those anticipated or implied in the forward-looking statements. Further information on risks that could cause actual results to differ materially from forecasted results are included in Squarespace's filings with the Securities and Exchange Commission. Except as required by law, Squarespace assumes no obligation to update these forward-looking statements, or to update the reasons if actual results differ materially from those anticipated in the forward-looking statements.ที่มา : Squarespace Enters Definitive Agreement to Acquire Google Domains Assets (prnewswire.com)Cr. SOURCE Squarespace, Inc.
.png "Microsoft Visio")
.png "VMware")
