Monitor Network Activity with TCPView

TCPView is a Microsoft program which will list all transmission control protocols on your system. It can be downloaded for free here. Any server connected to your computer or network will be listed.

You can view the address of each TCP endpoint, and see how many bytes it is using. By right clicking any one endpoint, you can terminate it.

TCPView is particularly useful for detecting which programs running on your PC are accessing the internet. Simply shutting down your web browser and email client should reduce the number of running endpoints by a few hundred. What remains may be putting an unnecessary drain on your system, and could possibly be malware.

Don't Let the FUDs Get You!

Keep in mind that while your antivirus software may detect many types of malware, there are also a great number of malware programs which are 'fully undetectable' or FUD.

Malware may be encrypted so it's not possible for antivirus to scan through it.

Malware developers will check the detectability of their programs using widely used antivirus programs.

Malware can also evade antivirus software by using 'fileless techniques'. This means that the malware will run entirely in RAM - there will be no actual files downloaded to a PC. Rebooting your operating system can clear RAM, but some malware can manipulate the registry or PowerShell to keep functioning. It is also possible for ransomware attacks to work without using any files.

Beware of zero day attacks, that will successfully circumvent antivirus software before the malware is discovered. While virus definition updates are distributed daily, thousands of new malware attacks are also devised each day.

Data Encrypted at Rest in Relativity

RelativityOne encrypts data at rest on servers so attackers cannot read the data without encryption keys.

FedRAMP, HIPAA, and other regulations may require data at rest encryption. Relativity uses the Microsoft Azure platform which according to this white paper meets, “more than 70 international and industry-specific compliance standards, such as ISO 27001, SOC 2, Type II, HIPAA, and FedRAMP, as well as country- specific standards like Australia IRAP, UK G-Cloud, and Singapore MTCS.”

Note that the HIPAA Security Rule does not actually require encryption but it does make it an 'addressable implementation' which means that it may be found that it is reasonable and appropriate to encrypt data. If not, alternative measures can be taken.

FedRAMP's Control Specific Contract Clauses, which provides language to be used in the provisions of contracts addressing cloud security, states that, "Cloud Service Providers pursuing a FedRAMP authorization will have to support the capability to encrypt data-at-rest; however, contract clauses should indicate any specific agency requirements for data encryption."