Beware of the Rise of Ransomware

On March 31, 2016, the U.S. Department of Homeland Security, in collaboration with the Canadian Cyber Incident Response Centre, issued a joint alert on ransomware (1).  Less than one month later, anti-malware maker Enigma Software reported that April 2016 was the “worst month for ransomware on record in the U.S.” (2).  In an effort to increase awareness to this ever-growing cybersecurity threat, I'd like to share the below information with you today:

What is Ransomware?

According to the U.S. Computer Emergency Readiness Team (“US-CERT”), ransomware is a specific type of malicious program (i.e., a virus) where the victim’s computer, network, and/or files become strongly encrypted to the point they are effectively rendered useless.  Shortly after the victim realizes what happened, he or she typically receives a message demanding a ransom in exchange for restoring access to the affected systems and data.

How is Ransomware Spread?

According to US-CERT, ransomware can be spread through e-mails that contain the malicious program or contain links to an infected website, or through messages or links sent through social media; however, in some recent variants, ransomware was spread by means of a “drive-by download attack,” which occurs when an attacker covertly “injects” an ordinary website—usually a trusted or popular website—with malicious code, which, in turn, is  downloaded and installed on unsuspecting visitors’ computers.  An October 2014 article in SecurityWeek magazine explains that many drive-by download attacks target users running out-of-date or older versions of common software programs; users who fail to promptly install the most current security patches can also easily fall victim to this method of attack (3).

Impact

According to Kaspersky Lab, cybersecurity experts found that in 2015, one in three business computers was exposed at least once to an internet-based attack; during that same timeframe, more than 50,000 corporate machines fell victim to ransomware attacks (4).  Businesses, however, haven’t been the only target. According to the FBI, victims have included hospitals, school districts, state and local governments, and law enforcement agencies (5).  In short, anyone with a computer and internet access could potentially become the next victim of a ransomware attack.

Solutions

Enigma Software and US-CERT provided recommendations to help minimize the impacts of a ransomware attack, including:

1.    Back up your data regularly (at least weekly) to an external device that isn’t regularly connected to the network.  Keep in mind that ransomware will target anything connected to an infected computer or network; unless the computer or network has been completely wiped clean of any trace of the malicious program, the ransomware will easily spread to any device connected, even after infection. Disconnect the backup drive after the backup and store it in a safe, secure and weatherproof location. I recommend that you keep at least two backup drives and rotate your backups between them.

2.    Update your software.  Keep your operating system and software up-to-date with all the latest patches, especially critical security patches. Better yet, allow or set up Windows to automatically update your PC with the latest patches.

3.    Maintain up-to-date anti-virus software, and ensure that virus updates are downloaded automatically. Check with your internet provider. They may supply a commercial security suite at no or little cost to you.

4.    Think before you click.  Do not click on unfamiliar links sent in unsolicited messages or e-mails: social media accounts can be hijacked, and e-mails can be spoofed, so even a trusted sender could really be a wolf in sheep’s clothing.

5.    Contact your local FBI field office immediately if you become the victim of a ransomware attack.  Avoid paying the ransom if at all possible.  According to the FBI, paying a ransom does not guarantee that you will regain access to your data; in a number of instances, individuals who paid the ransom were never provided with decryption keys.

And finally, more than anything, have a plan.  There are a number of resources on ransomware that contain useful considerations for both before and after a ransomware attack (6).  While there is no certain way to protect against ransomware attacks, preventative preparation has the potential to mitigate the impact.

 If you would like to review your current investment portfolio or discuss any other financial planning matters, please don’t hesitate to contact us or visit our website at http://www.ydfs.com. We are a fee-only fiduciary financial planning firm that always puts your interests first.  If you are not a client yet, an initial consultation is complimentary and there is never any pressure or hidden sales pitch. We start with a specific assessment of your personal situation. There is no rush and no cookie-cutter approach. Each client is different, and so is your financial plan and investment objectives.

Sources and Foot Notes:

(1) US-CERT Alert TA16-091A, “Ransomware and Recent Variants” https://www.us-cert.gov/ncas/alerts/TA16-091A
(2) Enigma Software, “April 2016 was the Worst Month for Ransomware on Record in the US” http://www.enigmasoftware.com/april-2016-worst-month-ransomware-record-us/
(3) Security Week, “The Internet’s Big Threat: Drive-by Attacks” http://www.securityweek.com/internets-big-threat-drive-attacks
(4) Kaspersky Lab, “Kaspersky Lab on Business Threats: 2015 Saw the Number of Cryptolocker Attacks Double” http://www.kaspersky.com/about/news/virus/2015/Kaspersky-Lab-on-business-threats-2015-saw-the-number-of-cryptolocker-attacks-double
(5) FBI, “Incidents of Ransomware on the Rise” https://www.fbi.gov/news/stories/2016/april/incidents-of-ransomware-on-the-rise/incidents-of-ransomware-on-the-rise
(6) Department of Homeland Security United States Computer Emergency Readiness Team, “Ransomware” https://www.us-cert.gov/sites/default/files/publications/Ransomware_Executive_One-Pager_and_Technical_Document-FINAL.pdf.

Protect Your Future Income

For all of us, protecting our online accounts should be high on our priority list.  The Social Security Administration has finally caught on and has tightened security in order to frustrate hackers and identity thieves.  Now, when you log into your Social Security Administration (SSA) account, you do what you’ve always done: give your user name and password.  Then you receive a security code sent by text message, and type in that code to complete your login procedure.  In the cyber-security trade, this is known as multi-factor authentication.

The result is better security, but it may be a big hassle for some users.  On the first day, Verizon customers weren’t getting their security codes; the problem has since been fixed.  Less technology-oriented Americans (and there are many) don’t use texting on their phones, which means they’ll either have to learn or do without their SSA account.  At the same time, multi-factor authentication doesn’t necessarily prevent cyber criminals from fraudulently creating an online account in your name or from siphoning away your benefits. Still, it's a step in the right direction.

Your response?  If you don’t already have an online account with the Social Security Administration, now would be a good time to open one, before a thief decides to do it for you.  (Here’s a direct link: https://secure.ssa.gov/RIL/SiView.do)  And if you aren’t into texting, now is a good time to become familiar with that feature of your smart phone.  If you’re having trouble, ask any teenager for some quick technical support. You may wonder why you waited so long to do so.

If you would like to review your current investment portfolio or discuss any other financial planning matters, please don’t hesitate to contact us or visit our website at http://www.ydfs.com. We are a fee-only fiduciary financial planning firm that always puts your interests first.  If you are not a client yet, an initial consultation is complimentary and there is never any pressure or hidden sales pitch. We start with a specific assessment of your personal situation. There is no rush and no cookie-cutter approach. Each client is different, and so is your financial plan and investment objectives.

Source:

http://time.com/money/4434100/social-security-website-two-factor-authentication/?xid=tcoshare

The MoneyGeek thanks guest writer Bob Veres for his contribution to this post

Managing and Paying Off Student Loans

A couple of weeks ago, I posted an article here entitled "A College Education Still Pays" despite the growing student loan burden. If you already owe money on student loans, this article follows up and suggests ways to manage and pay off your student loans.

Actively managing your debt is an important step, and your student debt may be one of the biggest financial obligations you have. There are many strategies that could help you manage student loans efficiently. Here is a checklist:

• Choose a federal loan repayment plan that fits your circumstances: 
  • The Graduated Repayment Plan starts with a reduced payment that is fixed for a set period, and then is increased on a predetermined schedule. Compared to the standard plan, a borrower is likely to end up paying more in interest over the life of the loan.
  • The Standard Repayment Plan requires a fixed payment of at least $50 per month and is offered for terms up to 10 years. Borrowers are likely to pay less interest for this repayment plan than for others.
  • The Extended Repayment Plan allows loans to be repaid over a period of up to 25 years. Payments may be fixed or graduated. In both cases, payments will be lower than the comparable 10-year programs, but total costs could be higher. This program is complex and has specific eligibility requirements. See the Extended Repayment Plan page on the U.S. Department of Education website for details.
  • The Income-Based Repayment Plan (IBR), the Pay as You Earn Repayment Plan, the Income-Contingent Repayment Plan (ICR) and the Income-Sensitive Repayment Plan offer different combinations of payment deferral and debt forgiveness based on your income and other factors. You may be asked to document financial hardship and meet other eligibility requirements. See the U.S. Department of Education's pages on income-driven repayment plans and income-sensitive repayment plans for more information.

• Take an inventory of your debt. How much do you owe on bank and store credit cards? On your home mortgage and home equity credit lines? On car loans? Any other loans? Consider paying extra each month to reduce the loans with the highest interest rates first, followed by those with the largest balances.

• Free up resources by cutting costs. Consider eating out less, reducing snacks on the go, and carpooling or using mass transit instead of driving to work. You may also be able to cut your housing costs, put off or take less costly vacations and reduce clothing and other discretionary purchases.

• Think about enhancing your income. A second job? A part-time business opportunity? Selling unused household items on eBay? Diversifying your income is just as important as diversifying your investments.

• Consider jobs that offer opportunities for subsidies or debt forgiveness. 
  • Federal civil service employees may be eligible for up to $10,000 a year for paying back federal student loans. See the U.S. Office of Personnel Management's Student Loan Repayment Program for more information.
  • Nurses working in underserved areas may be eligible for loan assistance through the U.S. Department of Health and Human Services' NURSE Corps Loan Repayment Program.
  • Service members in the U.S. Armed Forces are eligible for support. Check out the service-specific programs offered by the Air Force, the Army, the National Guard and the Navy.
  • Teachers can consider programs such as Teach for America and the Teacher Loan Forgiveness Program.

• Sign up for automatic loan payments. Many loans offer discounted interest rates for setting up automatic electronic payments on a predetermined schedule. A reduction of 0.25% per year may look small, but over the life of a 20-year loan, it can reduce your total interest cost by hundreds or even thousands of dollars.

• A last resort is seeking loan deferment or forbearance. Students facing significant financial hardship may be able to put off loan interest or principal payments. To see whether you might qualify, look to the U.S. Department of Education's information on Deferment and Forbearance.

If you would like to review your current investment portfolio or discuss any other financial planning matters or student loan options, please don’t hesitate to contact us or visit our website at http://www.ydfs.com. We are a fee-only fiduciary financial planning firm that always puts your interests first.  If you are not a client yet, an initial consultation is complimentary and there is never any pressure or hidden sales pitch. We start with a specific assessment of your personal situation. There is no rush and no cookie-cutter approach. Each client is different, and so is your financial plan and investment objectives.

Did You Exit After Brexit?

The pundits had it all wrong with the Brexit vote (I too was wrong on the British vote to exit from the European Union).

With the benefit of hindsight, we can see that it would have been a bad idea to sell your stock holdings after the Brexit vote; you would have locked in a 5% to 10% loss in a market that has trended upward to new record highs.  The same is true of the aftermath of the World Court decision that slapped China in the face by declaring that man-made islands don’t transform an ocean into territorial waters, the attempted coup in Turkey, or, really, any other alarming headline which doesn’t materially affect a company’s ability to run its operations or earn a profit.

But the bigger issue is that, even if you knew the outcome of the vote, you still wouldn't have known how markets were going to react.  How would you know whether quick-twitch traders would buy or sell the event?  After the Brexit vote, it took a weekend for investors and traders to realize that this was Britain’s problem, not theirs.  Realistically, it could have taken a month, or even a year to play out.

The same is true for the time period that we’re heading into now.  As you can see from the accompanying chart, the average return for various months of the year has been pretty much the same across the spectrum.  But August, September and October have seen bigger highs and (most alarmingly) also deeper lows, on average, than other months.  This additional volatility seems to be random, and is, once again, impossible to time.  People who decide to side-step the late summer and early fall would miss out on average yearly gains for September and October of 1.05% and 1.21%.  (Skipping August would have saved you modest losses of less than 1%, on average, but one suspects that this is a statistical anomaly.) The month of August in election years, even during the bear market of 2008, tends to have a positive bias; will this year be one of them?

Finally, biggest picture of all, the current bull market, which started March 9, 2009, has now become the second-longest bull market on record, beating the June 1949 to August 1956 rally.  It is second only to the December 1987 to March 2000 advance.  In terms of percentage change, we are experiencing the fourth strongest bull market on record.

Doesn’t that mean it’s time to take our chips off the table?  If we knew how to consistently time the market, if we could be sure that the market run won’t continue to run up for another few years, then the answer would be yes.  But with the economy continuing to churn out positive gross domestic product (GDP--the measure of our output of goods and services), with inflation low and unemployment continuing to fall, and central bankers supplying liquidity and stimulus to the markets, it’s hard to see what would cause U.S. stocks to be less valuable in the near future than they are today.

Meanwhile, once again, even if we did exit, how would we know when to get back in?  Investors who bailed during the 2008 downturn missed much of the surprise upturn that began this current bull run.  Those who hung on more than made up for their losses, even though it seemed like every year would be the bull market’s last. One thing that I've learned from doing this for so long, is that moves in the market (in both directions) usually go on far longer than most people can imagine.

There isn't a day where some market "expert" or pundit comes out and says he likes nothing in this market and to sell everything? ... Really?? Sell everything?! It angers me how reckless these statements are. Giving blanket advice to people is irresponsible. You don’t know the person’s goals, age, risk tolerance, time-frame, etc. But fearful headlines will always attract eyeballs, and most of these pundits have something to sell you. Don't buy it. Maybe you should sell some things, but always do your own due diligence and always keep in mind your long-term goals.

It’s nearly certain that there will be a lot of scary headlines between now and the end of the year, and it’s quite likely that the investment roller coaster is about to get bumpy.  All of us wish that we had a working crystal ball to help us navigate through uncertainty, but all we have is the historical record, which says that after the next downturn, the market will eventually experience a new high (yes, this will happen regardless of who becomes our next president).  We want to be there to celebrate it.

If you would like to review your current investment portfolio or discuss any other financial planning matters, please don’t hesitate to contact us or visit our website at http://www.ydfs.com. We are a fee-only fiduciary financial planning firm that always puts your interests first.  If you are not a client yet, an initial consultation is complimentary and there is never any pressure or hidden sales pitch. We start with a specific assessment of your personal situation. There is no rush and no cookie-cutter approach. Each client is different, and so is your financial plan and investment objectives.

Sources: 

https://www.washingtonpost.com/business/get-there/given-the-brexit-brouhaha-how-did-your-investments-hold-up/2016/07/22/a7bc1198-4d03-11e6-a7d8-13d06b37f256_story.html

http://www.investmentnews.com/article/20160801/FREE/160809992/if-history-is-a-guide-market-volatility-is-about-to-spike

http://www.cnbc.com/2016/07/13/merrill-second-longest-bull-market-ever-has-further-to-run.html

The MoneyGeek thanks guest writer Bob Veres for his contribution to this post

A College Education Still Pays

These days, it's hard not to hear about the student loan mess and how it's the next financial crisis that's currently brewing (some are already calling it a bubble).  Students and parents write stories of how they were lured into borrowing far more money for college than they could ever pay back, even after throwing three or four years worth of salary at it. That is, if they could even find a job after graduation. Despite a student debt level that continues to grow, a college education is still one of the most worthwhile investments a high school graduate can make.

According to the Student Loan Marketing Association (more commonly known as Sallie Mae Bank), the average tuition, room and board at a private college comes to $43,921.  Public tuition for in-state students at state colleges amounted to $19,548, with out-of-state students paying an average of $34,031.

How are parents and students finding the cash to afford this expense?

Sallie Mae breaks it down as follows: 34% from scholarships and grants that don’t have to be paid back, coming from the college itself or the state or federal government, often based on need and academic performance.

Parents typically pay 29% of the total bill (an average of $7,000) out of savings or income, and other family members (think: grandparents) are paying another 5%.

The students themselves are paying for 12% of the cost, on average.

The rest, roughly 20% of the total, is made up of loans.  The federal government’s low-interest loan program offers up to $5,500 a year for freshmen, $6,500 during the sophomore year, and $7,500 for the junior and senior years.  If that doesn’t cover the remaining cost, then students and parents will borrow from private lenders.  The average breakdown is students borrowing 13% of their total tuition costs and parents borrowing the other 7%.

Is the cost worth it?  The Federal Reserve Bank of New York recently published a report on the labor market for college graduates.  The conclusion, in graphical format, is that younger workers have experienced much higher unemployment rates than their college graduate peers—the figures currently are 9.5% unemployment for all young workers, vs. just 4.2% for recent college graduates.  Overall, the unemployment rate for people who have graduated with a 4-year degree is 2.6%, and even during the height of the Great Recession, it never went over 5%.

And income is higher as well.  The average worker with a bachelor’s degree earns $43,000, vs. $25,000 for people with a high school diploma only.  The highest average incomes are reported for people with pharmacy degrees ($110,000 mid-career average), computer engineering ($100,000), electrical engineering ($95,000), chemical engineering ($94,000), mechanical engineering ($91,000) and aerospace engineering ($90,000).

Lowest average mid-career incomes: social services ($40,000), early childhood education ($40,000), elementary education ($42,000), special education ($43,000) and general education ($44,000).

Among the lowest unemployment rates: miscellaneous education (1.0%), agriculture (1.8%), construction services (1.8%) and nursing (2.0%).

Yes, there are some themes here, and of course people in every career can fall above or below these averages.  Nor does everybody who graduates with a particular degree end up in a career that tracks that degree.  (Of particular note: the list does not include a financial planning or investment advisory degree.)  The point is that despite the cost, a college degree does seem to provide significantly better odds of getting a job, and getting paid more for the job you do get.

I plan to expand on some of the finer aspects and stories about student loan debt in an upcoming article-stay tuned.

Sources:

http://money.cnn.com/2016/06/29/pf/college/how-to-pay-for-college/index.html?iid=SF_LN

https://www.newyorkfed.org/research/college-labor-market/college-labor-market_unemployment.html

The MoneyGeek thanks guest writer Bob Veres for his contribution to this post