Category Guidance

Security Update – 2019

by Billy J Long Articles, Guidance

Article (PSA‑0011)

Why This Year Was a Wake‑Up Call

From the rapid spread of WannaCry and NotPetya ransomware to the explosion of illicit cryptocurrency miners, 2017 reminded us that cyber‑threats can appear from unexpected places. Each year the quantity and variety of threats increase, and attackers continuously develop new ways to infiltrate devices while covering their tracks.

Key Threat Statistics (2017‑2023 Trend Highlights)

  • Ransomware – Over 2 billion records exposed worldwide (2022 Verizon DBIR).
  • Cryptocurrency miners – Symantec reported an 8,500 % increase in miner detections from 2016 to 2017; the trend continues with modern “cryptojacking” scripts on compromised websites.
  • Downloader families – + 92 % new variants reported in 2017; these “dropper” programs fetch additional malware after initial infection.
  • Mac malware – + 80 % new threats in 2017, and the numbers have kept climbing as macOS market share grows.

What Is Malware?

“Malware” = malicious software. It’s an umbrella term for any program that infects a computer without the user’s consent, including viruses, ransomware, spyware, ad‑ware, trojans, and cryptominers.

Common Infection Vectors (non‑exhaustive)

  • Infected email attachments.
  • Compromised USB thumb drives or external disks.
  • Downloads from untrusted websites or pirated software.
  • Malicious links in email, social‑media posts, instant‑message chats.
  • Drive‑by downloads via compromised legitimate‑looking websites (malvertising).

For a full glossary of terms, see our Threat Glossary.

Do You Need to Worry About Malware?

Absolutely. Cyber‑crime targets anyone with an Internet‑connected device—home users, small businesses, and large enterprises alike.

  • Business impact: A breach can expose customer data, trigger legal penalties (GDPR, HIPAA, PCI‑DSS), and damage reputation.
  • Personal impact: Family photos, financial documents, and personal communications can be stolen, encrypted, or deleted.
  • Recent surveys (Verizon 2023) show **≈ 1 in 3 people** reported a personal security incident in the past year.

Basic Protection Checklist (Start Here)

  1. Keep software updated. Enable automatic Windows/macOS updates, and patch third‑party apps as soon as patches appear.
  2. Use reputable antivirus/anti‑malware. Microsoft Defender (Windows 10/11) or a trusted third‑party solution (Bitdefender, Malwarebytes, ESET).
  3. Enable a firewall. Built‑in OS firewall is sufficient for most home users; ensure it’s turned on.
  4. Practice safe browsing. Don’t click unknown links, verify URLs, and avoid downloading from untrusted sites.
  5. Secure email. Use spam filters, enable MFA on email accounts, and never open unexpected attachments.
  6. Back up your data. Follow the 3‑2‑1‑0 rule (three copies, two media types, one off‑site, zero errors).
  7. Enable multi‑factor authentication (MFA) on any cloud service, VPN, and privileged accounts.

What to Do If You Suspect an Infection

  • Disconnect the device from the Internet (disable Wi‑Fi/Ethernet).
  • Run a full scan with an up‑to‑date anti‑malware product.
  • If the scan reports ransomware or a serious threat, isolate the machine and consider professional remediation.
  • Change passwords for any accounts accessed from the infected device (preferably from a clean device).
  • Restore files from a recent, verified backup if they have been encrypted or corrupted.

2025 Update – New Threat Landscape & Mitigations

Since the original 2017‑2023 overview, several important developments have reshaped the threat environment. Below is a concise addendum you can use to keep the article current.

1️⃣ Ransomware‑as‑a‑Service (RaaS) is Mainstream

  • Attack‑as‑a‑service platforms (e.g., LockBit 2.0, Hive, Blackcat) let low‑skill actors launch ransomware attacks for a subscription fee.
  • 2024 Verizon DBIR reported 61 % of data‑breach incidents involved ransomware, and total ransomware payments in 2024 topped **$1.5 billion**.
  • Mitigation: Deploy **endpoint detection & response (EDR)** solutions (CrowdStrike Falcon, SentinelOne, Microsoft Defender for Endpoint) that can detect malicious behavior before encryption begins; maintain immutable backups (write‑once, read‑many) to thwart ransom demands.

2️⃣ AI‑Generated Phishing & Deepfake Social Engineering

  • Large‑language models are being used to craft hyper‑personalized phishing emails that bypass traditional keyword filters.
  • Deepfake video/audio calls are increasingly used to impersonate executives (“CEO fraud”).
  • Mitigation: Adopt **zero‑trust email verification** (DMARC, SPF, DKIM), train staff with regular simulated phishing campaigns, and enforce MFA for all privileged accounts.

3️⃣ Supply‑Chain & Software‑Update Attacks

  • After the 2020 SolarWinds breach, attackers have focused on compromising software update mechanisms (e.g., recent Octave and EventX incidents in 2025).
  • Mitigation: Verify code signatures, enable **code‑signing integrity checks**, and limit admin rights on update tools.

4️⃣ Cryptojacking Evolution

  • Browser‑based cryptojacking scripts now target **WebAssembly** for higher hash rates, often delivered via compromised ad‑networks.
  • Mobile devices are also being hijacked to mine Monero via malicious apps.
  • Mitigation: Use browser extensions that block crypto‑mining scripts (e.g., uBlock Origin, NoScript), keep browsers and plug‑ins up to date, and run mobile anti‑malware scans.

5️⃣ Rise of “File‑less” Malware & Living‑off‑the‑Land (LotL) Techniques

  • Attackers increasingly leverage legitimate OS utilities (PowerShell, Windows Management Instrumentation, Office macros) to execute payloads without dropping a file on disk.
  • Mitigation: Enable **Windows Defender Exploit Guard** (Attack Surface Reduction rules), enforce **Application Control** (AppLocker or Microsoft Defender Application Control), and limit PowerShell execution policies.

6️⃣ Enhanced Defensive Technologies (2025)

  • Microsoft 365 Defender XDR integrates email, endpoint, identity, and cloud app protection using AI‑driven analytics.
  • Zero‑Trust Network Access (ZTNA) replaces traditional VPNs for many businesses, reducing lateral movement risk.
  • Endpoint platforms now provide **automated ransomware rollback** (e.g., CrowdStrike’s “Rollback” and SentinelOne’s “ActiveEDR”) that can restore files to pre‑infection state without a backup.

7️⃣ Updated Statistics (2025)

  • IDC estimates **5.6 billion** devices will be infected with some form of malware by the end of 2025.
  • 2024 Palo Alto Networks report shows a **28 % increase** in credential‑theft attacks targeting remote‑work setups.
  • Cyber‑insurance premiums have risen an average of **23 %** year‑over‑year, reflecting the growing cost of ransomware and data‑breach remediation.

Need Help Right Now?

If you have questions about current threats, want a security assessment, or need assistance cleaning an infected system, call PSA Computer Services at (707) 506‑6802. We’ll help you protect your data and get you back online safely.

Directory Structure and File Name Conventions

by Billy J Long Articles, Guidance

Article (PSA‑0010)

Why Organised Folders & File Names Matter

Clear, consistent folder hierarchies and descriptive file names make it easy for anyone – you, a colleague, or a future replacement – to locate, sort, and understand data without having to open every file. When the structure is well‑planned you also reduce the risk of accidental overwrites, improve backup reliability, and simplify compliance audits.

General Principles

  • Consistency is king. Choose a convention and apply it everywhere.
  • Keep it human‑readable. A person should understand the purpose of a folder or file just by glancing at its name.
  • Stay within OS limits. Most file systems allow 255 characters per name and 260 characters for a full path (Windows) or 4 KB per path (Linux/macOS). Avoid nesting too deeply.
  • Separate concerns. Use top‑level directories for major categories (e.g., Personal, Business, Projects, Archives).

Designing a Folder Hierarchy

1️⃣ Top‑Level Categories

Start with a few broad folders that reflect the primary purpose of the data.

/Personal
/Business
/Shared
/Archives

2️⃣ Sub‑Categories by Type

Inside each top‑level folder, group by data type or function.

/Personal/
    Documents/
    Pictures/
    Music/
    Finance/
    Health/

 /Business/
    Clients/
    Projects/
    Marketing/
    HR/
    Finance/

3️⃣ Time‑Based Segmentation (when relevant)

For large, chronological collections (photos, invoices, logs) add a date hierarchy. Use the ISO‑8601 format YYYY‑MM (or YYYY‑MM‑DD) – it sorts naturally.

/Personal/Pictures/2024/01_Jan/
/Business/Finance/Invoices/2024/01_Jan/

4️⃣ Project‑Oriented Segmentation

When a project spans multiple data types, create a dedicated project folder and nest type‑specific subfolders inside it.

/Business/Projects/ABC_Redesign/
    Docs/
    Designs/
    Deliverables/
    Archive/

File‑Naming Conventions – Actionable Rules

  1. Date format – Use YYYYMMDD (or YYYY‑MM‑DD) at the beginning or end of the name. This format sorts correctly and avoids ambiguity across regions.
  2. Scope identifiers – Add short, standard abbreviations for:
    • Project code – e.g., ABC for Project ABC.
    • Department or client initials – e.g., HR, ACME.
  3. Versioning – Use zero‑padded numbers (v001, v002) so that lexical sorting matches chronological order.
  4. Descriptive title – Include a concise subject (max 3‑4 words) that remains meaningful outside the folder context.
  5. Separator choice – Use either _ (underscore) or - (hyphen) consistently. CamelCase is acceptable but avoid mixing styles.
  6. File‑type extension – Keep the correct extension (e.g., .pdf, .xlsx) as the last element.

Example File Names

20240415_ABC_Proposal_v001.pdf
20240328_HR_EmployeeList_v03.xlsx
IMG_20240112_Jan_Holiday.jpg
2024-04-30_Invoice_ACME_001.pdf

Do’s & Don’ts (quick reference)

  • Do use only alphanumeric characters, underscores (_), hyphens (-), and periods for the extension.
  • Do keep names concise – aim for ≤ 30 characters (excluding extension) when possible.
  • Do make the name readable without relying on the folder path for context.
  • Don’t use spaces, tabs, commas, semicolons, or special symbols (e.g., # $ % & *).
  • Don’t use all caps for the entire name; reserve caps for abbreviations only.
  • Don’t embed version control software identifiers (like .git) in regular file names unless the file is truly part of a repo.

Practical Tips for Implementation

  1. Document the standard. Create a one‑page cheat sheet and store it in the root folder (e.g., README_FileNaming.txt).
  2. Automate where possible. Use bulk‑rename tools (PowerRename in PowerToys, Bulk Rename Utility, or scripts) to retrofit existing files to the new convention.
  3. Leverage OS features. Use “Quick Access” (Windows) or “Favorites” (macOS) to pin frequently used top‑level folders.
  4. Regularly audit. Conduct a quarterly review to ensure new files follow the rules and to prune empty or obsolete folders.
  5. Back up consistently. A predictable folder structure improves backup reliability and makes restores faster.

When Working in a Team or Organization

  • Adopt the same hierarchy across all shared drives or cloud storage (OneDrive, Google Drive, SharePoint).
  • Agree on a master list of abbreviations (project codes, department IDs) to avoid collisions.
  • Include the naming policy in onboarding material and enforce it through periodic spot‑checks.

Bottom Line

A well‑designed folder tree combined with a clear, consistent file‑naming scheme turns a chaotic data dump into an organized, searchable library. Adopt the rules above, document them, and enforce them – the time you invest now saves countless hours later.

Need Assistance?

If you’d like help designing a folder hierarchy, creating a naming standard for your team, or cleaning up an existing file system, call PSA Computer Services at (707) 506‑6802.