In early April, online tech outlets began reporting about Heartbleed, a new online threat to password security. In the subsequent weeks many companies warned users to change their passwords, and news outlets picked up the story in an attempt to warn Internet travelers of the dangers Heartbleed could pose. If you are an IT professional, you have likely been bombarded with questions about this threat from your friends, your co-workers, and your company.
To understand Heartbleed, you first need to understand OpenSSL
OpenSSL is a security standard used to encrypt the communication between you and the online services you use.
In short, it is what makes you feel safe sending sensitive or private information to your bank, your email, your social media accounts, or your online cloud storage solution. OpenSSL is a widely used technology, adopted by web giants such as Facebook, Google, and Yahoo.
Heartbleed exploits a feature of OpenSSL called “heartbeat.” As illustrated in the comic below from XKCD, when you access a website your computer communicates with a server. As part of this communication, the server responds to your computer to let it know that the server is active and available.This back-and-forth (the heartbeat) is a data exchange.
Typically the server will only send back requested data, but servers affected by the Heartbleed bug are open to send back much more data, which is what hackers are using to access encrypted information from the server (up to 65,536 bytes).
That’s because it isn’t a computer virus. Heartbleed is a bug or programming error that leaves data unencrypted using OpenSSL exposed to hackers.
You can’t “get” Heartbleed on your computer or server, and you aren’t safe from it just because you use an anti-virus program or firewall.
Most major online services (Yahoo, Google, Microsoft, Facebook) have reacted quickly to upgrade their OpenSSL software version, so simply changing your password on those services should be enough. You might also consider using a password manager for enhanced security in the future.
If you are worried about your business’ security, and whether your and data might be compromised, give us a call.
We’ve helped several of our clients secure themselves against Heartbleed, and assured others that they were fine, removing the stress of not knowing.
71% of SMBs are outsourcing their IT needs to a managed service provider.
More than 90% of businesses are either evaluating, adopting or embracing the cloud.
The average price of a data breach now stands at about $4 million.
“We believe our success is due to the strength of our team, the breadth of our services, our flexibility in responding to clients, and our focus on strategic support.”
Javier Gomez, CEO
70% of SMBs reported suffering a security breach during the previous 12 months – and companies with fewer than 500 employees were the most vulnerable, with a 75% breach rate.
$500 billion will be spent in the greater cloud market by 2020.
93% of businesses file for bankruptcy after losing data for 10 or more days.
Billions of devices will be connected to the Internet of Things by 2025, exponentially increasing demand for MSPs to back up growing companies.