To say that I’ve been in the IT world for a while is an understatement.
For those who don’t know me, I left big business in 2003 to start Clark Computer Services. I didn’t have some grand vision, I had three kids at home who needed to have their Dad around. My plan to replace my salary was to go around Frederick, introduce myself to small business owners, and see if they needed IT support. What I found were a lot of business owners dealing with subpar IT service. Making customer service my highest priority helped me to build a successful and thriving company, but that’s only part of it.
Let’s be honest, most computer technicians don’t understand that The IT Business is 80% Personal – so setting myself apart was not difficult. But if you really want to make customers happy in IT, you do your best to prevent them from having to call you at all. I didn’t want to just provide my clients with a smiling face and a friendly attitude, I wanted to make them happy, so one of my primary focuses has always been Maintenance.
When people think of IT Maintenance, a lot of things come to mind:
- archiving old files
- computer cleanups
- firmware updates
- hardware checks
- network patching
- security updates
- software updates
- system updates
There is one recurring word here that is incredibly important.
A huge part of all of our maintenance contracts – whether Small Business or Residential – is handling updates. Many people have been learned to be cautious of performing updates, very often preferring to leave them to more experienced IT people – just in case. One of the things that I saw very early on when building CLARK, was a lot of small businesses with hardware and software that had not been updated at all. Not coincidentally, these were also the people with the worst experiences.
Whether we are talking computers, tablets, phones, or network servers, updates fix potential problems. They also often include new features or services, such as Snip & Sketch. But most importantly, they fix security vulnerabilities, like this one:
Emergency Security Directive!
This vulnerability has received Microsoft’s highest severity rating – 10 – but they didn’t publish the details of its impact. However, on September 11th, 2020, the Dutch security firm Secura BV published a report with these details:
This vulnerability affects Windows Domain Controllers which act as the security gateway to network resources such as your shared file system. The cryptographic authentication process used by all Windows domain controllers contains the vulnerability which can be used to change computer passwords.
In a nutshell, this means that a cybercriminal can gain administrative access to your systems with the click of the mouse. All that is required is for them to gain access to one device on your network. From there, he or she can gain administrative access to every computer on the network and all the data they house.
If the agency in charge of securing our nation’s technical infrastructure is advising all federal agencies to apply this update, then everyone should.
The high-level answer is every business using a Windows domain. Most small businesses use computers running Microsoft Windows. If your business does, and it also uses one or more Windows servers, then chances are your systems are on a Windows domain.
For one simple reason, your information is at risk! This is one of the most dangerous vulnerabilities to a network operated by Windows Servers. With this exploit, a cybercriminal needs to only compromise an employee’s computer – this could be through a phishing attack, social engineering, password cracking, malware, etc. With access to one computer, the cybercriminal simply needs to run the exploit against your domain controller and they will have unrestricted access to all your networked computers and servers, as well as the information they contain. Pretty scary!
Apply the updates ASAP. There is no other way to say it – this update is important and by applying it you can avoid the results of a successful hack attempt using this exploit. It only applies to your Windows server. Click here for a list of servers and its specific link to download the update.
For more information from Microsoft about this vulnerability and how to remediate it, click here.
But You Might Need Help
Stop. Before you rush off and download the update, consider asking for assistance.
This update is a little more complex than it seems.
It will be a two-phased update. In the first phase, servers are updated, fixing the vulnerability in the code, but computers requesting authentication will still be able to use the vulnerable authentication process. This will allow computers that have not yet patched their communications channels to still access the network. On February 9th, 2021, the second phase will occur when another update is rolled out. This update – called the Enforcement Phase – will retire the existing communication channel and require the new, secure communication channel whenever a computer requests authentication.
This Enforcement Phase has been purposely delayed.
Microsoft is giving software manufacturers time to update their code – this will allow software packages and other operating systems to continue using the older processes until the final enforcement phase. During this delay, systems are still vulnerable unless further action is taken by visiting each computer to change their settings, requiring them to use the newly patched secure communication channel.
It’s for this reason that I advise seeking outside help, like Clark Computer Services – this gives you the assurance that all steps were taken to protect your systems NOW.
Business or Residential, We Can Help
Big updates like this are not the only reason to seek assistance. In addition to Small Business IT Maintenance contracts, we also offer Home IT Maintenance Plans.
With so many still working from home and doing eLearning, home networks are more important than ever and to keep them running smoothly they need maintenance.
Since those first days of knocking on doors, I’ve always had residential clients – and we have always given them the same high level of customer service that we provide to our business clients.
I left big business to start Clark Computer Services in 2003; not because I had a grand vision, but because I had three young children who needed their Dad around. Knowing I had to replace my salary, I went door-to-door visiting small businesses to introduce myself and ask if they needed IT support. I heard story after story from business owners and office managers about IT companies not returning calls and emails, grumpy technicians showing up late or not at all, and systems being down for days, weeks, and in some cases…months. I realized quickly that there was a clear and pressing need for reliable, honest, and professional IT support completed pleasantly and on time.