14 Mar 2022

Blogpost, eLearning creativ technologies 0 comment

Can an LMS be hacked? Make sure that does not happen!

Online learning has become a crucial part of our lives in the pandemic. Cyber awareness training takes so much of a company’s time, but it is worth the effort when the LMS does not get hacked. E-learning is happening all the time, but sometimes that can cause problems when your security details are shared with unwanted people.

Issues arise when the company’s LMS gets hacked or when a MOOC’s website is compromised.

Hence, these organizations must ensure that the users cannot log in without providing an OTP. It will prevent unauthorized users from accessing the accounts of learners. This can be the adverse consequence when an LMS gets hacked:

Hackers can take loans and steal mail

Hackers can get access to so much valuable information through login credentials. This can include the user’s bank details, which can be further used to take credit. But this can be stopped through a credit freeze, where the users can ensure that no one can apply for a credit card or a loan when such a freeze has been imposed. When you need a loan, you can unfreeze your account.

Apart from that, the unsuspecting users of such e-learning sites can also have concerns when someone gets access to their house address and pays a visit. He can check the mailbox and steal all kinds of items, such as passport numbers included in confidential mail.

The learners must make sure that they do a follow-up whenever they have not received any mail from an organization. They know if their mail has been stolen by someone else in such a situation. When they are not in the house, they must ensure that their mail is received by someone else so that it does not go into the hands of fraudsters. If someone is not available to collect your mail while on vacation, it’s better to ask the sending organization to delay it until you arrive. Apart from passport numbers, thieves can get access to all kinds of information through your mail, such as school records, utility bills, etc.

Solution 1: Limited number of login attempts

The e-learning companies USA must ensure that the users are given an extra layer of protection when they log on to the LMS through their business’s website. Any user must be unable to access the LMS after three attempts to log in. His access must be blocked because, generally, a user can’t enter an incorrect password three times. It could be hackers trying to get into an account using brute force algorithms.

Solution 2: Anti-spam feature in the LMS

The users must also be given a reCAPTCHA option so that no bot can access the LMS. Also, the user data must be protected on the server’s end. Only specific LMS administrators must have access to this server so that no one can steal this confidential data. The company getting an LMS from the e-learning vendors must ensure that it has features such as anti-spam. It makes sure that no one can access the LMS through spam email accounts. Once any spammer creates an account on an LMS, he can install ransomware on the server and access all user details. They can then ask for a hefty ransom to get back access to all its LMS files. Even if such spammers don’t install ransomware on the server, they can still send learners phishing emails and access sensitive information like banking details.

Solution 3: LMS access allowed through specific IP addresses

It’s the job of the e-learning vendor to check that anyone cannot register on the LMS. The permitted users should only be from certain specific domains, like the corporate website or an e-learning portal created for this purpose. Anyone else logging from his email ID should not create an account. Furthermore, the company should ensure that no one has access to the e-learning portal except the employees. But even if the URL gets known to others, its access must be allowed from specific IP addresses. Hence, the businesses must ensure that the LMS security is taken care of properly by the e-learning vendor.

Solution 4: Automatic Backup

An LMS vendor must also have backup support if the servers get hacked. In the absence of a backup, the e-learning content is also lost apart from user details. Hence, its LMS software must have the capability to create a backup every night on the dedicated server of the LMS vendor. When a backup option is there, companies are saved from the hassle of recreating all the e-learning content from scratch.

The LMS vendor must ensure that the users’ systems don’t get hacked by fraudsters. Hence, the LMS must come bundled with antivirus software to scan the users’ computers and alert them about any virus installation.

Solution 5: Access through OTP only

The LMS vendors must also ensure that the software is compatible with the mobile phone. It’s because any app can be hacked quite easily; hence it’s the job of the LMS vendor to check that the users can only log into the app through the OTP protocol so that anyone who has downloaded the app can’t log on to it. Also, all the data transferred through the app must be encrypted to protect it from hacking.

This is how an e-learning vendor can prevent an LMS from getting hacked.

Learn more…

24 Jan 2022

Blogpost, eLearning creativ technologies 0 comment

Can companies prevent ransomware attacks through RDP with cyber awareness training?

Ransomware attacks have become commonplace, and their danger is increasing.

It’s because companies can only fight them once employees get the crucial cyber awareness training.

After all, once such software is installed on the systems the companies have to experience downtime affecting their reputation.
CAN Financials paid the largest amount of 40 million USD as ransom in March 2021 to hackers. But most importantly, hackers got access to confidential data of its clients, i.e. the insured.
Hence, employees must have due training to detect such attacks in time. Insider attacks are also common when they upload ransomware on the system. RDP(Remote Desktop Protocol) is now the most common way to upload ransomware on systems.

What is RDP?

Over time, RDP has become an increasingly common way for employees to access their systems once they are not present near them. This happens because employees are working from home on their laptops but need to work on some files stored on the office computer. So, when the employee works in a hybrid model and uses the office PC sometimes but does not have time to transfer them to a USB for use when he is working from home, he can use RDP. In RDP, the user gets access to the desktop of his office PC and all the files stored on the PC can be edited by him.

Through the internet, the keystrokes of the user on his home PC’s keyboard are transferred to his desktop PC.

The RDP method of connecting the home PC to the office desktop pc allows companies to keep a tab on their operations because they can monitor when an employee logged into the remote desktop client software to access the desktop PC. The user can locally get printouts of documents available on his office PC. In RDP, the keystrokes of the user are encrypted through 128-bit RC4 encryption. The user can also store his files on the office PC through the copy-paste functionality through a shared clipboard. Through the remote desktop functionality, since the users get control of the office PC, they can run any software installed on it.

So, it makes sure that they don’t have to install the software on their home PC. Although RDP, is a time-saving feature, the problem arises when a hacker gains access to an office PC because he has somehow accessed an employee’s credentials. Therefore, organizations need to follow some guidelines for the prevention of such unwanted intrusion. The organizations must ensure that all the PCs in the office are not accessible through the RDP, especially those containing confidential data.

Hence, cyber awareness training can help employees who are using the RDP to work safely. They can be taught how to change the RDP port because port 3389 is used by Microsoft to provide access to any RDP request. This port whenever it’s open due to the RDP connection can be discovered by any port scanner and hence the hackers can intercept the keystrokes.

Prevention of brute force attacks

The organizations must also be cautious regarding who is allowed access to a network. This can happen because hackers use brute force attacks to get the password to an RDP connection. Brute force algorithms try hundreds of passwords before they figure out the correct one. Hence, the organizations should block logging in through RDP client software once a certain number of login attempts fail.

Also, employees should only log in to the RDP through their email addresses, which will make it tough to access their systems even if brute force algorithms are used for cracking passwords. Employees should make sure that their email IDs are not disclosed unintentionally to anyone.

Employees can also use strong passwords to prevent any brute force algorithm from finding them. Apart from that, a company should use Remote Desktop Gateway Server, which makes sure that 2-factor authentication is there, in which case an employee can’t log in to a remote desktop without an OTP. This is the server through which all the connections to the RDP server pass through. So, the remote desktop gateway server minimizes the chances of the remote desktop server getting hacked because the latter has a private IP address and hence the connections to this server have to be routed through the gateway server.

05 Jan 2022

Blogpost, eLearning creativ technologies 0 comment

Can cyber awareness training protect employees from keylogging software?

Cyber awareness training must include the prevention of installation of the keylogging software because they are now the most prevalent method of cyberattacks along with phishing.

The training of the C-level employees is important too because any data breach with them makes the company more vulnerable. They have access to the most sensitive data of the company, and hence their training should be a priority.

Companies are implementing cyber awareness training but still, problems get caused due to the ignorant attitude of employees. The companies hence have to make sure some checks are made mandatory for company employees. For example, a company needs to make sure that if there has been a security lapse, it is reported on time. An employee could be browsing some unanticipated sites, leading to malware getting downloaded on his PC. His fellow employees could report his behavior and then action could be taken on time and the malware could be removed from his system. But the reporting employees’ identity should be protected so that he does not face any consequences of his actions. The employees could be informed about the hotline for filing complaints through sticky notes etc.

What is keylogging software/hardware?

In a specific case, when an employee has left the company but still has access to a system through a keyboard capture/keylogging software because this software allows him to get access to an office PC as he is aware of the credentials of other employees. This is because once such software is installed on a PC; it allows the ex-employee/hacker to know the keystrokes which are entered on the computer. The victim on whose PC this software is installed does not know that this software is running in the background while he is doing his work.

Keyloggers don’t need to be only in the form of software. There are such devices, too, attached to the computer or the keyboard that can intercept the keystrokes.

Such software/hardware allows a lot of privilege to the user because he can get all the information such as the webpages visited by a victim and text which is copied and pasted. This key capture software is used when the parents want to monitor what sites children are visiting in their absence. It’s because such software can read what the children type in the browser.

How to tackle them?

Incident response plan

Employees must be made aware of how pivotal a role they play in the cybersecurity of the company. The cyber awareness training is not a one-time event, and it should be imparted continuously for best results. In a situation, when a company has detected that a key capture software is getting used, it must have an incident response plan in place.

The employees should be given all the details about the incident response plan to be implemented in case a security breach happens. All the participants should be trained about their specific roles in this plan.

Prevent installation

The employees have to be elucidated about how they can prevent the installation of a keylogging software on their system, which can happen in many ways:

Antivirus software: A user should have antivirus software installed on his system so that when he gets an email from an unauthorized source, he does not open it. Even though he might open this email, he must not download and install the email attachment including games too. A keylogger can also get access to a PC when a user visits a malicious site that has an expired security certificate. Such websites can also download a payloader software to the system, which can download and install a keylogger.

He should also not open up malicious popups and click on any mp3 files on the internet to play them and any YouTube videos.

But installing the antivirus software is not a sufficient technique to block the keylogging software. It’s because the latter software are getting invented all the time and the antivirus software can only block the installation of known software included in its database. It takes time for antivirus software to recognize any new keylogging software on the block and discover how to prevent it by creating specific signatures for its detection.

Hence, how to prevent keyloggers from finding your keystrokes?

Virtual keyboards

A user can also ensure that the keylogging software is not able to detect his keystrokes when he is using a virtual keyboard. This is because through this software the user does not press the keys on the keyboard hardware to type, but instead uses the mouse to touch the keys on the virtual keyboard, which can’t be traced. The windows operating system already has this feature enabled in its “accessories”.

The virtual keyboards were not invented for stopping keylogging software from detecting keystrokes, and such software can capture the keystrokes of such keyboards too. The reason behind the generation of such keyboards was to help the physically challenged computer users who could not type to enter the keystrokes by touching the mouse. Hence, they have to be invented exclusively for blocking such software.

Using an encryption software

Encryption can only help you in protecting against data theft through keylogging software. Through cyber awareness training, employees can be taught about how to use anti-keylogging keystroke encryption software. The keystrokes are encrypted through this software and can’t be detected by any keyloggers installed on the PC.

20 Aug 2021

Blogpost, eLearning creativ technologies 0 comment

Make employees learn about the safety of home PCs through an LMS

In our age, implementing an LMS is an absolute necessity to deliver knowledge to employees. Employees indeed need to be trained consistently to ensure that an organization reaches its peak level of success. Cybersecurity is quite important for organizations to make sure that the employees are safe in their workspace.

It is crucial because employees are working from home and use company servers to access data. Although VPNs are getting used to protect the company networks, they are still prone to attacks through user errors.

As per security reports, there has been a huge increase in mobile phishing attacks. There has been a huge rise in such attacks between the times since October 2019-March 2020. This has happened due to user mistakes.

Training software is required to make sure that employees protect company systems while working from home. Since it’s so necessary, such kind of training can’t be for a short duration.

The LMS needs to be updated with cybersecurity materials to ensure that the employees look for warning signs to protect themselves from phishing.

When a child is using your system

Cyber-attacks have increased because employees use social media also. But with proper cybersecurity training, employees can inform their companies on time about any potential threats. Employees need to know that their home devices can be hacked also. It can happen when someone hacks their home Wi-Fi.

For example, someone can introduce viruses into the home PC when it is used by a child to access a gaming site. That means compromising the system and giving access to VPN credentials. Even mobile phones used to access office emails can be hacked when a nefarious site is opened.

Make sure employees use the LMS to learn about cybersecurity

Through an LMS, employees can be taught about the rules of cybersecurity. An LMS can make sure that employees partake in games, where they are asked for their response to a phishing situation. An employee with the correct answer is rewarded with tokens. So, an employee with the maximum tokens can be given the awards such as “the best employee of the year”. This way, employees can be encouraged to receive training about the latest phishing trends.

Businesses need to understand the importance of cybersecurity because if the LMS does not contain information on it, the whole system can be compromised. The employees must comprehend how important it is for them to protect the data of the company.

What to do when hackers have accessed the router?

The hackers can get access to the router’s password. Once this password, is compromised, he can attack all the systems in your home. There are many signs of what happens after a router has been hacked:

Low bandwidth: The hacker will take advantage of your bandwidth, which implies you won’t have much left to use. You will suffer from the problem of slow-loading sites, which can affect your work.

Compromise of firewall: Once the hacker can install some malware on your system, the firewall becomes disabled, leading malicious websites to open up on the system. Viruses can be unleashed on your computer, stealing all the critical data. They can also start operating the computer by themselves. They can also check all your internet activity to know which sites are getting accessed.

The employees of a company can be sent videos through the LMS to detect if any hacker has been accessing their home systems.

The employee has to follow certain basic steps:

Log into the computer: He has to log in to the computer using his own username and password. Once he has logged in, he then has to type the router’s IP address in the browser’s URL bar.
Find the connected devices: After that, you can check how many devices are logged into your network. There is a list of attached devices you can check. You might know some devices, but some of them are recognizable through their IP addresses. If you don’t recognize the IP address of any device, this implies it is the device of a hacker. What to do, once you discover such an IP address. The best way is to reboot the router to disconnect such a device from your network.

The first thing you can do is reboot the router. This reset button is located on the back of this device. It’s a hole with the words RESET mentioned on top of it. You have to stick something pointed in this hole to press the button. You have to make sure that this button stays pressed for 30 seconds.
After that release, the button and the router are restarted.
But after that, you have to call the ISP(Internet Service Provider) person at home, to configure the network and start the internet on your PC.

All these steps can be shown to employees in a Zoom call so that their home networks are safe.

13 Jul 2021

Blogpost, eLearning creativ technologies 0 comment

Why do banks need a BFSI LMS?

The world has changed dramatically in the past with new technologies coming to the fore. The service industry has indeed seen a boom, but there are so many complexities also one of which is intense competition.

How can a BFSI LMS help bank employees?

This is true in the case of the financial sector. Banks have to make sure that customers get a prompt response when they ask questions from their executives whether on phone or in person. The banking executives can hence take the help of chatbots who have been programmed to answer the common questions posed by customers. The banking executive can make sure that they ask the chatbots about the perplexing questions asked by customers and using the keyword of questions, these bots respond within seconds.

Apart from chatbots, many new technologies are getting used by banks, including a BFSI LMS.

This is because such LMS can help companies train employees effectively about new compliance laws. There can be huge consequences for defaulting banks. In case they are unable to follow a compliance law, a bank may have to shut down. These are the new laws due to which the implementation of a BFSI LMS has become necessary:

New Banking laws in the US:

Computer-Security Incident Notification Requirements for Banking Organizations and Their Bank Service Providers

Cybersecurity is one of the critical concerns of banks, especially since there has been digitalization of their services to please the customers. Although services like Net Banking have been introduced, there is a need for a lot of security so that no data breaches occur through the bank’s server. In January 2021, the Board of Governors of the Federal Reserve System, Federal Deposit Insurance Corporation (FDIC), and the Office of the Comptroller of the Currency (OCC) proposed a new rule as per which banks are supposed to inform the OCC within a maximum of 36 hours if they believe that a cyber attack(“notification incident”) has happened. This kind of communication can be in verbal or written form also. A notification incident is defined as something that can stop the banking operations or the provision of banking services and goods.

Apart from that, if there is a cyber attack on a bank service provider, which could ensure that its services to the bank are going to be affected for four hours, then it’s his job to inform at least two persons at every bank.

Corporate Transparency Act:

There is also an imposition of anti-money laundering laws known as the Corporate Transparency Act. As per it, the financial institutions if they have a business customer who opens accounts with them, then they are supposed to get all his details. Business customers often open accounts with banks to conduct a transaction on behalf of legal entities owned by them. So, such business customers known as beneficial owners in legal terms are defined as someone who has ownership rights of 25% in an entity or has major control. Such an entity is defined as Limited Liability Companies and Corporations.

So banks are supposed to train their front-line staff about all such new regulations through a BFSI LMS.

Other advantages of a BFSI LMS:

A BFSI LMS ensures that the banks can also monitor how well the learners are reacting to it. They can allow more participation rates for employees because after going through each nugget, they are sent a survey in which they can provide feedback. The learners can also be checked for their gained knowledge through an assessment. Sometimes, the internet connection is not steady in some branches of a bank due to which the BFSI LMS must be accessed offline.

So, this is how a BFSI LMS can help banks in updating their employees with the latest compliance laws.