On February 12, Drewa Designs, as the City of Floresville’s social media manager, initiated a series of posts on City social media pages alerting citizens and area residents about the severity of the upcoming weather and urging them to prepare. Detailed messaging, including posts relayed from the National Weather Service, emergency service districts, and area utility and plumbing companies, started showing up in City of Floresville Facebook and Twitter feeds on Friday and Saturday.

As the largest city and county seat of Wilson County, Floresville (population 8,045) has an outsized influence and reach, even beyond its city limits. With over 5,000 Facebook followers, the City can quickly and directly communicate important information to thousands of individuals and businesses in the area.

Benefits of Effective Communication

During this historic weather event, successfully connecting with citizens via social media was a key factor that allowed Floresville to ride out the record low temperatures, icy roads, and wintry mix of precipitation—faring better than many other Texas cities.

As described by KSAT News and the Wilson County News, Floresville Electric Light & Power System (FELPS) was largely able to keep the power on—with minimum outages and rolling blackouts. Drewa Designs and the City of Floresville aided this effort by relaying conservation messages from FELPS, allowing the utility to better manage the local power system and keep lights and heat on as much as possible.

Advanced warnings also enabled citizens and businesses to prepare and protect people, plants, pets, and pipes. Working closely with City staff, we issued messages about area road conditions and closures and encouraged residents to stay home and stay safe during the worst parts of the storm. While Floresville was not entirely spared from burst pipes and water damage, social media notifications likely helped the city better manage the weather event relative to many other towns and cities.

As the thermometer dipped to ten degrees Fahrenheit in the Floresville area, Floresville United Methodist Church teamed with the City of Floresville and the American Red Cross to open a warming shelter for those in need. City Hall’s Facebook post announcing this warming shelter quickly reached over 31,000 individual Facebook users and was shared more than 500 times.

In fact, during the month of February, Facebook post reach and page views were up nearly 300 percent; and new page likes and followers increased by nearly 400 percent.

Building the Foundation for Digital Outreach

The City of Floresville was able to communicate effectively and broadly during this event, largely because it laid the groundwork years in advance. In 2016, working closely with former city manager Henrietta Turner, Drewa Designs helped Floresville launch a social media presence on Facebook (and later Twitter).

Building the City’s social media presence and expanding its outreach over the past five years has enabled Floresville to promote events such as Freedom Fest and the Peanut Festival, convey information about local government meetings and opportunities, provide alerts and closure notices related to the Covid-19 pandemic, and broadcast critical information during this and other extreme weather events.

Over the past year, due to Covid-19, many City meetings have been conducted via Zoom videoconferencing software and broadcast to the public through Facebook and the City website.

Investments made by City Hall over the past several years in the City website and social media presence have paid dividends during the Covid-19 pandemic and recent winter storm events. While many Texans suffered during this weather event, the City of Floresville was able to use social media and digital communication to minimize the impacts on its citizens.

Looking to the Future

Following this weather event, Drewa Designs continues to work with City staff to utilize social media and the City of Floresville website to share information about federal assistance opportunities, food and water distribution events, and other helpful resources. With light at the end of the Covid-19 tunnel, we anticipate using digital communication media to provide information on upcoming vaccine clinics and other pandemic-related news and updates. Of course, we are all looking forward to warmer, healthier days ahead—when we can once again promote and attend in-person gatherings such as the Freedom Fest and Holiday Extravaganza.

We are grateful for the opportunity to partner with the City of Floresville and assist with their social media management, website design, and other digital communications. We look forward to continued collaboration with the City of Floresville and our other municipal clients in the upcoming months and years.

Related Case Study

City of Floresville

The post How One Texas Town Leveraged Social Media to Help Protect Citizens and Infrastructure During Winter Storm Uri appeared first on Drewa Designs.

Perhaps the biggest readily observable privacy flaw is that all student profile pages are publicly accessible, contrary to what the platform website states about privacy. It is true that one must know the URL of a page to access it, but that’s quite easy to guess since the database and site URLs use sequentially incremented integer sequences as identifiers rather than UUIDs or some other unique, randomly generated identification string.

As an illustration, the child’s page URL used this syntax:

www.sitedomain.com/entityname/9347869234

Anyone can access the profile page via this URL—it’s completely public. And anyone can see all this child’s classmates by adding or subtracting one from the ID number. Keep going in either direction and you quickly get to students from other schools. Instead of using sequential numbers, which are easily guessed, the IDs should be something completely random and non-incremental like:

123e4567-e89b-12d3-a456-426614174000

It would take well over a trillion years for the fastest supercomputer to guess one of these identifiers, thereby achieving de facto privacy without requiring authentication.

There isn’t a ton of super-sensitive information visible on these student profile pages. But with children, privacy is paramount. And this is a ripe target for a coder with even a rudimentary level of knowledge to write and run a script to iterate through and amass student full names, photos, school names, and donor names (likely parents and relatives) for thousands, if not millions, of children.

Unique IDs Pointless When Indexed by Search Engines

The school signup pages do appear to use a more unique identifier, which is much more difficult to guess (though it should be longer for better security):

www.sitedomain.com/pluralentityname/EdIlHj

But that doesn’t help in this case because not only are they publicly accessible; but they are indexed by Google and therefore no guessing is even required! Landing on one of these school signup pages, one can relatively easily glean lists of teachers and students by typing a letter or designing a simple collection script.

Likely there are additional vulnerabilities that we did not uncover in our cursory exploration of the website.

Response from Fundraising Company

We reached out to the platform right away with our concerns. Thankfully they responded quickly and seemed receptive. Apparently one of these issues is on their radar and, according to the representative, they are working on it—but it’s a structural change which is not likely easy or quick to implement and would only apply to new profiles that are added to their system after the fix is in place. The second issue can be easily resolved with a couple of noindex and/or nofollow tags, or a couple of lines in robots.txt—hopefully they’ll patch that hole right away.

It was a bit concerning that the platform representative seemed to transfer the responsibility for privacy to schools and parents (“they get to choose what they put on the site”), since parents and schools don’t have the time or technical expertise to test the site’s privacy and security, and are likely to trust what the site says about privacy—which, in this case, is misleading at best.

They claimed to have IP rate-limiting measures in place—which would hopefully mitigate the damage if a bad actor tries to collect all the data stored on the platform. But, in reality, this obstacle would be fairly easy for a determined coder to work around.

These vulnerabilities stem from very basic, structural issues (i.e., cheap and/or lazy developers) that have allowed huge data breaches affecting Fiserv, Parler, and First American Title, to name a few. There are quite likely other privacy and security issues that we didn’t discover in our quick, “at a glance” examination. This company should immediately hire a third-party security advisor to perform a comprehensive audit of their website, data systems, and internal processes.

This is a great fundraising effort and we certainly don’t want to dampen enthusiasm. But that parent has changed the child’s last name to initial on the site and may or may not upload a photo. Maybe they’ll upload one of the family dog instead!

What About You?

How confident are you in the security and privacy of your website, database, custom web applications, and public-facing systems? Are you adequately protecting your clients’ or stakeholders’ personally identifiable data? If you have questions or concerns, or if you are interested in a security analysis of your website and data systems, please don’t hesitate to contact us. For updates on privacy, security, and other technology matters, follow our Facebook page.

The post Glaring Privacy Issues on Popular School Fundraising Platform appeared first on Drewa Designs.

The COVID-19 pandemic has ushered in a truly uncertain and unprecedented time. Therefore, it’s more important than ever to communicate clearly and effectively with current clients and prospective customers. With that in mind, a few tips and recommendations:

• Update your Google My Business, Bing Places, and Yelp profiles with COVID-19 specific information on your business status, current days/hours of operation, and any adjustments you are or will be making. For many customers, this is the first (and sometimes only) information they see when they search for you. It’s vitally important that this information is accurate and complete. Updates can be added in the form of a COVID-19-specific post/announcement, as well as other data elements. If you aren’t yet managing your own Google My Business and Bing Places profiles, we strongly recommend that you claim and curate these. In addition, there are many other benefits like higher rankings on search engine result pages—especially local area searches.

• Add a banner/notice to your website with COVID-19 specific information and any adjustments or practices you are or will be making—or just let your current and prospective customers know somewhere on your website that it’s business as usual if that’s the case.

• Keep your social media accounts up to date. Haven’t posted recently on Facebook, Twitter, or Instagram? Now is a great time to do so. If you haven’t yet set up social media accounts on the major platforms, we highly recommend doing this. Even if you don’t have time to post on a daily basis, that’s fine—there’s a full array of other benefits to setting up social media pages for your business or organization.

• Email your customers. Use your normal email newsletter format to reach out and inform your existing customers. If you don’t send periodic email newsletters and communications, now would be an optimal time to start. 

What to Say

Some messaging ideas when communicating with your customers include:

• Thank them!
• Detail any changes to days/hours of operation, business practices, etc.
• List any new or updated refund, cancellation, or payment policies
• Make sure they know how to contact you
• Any other information about what your business/organization is doing and how it affects them

If you need any assistance or advice with the recommendations above, please let us know. We’re happy to provide as much or as little help as you need—whether it’s social media management, choosing an email newsletter platform, writing copy, updating your website design, or full-service management of your communication needs.

We are certainly in this together and despite the tough road ahead, trust that we will both emerge from this crisis even stronger than before.

Stay safe and healthy!

The post Important COVID-19 (Coronavirus) Updates for Small Businesses and Organizations appeared first on Drewa Designs.

Over the past few years, email authentication has become increasingly important to optimize delivery of messages. The goal of these email-related DNS records is to ensure delivery of legitimate email and block unwanted spam.

Have you experienced issues with messages sent from your own domain winding up in a spam folder—or never even arriving in the recipient’s inbox? (Nearly all of us have at some point.) This may be due to missing email authentication records. If you do not currently have DMARC, SPF, and DKIM records in place for your domain, we highly recommend implementing them.

Third-Party Senders

These records are especially important to have in place if you send email using a third-party platform or service such as Mailchimp, Constant Contact, or SendGrid, or if you are routing outgoing mail through a third-party SMTP server. Otherwise, many of these messages will end up in spam folders or be rejected by the recipients’ mail servers. Additionally, a high volume of unauthorized messages like this can negatively impact the delivery rates of your personal and transactional email.

Incorporation of email authentication records will reduce the number of outgoing messages that end up in your recipients’ spam folders. Even if you haven’t noticed any message delivery issues, adding these records can help avoid issues in the future. Large email providers like Office 365, Google/Gmail, and Yahoo recommend these records and will likely require them in the future.

Protecting Your Reputation

Additionally, properly configured DMARC, SPF, and DKIM records will help guard your company’s reputation. If you have not yet established these records and are not actively monitoring DMARC reports and feedback from mail service providers, you are at increased risk of fraud and phishing. When customers, vendors, and partners receive illegitimate emails that appear to be from your organization and your domain, your brand and reputation could be threatened. Protecting your hard-earned name and professional image is vital. With these records in place, it will be much more difficult for spammers to forge or fake email using your domain name.

Taking Action

Interested in adding email authentication records to your domain? We can help! We’ll coordinate and consult as needed with your mail provider or IT support to help craft, implement, and monitor appropriate DMARC, SPF, and DKIM records to maximize the delivery rate of your outgoing email. Additionally, we can monitor email authentication reports on a regular basis to ensure all legitimate sources are whitelisted.

Questions about email authentication, or any other aspect of our website design or web and email hosting services? Contact us.

The post Improving Delivery of Outgoing Email Messages appeared first on Drewa Designs.

We’ve observed a recent uptick in “sextortion” email messages lately. In these messages, the scammer typically claims to possess a video of the recipient visiting an adult website and threatens to send the video to the recipient’s contacts if the recipient doesn’t remit payment via bitcoin.

In the email, the spammer usually includes the recipient’s name or username and an actual password used by the recipient. The presence of this personal, sensitive data makes these emails even more scary than your typical scam or phishing message. (Unfortunately, the slew of recent data breaches have given spammers access to a lot of personal information, including names, usernames, email addresses, and passwords.)

If you haven’t received one of these emails yet, great! If you have, don’t panic: treat it as any other scam or phishing email: ignore and discard.

Review Your Passwords

Of course, if the email includes one of your current passwords, make sure you change all occurrences of that password immediately. Even if it’s an old password that you no longer use, double-check to make sure you are not using that password anywhere. Furthermore, if you haven’t done so in a while, consider changing all your passwords. Finally, it’s always good practice to avoid using the same password for everything—even slightly different passwords will provide you with more security if (when) a data breach exposes one of your passwords. You may also wish to consider using a password manager.

More information and details on sextortion email and techniques are available from Krebs on Security. For updates on security and other technology matters, please follow our Facebook page. If you have any questions or concerns, please don’t hesitate to contact us.

The post Sextortion Email on the Rise appeared first on Drewa Designs.

By now you’ve almost certainly seen or heard something about GDPR—General Data Protection Regulation—the EU data privacy regulation that goes into effect on May 25. Even if you don’t do business with citizens of the European Union, you still may need to update your website in order to comply.

If you currently do business with or plan to do business with EU citizens in the future, many changes may be required. In that case, this regulation should be much more important to you and will extend beyond the scope of your website.

We cannot provide legal counsel, but most businesses based entirely in the United States who do not conduct business with EU citizens may need to perform some relatively simple tasks like scanning their websites for any instances of EU country names (e.g., in Country drop-down boxes) and eliminate those, and ensuring any digital marketing efforts exclude all EU countries.

Enforcement and Additional Resources

While enforcement mechanisms for businesses based entirely in the US (with no EU presence) still range from blurry to non-existent, depending on what you read, GDPR compliance on your website (and elsewhere) is something we encourage you to carefully consider.

More information is available at GDPR.EU, Wikipedia, and numerous other resources. If you have any questions about how GDPR may apply to your website, or what changes may be needed to achieve compliance, please contact us.

The post How GDPR Affects Your Website appeared first on Drewa Designs.