By -- 2021-07-1 in OptfinITy News


The NextGen 101 List Honors Partners Building MSP Practices


JULY 01, 2021: OptfinITy has been named as one of the world’s premier managed service providers on the prestigious Channel Futures 2021 NextGen 101 rankings.


The NextGen 101 list, honors industry-leading managed services and technology providers who are driving a new wave of growth and innovation for the tech channel via the groundbreaking solutions they deliver for their customers. The Channel Futures NextGen 101 are those companies that hold great promise given the leading-edge information technology and communication solutions they offer. Many of those business models revolve around generating recurring revenue from cloud, security and unified communications, among others.


Channel Futures is pleased to name OptfinITy to the 2021 NextGen 101.


“It is an honor to be recognized as one of the top 101 IT companies among my peers in the NextGen101 list. This recognition further demonstrates the dedication of our team, all of whom are committed to helping our small business and non-profit organization clients transition into this “new normal,” said Michael Drobnis, CEO OptfinITy.


Channel Futures always wants to ensure that their partner communities are being recognized for what they do best and are therefore creating programs targeted toward their needs. The Nextgen 101 represents that effort.


“The NextGen 101 represents those organizations and leaders ushering in a new wave of growth for the technology industry. The customer experience is at the very heart of their businesses and thinking and they approach partnering in a unique way,” said Robert DeMarzo, vice president of content for Informa Tech Channels.


“The NextGen 101 is designed specifically to honor partners dedicating resources to building out their practices — all while maintaining the integrity of their core businesses,” said Allison Francis, editor and content producer at Channel Partners and Channel Futures. “Given that these companies represent the future of the technology channel and IT industry, the Channel Futures NextGen 101 are the most watched of all organizations in the channel today.”


The data collected by the annual NextGen 101 and MSP 501 drives Channel Futures’ market intelligence insights, creating robust data sets and data-based trend reports that support our editorial coverage, event programming, community and networking strategies and educational offerings.



The 2021 MSP 501 and NextGen 101 lists are based on data collected by Channel Futures. Data was collected online from March 1 through May 24, 2021. The MSP 501 list recognizes top managed service providers based on metrics including recurring revenue, profit margin and other factors.


By -- 2021-07-1 in OptfinITy News

Springfield, VA July 1, 2021– OptfinITy, LLC, one of the world’s premier managed service providers as ranked on the prestigious 2020 Channel Futures MSP 501 list, is proud to announce the acquisition of Metro Managed IT. Since 2004, Metro Managed IT has established a sterling reputation for delivering enterprise-level managed IT solutions for small and medium-sized businesses (SMB) in the Washington DC market, including recognition by several local chambers as the top-rated IT Support Company in the area.

This acquisition is part of OptfinITy’s commitment to growing a stronger presence in the Washington, DC area in offering enterprise quality managed services for SMB clients in this market.

Michael Drobnis, CEO of OptfinITy, stated, “Our focus from day one has been in building a leading presence to better serve our clients and to offer enterprise quality, concierge level services to satisfy all of our clients IT needs. We are delighted to welcome Metro Managed IT to the OptfinITy family. The addition of Metro Managed IT expands our capabilities and coverage and enhances our position in the Washington DC market.

Ed Finn, CEO of Metro Managed IT, stated, “We are pleased to become part of the OptfinITy family. Not only will this allow us to better serve our clients, but it also offers our team a great opportunity and provides added value to all of our clients. OptfinITy truly cares about clients and people as demonstrated by their 20 years in business”

About OptfinITy

OptfinITy continues to grow as a leading provider of enterprise quality managed services for the SMB market. We offer comprehensive on-premise and cloud solutions ranging from Managed IT, Managed VOIP, Managed Security to a full suite of Professional Services, including Software Development, Website Development and Cyber security solutions through our PerusITy division. Our team of proven leaders and technical experts, paired with a focus on operational excellence, has earned us a reputation for world-class customer service, long-lasting client relationships, and numerous industry awards and recognition.

# # #

For more information, please contact Michael Drobnis at (703) 790-0400 or email at

By -- 2021-06-30 in Uncategorized

For the past year, we’ve been profiling major cyberattacks in order to raise awareness about the increase in cybercrime after 2020.  Businesses have been struggling to balance remote work with the increased security necessary. Some, unable or unwilling to invest in structural security improvements, are instead choosing to take out insurance policies against cyberattacks.  Cyber insurance or “cyber-liability insurance” helps companies recover from cyber threats and attacks. Having a cyber insurance policy reduce disruptions and downtime during an incident, as well as potentially helping to absorb the financial cost of dealing with and recovering from the cyberattack. But what happens when a giant in the cyber-insurance field is the one targeted?

Insurance company CNA offers many different insurance solutions to its customers, including cyber insurance policies to protect against ransomware attacks.  In a public statement, CNA confirmed that “on March 21, 2021, CNA determined that it sustained a sophisticated cybersecurity attack” and that “the attack caused a network disruption and impacted certain CNA systems, including corporate email”.  The hacking group known as Phoenix also encrypted data on over 15,000 CNA devices, potentially compromising sensitive client information.  While CNA is working with the FBI to mitigate the fallout from this attack, it may be the start of a ‘second wave’ of cyberattacks.

Bystanders may be wondering why this attack is so significant. Simply put, threat actors, especially those utilizing ransomware, are incentivized to target organizations with cyber insurance.  This may seem counterintuitive, given that cyber insurance is marketed as a product that counters cyber attacks.  However, threat actors have realized that when they attack an insured organization, they are more likely to receive payment.  If Phoenix was able to identify CNA clients who have purchased cyber insurance, those organizations may be future targets.

If you’ve purchased cyber insurance for your organization through CNA, acknowledge that your risk of attack has increased, and monitor the news for more information on what information was compromised.  Additionally, consider improving your business’s other cybersecurity measures. Finally, if you’re interested in help identifying flaws in your business’s security, reach out to us at for more information.

By -- 2021-06-20 in Uncategorized

2020 shifted the business world’s mindset on a lot of important issues.  Policies about time off, remote work, sick policies, and office communication have all adapted in response to the pressures of the coronavirus pandemic. However, the dramatic global increase in cybercrime, especially ransomware attacks, have created a new pressure on businesses to adapt their security policies as well.  This shift in security has resulted in relatively new products like cyber insurance increasing in popularity, as smaller companies look for a one-step security solution.  However, experts in the field are promoting a more holistic style of digital threat prevention called “cyber resilience.  But what is cyber resilience, and you can you implement it at your organization?

Cyber resilience is the ability to predict, resist, recover from, and adapt to both adverse and changing business conditions. By creating a cyber resilient business, you increase your ability to respond flexibly and efficiently to a multitude of potential attacks or general failures.  Implementing cyber resilience at your place of business means creating backups, strategies to minimize downtime, disaster response plans, managing cyber decisions from a business-oriented perspective, and finally, using a data-centric security strategy.

Data-centric models deliver the most value when they are used to create visibility throughout a business.  Endpoint security, IAM, and security controls are all examples of how to provide that increased visibility that makes data-centric models so valuable.  Finally, zero-trust models are becoming ever-more popular.  The NSA went so far as to issue guidance on implementing a zero-trust model, saying that “Zero trust is a security model, a set of system design principles, and a coordinated cybersecurity and system management strategy based on an acknowledgment that threats exist both inside and outside traditional network boundaries.”

By -- 2021-06-10 in Uncategorized

With the increase in digital threats and cyber attacks over the past two years, experts are recommending for organizations to take another look at their security protocols.  However, some people are falling prey to common misconceptions about digital threats and cybersecurity and leaving their organization vulnerable as a result.  Here are 5 of the most common misconceptions about digital threats and cybersecurity.


Many small-to-medium business owners don’t view ransomware and other digital threats as real dangers for their organization.  Because SMBs have fewer employees, store  locations, and revenue than large conglomerates like Google or Target, decision makers often assume that threat actors like hackers will view them as too small a fish.  The truth is that 76% of all cyberattacks are against businesses with less than 100 employees.


The coronavirus affected many small business’s ability to pay their bills.  Many are cutting down on spending that the organization’s decision makers have deemed frivolous.  Cybersecurity spending has been one of those expenses–but it shouldn’t be! Basic security protocols, like multi-factor authentication, password managers, and phishing awareness campaigns are inexpensive ways to protect your business from real threats.

MYTH #3 : you need an in-house expert

Some people believe that an in-house expert is necessary for business security.  However, the expense of a full-time, salaried employee can be too much for a small business to afford.  Furthermore, one employee rarely has the experience, expertise, or time to fully meet the security needs of an organization.  However, one option that isn’t often considered is outsourcing your security concerns to another company. By outsourcing, you can take advantage of a full suite of security experts, for less cost than an in-house team.

myth #4 : anti-virus software is good enough

Anti-virus and anti-malware programs are an important tool in ensuring your devices’ security.  Despite their usefulness, they are not a substitute for strong security policies and enforcement. If the hackers use a new kind of malware to infect your network or PC then there’s a high chance that these anti-virus software won’t be able to detect those. These programs are only the first line of defense for your system.

Myth #5 : threats are from the outside

When people consider what cybersecurity threats look like, they often imagine a lone hacker sitting in a dark basement.  Most attacks, in fact, are internal, with over 75% of data breaches coming from insiders at an organization.  Security protocols need to take into account that not everyone within an organization needs access to sensitive information and tools.  Take a look at our article on internal threats if you’re interested in learning more.

By -- 2021-05-30 in Blog

It’s been a cold month in Texas–an Arctic front covered most of the middle and southern American states in snow.  Some parts of the southernmost state received over a foot of icy accumulation, and temperatures fell to single digits.  While areas of the US can handle those conditions, Texas’s infrastructure was drastically unsuited to the task.  When you combine houses with little to no insulation, a lack of snowplows, and a failing electrical grid, you get the kind of tragedy that Texas is slowly recovering from.  So much of the damage done has been to the state’s citizens.  However, the continual power outages and shutdowns are also impacting technology-focused businesses around the world in unexpected ways.

First, some background: a large proportion of the world’s technology requires semiconductors in order to operate.  These are substances that help form most modern circuits, including those in everything from cars to iPhones to refrigerators.  Without semiconductor chips, most modern technology cannot function.  Because they are so important to modern manufacturing, a shortage of semiconductors can transform from a supply issue to a national crisis.  In 2020, experts predicted that a such a shortage was imminent as consumer demand for products like cars outpaced corporate expectations.  By January 2021, that shortage was fully realized. Then, the blizzard hit Texas.

Texas hosts the largest amount of semiconductor manufacturing facilities in the country, each of which relies on Texas’s energy grid in order to function.  When the blizzard began disabling power plants, several of these manufacturers were forced to halt production indefinitely. For some companies, the uncertainty surrounding the power grid made work impossible.  Others shut down voluntarily  so that power could be redirected to nearby hospitals and residential areas.  Either way, the gap in production represents another blow to semiconductor supply.

As of now, the ultimate impact of the semiconductor deficit is unknown. More important than the immediate supply chain failure is what the situation signifies: uncontrollable physical disasters can have major ripple effects.  Whether your business is a semiconductor manufacturing firm or a small local bakery, our modern economy requires some degree of interdependence.  You cannot predict everything, which is why a disaster recovery plan is a crucial aspect of any business.  If you don’t currently have a disaster recovery plan for your business, consider reaching out to us at–we’re always happy to help!


By -- 2021-05-20 in Uncategorized

Almost 10 million devices have been compromised by a popular scanning app.

Lavabird Ltd’s Barcode Scanner was a popular barcode and QR code scanner downloaded to almost 10 million devices from the Google Play Store.  Android devices, unlike newer generation Apple products, do not have a built in QR code scanner or a barcode reader, making an app like Lavabird’s a must have for many consumers.  Unlike some malicious apps, Lavabird’s Barcode Scanner had been on Google’s official app store for years. The app had a clean security certificate, thousands of positive reviews, and no obvious malicious code.  This meant that security-conscious consumers, who are aware of potential dangers, downloaded the app believing it was safe.  That made it all the worse when what should have been a routine update transformed the app into malware

Malwarebytes, a cybersecurity company dedicated to identifying and preventing malware infections, began receiving complaints from customers in late December.  These customers were experiencing ads opening themselves using their device’s built in internet browser.  This type of malware, sometimes called “malvertising”, is typically connected with new app installations.  However, those consumers had not downloaded any new apps that could have been causing the problem.  The company eventually discovered that this malware was coming from Lavabird’s Barcode Scanner, which had been operating on these devices without issues for years.

The good news is that, if your device has been infected, uninstalling the app seems to remove the malware as well.  What’s more concerning is the fact that an app was able to build up a large following before discretely pushing a malicious update.  For consumers, this means that doing due diligence on an application prior to downloading it is no longer enough.  So how do you keep your devices and your data safe?

The first step is knowing what apps you have downloaded on your phone. Make a point of deleting apps that you no longer use, and monitor your phone for any changes in performance after an app is downloaded or updated.  If you are a decision-maker at a business that issues ‘work phones’ to employees, consider restricting app downloads and updates so that you can monitor the phone’s performance.  If you’re looking for outside assistance in developing a security plan for your company’s mobile devices, you can always reach out to us at


By -- 2021-05-10 in Blog

Everyone is familiar with the uptick in email phishing scams that have come with the COVID-19 pandemic. Workers and employers alike are adapting their security practices to defend company and consumer data. However, cybercriminals are adapting too. One group is combining phone calls and custom phishing sites to corporate VPN credentials. This group acts on a ‘bounty’ system, where a person hires the group to attack a specific company. Worst of all? The attacks have been remarkably successful.

So what does this attack look like? First, the group receives a request to target a specific company. They then create a site that mimics that company’s VPN portal. Once the setup is finished, the group makes a series of phone calls to employees working from home. The callers inform the target that they are with the company’s IT department trying to troubleshoot VPN issues. They then try to coerce the target into revealing their log-in information over the phone or entering their credentials into the fake website. At that point, the phishers have access to the company’s internal information.

This combination of fake websites and fraudulent calls have been more effective than traditional email phishing attempts. Despite that, workers can take steps to prevent being caught up in this scheme. If you receive a call from someone you don’t recognize who is asking for sensitive information, take these steps before disclosing anything.

  1. Ask for the caller’s name.
  2. Hang up and call your company’s IT department or managed services provider—do not just redial the number that called you.
  3. When you reach your company’s tech support, explain that you received a call from someone claiming to be from their department. Once you explain what the caller was asking for, they can confirm whether the call was legitimate.

If the call was legitimate, no harm done! You can continue troubleshooting the issue with only a small delay. If not, you’ve saved yourself and your company a lot of trouble. If you’re concerned about your company’s vulnerability to these types of combination attacks, OptfinITy is here to help! You can email us at or call us at (703) 790 – 0400 to discuss all your cybersecurity needs

By -- 2021-04-30 in Uncategorized

“Why can’t I be the admin of my own computer?”

It’s a question that everyone who works in IT dreads being asked.  Admin privileges are a useful thing to have, after all.  They’re required for major system changes to a device, which can cover everything from editing files to downloading software.  It can get incredibly frustrating to have to call up your IT provider just to have them type in a passcode. When your role requires regular software downloads, it makes sense to want to ‘cut out the middle man’ so to speak.  After all, what’s the worst that can happen?

Principle of Least Privilege

No two IT providers are exactly the same–we’re all special little snowflakes like that.  However, like snowflakes, that’s almost impossible to tell when you aren’t an expert (and even then, you have to get really close).  Many of the basic principles of IT and cybersecurity are shared among various providers.  One of those principles is that of least privilege. Essentially, least privilege is the idea that each user should have the least amount of privilege necessary to get their job done.  Some end users may require admin-level privileges to complete their work, but the vast majority do not.

The goal of the principle of least privilege is to limit the damage that any one account can do to a system.  That damage could be the fault of the end user, like if they deleted an important file or downloaded malware to the device. In many cases, the end user is not at fault, and their account was compromised by a threat actor.  Whatever the scenario, it’s one that could have been limited or even prevented by the principle of least privilege.

For each additional admin account on a device, that device’s exposure to threats increases dramatically.  When that device is used for work, additional admin accounts raise the business’s exposure to threats as well.  An admin account allows a threat actor to make major changes to a device that can damage an entire organization before being contained-if they are contained at all.

In short, is the principle of least privilege annoying? Yes.  Is it much less annoying than a full-blown security failure? Definitely.

By -- 2021-04-20 in Blog

With work-from-home becoming the new normal, companies are scrambling to adapt their security practices.  Some are hiring an outside firm to handle their transition, while others are trying to cobble together an in-house solution.  Security is difficult to maintain at the best of times, and 2020 is most definitely not the best of times.  Security experts have noticed a large increase in cyberattacks over the course of 2020.  Threat actors have created over 5.5 million Trojan attacks.  Malware has increased by 2000%.  Threat actors are taking advantage of the pandemic, resulting in the loss of crucial data and massive amounts of money.  With all of these threats out there, what can you do to keep your company safe?

In times like these, you need expertise.  While you could hire an outside firm to handle your transition, small businesses often can’t afford that option.  This series of blog posts will go over some of the steps you can take to keep your company’s data safe without going over-budget.  If you’re looking for an in-depth explanation of any of these topics, you can leave a comment here or on any of our social media posts.  We also have a free webinar series starting in January that will cover this transition to the “New Normal” that you can sign up for soon. In the meantime, we’ll be discussing a new step you can take to improve your business’s security every week.

Consider A Password Manager

Do you know how common bad passwords are?  Over 25 million people use “123456”, and another 8 million use “123456789”.  4 million people are still using “password” to secure their data.  Each of these can be cracked in under a second — not much better than no password at all.  One common reason for why people choose non-secure terms for password is their difficulty in remembering complex passwords.  If your company’s security protocols require a certain degree of password complexity, workers might then store their passcodes in a text document that itself is not password-protected.  So how do you solve these issues? A password manager!

A password manager allows employees to generate, store, and fill passwords for various sites. This allows each employee to easily follow uniqueness and complexity requirements. Some password managers even allow employees to securely share passwords with other employees, without allowing them to see the password itself.  Furthermore, password managers are usually either free or available at a low monthly cost, making them a fantastic option for small businesses on a budget. In short, a password manager is the way to go for anyone concerned with improving business security.

Do you use a password manager? Are there questions or concerns you have about using one? Leave a comment here, or email us at  We’d love to hear from you!