text:
Category Archives: Endpoint security
Introducing the security configuration framework: A prioritized guide to hardening Windows 10
In the past, we left defining the security configuration for Windows 10 as a task for every customer to sort out. As a result, we saw as many different configurations as we saw customers. Standardization has many advantages, so we developed a security configuration framework to help simplify security configuration while still allowing enough flexibility to allow you to balance security, productivity, and user experience. We are defining discrete prescriptive Windows 10 security configurations (levels 5 through 1) to meet many of the common device scenarios we see today in the enterprise.
While building out this framework, we thought: what are key considerations for a security professional in today's world?
What do I do next?
This is the question security professionals must constantly ask themselves. Nearly every security architect I've met with has a pile of security assessments on their desk (and a list of vendors eager to give them more); their challenge is never identifying something that they can do, but identifying which is the next most important thing to do from the massive list they have already identified!
I also get questions from customers who are just now planning their Windows 10 deployment and are hoping to configure as many security features as possible – but since they haven't deployed yet, they don't have guidance from the Microsoft Defender ATP Secure Score yet (we'll discuss that in a minute) – how can they prioritize the features to initially enable? Achieving early wins is a key aspect to driving business value from the investment in this deployment.
Clearly, a key aspect for a security configuration framework is to help drive a smart set of priorities.
Understanding where you lie in a continuum of security is also valuable. You see, there is no perfect score in security; everyone could always get better. What we really need to drive is a cycle of continuous improvement. But without an absolute target to pursue, how do you get a sense of how good is good enough? Looking at the posture of others is helpful. Being the best in security is of course aspirational, but being the worst is something you must avoid! There are other unintended consequences of being the "best" to be mindful of as well. Security configuration may be at odds with productivity or user experience; imagine if you worked for a software company and couldn't test your own code because it wasn't on your organizational safe programs list yet?
I want to be careful not to overemphasize the competitive aspect here. You don't want to go deliberately misleading your peers in the industry – in fact, one thing I'm deeply passionate about is improving cooperation among the people on the side of good. Why is this so important? Because bad people have, through innovations of commerce on the dark web, devised a system of cooperation that is shockingly effective. In an environment of inherent distrust (think about it – literally everyone involved is, by definition, untrustworthy), they work together. We're at a significant disadvantage if we don't learn to cooperate at least as well!
Secure score in Microsoft Defender ATP
In Microsoft Defender ATP, the secure score is the path to achieving this. Through the top recommendations, we suggest a prioritized list for securing your devices, with a relative ranking of the overall impact to your security posture. We are also exploring ways to provide useful comparisons using this framework.
Secure score represents our best recommendations for securing your endpoint devices (among other things). It's context-aware, driven by your existing configuration and the threats impacting your environment.
One of the questions we've been asking is – what should you do if you have not yet purchased or deployed Microsoft Defender ATP in order to compute your secure score? What if you haven't even deployed Windows 10? What if you don't know exactly how to configure a given set of features? We thought we should supplement secure score to help people in all these scenarios with the security configuration framework.
The security configuration framework
The security configuration framework is designed to assist with exactly this scenario. We sat down and asked ourselves this question: if we didn't know anything at all about your environment, what security policies and security controls would we suggest you implement first? We worked with a select group of pilot customers, experts from Microsoft's engineering team, and the Microsoft sales field to develop this guidance.
Rather than making an itemized list, we grouped recommendations into coherent and discrete groups, which makes it easier for you to see where you stand in terms of your defensive posture. In this initial draft, we have defined 5 discrete levels of security configuration. Mimicking the DEFCON levels used to determine alert state by the United States Armed Forces, lower numbers indicate a higher degree of security hardening:
- Enterprise security – We recommend this configuration as the minimum-security configuration for an enterprise device. Recommendations for this security configuration level are generally straightforward and are designed to be deployable within 30 days.
- Enterprise high security – We recommend this configuration for devices where users access sensitive or confidential information. Some of the controls may have an impact to app compatibility, and therefore will often go through an audit-configure-enforce workflow. Recommendations for this level are generally accessible to most organizations and are designed to be deployable within 90 days.
- Enterprise VIP security – We recommend this configuration for devices run by an organization with a larger or more sophisticated security team, or for specific users or groups who are at uniquely high risk (for example, one organization identified users who handle data whose theft would directly and seriously impact their stock price). An organization likely to be targeted by well-funded and sophisticated adversaries should aspire to this configuration. Recommendations for this security configuration level can be complex (for example, removing local admin rights for some organizations can be a long project in and of itself) and can often go beyond 90 days.
- DevOps workstation – We recommend this configuration for developers and testers, who are an attractive target both for supply chain attacks and credential theft attacks that attempt to gain access to servers and systems containing high-value data or where critical business functions could be disrupted. We are still developing this guidance, and will make another announcement as soon as it is ready.
- Administrator workstation – Administrators (particularly of identity or security systems) face the highest risk, through data theft, data alteration, or service disruption. We are still developing this guidance, and will make another announcement as soon as it is ready.
How do you choose the configuration that's best for your organization? If you're an organization that's already looking to Windows security baselines to provide advanced levels of security (now also available in preview for Intune), then level 3 incorporates these baselines as the foundation. If you're earlier in your journey, then you should find level 5 a great starting point and can then balance the enhanced security of higher levels against your application readiness and risk tolerance.
We are releasing this draft version to gather additional feedback from organizations looking to organize their device security hardening program. You can find the draft security configuration framework documentation and provide us feedback at https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-security-configuration-framework/windows-security-configuration-framework.
We are eager to gather feedback on how we could make this guidance more useful, and if there are security controls and configurations you feel may be misplaced (or missing)!
The post Introducing the security configuration framework: A prioritized guide to hardening Windows 10 appeared first on Microsoft Security.
Analysis of a targeted attack exploiting the WinRAR CVE-2018-20250 vulnerability
In early March, we discovered a cyberattack that used an exploit for CVE-2018-20250, an old WinRAR vulnerability disclosed just several weeks prior, and targeted organizations in the satellite and communications industry. A complex attack chain incorporating multiple code execution techniques attempted to run a fileless PowerShell backdoor that could allow an adversary to take full control of compromised machines.
The WinRAR vulnerability was discovered by Check Point researchers, who demonstrated in a February 20 blog post that a specially crafted ACE file (a type of compressed file) could allow remote code execution. Attackers quickly took advantage of the vulnerability in attacks, including a targeted attack that 360 Total Security researchers discovered just two days after disclosure. The exploit has since been observed in multiple malware attacks.
The use of ACE files is not uncommon in malware campaigns. A combination of machine learning, advanced heuristics, behavior-based detections, and detonation enables Office 365 Advanced Threat Protection (ATP) to regularly detect and block a variety of threats that are packed in ACE files, including common malware like Fareit, Agent Tesla, NanoCore, LokiBot and some ransomware families.
The same capabilities in Office 365 ATP detected malicious ACE files carrying the CVE-2018-20250 exploit. We spotted one of these ACE files in the sophisticated targeted attack that we describe in this blog and that stood out because of unusual, interesting techniques. Notably, the attack used techniques that are similar to campaigns carried out by the activity group known as MuddyWater, as observed by other security vendors like Trend Micro.
Figure 1. Attack chain that delivered the CVE-2018-20250 exploit
Attack chain overview
A spear-phishing email purporting to be from the Ministry of Foreign Affairs (MFA) of the Islamic Republic of Afghanistan was sent to very specific targets and asked for "resources, telecommunication services and satellite maps". The email came with a Word document attachment.
Figure 2. Spear phishing email containing lure Word Document
When opened, the document asks the recipient to download another document from a now-inactive OneDrive link. While the URL was down during our analysis, we still reported the case to the OneDrive team.
The use of a document with just a link—no malicious macro or embedded object—was likely meant to evade conventional email security protection. This didn't work against Office 365 ATP, which has the capability to scan emails and Office documents for URLs and analyze links for malicious behavior.
Figure 3. Word document lure containing OneDrive link
Clicking the link downloads an archive file containing a second Word document, which has malicious macro. Microsoft Word opens the document with security warning. Enabling the macro starts a series of malicious actions that leads to the download of the malware payload.
Figure 4. Downloaded document with malicious macro
Interestingly, the document has a "Next Page" button. Clicking that button displays a fake message signifying that a certain DLL file is missing, and that the computer needs to restart. This is a social engineering technique that ensures the computer is restarted, which is needed for the payload to run. (More on this later.)
Figure 5. Fake message instructing user to restart the computer
Meanwhile, with the macro enabled, the malicious code performs the following in the background:
- Extract and decode a data blob from TextBox form and drop it as C:\Windows\Temp\id.png
- Create a malicious Visual Basic Script (VBScript) and drop it as C:\Windows\Temp\temp.vbs
- Add persistence by creating a COM object and adding autorun registry key to launch the created shell object
- Launch temp.vbs, which is a wrapper for the malicious PowerShell command that decodes the id.png file, which results in the second-stage PowerShell script that is highly obfuscated and contains multi-layered encryption (this PowerShell script is similar to a script that has been used in past MuddyWater campaigns)
The second-stage PowerShell script collects system information, generates unique computer ID, and sends these to remote location. It acts as a backdoor and can accept commands, including:
- Download arbitrary file
- Run command using cmd.exe
- Decode a base64-encoded command and run it using PowerShell
The PowerShell script's ability to accept commands and download programs provided a way for a remote attacker to deliver the malicious ACE file containing CVE-2018-20250 exploit. When triggered, the exploit then drops the payload dropbox.exe.
The next sections discuss in detail the key components of this attack chain.
Malicious macro
The highly obfuscated malicious macro code used in this attack has a unique way of running malicious code by chaining several programs. It first extracts an encoded data taken from UserForm.TextBox, before decoding and saving it as C:\Windows\Temp\id.png. This file contains an encoded PowerShell command that is executed later by the first-stage PowerShell script.
Figure 6. Obfuscated macro code
The malicious macro code then creates an Excel.Application object to write the VBScript code.
Figure 7. VBScript code created by the malicious macro
It then runs wscript.exe to launch the PowerShell script at runtime. The PowerShell script itself does not touch the disc, making it a fileless component of the attack chain. Living-off-the-land, the technique of using resources that are already available on the system (e.g., wscript.exe) to run malicious code directly in memory, is another way that this attack tries to evade detection.
The first-stage PowerShell script contains multiple layers of obfuscation. When run, it decodes the file id.png to produce another PowerShell script that's responsible for the rest of the actions.
Figure 8. Obfuscated first-stage PowerShell code
Figure 9. De-obfuscated first-stage PowerShell script
The decrypted PowerShell script is also highly obfuscated. Fully de-obfuscating the malicious script requires over 40 layers of script blocks.
The second-stage PowerShell script collects system information, such as operating system, OS architecture, username, domain name, disk information, enabled-only IP addresses, and gateway IP address. It computes the MD5 hash of collected system information. The computed hash is used as the BotID (some researchers also refer to this as SYSID).
It then concatenates the hash and system information in a string that looks like the following:
<BotID>**<OS>|Disk information**<IP Address List>**<OS Architecture>**<Hostname>**<Domain>**<Username>**<Gateway IP>
For example:
6e6bdbd3d8b102305f016b06e995a384**Microsoft Windows 10 Enterprise|C:\WINDOWS|\Device\Harddisk0\Partition3**192[.]168[.]61[.]1-192[.]168[.]32[.]1-157[.]59[.]24[.]113**64-bit**<Hostname>**<Domain>**<Username>**131[.]107[.]160[.]113
It then encodes each character of the collected system information in decimal value by applying simple custom algorithm with hardcoded key (public key): 959,713. The result is formatted as XML-like data:
{"data":"665 545 145 145 222 545 222 145 73 367 665 438 438 438 598 616 145 518 616 566 438 [REDACTED] 616 73 145 145 665 518 365 438 316 665 513 513 432 261 181 344}
It sends the encoded data to a hardcoded remote command-and-control (C&C), likely to check and register the infected computer: hxxp://162[.]223[.]89[.]53/oa/.
It continuously waits until the remote attacker sends back "done". Then, it sends an HTTP request to the same C&C address passing the BotID, likely to wait for command: hxxp://162[.]223[.]89[.]53/oc/api/?t=<BOTID>.
It can accept command to download and execute command and sends back the output, encoded in Base64 format, to the remote C2 server using HTTP POST: hxxp://162[.]223[.]89[.]53/or/?t=<BOTID>.
CVE-2018-20250 exploit
In their analysis of the CVE-2018-20250 vulnerability, Check Point researchers found that when parsing ACE files, WinRAR used an old DLL named unacev2.dll that was vulnerable to directory traversal.
Malicious ACE files that carry the CVE-2018-20250 exploit can be spotted through:
- Directory traversal string – The validation from Unacev2.dll for the destination path when extracting ACE is not enough. If attacker can craft relative path that can bypass the checks in place, it may lead to extraction of the embedded payload to the specified location.
- Drop zone – In-the-wild samples commonly use the Startup folder, but it's also possible to drop the file to known or pre-determined SMB shared folders.
- Payload – The malicious payload, as in this attack, is commonly an .exe file, but in-the-wild samples and other ACE files that we've seen use other malicious scripts like VBScript executable.
Figure 10. ACE file with CVE-2018-20250 exploit
The ACE file contains three JPEG files that may look related to the email and Word document lures. When the user attempts to extract any of them, the exploit triggers and drops the payload, dropbox.exe, to the Startup folder.
Figure 11. Contents of the malicious ACE file
Going back to the fake error message about a missing DLL and asking the user to restart the computer: The CVE-2018-20250 vulnerability only allows file write to specified folder but has no capability to run the file immediately. Since the payload was dropped in the Startup folder, it is launched when the computer restarts.
The payload dropbox.exe performs the same actions as the malicious macro component, which helps ensure that the PowerShell backdoor is running. The PowerShell backdoor could allow a remote attacker to take full control of the compromised machine and make it a launchpad for more malicious actions. Exposing and stopping the attacks at the early stages is critical in preventing additional, typically more damaging impact of undetected malware implants.
Stopping attacks at the entry point with Office 365 ATP
The targeted attack we discussed in this blog and other attacks that use the CVE-2018-20250 exploit show how quickly attackers can take advantage of known vulnerabilities. Attackers are always in search of new vectors to reach more victims. In this attack, they also used some sophisticated code injection techniques. Protections against cyberattacks should be advanced, real-time, and comprehensive.
The URL detonation capabilities in Office 365 ATP was instrumental in detecting and blocking the malicious behaviors across the multiple stages of this sophisticated attack, protecting customers from potentially damaging outcomes. URL detonation, coupled with heuristics, behavior-based detections, and machine learning, allow Office 365 ATP to protect customers not only from targeted attacks, but also well-crafted spear phishing attacks—in real time.
Unified protection across multiple attack vectors with Microsoft Threat Protection
These advanced defenses from Office 365 ATP are shared with other services in Microsoft Threat Protection, which provides seamless, integrated, and comprehensive protection against multiple attack vectors. Through signal-sharing, Microsoft threat Protection orchestrates threat remediation.
For endpoints that are not protected by Office 365 ATP, Microsoft Defender ATP detects the attacker techniques used in this targeted attack. Microsoft Defender ATP is a unified endpoint protection platform for attack surface reduction, next generation protection, endpoint detection & response (EDR), auto investigation & remediation, as well as recently announced managed threat hunting and threat & vulnerability management.
Microsoft Defender ATP uses machine learning, behavior monitoring, and heuristics to detect sophisticated threats. Its industry-leading optics, integration with Office 365 ATP and other Microsoft Threat Protection services, and use of AMSI give it unique capabilities to detect attacker techniques, including the exploit, obfuscation, detection evasion, and fileless techniques observed in this attack.
The attacks that immediately exploited the WinRAR vulnerability demonstrate the importance of threat & vulnerability management in reducing organizational risk. Even if your organization was not affected by this attack against specific organizations in the satellite and communications industry, there are other malware campaigns that used the exploits.
Microsoft Defender ATP's threat & vulnerability management capability uses a risk-based approach to the discovery, prioritization, and remediation of endpoint vulnerabilities. As a component of a unified endpoint protection platform, threat & hunting vulnerability management in Microsoft Defender ATP provides these unique benefits:
- Real-time correlation of EDR insights with info on endpoint vulnerabilities
- Invaluable endpoint vulnerability context for incident investigations
- Built-in remediation processes through Microsoft Intune and Microsoft System Center Configuration Manager
Figure 12. Sample Threat & Vulnerability Management dashboard showing WinRAR vulnerabilities on managed endpoints
The complex attack chain that incorporated sophisticated techniques observed in this targeted attack highlights the benefits of a comprehensive protection enriched by telemetry collected across the entire attack chain. Microsoft Threat Protection continues to evolve to provide integrated threat protection solution for the modern workplace.
Rex Plantado
Office 365 ATP Research Team
Indicators of compromise
Files (SHA-256):
- 68133eb271d442216e66a8267728ab38bf143627aa5026a4a6d07bb616b3d9fd (Original email attachment) – detected as Trojan:O97M/Maudon.A
- ef3617a68208f047ccae2d169b8208aa87df9a4b8959e529577fe11c2e0d08c3 (Document hosted in OneDrive link) – detected as Trojan:O97M/Maudon.A
- 4cb0b2d9a4275d7e7f532f52c1b6ba2bd228a7b50735b0a644d2ecae96263352 (ACE file with CVE-2018-20250 exploit) – detected as Exploit:Win32/CVE-2018-20250
- 6f78748f5b2902c05e88c1d2e45de8e7c635512a5f25d25217766554534277fe (dropbox.exe (Win64 Payload)) – detected as Trojan:Win32/Maudon.A
- c0c22e689e1e9fa11cbf8718405b20ce57c1d7c85d8e6e45c617e2b095b01b15 (Encoded id.png) – detected as Trojan:PowerShell/Maudon.A
- 0089736ee162095ac2e4e66de6468dbb7824fe73996bbea48a3bb85f7fdd53e4 (temp.vbs) – detected as ThreatRelated
- 1c25286b8dea0ebe4e8fca0181c474ff47cf822330ef3613a7d599c12b37ff5f (PowerShell script decrypted from id.png) – detected as Trojan:PowerShell/Maudon.A
- 144b3aa998cf9f30d6698bebe68a1248ca36dc5be534b1dedee471ada7302971 (Decrypted PowerShell) – detected as Trojan:PowerShell/Maudon.A
- hxxps://1drv[.]ms/u/s!AgvJCoYH9skpgUNf3Y3bfhSyFQao
- hxxp://162[.]223[.]89[.]53/oa/
- hxxp://162[.]223[.]89[.]53/oc/api/?t=<BOTID>
- hxxp://162[.]223[.]89[.]53/or/?t=<BOTID>
The post Analysis of a targeted attack exploiting the WinRAR CVE-2018-20250 vulnerability appeared first on Microsoft Security.
Steer clear of tax scams
In the month of February, we saw an average of 300,000 phishing attempts across Microsoft's browsing platforms daily. Our security experts expect these attempted scams to become increasingly more prevalent through the April 15 Tax Day, especially in the two weeks leading up to it, when about 25 percent of people file their taxes. The phishing campaigns we've seen aren't just in the U.S., though; we've also recently uncovered similar tactics in Canada, Brazil and India. It's important for users across the globe to follow best practices and stay vigilant.
With less than a month until the filing deadline in the U.S., we are urging the public to take the following simple steps to avoid tax scams – especially during the last-minute rush to file taxes.
- Watch for suspicious emails. Be suspicious of all links and attachments, especially when the email seems "off" or unexpected – like an unexpected email from your credit card company, or financial institution. Phish-y emails often include spelling and grammatical errors, or will ask you to send personal information. In these cases, you can apply additional scrutiny on the sender, the content, and any links and attachments. If you know the sender, for example, you can double-check with them before opening or downloading the file.
- Carefully inspect URLs. Hover over links to verify that the URL goes to the website where it's supposed to direct you. Is it pointing to the site you expected? URL shorteners provide a lot of convenience, but can make this inspection difficult. If you're unsure, rather than clicking a link, use search engines like Bing to get to the tax-related website you're looking for and log in from there.
|We recently discovered a phishing campaign targeting Canadian Tax payers where scammers were pretending to help Canadian taxpayers get their refunds, but really aimed to steal banking credentials. We've also seen old phishing documents resurface – these claim to be from the Canada Revenue Agency (CRA), inform victims that they have a refund via e-transfer from the CRA, and ask them to divulge their bank details where the funds will be "deposited". We've also seen similar campaigns in Brazil and India.
- Be wary of any attachments. If you haven't just made a purchase for tax software, don't be tricked by getting an email with an invoice from a tax preparation company. Sending fake invoices for services is one of the top methods attackers use to trick people into opening a malicious attachment that could automatically execute malware on your computer. Malicious attachments could also contain links that download and execute malicious programs. We've seen PDFs that contain innocuous-looking links that lead to people accidentally downloading malicious software designed to steal credentials, like usernames and passwords.
- Don't rely on passwords alone. Scammers take advantage of weak or stolen passwords used across multiple websites, so don't just rely on your password to keep you safe. When possible, always use multi-factor authentication like the Microsoft Authenticator app for managing your sign-ins for Microsoft accounts and others, and Windows Hello for easy and secure sign-in to your Windows 10 device. These solutions enable biometric authentications like your face or fingerprint to quickly and safely sign in across devices, apps and browsers without you having to remember passwords. Did you know that with a Microsoft Account, you can securely and automatically sign-in to other Microsoft cloud-based applications including Bing, MSN, Cortana, Outlook.com, Xbox Live (PC only), Microsoft Store and Office?
- Keep software current. Run a modern operating system, like Windows 10 or Windows 10 in S mode, with the latest security and feature updates, in tandem with next-generation anti-malware protection, such as Windows Defender Antivirus.
Microsoft security solutions can proactively inspect links and attachments, as well as block phishing documents and other malicious downloads to help protect users, even if they accidentally click a phishing link or open a malicious attachment. We expect tax scams to be on the rise in the next several months as global tax deadlines approach so our experts will be on the lookout for new campaigns.
Here's a couple of examples of what we've seen just in the last few weeks: two documents named irs_scanned_551712.doc and Tax(IP.PIN).doc. You'll notice that the security tools built into Microsoft Office caught these and displayed a warning at the top. Before enabling content like these, ensure that the sender is a trusted source, and notice things like missing or misspelled words.
Be on the lookout for scams like we've described here. There will undoubtedly be more schemes that crop up. Stay vigilant! Learn how to report phishing scam websites through Microsoft Edge or Internet Explorer and suspicious email messages through Outlook.com, Outlook 2016, or Office 365.
Keep these tips and tricks handy, and share with your networks so we can increase awareness of and stop the spread of Tax Day scams! For more information about Microsoft Security, please visit microsoft.com/security.
The post Steer clear of tax scams appeared first on Microsoft Security.
Why Traditional EDR Doesn't Solve Today's Modern Threats
Today's cyberattacks are more advanced and complex than ever before. It's no surprise that enterprises can no longer rely on traditional endpoint detection and response (EDR) solutions to protect against the evolving threat landscape. With the amount of data rapidly expanding in conjunction with an increasing number of endpoints, enterprise IT departments are facing new management and security challenges. EDR can provide businesses with another layer of threat detection in a multilayered security approach.
Cyberthreats Have Evolved, So Should Your Security
The impact of a cyberattack is no longer siloed to one employee's device. It has the ability, speed, and scope to impact your entire business in mere seconds. And it's hard not to think of cybersecurity as being the never-ending game of cat-and-mouse, with cybercriminals constantly developing new skills, updating code, and deploying new tactics to get inside your endpoints. But instead of your organization trying to play catch up, get ahead of malicious actors by developing a comprehensive security strategy to prevent attacks before they happen.
Many cyberthreats use multiple attack mechanisms, which means just one form of security is no longer enough to keep your entire enterprise secure from malicious actors. And although some anti-virus software can't keep up with new malware or variants of known malware, it still plays an important role in a multilayered approach for a robust cybersecurity strategy. Endpoint detection and response is also essential when developing a comprehensive security approach. It offers a threat detection capability, allowing your next-generation solution to track down potential threats if they break through the first layer of your digital perimeter.
The Importance of EDR
The SANS Endpoint Protection and Response Survey reports that 44% of IT teams manage between 5,000 and 500,000 endpoints across its network. Each of these endpoints become an open door for a potential cyberattack. Given the increasing number of endpoints, organizations are beginning to understand that they're more susceptible to breaches and are willing to adopt a multilayered security approach to prevent as many attacks as possible.
With endpoint detection and response, organizations have granular control and visibility into their endpoints to detect suspicious activity. There are new features and services for EDR, expanding its ability to detect and investigate threats. An EDR solution can discover and block threats in the pre-execution stage, investigate threats through analytics, and help provide an incident response plan. Additionally, some EDR solutions can leverage AI and machine learning to automate the steps in an investigative process. These new capabilities can learn an organization's baseline behaviors and use this information, along with a variety of other threat intelligence sources, to interpret findings.
Incorporating EDR Into Your Security Strategy
The adoption of EDR is projected to increase significantly over the next few years. According to Stratistics MRC's Endpoint Detection and Response – Global Market Outlook (2017-2026), sales of EDR solutions—both on-premises and cloud-based—are expected to reach $7.27 million by 2026, with an annual growth rate of nearly 26%.
When adopting EDR into your security portfolio, the application should have three basic components: endpoint data collection agents, automated response, and analysis and forensics. McAfee MVISION Endpoint Detection and Response (EDR) helps you get ahead of modern threats with AI-guided investigations that surface relevant risks and automate and remove the manual labor of gathering and analyzing evidence.
For more information on endpoint detection and response, check out our Security Awareness page and the McAfee Endpoint Security portfolio of products.
The post Why Traditional EDR Doesn't Solve Today's Modern Threats appeared first on McAfee Blogs.
From Mobile and ISP to Endpoint Engineering: Undergoing a Role Transition in the Security Industry
The technology around us is constantly changing, and cybersecurity practices are evolving to match these new innovations. As the cybersecurity landscape shifts to meet the needs presented by new technology, opportunities arise for cybersecurity professionals to step into new roles – an experience I recently underwent myself. I've recently shifted from McAfee's Mobile and ISP Business Unit to our Enterprise Endpoint Engineering team, a transition that has given me the opportunity to leverage what I've learned in the industry and step forward as a leading woman in tech.
Through this process, I've seen first-hand how growth opportunities within the cybersecurity field are beneficial for both individuals and the future of the security industry as well. For example, my transition allows me to apply my past experience and knowledge to a new area of security. Previously, I specialized in engineering solutions that protected mobile, IoT, and smart home devices. However, with my transition into this new role, I am still protecting individual endpoint devices, but rather in a new type of environment — an organization's network.
Just like the ever-growing number of IoT devices connecting to users' home networks, endpoint devices are popping up everywhere in corporate networks these days. As we add more endpoint devices to corporate networks, there is a growing need to ensure their security. Endpoint security, or endpoint protection, are systems that protect computers and other devices on a network or in the cloud from security threats. End-user devices such as smartphones, laptops, tablets, and desktop PCs are all classified as endpoints, and these devices are all now rapidly connecting to an organization's network with every employee, partner, and client that enters the building. That's why it's imperative companies prioritize a robust and agile endpoint security strategy so that all of their network users can connect with confidence. Similar to securing all the personal devices on a home network, it's a sizable challenge to secure all corporate endpoints. And my new team, the McAfee Enterprise Endpoint Engineering group, is here to help with exactly that.
Leading consumer engineering taught me how to make security simple for a home user's consumption. How to protect what matters to a user without them being experts on the threat landscape or security vulnerabilities, security breaches and campaigns around device, data, cloud and network. This is something I plan to bring to the new role. Leading a business unit focused on delivering security through mobile carriers and ISPs taught me the strength of bringing together an ecosystem both on technology and the channel to solve end users' security needs in a holistic way. That ecosystem view is another that I bring to this role, besides leading engineering from the lens of growing the business.
This transition is not only exciting from a personal perspective but also because it is a testament to the progress that is being seen across the cybersecurity industry as a whole. There's a lot to be said about the vast opportunities that the cybersecurity field has to offer, especially for women looking to build a career in the field. Cybercriminals and threat actors often come from diverse backgrounds. The wider the variety of people we have defending our networks, the better our chances of mitigating cyberthreats. From there, we'll put ourselves in the best position possible to create change – not only within the industry but within the threat landscape as a whole.
The post From Mobile and ISP to Endpoint Engineering: Undergoing a Role Transition in the Security Industry appeared first on McAfee Blogs.
Mobile Threat Report Commentary: Mobile Malware is Not Going Away
Employees use their mobile devices to be proactive and stay connected in both their personal and work lives. The movement to the cloud has allowed employees to check email, download documents, and share information that may contain sensitive information, even when they're not on an enterprise network. Businesses must protect their enterprise environments and combat threats that target their employees as average consumers.
McAfee research shows that every mobile-enabled device is subject to some type of malicious exploit. In 2018, McAfee researchers discovered mobile malware named TimpDoor, which turned Android devices into hidden proxies. But in 2019, businesses should be prepared for malware that goes beyond mobile devices too.
Detections of backdoors, cryptomining, fake apps, and banking Trojans all increased substantially in the second half of 2018 and attacks on other connected household devices gained momentum as well. While hidden apps like Adware remain by far the most common form of mobile malware, others are growing and learning how to infect other devices.
Mobile devices are becoming a hub for ransomware and malware developers. One common thread through much of the mobile attack landscape is the quest for illicit profits. Criminals are looking for ways to maximize their income and shift tactics in response to changes in the market.
"75% rise in banking Trojans, enabling cybercriminals to steal financial credentials from mobile devices"
"550% increase in mobile malware realized by the end of 2018"
Weak to non-existent security controls from manufacturers and a lack of simple evasion techniques, such as changing the default username and password, make connected devices in the home and workplace targets for cybercriminals.
Although mobile devices have become key enablers for business productivity and connectivity, they're still the greatest risk to enterprises today. This changes how enterprises need to secure the mobile devices that connect to their environment. Enterprises must invest in endpoint security solutions to protect themselves from the evolving threat landscape. Mobile is one of the fastest growing endpoints and needs to be protected just as much as laptops and desktop computers.
McAfee has addressed the growing need by introducing the MVISION portfolio family, which provides IT administrators with comprehension and control through one single management console. McAfee MVISION Mobile provides on-device detection, local (end user) threat remediation, visual mapping of nearby dangerous networks, customizable on-device user notifications, and advanced threat detection. This provides the enterprise-class threat defense that businesses today need to be secure.
Read the McAfee Mobile Threat Report to learn more about protecting your employees' mobile devices from malware and other cyberthreats.
The post Mobile Threat Report Commentary: Mobile Malware is Not Going Away appeared first on McAfee Blogs.
Your Mobile Phone: Friend or Foe?
Where would we be without our mobile phones? Our kids, boss, friends – so many people reach out to us via our mobile phone. And unfortunately, hackers have also started reaching out – in major ways. The severity of attacks on mobile devices is often underestimated. It is now common to have employees use their phones for work-related tasks when they are not within the perimeter of their corporate firewall, giving cybercriminals the opportunity to access sensitive information if and when they hack into an employee's phone. Let's take a closer look at some of the common mobile threats that put your business at risk and how to prevent them.
App-Based Threats
Although new mobile malware declined by 24% in Q3 2018, per our latest Quarterly Threats Report, app-based threats still dominate the threat landscape. Malicious actors use social engineering techniques by asking users to update their applications by uninstalling the real app and re-installing a malicious one. With one click, malware can be installed on your mobile device.
Many app-based threats can evolve into more insidious attacks and can go beyond exploiting your personal information. An attacker's initial goal is to get access and all they need is one vulnerable employee to fall victim to an app-based threat. Once the attacker gains access to an employee's personally identifiable information (PII) or credentials, they can hijack accounts, impersonate the employee, and trick other employees into divulging even more sensitive corporate data.
Late last year, the McAfee Mobile Research team discovered an active phishing campaign that uses text messages (SMS) to trick users into downloading and installing a fake voice-message app. The app allowed cybercriminals to use infected devices as network proxies without the users' knowledge.
This year, we expect to see an increase in underground discussions on mobile malware—mostly focused on Android—regarding botnets, banking fraud, ransomware, and bypassing two-factor authentication security.
Risky Wi-Fi Networks
Using public Wi-Fi is one of the most common attack vectors for cybercriminals today. With free public Wi-Fi widely available in larger cities, it has become a convenient way to access online accounts, check emails, and catch up on work while on the go. The industry has seen network spoofing increase dramatically in the past year. To put this into perspective, picture a hacker setting up a rogue access point in a public place like your local bank. A hacker will wait for you to connect to Wi-Fi that you think is a trusted network. Once the hacker gains access, they're connected to your mobile device. They'll watch remotely as you access sensitive information, revealing log-in credentials, confidential documents, and more.
Whether you are at home or working remotely, network security needs to be a high priority.
Device Attacks
Cybercriminals have various ways of enticing users to install malware on their mobile devices. Ad and click fraud is a growing concern for device attacks, where criminals can gain access to a company's internal network by sending an SMS phish. These types of phishing attempts may start as adware, but can easily spread to spyware to the entire botnet.
Another growing concern with mobile device threats is when malware is hidden in other IoT devices and the information obtained by the hacker can be used as an entry point to your mobile device or your company network. With IoT malware families rapidly being customized and developed, it's important for users to be aware and know how to protect themselves.
How to Better Protect Your Mobile Device
Mobile devices have all the organizational information that traditional endpoints have. McAfee® MVISION Mobile lets you protect against threats to your employees and your data on iOS and Android devices like you do on your PCs. With MVISION Mobile, you can manage the defense of your mobile devices alongside your PCs, IoT devices, servers, and cloud workloads inside McAfee ePolicy Orchestrator (McAfee ePO) with unified visibility into threats, integrated compliance reporting, and threat response orchestration.
The most comprehensive mobile device security is on the device itself, and MVISION Mobile delivers unparalleled on-device protection. Visit our web site for more information, and a product tour.
The post Your Mobile Phone: Friend or Foe? appeared first on McAfee Blogs.
Giving Your Endpoint the Gift of Security This Holiday Season
Suddenly, it's December, and the beginning of the holiday season. Your coworkers are now distracted with getting in their PTO, flying home to be with family, and completing their shopping lists. But the holiday season isn't always filled with cheer, it's got some scrooges too – cybercriminals, who hope to take advantage of the festive fun to find vulnerabilities and infect unsecured devices. And with many employees out of office, these hackers could potentially pose a serious threat to an organization's endpoints, and thereby its network. As a matter of fact, there are a few key reasons as to why your organization's endpoints may be in danger during the holidays. Let's take a look.
Business Shutdowns
Most companies close down for a handful of days during the holidays, if not a full week or two. That means less people manning the IT station, executing updates, and defending the network if cybercriminals manage to find a way inside. A lack of personnel could be just the opportunity cybercriminals need to take advantage of an open entry point and swoop data from an organization essentially undetected.
Holiday Spirit, Relaxed Attitude
For the employees that do stay online during the holidays, attitudes can range from relaxed to inattentive. Unless their product or service directly relates to the holidays and shopping, businesses tend to be quiet during this time. And with many coworkers out, employees tend to have less reason to be glued to their computer all the time. This could mean cyberattacks or necessary security actions go unattended – irregular activity may not seem as obvious or a necessary software update could go unresolved a little too long. What's more – the lax attitude could potentially lead to a successful phishing attack. In fact, phishing scams are said to ramp up starting in October, as these cybercriminals are eager to time their tricks with the holiday season. In order to accurately identify a phishing scheme, users have to be aware and have their eyes on their inbox at all times. One false move could potentially expose the entire organization, creating a huge problem for the reduced staff on hand.
Holiday Travel = Public Wi-Fi
Workplace mobility is a great new aspect of the modern age – it permits employees more flexibility and allows them to work from essentially anywhere in the world. But if employees are working out of a public space – such as a coffee shop or an airport – they are likely using public Wi-Fi, which is one of the most common attack vectors for cybercriminals today. That's because there are flaws in the encryption standards that secure Wi-Fi networks and cybercriminals can leverage these to hack into a network and intercept or infect users' traffic. If an employee is traveling home for the holidays and using public Wi-Fi to get work done while they do, they could potentially expose any private company information that lies within their device.
BYOD in Full Force
Speaking of modern workplace policies, Bring Your Own Device (or BYOD) – a program that allows employees to bring their own personal devices into work – is a common phenomenon these days. With this program, employees' personal devices connect to the business' network to work and likely access company data.
That means there is crucial data living on these personal devices, which could be jeopardized when the devices travel outside of the organization. With the holidays, these devices are likely accompanying the employees on their way to visit family, which means they could be left at an airport or hotel. Beyond that, these employees are more likely to access emails and company data through these mobile devices while they are out of the office. And with more connected devices doing company business, there are simply more chances for device and/or data theft.
Staying Secure While Staying Festive
Now, no one wants their employees to be online all the time during the holidays. Fortunately, there are actions organizations can take to ensure their employees and their network are merry and bright, as well as secure. First and foremost, conduct some necessary security training. Put every employee through security training courses so they're aware of the risks of public Wi-Fi and are reminded to be extra vigilant of phishing emails during this time. Then, make sure all holes are patched and every update has been made before everyone turns their attention to yuletide festivities. Lastly, if an employee is working remotely – remind them to always use a VPN.
No matter who's in the office and who's not, it's important to have always-on security that is armed for the latest zero-day exploits – like McAfee Endpoint Security. You can't prevent every user from connecting to a public network or one that is set up for phishing, but you can ensure they have an active defense that takes automatic corrective actions. That way, employees can enjoy the time off and return to a safe and secure enterprise come the new year.
To learn more about endpoint security and McAfee's strategies for it, be sure to follow us at @McAfee and @McAfee_Business.
The post Giving Your Endpoint the Gift of Security This Holiday Season appeared first on McAfee Blogs.
A Quick Introduction to the MITRE ATT&CK Framework
If you're an avid reader of threat trends or a fan of red team exercises, you've probably come across a reference to the MITRE ATT&CK framework in the last few months. If you have ever wondered what it was all about or if you've never heard of it but are interested in how you can improve your security posture, this blog is for you.
To start with, let's explain what MITRE is. MITRE is a nonprofit organization founded in 1958 (and funded with federal tax dollars) that works on projects for a variety of U.S. government agencies, including the IRS, Department of Defense (DOD), Federal Aviation Administration (FAA), and National Institute of Standards and Technology (NIST). It is not a professional third-party cybersecurity testing agency, which is a common misconception. Its focus is to provide U.S. government agencies with essential deliverables—such as models, technologies and intellectual property—related to U.S. national security, including cybersecurity, healthcare, tax policy, etc. In the cybersecurity landscape, MITRE is mostly known for managing Common Vulnerabilities and Exposures (CVEs) for software vulnerabilities. Note that CVEs are pre-exploitation/defense, whereas the MITRE ATT&CK model is focused on post-exploitation only.
Your next question is probably around what MITRE ATT&CK is and what makes it a model or a framework. The name stands for: Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK). It is a curated knowledgebase and model for cyberadversary behavior, reflecting the various phases of an adversary's attack lifecycle and the platforms they are known to target. The tactics and techniques looked at in the model are used to classify adversary actions by offense and defense, relating them to specific ways of defending against them. What began as an idea in 2010 during an experiment has since grown into a set of evolving resources for cybersecurity experts to contribute to and apply for red teaming, threat hunting, and other tasks. Security practitioners can harden their endpoint defenses and accurately assess themselves by using the model and the tools to help determine how well they are doing at detecting documented adversary behavior.
If you've been in the security realm for a while, this may remind you somewhat of Lockheed Martin's Cyber Kill Chain. It stated that attacks occur in stages and can be disrupted through controls established at each stage. It was also used to reveal the stages of a cyberattack. To understand the overlap of the two models, take a look at this figure:
In the figure above we see that the MITRE ATT&CK matrix model is essentially a subset of the Cyber Kill Chain, but it goes in depth when describing the techniques used between the Deliver and Maintain stages. The Cyber Kill Chain, including the MITRE ATT&CK model, might look like a linear process, but it actually isn't. It's rather a branching and looping chain, but we have shown it in a linear fashion to make it easier to understand.
At McAfee, we embrace the MITRE model as a fabulous and detailed way to think about adversarial activity, especially APTs post-compromise, and are applying it to different levels and purposes in our organization. Specifically, we are engineering our endpoint products using the insights gained from MITRE ATT&CK to significantly enhance our fileless threat defense capabilities. Additionally, we are using it to inform our roadmaps and are actively contributing to the model by sharing newly discovered techniques used by adversaries. We are partnering with MITRE and were recently a core sponsor of the inaugural MITRE ATT&CKcon in the Washington, D.C. area.
Over the next few weeks, I'll continue to go deeper into how MITRE ATT&CK matrix testing works, how you can use it, how it's different from other testing methods, and how McAfee is investing in it.
The post A Quick Introduction to the MITRE ATT&CK Framework appeared first on McAfee Blogs.
McAfee Named a 2018 Gartner Peer Insights Customers' Choice for Endpoint Protection Platforms
We are excited to announce that McAfee has been recognized as a 2018 Gartner Peer Insights Customers' Choice for Endpoint Protection Platforms. McAfee takes great pride in this distinction, as we feel that real-world feedback from our customers is the driving force behind the recognition and that they have spoken loudly about the value they are receiving from our products.
In its announcement, Gartner explains, "Since October 2015, more than 100,000 reviews across more than 300 markets have been posted to Gartner Peer Insights. In markets where there is enough data, Gartner Peer Insights recognizes the vendors who are the most highly rated by their customers through the Customers' Choice distinction. This peer-rated distinction can be a useful complement to expert opinion, as it focuses on direct peer experiences of implementing and operating a solution." To ensure fair evaluation, Gartner maintains rigorous criteria for recognizing vendors.
For this distinction, a vendor must have a minimum of 50 approved ratings with an average overall rating of 4.2 stars or higher. McAfee received 651 reviews and an average 4.4 rating out of 5 total for the Endpoint Protection Platforms market as of November 19th, 2018.
Here are some excerpts from customers that contributed to the distinction:
"This is what an Endpoint Security Solution should look like"
Cyber Security Analyst in the Government Industry
"McAfee ENS has been a complete game changer in the world [of] endpoint security."
Infrastructure and Operations in the Retail Industry
"Seamless upgrade from legacy products to ENS, ePO is probably the best management console I've used for any product I've used"
Sr. Desktop Engineer in the Services Industry
And those are just a few. You can read more reviews for McAfee Endpoint Security on our web site and on the Gartner site.
On behalf of McAfee, I would like to thank all of our customers who took the time to share their experiences. We are delighted to be a 2018 Gartner Peer Insights Customers' Choice for Endpoint Protection Platforms and we believe that it is your valuable feedback which made it possible. To learn more about this distinction, or to read the reviews written about our products by the IT professionals who use them, please visit Gartner Peer Insights Customers' Choice announcement page.
- Gartner Peer Insights' Customers' Choice for Endpoint Security and Protection Software announcement November 19, 2018
The Gartner Peer Insights Customers' Choice logo is a trademark and service mark of Gartner, Inc., and/or its affiliates, and is used herein with permission. All rights reserved. Gartner Peer Insights Customers' Choice constitute the subjective opinions of individual end-user reviews, ratings, and data applied against a documented methodology; they neither represent the views of, nor constitute an endorsement by, Gartner or its affiliates.
The post McAfee Named a 2018 Gartner Peer Insights Customers' Choice for Endpoint Protection Platforms appeared first on McAfee Blogs.
Shut Down Unlikely Attack Vectors in Your Organization
As a security professional, I probably take security more seriously than most. But when we start talking about the Internet of Things (IoT), the science fiction buff in me comes to the forefront a little bit. While we don't want any kind of attacks to happen to our organizations, it can be a little fun to imagine the crazy ways hackers can use mundane appliances to hack into a network.
For example, earlier this year, a North American casino was hacked through a smart fish tank. Since the equipment in the tank was connected to the Internet, attackers were able to use that as their vector for network access. Fortunately, the breach was discovered quickly afterward—and you never want to hear about security breaches like this, but it certainly does make for a unique story.
That highlights the risks that are out there today. If you're connected to the Internet, you are vulnerable to attacks. With IoT and the proliferation of smart devices, we're starting to see some creativity from hackers that is not necessarily being counteracted with the appropriate level of security controls. That fancy fish tank certainly didn't have the appropriate level of security controls. Having "regular" devices connect to the Internet can bring flexibility and manageability, but it also opens up more vulnerabilities.
That risk is something that everybody needs to understand. Basically, like any good risk owner, you need to think about what device you have, how it's connecting, where it's connecting to, and whether or not that connection has a level of security that meets your policy and control expectations. Honestly, what I've seen is that because of the easy and seamless connectivity of these smart devices, a lot of organizations are not thinking about necessary security measures. They aren't quite seeing that a fish tank or a biomedical device or even an HVAC system can be just as vulnerable to attack as a server or application.
So how do you keep your network and data safe and still take advantage of the benefits of the IoT? Employ the same techniques I spoke of last week: protect, detect, and react. Assess, document, and validate risks. Make sure that you have a complete and total information security risk management or risk governance program. Apply these techniques and programs to every single device on your network, no matter how low-level it may seem. Something as normal as a thermostat or refrigerator could be a gateway for a hacker.
Our experts can help you assess your environment for risks and vulnerable points in your network, and help you put together a comprehensive security program that doesn't leave out anything—even your lobby fish tank or break room fridge.
The post Shut Down Unlikely Attack Vectors in Your Organization appeared first on Connected.


text:
Darren is shocked when Frankie tells him her suspicions about Joe and Jack. He marches round to the Roscoes' and questions his dad in front of the grieving family, prompting Joe to want a DNA test - is it true?
Meanwhile, Freddie is desperate to comfort the woman he loves.
Elsewhere, Trevor decides to get payback, but how far will he go?
Also today, Carmel is surprised when she looks out the window and sees Jim on top of a white horse, dressed in battle regalia. He proposes and she accepts.
Writer: Daniel Moulson
Director: Ian White
Hollyoaks: 3695: 2013-09-20

subset: commoncrawl


text:
You can also have symptoms of low blood pressure when someone with hypertension comes down from very high pressures. For instance, 120/80 mm Hg may be normal for everyone else, but if your patient lives at 190/100 mm Hg, they are going to feel the difference. For this reason, the objective sign of a pressure must be combined with the subjective symptoms the patient reports.
Your doctor may diagnose you with high blood pressure when you have consistent systolic readings of 140 mm Hg or higher or diastolic readings of 90 mm Hg or higher. Based on research, your doctor may also consider you to have high blood pressure if you are an adult or child age 13 or older who has consistent systolic readings of 130 to 139 mm Hg or diastolic readings of 80 to 89 mm Hg and you have other cardiovascular risk factors.
As of 2014, approximately one billion adults or ~22% of the population of the world have hypertension.[137] It is slightly more frequent in men,[137] in those of low socioeconomic status,[6] and it becomes more common with age.[6] It is common in high, medium, and low income countries.[137][138] In 2004 rates of high blood pressure were highest in Africa, (30% for both sexes) and lowest in the Americas (18% for both sexes). Rates also vary markedly within regions with rates as low as 3.4% (men) and 6.8% (women) in rural India and as high as 68.9% (men) and 72.5% (women) in Poland.[139] Rates in Africa were about 45% in 2016.[140]
It occurs more often in older people who are taking a lot of medication. However, it can cause symptoms in younger people. There may be underlying medical conditions such as joint hypermobility syndrome, diabetes, parkinson's disease, addison's disease or autonomic failure. Dehydration, hunger, low body weight and deconditioning (being out of shape/unfit) can reduce blood pressure.
NHLBI Expert Panel on Cardiovascular Health and Risk Reduction in Children and Adolescents. We have supported the development of guidelines based on up-to-date research to evaluate and manage risk of heart disease in children and adolescents, including high blood pressure. Visit Expert Panel on Integrated Guidelines for Cardiovascular Health and Risk Reduction in Children and Adolescents for more information.
ARcare serves rural Arkansas with locations in Augusta, Bald Knob, Batesville, Batesville-Southside, Brinkley, Cabot, Carlisle, Cherry Valley, Conway, Cotton-Plant, Des Arc, England, Hazen, Heber Springs, Horseshoe Bend, Jonesboro, Kensett, Lake City, Little Rock, Lonoke, McCrory, Mayflower, Melbourne, Newport, Parkin, Searcy, Swifton, Vilonia, and Wynne.
Lap band (gastric banding) surgery, also referred to as laparoscopic adjustable gastric banding (LAGB) is a surgical procedure in which an adjustable belt is placed around the upper portion of the stomach. Candidates for lap band surgery are generally individuals with a body mass index over 40 kg/m2, or are more than 45 kilograms over their ideal body weight. Side effects, risks, and complications from lap band surgery should be discussed with a surgeon or physician prior to the operation.
If you had previously been diagnosed with high blood pressure, the new guidelines don't affect you too much, says Dr. Conlin, as you still need to continue your efforts to lower it through medication, diet, exercise, and weight loss. "However, based on new information in the guidelines, your doctor may propose treating your blood pressure to a lower level," he says.
Blood pressure control is a lifelong challenge. Hypertension can progress through the years, and treatments that worked earlier in life may need to be adjusted over time. Blood pressure control may involve gradually making lifestyle changes like diet, weight loss, exercise, and possibly taking medicine if necessary. In some situations, medications may be recommended immediately. As with many diseases, you and your doctor should work together to find the treatment plan that works for you.
a heart attack, annual physical, blood pressure, blood pressure chart, blood pressure diet, blood pressure hypertension, blood pressure readings, blood pressure remedies, cardiomyopathy, dairy, dash diet, diabetes, diastolic blood pressure, diet, disease of the heart, enlarged heart, foods that lower blood pressure, good health, have high blood pressure, having a heart attack, health, health news, heart attack, heart failure, heart healthy, heart healthy foods, heart muscle, high blood pressure, high blood pressure hypertension, high blood pressure remedies, hypertension, hypotension, low blood pressure, lower blood pressure, mercury, muscle, paleo diet, physical activity, plaque buildup, prevent high blood pressure, stroke, stroke risk, university health news, weather.
I just started using high blood pressure medication and purchased a blood pressure meter at age 72. what concerns me is that the BP readings I get have a very wide variance in. I measure every morning as soon as I wake up, while still in bed and prior to having any coffee. I take 3 or 4 readings. I have found that on any given day my reading can vary from 126 to 143 systolic and the diastolic reading from 68 to 87. this wide variance makes it very difficult to track trends. My questions are: is this normal? is my instrument possibly defective? How can my cardiac doctor make a decision to put me on life long medication based on SINGLE reading in his office?
• Important Disclaimer: Information provided on disabled-world.com is for general informational and educational purposes only, it is not offered as and does not constitute medical advice. In no way are any of the materials presented meant to be a substitute for professional medical care or attention by a qualified practitioner, nor should they be construed as such. Any third party offering or advertising on disabled-world.com does not constitute an endorsement by Disabled World. All trademarks(TM) and registered(R) trademarks are the property of their respective owners. Please report outdated or inaccurate information to us.


text:
"Joining an MLM is appealing to women who find hope in their promises of a better life: freedom, economic independence, and an endless supply of cheery trinkets. Despite professing quick-income prospects though, it's difficult for MLM consultants to earn more than pocket change. When glitzy recruitment videos yield to the reality of suburban cul-de-sacs, people selling for MLMs can be plunged into debt and psychological crisis." (Quartz)
So to make it possible, you structured a kind of "payplan" or ways how you are going to pay your neigbors and relatives based on the number of people they've brought in or the group sales they've made. And by applying some MLM principle, you were able to plot a system that traces all sales from person to person down the line. Therefore, giving credit and commission also to the first person who initiated the effort.
Yep, it will NOT be easy. However, and I truly mean this, IF you embrace these 3 Network Marketing Tips for Guaranteed Success and truly honor them, you WILL get there. I don't know if it will take you one year, three years, five years but heck, what if it takes you 20 years, what is the alternative? Are you creating freedom with your other sources of income or are you trading dollars for hours? And remember, quitting never speeds the accomplishment of ANY goal.
Great tips, John! I really like them. #9 really hit home with me. Before, I didn't realize the mistakes that I made. Always pitching my business never really trying to make a connection and establishing a relationship with my customers until i noticed they're turning away from me. That's when I decided to learn what was wrong. Thankfully, I learned. Keep 'em coming John! I love reading your posts. Create a great day!
86. You need to learn this: People do NOT care about your MLM Success, it is ALL ABOUT THEIR Potential Success. Yes, you need a good personal testimonial, but down play it and make your Success a STRONG possibility for your prospect or new leader, and then show them that you will work hard to help them achieve it. It is NOT about You, but all about THEM. If an ego needs stroking, stroke their ego, not yours.
To apply the principle of MLM and the power of LEVERAGE in real time today to make money online, CLICK THIS LINK and join the strongest, easiest and fastest paying MLM company that created thousands of millionaires in the past years until today. You will be blown away how each member receives multiple $25, $100, $250, $500 and $1000 daily with this MLM company.
CrowdFlower distributes companies' "microtasks" to millions of contributors online. Make money right from your couch; all you need is a computer and a healthy internet connection. Contributors can assist with Data Collection & Enhancement, Data Categorization, Content Moderation, Search Relevance Tuning and Sentiment Analysis. Sign up for an account online, and you're ready to get working!Contributor referral: None
"The number one piece of advice I would give to up and coming sales professionals is to understand the personalities of your prospect. Most of us in sales tend to speak from "our" point of view not the point of view of the prospect which in turn can eliminate the prospect from buying. Always keep in mind their motivation to purchase whatever you're marketing and keep pressing on that motivation "button" and it will yield more sales in the future." - Cedrick Harris
As in any business opportunity, it can be a beneficial practice if an MLM allows participants to return unsold product to the MLM because the ability to return product can decrease the risk of losing money for participants who take advantage of that policy. Allowing participants to return product, however, does not in and of itself shield an unfair or deceptive compensation structure from law enforcement. As a general matter, money-back guarantees and refunds are not defenses for violations of the FTC Act. Even where such policies are offered, dissatisfied participants may not seek a refund for a number of reasons, including because they are unaware of their right to a refund, the refund process is too complicated or obscure, or they blame themselves for not being able to sell the product.
In an October 15, 2010 article, it was stated that documents of a MLM called Fortune Hi-Tech Marketing reveal that 30 percent of its representatives make no money and that 54 percent of the remaining 70 percent only make $93 a month, before costs. Fortune was under investigation by the Attorneys General of Texas, Kentucky, North Dakota, and North Carolina with Missouri, South Carolina, Illinois, and Florida following up complaints against the company.[39] The FTC eventually stated that Fortune Hi-Tech Marketing was a pyramid scheme and that checks totaling more than $3.7 million were being mailed to the victims.[40]
Breaking into the world of travel bloggers, hotel hoppers, and digital nomads with #wanderlust was one of the best ideas MLM ever had. Everyone out there wants to work remotely nowadays, and a huge portion of those people want to do it so that they can travel. So, a remote income opportunity with a travel MLM just makes sense. WorldVentures is hitting this niche hard, having been named one of the Inc. 5000's fastest growing companies twice in a row.
To apply the principle of MLM and the power of LEVERAGE in real time today to make money online, CLICK THIS LINK and join the strongest, easiest and fastest paying MLM company that created thousands of millionaires in the past years until today. You will be blown away how each member receives multiple $25, $100, $250, $500 and $1000 daily with this MLM company.
78. What makes a riveting presentation? Get the prospect involved. Ask lot of questions. Let them answer. Let them hold the product if you are there. Let the audience raise their hands. Keep focused on engaging the prospect as you present. And tell a story about what the products have done, and make it emotional. Then ask them if they know anyone that they can relate to that story.
For example, I save the comments I write in my email drafts folder and I use the subject line as a label for the topic. After I've saved the drafts, I can come back and turn these comments into blog posts. I can even make the comment itself the blog post. After all, it's still my writing. (Check out Meddle, which makes this whole process easy and allows you to share/syndicate your comments to your social platforms with a few easy clicks.)
Fast forward to 2017. LuLaRoe is the biggest MLM for women. "More than 80,000 women have paid around $5,000 for several boxes of low-cost clothing and worked as much as 80-hour weeks to outfit hundreds of thousands of suburban women in multicolored polyester. But according to a report that studied the business models of 350 MLMs, published on the Federal Trade Commission's website, 99% of people who join multilevel-marketing companies lose money. Depending on how you look at it, it's either a brilliant business model or a predatory practice — or a little bit of both." (FTC)
One of the benefits of MLM is the ability to bring in new business builders and profit from the sales they make in their business. While some see this as "using" others, the reality is that you're being rewarded for helping others succeed. But for them to succeed, you need to see your role not as racking up as many recruits as possible, but in being a leader and trainer. The focus then is on the success of those you help in the business, not on you.
"Nothing in the world can take the place of Persistence. Talent will not; nothing is more common than unsuccessful men with talent. Genius will not; unrewarded genius is almost a proverb. Education will not; the world is full of educated derelicts. Persistence and determination alone are omnipotent. The slogan 'Press On' has solved and always will solve the problems of the human race."
"People like doing business with individuals that make them feel good. In other words, you're going to get a lot more business when you're not simply there to 'get' your clients money in exchange for what you're selling. Think of it this way. Be the person who they'd want to actually spend time with outside of a business setting. It doesn't mean you have to be their best friend and hang out together, it simply means that you're showing you care through your actions. One of the best things you can do is reach out to a potential client when they least expect it, with no agenda, no contract, no pitch…and just say 'hello' to see how they're doing." - Todd Falcone
First: Invite people to look at your business proposition with a direct or indirect approach. A direct approach would be to ask them to look at your business for themselves. An indirect approach is asking someone to look at your business to assist you with recommendations or referrals. There are many different patterns of language that you can use based on the relationship you have with the prospective recruit. The invitation process is a very important skill to learn. Your invitation has a lot to do with whether the person will join your team or support your business.
Market America is just as known for their massive discounted products portal as they are for their crazy rich CEOs. I'm talking Forbes list, mansion in Biscayne Bay and penthouse in Manhattan, celeb bffs, and giant yachts rich…all thanks to MLM. They've hit their fair share of SEC-shaped road blocks, but Market America is still going strong at #29 on the DSN Global 100.
2. Show More People. Having a bad day? Show more people. Tires flat? Show more people. Not feeling good about your current results? Show more people. Spouse doesn't believe in you? Show more people. SMP, SMP, SMP, SMP will pull you out of ANY funk, help you with ANY circumstance and is the ONLY way to actually change your results. Keep in mind it is your habits that created your results so change those habits and…SHOW MORE PEOPLE!
Plexus Worlwide is ranked by Inc. magazine as #8 (in 2014) and #132 (in 2015) fastest growing privately held company with a three year growth of 2833%; all while offering a 60-day money back guarantee on all its products – which means the products work. And at a consumer friendly price point. 40% of all sales are from customers and not ambassadors.
To get started, create a profile with a photo, your professional skills, experience, education and portfolio. Then, search Upwork's database of jobs and submit a compelling application to the ones of interest. Projects are hourly or fixed price. Once you win and complete an assignment, get paid via direct deposit, PayPal, wire transfer, Local Funds Transfer (LFT), Payoneer or Skrill.
I saw that you know of reliable sources of web traffic. I am ready to spend money to get good results. So can you tell me what are the best services for high quality traffic? I would like to build large downline in some MLM programs (Go Fun Rewards, Savings Highway, Penny60pro and some other programs) I went through several techniques but I still can not build large downline . Can help me by giving me some information?
Although each MLM company dictates its own specific financial compensation plan for the payout of any earnings to their respective participants, the common feature that is found across all MLMs is that the compensation plans theoretically pay out to participants only from two potential revenue streams. The first is paid out from commissions of sales made by the participants directly to their own retail customers. The second is paid out from commissions based upon the sales made by other distributors below the participant who have recruited those other participants into the MLM; in the organizational hierarchy of MLMs, these participants are referred to as one's down line distributors.[5]
The prospect of working from home is becoming increasingly popular. According to The New York Times, a recent Gallup poll reports 43 percent of employees work remotely some of the time. Of those, the number working from home four to five days per week has jumped to 31 percent. Modern workers seem to be embracing the flexibility of working remotely, so it's not surprising that multi-level marketing companies (MLMs) are "poised for explosive growth," Forbes predicts.
They were hot. These guys caught some shade for over-inflating their health products, but what health MLM doesn't inflate their prices "a tiny bit" so they can dish out those juicy commissions? Well, their fiber product was 900% more than "leading alternatives" and their Trioten protein blend was 600% more expensive than Herbalife and Shaklee proteins. Ouch.
If you want to learn about the wonderful (and massive) world of internet marketing from the pros, Digital Altitude is where it's at. Their products might cost up to $10k+, but you're getting access to a toolbox of pure gold. Then there's their commission rate…up to 60%. Just take a second to think about what a 60% commission rate on a $10k+ product looks like. Not bad, huh?
How MLM companies are NOT considered Pyramid organizations is beyond me! They are all scams by the very nature of their organization structure. Those who start or get in early benefit directly from the efforts of those beneath them, forever. Not to mention the fact that most product sold through any of these MLM organization's is to the dealer network itself. The top dogs are making money regardless as long as there is new blood coming in. And the best way to keep new blood coming in is to incentivize those at the lower middle and below to continue recruiting to build "a network of their own". And those on the verge of "breaking through" who have already invested a small fortune in products along the way that are sitting on their pantry shelves NEED to keep recruiting. The very thing that differentiates a Pyramid scheme from an MLM is that an MLM sells an actual product. That is it. It doesn't determine who that product is sold to as it should since we know that most product is sold to the worker bees and not to the general public for long.
Multi-level marketing (MLM), also called pyramid selling,[1][2] network marketing,[2][3] and referral marketing,[4] is a marketing strategy for the sale of products or services where the revenue of the MLM company is derived from a non-salaried workforce selling the company's products/services, while the earnings of the participants are derived from a pyramid-shaped or binary compensation commission system.
I'm surprised Rodan and Fields didn't make the list, considering they are the fourth largest premium skin care company with the top three being 50+year old companies, Estée Lauder, Lancôme & Clinique. We are North America's 4th largest and fastest growing premium skincare company, but we're not in stores, the top 3 — Clinique, Lancôme and Estée Lauder.
Recruit new members. Just like you were recruited to a network marketing company, you'll have to recruit members to your team if you want to be successful. Always be on the lookout for new prospects who you think will be valuable additions to your team. Try recruiting services like: MLMRC. Also, you'll want someone who is personable, a good salesperson, and a team player committed to cooperating with you.
Disclaimer: The information contained in this document is provided for informational purposes only and should not be construed as financial or tax advice. It is not intended to be a substitute for obtaining accounting or other financial advice from an appropriate financial adviser or for the purpose of avoiding U.S. Federal, state or local tax payments and penalties.
Some people have the perception that network marketing is just a party here and there and an occasional pitch to your Facebook friends to buy your products and that's it. It is so much more than that (if you do it right). Your success with your new business is going to greatly depend on how seriously you take it and how much work you put into it. That doesn't mean you have to give up all your free time, but it does mean following a few sensible strategies.
There are a few ways to use LinkedIn lead generation as an effective marketing tool. One way that people don't often think of is participating in LinkedIn answers. There is a section on LinkedIn where people ask industry-specific questions and get advice. As an industry insider, you have the knowledge that can help people with these questions. Through participating in a regular dialogue of advice-giving, you can establish yourself as a thought leader. Moreover, you can optimize use of this tool by pointing people to your online blog that gives more information about the subject. Make sure to send them to a blog with a call to action at the end!
Because of the nature of recruitment and the dream of living the life of riches, it is no stretch to the imagination that sometimes, the real picture gets blurred between the lines. Also, MLM is notoriously known for getting you on the bad books of friends and family. This is of course a general stereotype against the industry and not a concrete consequence.
As in many other areas, the FTC periodically meets with consumer groups, industry representatives, and other stakeholders to learn more about evolving practices and concerns. Also, the FTC has issued and updates consumer and business educational materials. In addition, the FTC's Bureau of Economics has devoted and continues to devote its research expertise to issues relating to direct sales and multi-level marketing. These various efforts can provide valuable insight to inform the FTC's investigations of MLMs, which involve fact-specific and comprehensive analysis of multiple factors.
How many leads do you get for your money? Obviously the more leads you can get for the best price the more leads you can buy at a time. MLM Leads are a great way to not only create activity in your MLM Business, but also find some great people for your business. Want a great way to build your MLM business? Well Co-registration MLM leads are one of the best ways to find new prospects and new product buyers. Multi-level marketing lists generated by quality companies that have the tools and experience to glean true lists for an advertiser's particular marketing needs are also known as targeted MLM leads.
4. Lather on the recognition. One of the topics that is going to be covered at our next Top Earner Academy (August 13-16th in Tampa) is all about culture and recognition. Napoleon said "I have made the most wonderful discovery, I have discovered men will risk their lives, even die, for ribbons and men will also die to avoid having their ribbons taken away." Yes, Napoleon just gave you powerful Network Marketing tips and would have been a Crowd Presidential Diamond =) Make sure you are recognizing those that are putting in the effort you want them to.
People in MLM that come across like they have a dollar bill stuck on their forehead face massive resistance. Your prospect feels your hand already reaching for their money. Yes, you must get paid for what you do, but if you have a much better chance of doing business with them, if you ask for their help initially, vs. coming across like you want to sell them something. Seek their input FIRST, then seek the sale. You will be glad you did.
Every week as SmallBizLady, I conduct interviews with experts on my Twitter talk show #SmallBizChat. The show takes place every Wednesday on Twitter from 8-9 pm ET. This is excerpted from my recent interview with Sulaiman Rahman, @sulrah. Sulaiman is the founder of UrbanPhilly.com, or UPPN – Urban Philly Professional Network. He was also an African-American Chamber of Commerce Chair. Sulaiman is a Philadelphia native and Penn graduate. He is also currently a Creative Ambassador for philly360 and long-time entrepreneur.
Melaleuca, Inc. is listed as a Direct Marketing Company. The company contracts with independent marketing executives who refer customers to Melaleuca that purchase its various lines of nutritional, pharmaceutical, personal care, household cleaning, and pet care products. They also offer travel, phone and credit card services. Customers receive discounts if they order a minimum monthly product supply, but are not required to maintain an inventory of products. The company states that it offers a "Satisfaction or Money Back Guarantee".
Well MLM companies have been a frequent subject of criticism as well as the target of lawsuits. Criticism has focused on their similarity to illegal pyramid schemes (hence the "scheme" reference), price-fixing of products, high initial start-up costs, emphasis on recruitment of lower-tiered salespeople over actual sales, encouraging if not requiring salespeople to purchase and use the company's products, potential exploitation of personal relationships which are used as new sales and recruiting targets, complex and sometimes exaggerated compensation schemes, and cult-like techniques which some groups use to enhance their members' enthusiasm and devotion. Eesh!
Remember to create a plan at your very first opportunity. I know the saying gets old but people never create a plan to fail, but in most cases those who fail, do fail to plan! You would never travel all the way across the country without having some sort of plan, at least a map, on how to get there and how much it will cost. One of the very best MLM tips I can offer is the idea of developing a plan on the very first day you enter your new business. And remember one of the best ways to learn is to listen closely to those who have become successful doing the MLM business in the past.


text:
The Department of Transportation & Capital Infrastructure is currently seeking qualified applicants for an Assistant Director, Transportation Planning & Traffic Engineering. This position provides leadership and oversight of the Transportation Planning and Traffic Engineering Division, which encompasses a broad range of transportation functions, such as short and long range transportation planning, land use application referrals for the transportation discipline, managing traffic data collection; operational studies and analysis relating to citizen complaints, bicycle and pedestrian mobility projects, traffic calming, warrant analysis (signal and stop-control), intersection justification reports and other operational related evaluations; the review of land development applications including traffic impact statements to verify that traffic impacts are mitigated appropriately; and transportation travel demand modeling. The Assistant Director will make presentations to the Loudoun County Board of Supervisors, Planning Commission and other public forums on a wide variety of transportation issues; is responsible for leading and managing a high performing staff and maintaining a professional work environment in accordance with County policies and procedures, and may act as department head in the Director's absence.
HIRING RANGE: Up to $124,742; DOQ. Recruitment #19-A3-1549. Apply immediately. Visit our on-line employment center at www.loudoun.gov for more information and to apply. EOE
This position requires any combination of education and experience equivalent to a Master's degree in Civil Engineering, Urban Planning, Transportation Planning or related field and at least seven (7) years of related experience including two (2) years of supervisory experience in transportation planning and/or traffic engineering. Professional Engineer license or Certification from the American Institute of Certified Planners desired. Must have comprehensive knowledge of the theory, principles, practices and techniques of transportation planning, multi-modal systems and traffic engineering operations including the ability to solve all common and unusual problems encountered, as well as developing models to forecast traffic demand; thorough knowledge of all applicable Federal, State and local laws, codes and ordinances; thorough knowledge of the administrative operations of all County–wide agencies and the nature of the services provided; ability to analyze unusual circumstances, variations in approach, and incomplete or conflicting information, and defend and negotiate recommendations concerning road safety issues; ability to analyze conflicts and facilitate resolutions; ability to develop programmatic and administrative management plans and employee performance standards; ability to determine best use of human, fiscal and material resources; ability to communicate ideas clearly and concisely both verbally and in writing; ability to establish and maintain effective working relationships with fellow employees, County and State officials, contractors and the general public. Must have a valid driver's license and provide a current driving record, and satisfactory completion of a criminal background check.
Councils and Forums
MO/State Sites
Fall Conference 2018
Annual Convention
Fall Conference
Future Conferences
Exhibit and Sponsorship Information
Full Calendar
Key Issues
Minuteman Fund
ACEC/PAC and Political Programs
QBS Resource Center
Online Classes
On-Demand Online Classes
Business of Design Consulting
Senior Executives Institute
SEI Leadership Library
Pathways to Executive Leadership
Last Word
Engineering Inc.
Job Board
Books and Contracts
Coalition Documents
Risk Management Resources
Discount Programs
Advertise with ACEC
Engineering Excellence Awards
College of Fellows
Young Professional of the Year Award
Community Service Awards
Award of Merit
QBS Awards Program
Why Be a Member?
Join ACEC Now
Member Search
Supplier Directory