Applogie, SaaS Management

Advice and support for enterprises going remote during the COVID-19 crisis

As individuals around the globe contend with the unprecedented effects of the COVID-19 pandemic, those who suddenly find themselves able to socially distance by working from home every day are lucky. Countless others are dealing with unemployment or health anxieties as they work essential jobs on the front lines of society. 

The corporations who have had the option of transitioning their workforces remote almost overnight are lucky too, all things considered. Still, the shift doesn’t come without its challenges.

According to LinkedIn, searches for “remote working” on LinkedIn Learning have tripled since January, as employees and managers look for advice. The platform surveyed its users and found that 43% of those who used to work in an office are now working remotely. 

As a company founded on the principles of cloud-based work, we want to offer our support and advice to organizations that have suddenly transitioned their entire companies to remote work. While the decision to transition was made very quickly, LinkedIn found that 44% of senior leaders are somewhat or very likely to make their new remote work policies permanent.

That means the things your organization does today can set it up for remote working success or failure far into the future.

As your organization settles into its remote work routine: 

Beware of overextended licenses

Many enterprises don’t have a good understanding of all the cloud-based software they are paying for, or who is using what on a regular basis. When more of your employees than usual are suddenly using these subscriptions, which often enable work outside a corporate network, you may be liable for overages without knowing it. Especially at a time when you’re looking to decrease spend, an unexpected charge is an unwelcome surprise. 

Look for unused subscription capabilities

On the flipside, organizations also fail to use their software licenses to their full potential. Consider reaching out to your SaaS account managers to ask whether you’re paying for any capabilities that you aren’t currently using. You may find you already have the capacity to extend your remote workforce without paying extra. 

Offer employees secure sharing options 

When your employees are working from home for the first time (along with most of their customers, partners and prospects), they want to be productive. If you don’t provide them with approved methods of secure information sharing, there’s a good chance they will look for their own. While well-intended, sharing secure information and data over email, personal Google drives and other “resourceful” methods can put you at much higher risk of a security breach. 

Continue regular security training

A 2018 Data Breach Report from Verizon found that an average of 4% of targets in a phishing campaign will click – even under normal circumstances. Now consider the likely behavior of an anxious, distracted worker faced with a phishing campaign designed to prey on them during an especially vulnerable time. Remind your employees working remotely of security guidelines and best practices, and stress that both are even more important when working from home (on a potentially unsecured network). 

In addition to our support, Applogie is offering a free trial of its SaaS management platform and security monitoring tool. To take advantage of this offer and ease the transition to working remotely, get in touch with us

Stay safe, everyone.


ICYMI: A roundup of the SaaS & security insights you cared about in 2019

It’s nearly impossible to be successful as a company without paying attention to what’s happening in the industry and what our competitors are doing. But it’s truly impossible to be successful without paying attention to what you care about. Our customers, subscribers and supporters are crucial to our success, so noticing what resonates with you – what you engage with, what excites you, what you want to talk about – will continue to drive our organizational focus.

So as 2019 draws to a close, we wanted to take a look back at our most popular content of the year and give you another chance to check it out, just in case you missed it the first time around. 

  1. An interview with Scott Coons, Co-Founder of Applogie “I believe customers will always tell you what you should build. You just have to be paying attention.”
  2. New feature: Protect your corporation with data breach discovery “When you know that an account has been a victim of a data breach somewhere else online, you can prompt that employee to change his or her corporate password immediately, greatly reducing the chance that your own corporate systems are at risk of a breach as well.”
  3. Five ways to encourage security at your organization “One of the biggest problems is that people are now so comfortable working, communicating and conducting business online, they’ve become overconfident in their immunity to risk.”

Happy New Year to all of you, and thank you for your continued support of Applogie throughout 2019.

If you haven’t tried Applogie yet, why not start your 2020 off right? Sign up for your free trial today!


Corporate Mergers and Acquisitions in the Cloud: Four Things to Consider

Digitally transforming your organization to operate primarily in the cloud means minimized costs, increased flexibility, and the ability to provide better customer support. It also means,though, that it’s easier to lose control of technology spending and communication across departments. Imagine, now, how a merger or acquisition can highlight both the benefits and drawbacks of these cloud pros and cons. 

Recently, Deloitte published a blog post that compiled three ways cloud computing enables mergers and acquisitions, making the process better and smoother for everyone involved. 

Author David Linthicum specifies that this is because the cloud’s ability to exchange data intra-cloud is faster, easier and less expensive, because security systems can be synced in a fraction of the time traditional legacy security integration, and because the cloud encourages common data semantics and promotes a single source of truth on what is considered a customer, inventory, product, etc. 

Linthicum begins his article on cloud as the answer to life, the universe and acquisitions by saying, “it’s difficult to bring together the IT systems of both companies, and synergy can take years, not months to achieve. Both the customers and investors can become underwhelmed by the progress, and the company often pays the price by falling short of expectations.” 

This is very true. We think, however, that while the cloud can help to alleviate these issues, it cannot remove them entirely. Especially once two organizations reach a certain size and reliance on cloud-based processes and storage, approaching a cloud-based merger under the belief that things will go smoothly by default is a mistake. 

It’s also true that “cloud computing and its ability to more easily merge IT systems” can benefit merging companies, as Linthicum says, and that “cloud-based resources can be allocated as needed, and public cloud-based systems can easily work and play well with each other.”

But what are some of the potential “gotchas” of a cloud-based merger? Where are the scenarios in which both companies could end up losing money and compromising security because of SaaS? 

Here are four of the most common pitfalls to watch out for when merging corporations that are already digitally transformed:

  • Employees logging onto new systems with different levels of training and different guidelines. We’ve outlined five ways to build a secure culture, but all organizations exist at varying levels of cybersecurity maturity. If you acquire a company that has done less training on security risks with its employees, inviting them to access your systems could open security rifts that will be difficult to track with all the other acquisition activities going on. 
  • Disgruntled employees (on both sides). Change is hard. Whether your company is purchased by another and your employees are forced to assimilate, or your company purchases another and your employees need to welcome outsiders into their comfortable day-to-day, not everyone will take it well. There’s a good chance they’ll come around, but in the meantime, you’re allowing unhappy workers to access sensitive data in new systems. Watch for signs of malicious activity as you merge corporations. 
  • Wasting money while one organization or the other runs out duplicate contracts. There’s a good chance the merging organizations will have dual licenses to some of the most common software. Considering Gartner estimates most organizations overspend on cloud by 30% on their own, a merger may represent a period of significant overspend. There may be no way around it, but knowing which software license subscriptions each organization is paying for, and being able to track their usage and renewal dates, is priceless during a time of such upheaval at cloud-based companies. 
  • Higher chance of overpaying for duplicate functionality and unused licenses. Again, this happens under the status quo, too, but during a merger, it becomes even more difficult to tell who’s using what, who needs a license renewed and who will never use a license because another subscription provides the same functionality with more familiarity. Only when you track licenses, usage and functionality can you determine how your newly-combined organization can use the cloud most efficiently. 

Overall, we still encourage organizations to move to the cloud for many reasons – the enablement of smooth mergers and acquisitions is one of them. Deloitte is right on that. We just want to caution those of you eagerly approaching a merger that just because SaaS enables collaboration and combination doesn’t mean you can just look the other way when it comes to your software. There’s a lot to consider. The good news is, just by being aware of the places where cloud-based processes can allow money and security to fall through the cracks, you’re in a better position to prevent it. 


Which of your employees are out to get you? Tips for identifying and understanding malicious insiders

Not to sound like a broken record, but protecting your organization’s information is a pretty big deal. Recent data breaches have cost corporations millions of dollars, and the trust of thousands of people. Like we’ve pointed out in the past, many of these breaches are caused by your employees and the other people who have access to your systems – the insiders. These insiders fall into four broad categories – and two of them aren’t even threatening your security on purpose. Those inadvertent insiders are the categories Applogie protects against. 

But what about the other two categories? The malicious insiders and the professional insiders? There are fewer people who are actively scheming to steal your company data, but they are out there – and they’re motivated. 

Okay, so the Applogie platform isn’t going to track down the people who are hellbent on stealing your information, but we’re experts in data protection, and we want to make sure you’re educated about all the ways in which your data could slip through the cracks. That’s why we want to run through some tips for spotting and understanding insider threat. It’s time to get to know your malicious insiders. 

Who are they? 

Research done by Carnegie Mellon University’s CERT Insider Threat Center states “the employees that pose the greatest risk for insider threat/theft include technical staff such as engineers and scientists, managers, sales personnel and programmers,” and warn organizations to pay particularly close attention to employees with administrative rights and specialized users of IT systems, because “these employees know the strengths and vulnerabilities of the systems.”

What’s their motivation?

The CERT Insider Threat Center has identified four categories of motivation for someone stealing corporate data: 

  • IT sabotage: When an insider wants to steal code, proprietary programs or other IT assets as retribution against the company for a perceived slight.
  • Business advantage: When an insider takes corporate data to use as an advantage at a new job (probably with one of your competitors) or to start a new business of their own. 
  • Financial gain: When an insider steals Social Security numbers, credit card data or banking information in order to defraud your company of money. 
  • Espionage: When an insider is spying on your company and taking its information to “the enemy” for corporate advantage, political gain, or financial reward. 

How do they do it? 

Malicious insiders steal and move corporate data in a variety of ways, including: 

  • Over email: Email is one of the easiest ways to transfer smaller amounts of data (less than 10 GB). 
  • Via FTP (File Transfer Protocol): Malicious insiders who know what they’re doing are likely to upload stolen data to an FTP site.
  • With removable media: Physically transferring data to a USB drive, cell phone, tablet or external hard drive is an easy way to copy data and carry it out of the office. It’s also tough to track and trace. 
  • By accessing your systems remotely: If your data is in the cloud (and it probably is), employees likely have access to it from anywhere, meaning they can download and save it to personal devices, machines and servers. 
  • On paper: Sure, it’s old-school, but it still works. Malicious insiders can easily grab paper documents containing your information and pass them into the wrong hands. 
  • Taking pictures and screenshots: Taking a picture of information on a computer screen with a personal cell phone is one of the easiest, quickest ways to get proprietary data off-site, and it’s nearly impossible to track. 

How do you spot a malicious insider? 

A 2019 Security Today article points out risk signs that an employee might be up to no good or desperate enough to feel that stealing from your company is their best option. These risk signs include: 

  • Extreme interest in matters outside their role and job duties
  • Working odd hours without authorization
  • Excessive negative commentary about the organization
  • Signs of drug or alcohol abuse, financial difficulties, gambling, and poor mental health

As with all cloud and cybersecurity matters, reducing your risk of a data breach by malicious insider isn’t just one person or one department’s job. 

“HR and IT security teams should be vigilant in the wake of significant organizational events, such as a layoff or if an employee believes they are going to receive a promotion and do not,” says Security Today. “Most important is coordination between HR and IT security around these events.”

Of course, it’s important to remember that two-thirds of total data records compromised in 2017 were the result of inadvertent insiders. So while there’s still a significant chance of purposeful, malicious breach, it’s probably more important to defend your organization against the people who don’t know any better. Here are some steps to take to do so, and here’s how the Applogie platform puts automated protection in place. Try it today for free!


The riskiest types of insider security threats

For a few years now, research has shown upwards of 60% of all cybersecurity attacks against corporations have been committed by insiders – employees, partners, vendors, etc. And according to the Ponemon Institute’s “2018 Cost of Insider Threats” report, the average cost of insider incidents was $8.76 million in 2017 – more than twice the $3.86 million global average cost of all breaches during the same year.

It’s not a pleasant thought – knowing the biggest risk to your organization comes from the people you trust with your most sensitive systems, data and logins.

What’s even tougher, though, is not knowing what exactly that insider threat looks like. Who is it that you have cause not to trust? Should you have been more careful with your hires, your background checks, your PC monitoring? Not necessarily.

When Teramind determined four separate types of insiders that could be threatening your organization, they did include the two “blockbuster movie hacker” types you might be picturing:

  • The malicious insider: “Insiders that steal data intentionally, or destroy company networks – such as an employee that deletes company data on their last day of work.” These are your disgruntled workers, scorned staff, passed-up-for-promotion professionals. While the possibility of this type of attack is real, it would take someone in a very specific position to do real and lasting damage to your organization’s data without serious repercussion.
  • The professional insider: “Insiders making a career off exploiting network vulnerabilities, and selling that information on the DarkWeb.” These are the guys they make movies about … the moles, the ones really committed to the long con. Again, this threat is possible but not probable – especially for most types of organizations (no offense).

Here’s the thing. Most of your employees care about your organization and want to do a good job – or at the very least, they want to do a job and go home. They’re not out to get you at a global level, and they probably don’t have all that much to gain from sneakily stealing your data. Unfortunately, they’re the scariest ones.

Two-thirds of total data records compromised in 2017 were the result of inadvertent insiders, according to the “2018 IBM X-Force Threat Intelligence Index.” These inadvertent insiders take two primary forms:

  • The oblivious insider: “Insiders with important access to company information that have been compromised from the outside. Because the system is monitored from the outside, the employees are usually oblivious to the act,” and
  • The negligent insider: “Insiders that are usually uneducated on potential security threats, or simply bypass protocol to meet workplace efficiency. These employees are most vulnerable to social engineering.”

Often, oblivious and negligent insiders are one and the same. They’re the employees who didn’t pay attention to training, didn’t follow the practices outlined in those trainings and then – when this lack of protocol-following made them vulnerable – didn’t recognized the signs that their system had been compromised from the outside.

As we mentioned earlier this year, Verizon’s 2018 Data Breach Report found that an average of 4% of targets in a phishing campaign will click, and that people who have clicked once are more likely to click again. Sure, you could generalize about who these employees are most likely to be, but it’s more effective to make sure everyone takes part in regular training reminding them of the signs of phishing campaigns and how to respond if they think they’re an attempted target.

You should also make an effort to squelch one of the most common ways threats enter your organization: through what we like to call the connected compromise.

When researchers at Virginia Tech University and Dashlane analysts carried out one of the largest empirical studies (on a database of 28 million users and their 61 million passwords), on password reuse and modification patterns, they found 52% of people use the same passwords (or very similar and easily hackable ones) for different services – most of which are outside your organization’s purview.

That’s one of the places Applogie comes in. With our data breach discovery feature, you have access to the security of your users’ other accounts, in near real-time, and without compromising their privacy. Here’s how it works: when you know that an insider’s account has been a victim of a data breach somewhere else online, you can prompt that employee to change his or her corporate password and login info immediately. This greatly reduces the chance that your own corporate systems are at risk of a breach.

Nobody wants to think they can’t trust their employees, and nobody has time or energy to spend worrying about the potential “call coming from inside the house.” We can help.

Ready to see what Applogie can do? Give our platform a no-strings-attached spin with a free trial today.