Whatever the case, security is in the media forefront and that brings both pros and cons.  Malaise can set in from overexposure to “just another security incident” or denial in that users think they will never be “targeted” because of their seeming anonymity.  Businesses and websites are continually being scanned and probed for open security vulnerabilities.  Are those openings producing more breaches, likely not, but with compromised businesses delaying or avoiding disclosure the statistics are debatable?  Advanced computer and network security exploits are certainly more readily available today than they were just a few years ago.  Not all tools are designed for nefarious purposes, see metasploit, but nonetheless there are seemingly good tools and others that even elementary computer users and criminals may implement to breach a company’s server, bring down websites and more commonly steal user data.

So what are typical users and business to do?  Are they at risk or it is only towering conglomerates and DoD contractors?  What businesses need to understand is that the initial scans and probes are completely automated and will eventually hit their servers, websites, etc.  If those automated tools find open vulnerabilities then additional higher-level tools may be implemented or even a real person may be alerted to the possibilities of exploiting your site.  That is why it is so important to keep up with current patches and security updates for your routers, firewalls, servers, computers and other devices.  If you keep the most obvious holes plugged you are better off than many businesses and users.

Another common unwanted entry into systems and accounts is from poor passwords.  We’ve all been bothered and badgered by different systems requiring 8 or more characters in a password, and sometimes using uppercase and special characters.  There are different thoughts to the usefulness of changing passwords frequently, another common practice, but the length and especially complexity of passwords does help to mitigate threats.  Depending on the security in place, some passwords can be cracked in under 10 seconds and many in under 17 minutes (again this is all done by automated programs checking for common passwords and lower security systems).  Realistically, your password is more likely to be exposed from a larger database hack, seen from several breaches of banks and online commerce sites.  If you use the same password at many, or all, sites as a significant number of people do then all your data can be compromised.  The recent CitiBank hack and some of the gaming and pornography site hacks had the stolen passwords posted to the Internet with a suggestion for others to try logging in with the exposed email addresses and passwords on the users’ Facebook accounts, etc.

There is obviously a need for skilled computer and network security professionals to implement best practices but the above shows us that an old adage of “an ounce of prevention is worth a pound of cure” is true for online and data safety.  If you keep up with the current best practices for known threats and secure passwords you can help yourself, and your data, have a better chance of staying safe and secure.

Do small businesses need to focus on computer and network security?  Many think that only large organizations, such as Sony or CitiBank (see ** below), that boast about secure networks and taunt underground hacker organizations need to worry about network and computer security, right…? But what about the rest of businesses, the ones that are local or regional in size and scope, are they at risk and are they experiencing the same security failures and incidents?

A very telling article I read recently stated 80% of businesses experienced some data loss in the last year due to some security lapse or breach.  I absolutely believe the assertion of the article and the survey results:

• It indicates that customer information (52 percent) is the most common type of sensitive information compromised in data leaks
• followed by intellectual property (33 percent)
• employee information (31 percent)
• and corporate plans (16 percent)

Are large black hat organizations, such as the Anonymous hacker collective or LulzSec, targeting local Indiana business, not likely?  What smaller and medium sized business needs to worry about when it comes to security is internal security threats and more realistically lost devices.  This is what I see as the largest and easiest hole to plug in the dam to secure company data, simply securing mobile and movable devices with sensitive data.

What are the threats, then, and how can they be hardened to minimize data loss?  There are three main devices or device types to address when looking at mobile data and mobile devices.

1. Laptops – in this category is included netbooks, notebooks and tablet devices.  Many new laptops have more processing power and storage capacity than servers of just a few years ago.  With that increased size and power comes the ability to store vast amounts of data in spreadsheets, documents, mail and other communication programs, etc.  So what then is the threat?  Should you be worried about being hacked while checking email at Starbucks, downloading a trojan or virus form a colleagues email?  Not really.  The most common scenario of data loss for laptops is simply losing the device.  A laptop stolen from a car is a common incident that can embarrass companies and compromise their data.  When the laptop is lost it allows hackers (crackers are the bad guy hackers) or criminals unlimited time to creak into the device and glean the important data(read important as sellable so they can make money – for instance selling credit card info to other criminals on the Internet).  Simply password protecting your laptop on login does little to secure the device.  There are several ways to crack the password in under a minute or the disk may simply be pulled from the device and read from another computer without making any other changes.  The laptop hard drive, or other device, should be fully encrypted so that the disk is unreadable if pulled form the device and also protected by complex passwords.  There are many encryption programs available for a nominal fee that are essentially unbreakable.  I state essentially because there is always someone or some government working to crack the latest security software.  As an aside, the Chinese government has a large stake in Symantec, which owns PGP one of the standards in disk encryption and other security software.
2. Mobile phones and smartphones – tablets can be considered a crossover into this category and as smartphones increase in power (several models now have dual core processors, etc) they may be more apt to consolidate into the laptop category.  Mobile devices present some similar issues as laptops but then also present different challenges based on their primary uses.  Phones do not often have the same amount of data in documents or spreadsheets but within the stored email of the user may be those documents as well as sensitive communications, contacts, and access to other accounts such as banking form downloaded applications.  What is chilling about the increasing usefulness of the advanced mobile device is that they are often not protected with even a basic passcode or password.  So then, that must be the first step to manage security on mobile devices for business.  On top of that, there are applications and utilities available for phones (Android, iPhone, Blackberry, etc) to lock the phone, encrypt data files if needed and remotely wipe the contents of the device if it is lost.  Many applications will automatically wipe the device if an incorrect passcode is entered a set number of times.  Obviously you want to have a validated backup routine in place, but that is just another piece of the security and business continuity plan.
3. Offsite hard drive or tape rotation – this category is slowly shrinking as large Internet connection make online data backup over the wire possible to offsite data centers for redundant backup.  The scenario is similar again to laptop data loss.  A courier or trusted employee is transporting a tape or hard drive offsite as part of a company’s disaster recovery plan and the device is stolen most commonly from their car.  The irony of losing large amounts of sensitive data (what you decided was critical enough to backup) as part of a disaster recovery plan and doing the right thing is not lost on me.  Many backup programs can encrypt the backup or at least password protect the backup but even password protection not always implemented by the company.  If current encryption best practices are followed this threat can be almost reduced to zero even in the event of a lost or stolen backup device because the data on the tape or disk is rendered unreadable without the ability to unencrypt the data.

So we can see that small business is still at risk or data loss, security breaches and other incidents.  There are some fairly easy and inexpensive steps to implement prior to a security event to minimize loss and embarrassment.  It is well worth the time and effort to go ahead and take care of security before something happens.  However, most people and companies still react to security rather that prevent issues.

** Sony has been on the receiving end of multiple hacks (at least 6 times) over the past month or more and CitiBank has just recently disclosed a major databreach from about a month ago.

Now, to be clear, there is a simple way to thwart this threat and many argue it should be the default security setting on Safari browser’s on Macs.  Users may simply go to their Safari preferences, select the general tab and then uncheck ‘Open “safe” files after downloading’  By unchecking the default setting that allows files to download and open automatically you again take control over what is programs are installed and files opened on your system.

So the next logical question that comes to mind, after asking how do I stop this attack from infecting my Mac, is how do I better protect my Mac from other threats in general.  Unfortunately, the answer is likely that you’ll now need to consider installing an antivirus and/or other malware protection.  With an antivirus program you begin to fall into the same categories of issues that plague PC users:

• Which antivirus program to use and/or purchase
• Are the free virus scanners as good as the paid ones
• Computer slowdowns dues to antivirus running on your Mac
• Updating and scanning your system

The good news is that there are many antivirus programs currently, and likely more to come with the press given to this threat Mac Guard (a variant and evolution of Mac Protector and Mac Defender).  Some of the names in Mac virus protection are familiar to the PC world and others may be new: Sophos free antivirus for home users and paid business editions, ESET Cybersecurity for Mac on Apple’s web store, Clam AV, and others.

Are Macs now doomed to persistent unheralded threats just like PCs?  I think the time is still a little ways off, but it is certainly time to take notice and address security on your Mac just as you do on your PC.  As with PC users, when people ask me how to best keep their systems safe, my first response is to be smart about where you go and what you do on the Internet and other networks.  However, even websites you would consider safe such as your aunt’s picture webpage of her trip to the Adirondack Mountains can be compromised by the server that hosts the site and infect your system with malware.  So, if users who are smart about their web surfing and don’t share USB thumb drives with their music sharing son can be infected, then the next step is to tighten down the security of your Mac and install additional programs to automatically protect your system.

It is not the end of days for Mac users, but rather should be considered a wake-up to see that all the hype saying that Mac users don’t need antivirus or need to worry about security may have been more due to an advantage of low market share and low interest by virus writers rather than security superiority over PCs.  I like Macs.  I’m writing this post on a Mac.  But security issues are not limited by operating system manufacturer.  More so it depends on the user, how the system is configured and how it is used.  We’ve seen Linux server grossly compromised because they’ve been setup incorrectly alongside Windows servers suffering the same.  Take some time to learn about the security tools and options available for your Mac and enjoy the zen experience Apple offers.

Using robocopy makes many tasks easier with its robust switches and command line options.  One thing that is not easily determined and is not readily defined in the help or online is how to use robocopy with file names and folders that contain spaces.  After some quick trial and error I determined one way to make it work without using scripting code.

I came across this issue recently when migrating a small business server, sbs2003, to sbs2011, which as an aside is much easier than migrating to sbs2008. For example, if you have a share on a server named server01 and want to copy it to the local server from which you are working and the server share has space in the filename such as “Health Benefits,”  normally you would open a command prompt using runas administrator and then enter:

robocopy \\server01\Health Benefits\ C:\Data\HealthBenefits\ /E /R:10 /COPY:DATSOU /LOG:C:\Copy_HB_results.txt

However, this does not provide the correct input syntax for robocopy and the copy does not run.  It sees the destination incorrectly as the word immediately following the space, in this case Benefits.

robocopy /”\server01\Health Benefits\/” C:\Data\HealthBenefits\ /E /R:10 /COPY:DATSOU /LOG:C:\Copy_HB_results.txt

I hope this helps others as it will make it much easier, imho, than scripting for those not familiar with specific scripting syntax.  I know I’ll be using it more for sbs 2011 migrations and other server maintenance.

A few years later (end of 2002) there was an article in PC Magazine that asked “Are Tablet PCs the Next Big Thing?” The author was optimistic at that time, but here we are, over 8 years later and we are just (hopefully) getting there.

Are we there yet?

I don’t know, but I have high hopes because I received notification that my ASUS Eee Slate has shipped from Amazon. In addition to hoping it meets my goal of replacing my work laptop, I want to evaluate it to determine where it makes sense for L5 Solutions small business customers. I plan to use blog entries to provide some insight into the latter.

Why I waited for the ASUS Slate

I needed something that could do more than just allow me to play games, surf the internet, and watch video. I needed a business computer. Since most of our business applications are Windows based, I needed a machine that would run standard Windows. Also, I wanted speed, handwritten note taking ability, decent size, and expandability.I will provide more information on my experience in future posts. If you are looking to buy or see the specs, check it out at Amazon. When I ordered mine on March 22^nd, it said out of stock, but it ended up shipping April 7^th. So don’t hesitate to get in line if you want it.

ASUS Eee Slate EP121

There are several providers offering low cost video conference and telepresence options.  VU and UMI are two that I’ve looked into briefly.  The Cisco UMI commercial I saw recently helped solidify how regular people will use video in everyday life.  The commercial shows a woman trying to teach a younger lady how to “play spoons.”  It is not a large boardroom of angry men trying to take over the world or even geeky computer folks discussing how to beat the latest online video game.  These two women, likely friends or maybe even mother and daughter, can sit down and talk as well as see each other, in high definition – HD.  So there really are some good and fun reasons you will start to use video in the home and in small business just to make things easier and make them more personal.  What I see as the real reason this is viable now, however, is the price; under $1000 for the hardware and possibly some sort of small monthly payment, $50 or less, for the service.

The obvious limitation to the above technology is you must be in front of the device, which will likely be located on top or near your hd tv.  That is where the ability to send and receive video from your mobile phone or tablet comes in to play.  The iPhone4  already has, and supposedly next generation iPad will have, front and rear facing cameras for video.  Get ready, because video will begin to show up everywhere in your home and business…

What is the cloud?

When I saw a commercial on tv from Microsoft saying something to the affect of “go to the cloud” I knew this tech buzzword was finally mainstream. So, what is the cloud? And, more important, why should I care of about the cloud?

What is the cloud? Instead of storing your data (mail, photos, spreadsheets, etc) locally on your computer on your business servers it is stored on servers usually located at a large data center anywhere in the country, or world. The cloud name comes from the picture or diagrams used to describe networks which showed the data centers out on the Internet in a cloud. So, the cloud is really just a bunch of servers, which are just computers, located in a big building with specialized cooling, power backup generators, fire suppression systems, etc that allow users to access their data from anywhere on the Internet.

The cloud can be a good idea for you and your business or maybe not such a good idea.  It really depends on your view and needs regarding security, availability and other factors.  If you consider that something like Google’s Gmail or Yahoo mail is really just a cloud mail application then it is easy to wrap your head around what the cloud is and what it offers.  In the above two examples, your mail is stored on servers and you may access it from any Internet connected computer with a web browser.  As some Gmail users experienced over the past year or so, sometimes your mail is not accessible if the servers are down or there are Internet connection issues to the servers.

Why you should care about the cloud matters how you use technology. One example of how the cloud benefits business is that it allows mobile/remote users to access information through the Internet directly. That may not seem all that revolutionary because many businesses already allow remote users access to business information, and I agree.  However, for some small businesses without IT experience they can quickly and inexpensively setup document sharing and email for their employees.  There are always caveats, though, such as, are your emails and documents being crawled, stored and searched by the companies hosting your information on their servers?  That may be disturbing for some users and especially for some businesses.

I don’t want to give the impression that the cloud is bad in all respects and I recently came across a particularly useful cloud application scenario: storing virtual server backups and even hosting the virtualized servers during disaster recovery situations.  This is an example that illustrates both some of the advantages and limitations of the cloud.  Utilizing on site servers and data storage in most cases reduces costs and allows for faster access.  Internet connection speeds have come a long way but sitting in your office at 100Mbs or even 1000Mbps is much faster than an air card or a wireless connection at Starbucks (trust me I frequent the coffee titan daily).  However, in the event of a disaster having your server data and images of the server drives stored online in the cloud can literally save a business if their server room or entire building is destroyed or more commonly the case, flooded.

I’m beginning to digress, into the technical world, so I’ll wrap up by reiterating; the cloud simply allows you to store data on servers out on the Internet.  Again, this is not revolutionary, we’ve been storing mail on the Internet for many years.  The revolution, if it does happen, is when most of your applications run from, and store data on, the Internet and not on your computer.

So what are businesses and home computer users to do if just visiting a legitimate website has the potential of infecting your computer?  The first step is to make sure each computer has an anti-virus program installed and updated, such as AVG Internet Security 2011 – 20% off!, with the most recent threat definitions to hopefully block the infection from installing on the computer.  With that in mind, it is usually a good idea to run an anti-spyware program, such as Spybot Search and Destroy, along with an anti-virus program.  Again, the spyware detection program must be updated with the current version and most recent threat definitions to combat the latest threats on the Internet.

So the next issues becomes, what happens if you do everything you’re supposed to: run updated anti-virus, run updated -anti-spyware, go to only “safe” websites, etc… and you still get a virus on your computer.  It is always best to save your data (hopefully you already have a good backup of your computer data) and re-install your computer’s operating system, like WindowsXP, Windows7, etc.  For many reason, I know it is not always feasible or realistic to reinstall Windows if your computer is infected.  In that case you should try to restore your computer to an earlier time, before your computer was infected.  In Windows it is called system restore and does not restore your computer’s data to an earlier time, but restores the underlying settings, in the registry, to the way they were before the virus.

There is too much to write about removing viruses, which is why it is much more important to spend time on blocking them before the infect your computer.  Just like grandma used to say, “an ounce of prevention is worth a pound of cure.”  Take the few minutes necessary to install and setup your antivirus and other security programs to automatically update and protect your computer in the hope you don’t need to spend many hours removing the virus or reinstalling your system.

The technology side should be easy, at least from my standpoint.  Implement a proven backup and disaster recovery process to securely protect your data.  By that, I mean you need to have a stable server or platform to store your current data.  Next, your current working data needs to be backed up to another stable device onsite with large storage capacity to not only recover current data but also archived data in the event you need to restore files from a long while back.  The last point in the process is to securely transfer and store the backup data at an offsite location.  This last part of the process is the true disaster recovery preparedness in any good business plan.  If your current location is fully or partially lost, for example in a fire, you can recover data from the offsite location and resume business in a relatively short period of time.

The business side of a backup and disaster recovery plan should be equally as simple.  However, in reality, nothing is as easy at it seems.  Backup software and hardware devices require resources, not only money to purchase the applications and servers but also time to research, implement and test. The failure of so many businesses to address their data backup and recovery need lies with the disproportionately low value they place on their servers and computer systems that store their company data.  Every business, regardless of industry, is reliant on their computers to perform daily business operations.  With my previous statement, I am continually amazed at how many companies have inadequate or no backup plan or process in place.

For instance,

• many companies do not review what data is backed up.  The consequence of this is usually discovered when they attempt to recover a needed file and it is not there because the data they need was never part of the backup routine.
• many companies do not test their backups.  This is the most often frequent issue with backups I’ve seen with desperate companies. Many businesses still use notoriously unreliable tapes for backup because that is what has always been used in the past.  Did you know tapes have failure rates often cited at over 50%?
• many do not backup data offsite.  Offsite or online data storage used to be very expensive, but that is not the case anymore.  There are still places that charge $3-$5 per GB of offsite data storage but that is no longer the norm.  If your data is only available on the server or system and a drive close to that same location, a small event may destroy both instances of your data, both your current and backup storage.  For example, power events, like lightning strikes or power surges are the most common event to destroy data and water damage such as a water pipe breaking or sprinklers are close behind.

What are the results if a business tackles both the technology and business side of safely securing their company data for any event?  Easy, their data is always available to them. Their data is recoverable whether they accidentally deleted a file and need to recover it from yesterday , or a mail server crashes and all their documented correspondence is gone until they quickly recover from their onsite backup, or better yet run a virtual mail server off their backup device until their mail server is restored.  And in the rare event of a true disaster, their data is immediately available online, fully encrypted, from any Internet connection. Additionally, a new backup server, fully loaded with images of their servers to run virtual machines, is overnighted to any location.

Are you interested in comprehensive and secure backup and disaster recovery options?  Contact us for proven data backup solutions.