Author Archives: Tori Pazda

The Zerologon Vulnerability and its Long-term Impact

What does it mean exactly when a vendor stops supporting software and declares it end of life? Effectively the vendor is telling the world to stop using that software because if it breaks they won’t fix it. Most importantly this applies to newly discovered security vulnerabilities. The risk created by vulnerabilities within an Operating System do not cease to exist the day the vendor stops supporting it. What does cease to exist is the ability to mitigate those risks through vendor released patches.

Consider the Zerologon vulnerability recently discovered within Microsoft Windows Server. If exploited this vulnerability would allow an attacker access to the highest-level privileges within an organization’s Windows infrastructure. From there the damage an attacker can inflict is limited only by his or her imagination. The vulnerability is serious enough that the Department of Homeland Security released a directive to take immediate and emergency action to patch servers.

Fortunately, Microsoft released a patch in August to address this vulnerability within Windows 2012, 2016 and 2019. Unfortunately, the vulnerability exists within Windows 2008 which reached end of life on 1/14/20. Microsoft is not releasing a Windows 2008 patch unless an organization purchases a yearly subscription for extended support. The bad news doesn’t stop there. The vulnerability is only truly addressed when all legacy authentication protocols within older Operating Systems are blocked. Microsoft has stated that it will end support for these older protocols on patched systems as of February 2021. This will effectively prevent any unpatched Operating System from interacting with patched systems. That leaves organizations with 3 options:

Retire all systems running end of life Operating Systems and migrate to a modern OS or NextGen Platform
Purchase extended support for all end of life Operating Systems
Override the changes made by the patch and allow end of life Operating Systems to continue operating within the network.

Contact Thrive so we can assist your organization with option 1 (…and please don’t choose option 3).

Interested in learning more? CONTACT US TODAY!

Desktop Computing for the Remote Workforce

During this year of changes and challenges, we have been forced to evaluate and pivot in almost every aspect of life. The list is endless and includes everything from grocery shopping to education. At the same time most of us can say our cars are parked and we are living the “work from home” life. We’ve talked previously about the importance of maintaining a robust cyber security strategy, but as more than 60% of the US workforce is now operating from home due to COVID-19 it is important to evaluate the best approach to enable end users with scalable and supportable compute capabilities that also align with cyber security best practices.

Virtual Desktop Infrastructure (VDI) solutions have seen increased use over the years but the significant capital costs associated with establishing a VDI environment, combined with additional costs to modify that environment as business and security requirements change have limited the growth of VDI infrastructure, especially with medium sized businesses. This has opened the door for the increased use of hosted Desktop as a Service (DaaS) solutions particularly from private, multi-tenant cloud environments like ThriveCloud.

Regardless of your solution provider, DaaS solutions can be spun up quickly, are extremely scalable, integrate company security and compliance requirements, and also provide ease of access from low cost devices across just about any internet connection. From a solution support perspective, each of your workforce members now has a similar desktop that can be easily accessed by support personnel for quick problem resolution. Further, ease of system maintenance and application deployment are among the many advantages of DaaS solutions.

Now is the time to consider reducing costs for data center infrastructure and end user hardware while realizing workforce and support efficiencies by evaluating DaaS for your organization. As the remote workforce continues to evolve how will you maintain position from an infrastructure and security perspective while meeting the needs of your team members?

Interested in learning more? CONTACT US TODAY!

The Best (And Worst) States For Solution Providers In 2020

Massachusetts (No. 6 overall) ranked No. 1 in workforce education and experience in this year’s Best States analysis. That’s important to Rob Stephenson, CEO of Thrive Networks (No. 278 on the CRN Solution Provider 500), a Foxborough, Mass.-based IT solutions and managed services provider that prides itself on what Stephenson calls the company’s “white glove service.” That requires employees who are not only proficient in engineering and technical skills, but people skills as well.

“We have some of the most talented engineers and dedicated employees in the industry,” Stephenson said. “We have a very, very strong group of individuals here.” Thrive has multiple offices in Massachusetts, offices in Manhatten, Dallas, San Francisco, Chicago, Charleston, S.C. and Columbia, Md. The company also operates a security operations center in Portland, Maine.

Thrive Rebuilds Critical Infrastructure to Improve IT Operational Efficiency and Patient Care for Medical Provider, ENT Specialists. Download Now

CHALLENGE

Crippled by outdated servers, ENT Specialists faced daily operational problems, making it difficult for physicians to service their patients. At times when electronic medical records were completely inaccessible to providers, the practice would have to close and the business lost revenue. ENT Specialists turned to Thrive to create a solution that would stabilize their infrastructure quickly, allowing them to keep their business running consistently and efficiently.

SOLUTION

Thrive stabilized the foundation of the network and updated the switches in ENT’s environment to all new Meraki equipment, managed by Thrive’s top-tier engineers. Additionally, Thrive installed managed firewalls to replace legacy firewalls and improve security and visibility. ENT Specialists’ outdated servers were virtualized, and their medical records moved off premises into the eClinicalWorks SaaS offering. The company has continued to migrate more business-critical applications into Thrive’s private Cloud solution, ThriveCloud, as well as an Office 365 environment. As a cybersecurity measure, ENT Specialists adopted Thrive’s end user security services. Utilizing Thrive’s Security Team, the company gets monthly phishing tests and mandated quarterly cybersecurity awareness training for their employees.

RESULT

With the infrastructure built by Thrive’s team, ENT Specialists no longer face daily technological interruptions. Physicians continue to service their patients without the fear of losing access to their medical records. The increased capabilities have allowed ENT Specialists to grow in new directions. The company has onboarded new physicians, launched its FYSICAL® Dizziness & Fall Prevention Center, and is adding more locations.

“Thrive’s NextGen Cloud and Cyber Security solutions are critical to our business and patients. Every minute counts in healthcare, and that’s why we turned to Thrive to provide a swift, secure and innovative update to our IT infrastructure to ensure patient care isn’t compromised.” ~ Debbie Joyce, Operations Manager, ENT Specialists

How can Thrive help your business?

Thrive is a leading provider of outsourced IT Infrastructure designed to drive successful business outcomes with our talented engineering teams and suite of Cloud-First, NextGen Managed Services.

To learn more about our services, CONTACT US

Managed Microsoft 365 Meet Modern Security Needs with SIEM-as-a-Service

Organizations face constant cybersecurity threats and the numbers are staggering. The NextGen cybersecurity experts at Thrive offer a Security Information and Event Management solution that delivers comprehensive investigation, analysis and remediation. Secure your organization 24×7.

If you’re ready to experience NextGen managed security, talk to a Thrive expert today. CONTACT US

How To Use Microsoft Bookings to Manage Returning to the Workplace Safely

Microsoft Bookings, an app included in Microsoft 365, is a scheduling tool that allows customers to easily book appointments with a company. The app incorporates a web-based calendar that integrates with Outlook, ensuring availability always stays up-to-date. Customers can easily schedule appointments during available time slots with the team member of their choice, cancel and reschedule bookings, and enjoy auto-generated emails to keep all parties notified.

The following Microsoft licenses include Bookings:

Microsoft 365 Business Standard
Microsoft 365 A3
Microsoft A5 subscriptions
Office 365 E3 and E5 subscriptions

Components of Microsoft Bookings

Business Information

All details about your business are configured in the Business Information section. These details, such as your business name, address, phone number, logo, and hours of operations, are visible to your customers.

Microsoft Bookings Business Availability

Services

Business offerings are configured in the Services section. You can specify details such as:

Service location (virtual or physical)
Service description
Pricing
Staff member assignments
Maximum number of attendees per service

Staff

The Staff section is where you can specify all items relating to the members of your team relating to the services they provide. This can include:

Assign to specific services
Services the business provides
Hours of availability for each staff member

Customers

When users schedule an appointment or book a service, they are automatically added as a customer in your Bookings app.

Customers can be added manually or imported from a .csv file.

Bookings Page

The Bookings Page is where major app details are configured and where the app is published. These details include:

Selecting a color scheme/theme of the Bookings app
Setting the time zone
Setting email notifications
Requiring customers to have an Office 365 account to use the app

Calendar

The Calendar is for internal use only — it is only accessible by staff members. All Bookings made by customers will populate in the Calendar. The Calendar view can be switched around to display bookings by Day, Work Week, Week, Month, or Today. Clicking on each booking will display all the information regarding that specific booking.

Home

The Home dashboard displays an overview of the number of bookings made, the estimated revenue from all bookings, and the number of unique customers that have booked.

The Problem

The COVID-19 pandemic forced companies to quickly transition to working remotely. As the pandemic settles and work-from-home mandates are lifted, businesses will have to adjust, once again, to ensure a safe return to the workplace. One of the main priorities during return to work operations is limiting capacities to ensure social distancing is possible.

The Solution

At Thrive, we pride ourselves on discovering ways to leverage existing tools in the Microsoft 365 ecosystem to fulfill even more business needs than they were originally intended for. Why not utilize Microsoft Bookings to ensure a safe and socially-distanced return to the workplace?

By utilizing the Services section for your office building, room, floor, or workspace, you can automate monitoring and limiting capacity with ease. The Staff section can be used for reservations and the Customer section can be used by employees who would like to come into the office.

The Fine Print

The ‘Maximum Attendees’ feature in the Services component doesn’t always work as seamlessly as we would like.

The key to successfully limiting the number of people that can book on a specific day is to add the exact amount of staff members, listed below as “reservations,” as a guideline for the maximum capacity for the office. In other words, make the total number of staff members equal the maximum capacity of people allowed in the office at once to restrict any more appointments.

Bookings require at least one staff member per booking. With three added staff member reservations and myself as an Administrator (by necessity), the app will allow four bookings per day—and nothing more. Even if ‘Maximum Attendees’ was set to one or two, the app would still allow four users to book—which is why this workaround is necessary to get the app to behave how it is intended to.

For this to work, the Availability for the Services must be set to “Bookable when staff are free.”

Takeaways

We encourage you to try customizing your Microsoft features to best fit your needs. Microsoft Bookings’ capabilities reach far beyond simply scheduling and can be a great way to assist with keeping your team safe while returning to work.

As always, Thrive is here to help you keep up with these quick transitions. If you would like assistance to get the most out of your Microsoft 365 investment, please contact us today.

A Brief Explanation of Encryption and Why it Matters in the Cloud Age

Encryption has become so ubiquitous that one could assume that most people understand what it is, how it is used, and why it is important in the digital age. Of course, we all know what happens when you assume, right?

Simply put, encryption is how the content of a message between two or more trusted parties is hidden from untrusted or unintended recipients of that message.

In the early days of the Internet, there were no widely used methods to encrypt information sent over public or private networks. As a result, any individual with basic skills could intercept and read content as it was sent over a network to which they had access. For the Internet to grow into a digital marketplace, it was critical to secure sensitive data as it was in transit. To accomplish that goal, engineers at Netscape created the SSL protocol to encrypt content as it passed from webserver to web browser. SSL has since been replaced by TLS, but the underlying mechanics remain the same.

A web browser extracts the public key from a website’s certificate
The browser generates itself a new key, uses the website’s public key to encrypt it, and sends the new key to the website’s server
The server then decrypts the key using its own private key and uses that new key to encrypt all information exchanged between the web browser and website

The exchanged cipher keys are how text can be encrypted and then translated back to the original text. Whether data is at rest or in transit, encryption of that data still relies on cipher keys to encrypt and decrypt that data. Thus, encrypted data is only as secure as the keys used to encrypt that data.

In the modern cloud era, it’s safe to say that most data is encrypted as it’s transmitted and stored. The important question to ask is who has access to the keys used to encrypt that data. This is particularly important as more and more organizations move their data to Cloud Service Providers (CSP). It’s a given that nearly every CSP will encrypt your data, but how will they secure the keys used to encrypt that data? Do they support BYOK (bring your own key) options? If so, do you have the in-house expertise and infrastructure to deal with the added responsibility of managing your own encryption keys?

These are but a few questions that any organization should consider when moving data to CSPs. However, it’s important that business owners and decision-makers first understand the basics of the underlying technology used to secure their data before evaluating the answers to those questions.

Interested in learning more? CONTACT US TODAY!

Automation is Everywhere!

As you navigate everyday life, have you taken a moment to stop and think of how many things are automated. Almost every stoplight you pull up to has a sensor that ensures that the system controlling the traffic light knows you are there and then plans to change the sequence of red and green lights accordingly. More and more people have thermostats that are connected to the Internet that learn the behavior of the inhabitants and create a custom schedule to use as little energy as needed daily but keep the environment to their liking. Toll booths are becoming a thing of the past as cameras and RFID chips are being used to collect fees that were collected by humans in the past.

Over the last three years, we have been looking for ways to automate tasks as well. Why would we want our valued customers to have to wait any longer than needed to get an issue or task resolved? As we provide a varying array of services for different customers, we needed to make sure that we built a foundation that could scale across all the services. The foundational piece needed to be user friendly to the customer while being able to integrate with the enterprise-class solutions that we utilize to deliver NextGen managed services. After a long analysis of the options, ServiceNow was chosen as the foundational piece of the platform. As each customer is brought onto the platform, we work to understand their business and where automation of common IT tasks will provide a reduction of time to resolution and a more consistent outcome.

As an example, resetting passwords is usually a high-volume type task for most organizations. Historically the user would need to open a request with the helpdesk and then wait for someone to get back to them with a temporary password. With automation, the user can reset their password on their own within a minute after logging into the Thrive customer portal. As Thrive continues to build out more automation, Office 365 licensing and management, tasks will be incorporated into the customer portal. For instance, creating a new user may happen by filling out a form. Once submitted, the accounts and licenses will automatically be created and assigned to that user.

Interested in learning more? CONTACT US TODAY!

Biopharmaceutical Firm Relies on Thrive’s Life Sciences Industry Expertise to Transition to a Secure, Optimized IT Infrastructure – During a Global Pandemic. Download Now