Do small businesses need to focus on computer and network security?  Many think that only large organizations, such as Sony or CitiBank (see ** below), that boast about secure networks and taunt underground hacker organizations need to worry about network and computer security, right…? But what about the rest of businesses, the ones that are local or regional in size and scope, are they at risk and are they experiencing the same security failures and incidents?

A very telling article I read recently stated 80% of businesses experienced some data loss in the last year due to some security lapse or breach.  I absolutely believe the assertion of the article and the survey results:

• It indicates that customer information (52 percent) is the most common type of sensitive information compromised in data leaks
• followed by intellectual property (33 percent)
• employee information (31 percent)
• and corporate plans (16 percent)

Are large black hat organizations, such as the Anonymous hacker collective or LulzSec, targeting local Indiana business, not likely?  What smaller and medium sized business needs to worry about when it comes to security is internal security threats and more realistically lost devices.  This is what I see as the largest and easiest hole to plug in the dam to secure company data, simply securing mobile and movable devices with sensitive data.

What are the threats, then, and how can they be hardened to minimize data loss?  There are three main devices or device types to address when looking at mobile data and mobile devices.

1. Laptops – in this category is included netbooks, notebooks and tablet devices.  Many new laptops have more processing power and storage capacity than servers of just a few years ago.  With that increased size and power comes the ability to store vast amounts of data in spreadsheets, documents, mail and other communication programs, etc.  So what then is the threat?  Should you be worried about being hacked while checking email at Starbucks, downloading a trojan or virus form a colleagues email?  Not really.  The most common scenario of data loss for laptops is simply losing the device.  A laptop stolen from a car is a common incident that can embarrass companies and compromise their data.  When the laptop is lost it allows hackers (crackers are the bad guy hackers) or criminals unlimited time to creak into the device and glean the important data(read important as sellable so they can make money – for instance selling credit card info to other criminals on the Internet).  Simply password protecting your laptop on login does little to secure the device.  There are several ways to crack the password in under a minute or the disk may simply be pulled from the device and read from another computer without making any other changes.  The laptop hard drive, or other device, should be fully encrypted so that the disk is unreadable if pulled form the device and also protected by complex passwords.  There are many encryption programs available for a nominal fee that are essentially unbreakable.  I state essentially because there is always someone or some government working to crack the latest security software.  As an aside, the Chinese government has a large stake in Symantec, which owns PGP one of the standards in disk encryption and other security software.
2. Mobile phones and smartphones – tablets can be considered a crossover into this category and as smartphones increase in power (several models now have dual core processors, etc) they may be more apt to consolidate into the laptop category.  Mobile devices present some similar issues as laptops but then also present different challenges based on their primary uses.  Phones do not often have the same amount of data in documents or spreadsheets but within the stored email of the user may be those documents as well as sensitive communications, contacts, and access to other accounts such as banking form downloaded applications.  What is chilling about the increasing usefulness of the advanced mobile device is that they are often not protected with even a basic passcode or password.  So then, that must be the first step to manage security on mobile devices for business.  On top of that, there are applications and utilities available for phones (Android, iPhone, Blackberry, etc) to lock the phone, encrypt data files if needed and remotely wipe the contents of the device if it is lost.  Many applications will automatically wipe the device if an incorrect passcode is entered a set number of times.  Obviously you want to have a validated backup routine in place, but that is just another piece of the security and business continuity plan.
3. Offsite hard drive or tape rotation – this category is slowly shrinking as large Internet connection make online data backup over the wire possible to offsite data centers for redundant backup.  The scenario is similar again to laptop data loss.  A courier or trusted employee is transporting a tape or hard drive offsite as part of a company’s disaster recovery plan and the device is stolen most commonly from their car.  The irony of losing large amounts of sensitive data (what you decided was critical enough to backup) as part of a disaster recovery plan and doing the right thing is not lost on me.  Many backup programs can encrypt the backup or at least password protect the backup but even password protection not always implemented by the company.  If current encryption best practices are followed this threat can be almost reduced to zero even in the event of a lost or stolen backup device because the data on the tape or disk is rendered unreadable without the ability to unencrypt the data.

So we can see that small business is still at risk or data loss, security breaches and other incidents.  There are some fairly easy and inexpensive steps to implement prior to a security event to minimize loss and embarrassment.  It is well worth the time and effort to go ahead and take care of security before something happens.  However, most people and companies still react to security rather that prevent issues.

** Sony has been on the receiving end of multiple hacks (at least 6 times) over the past month or more and CitiBank has just recently disclosed a major databreach from about a month ago.

What is the cloud?

When I saw a commercial on tv from Microsoft saying something to the affect of “go to the cloud” I knew this tech buzzword was finally mainstream. So, what is the cloud? And, more important, why should I care of about the cloud?

What is the cloud? Instead of storing your data (mail, photos, spreadsheets, etc) locally on your computer on your business servers it is stored on servers usually located at a large data center anywhere in the country, or world. The cloud name comes from the picture or diagrams used to describe networks which showed the data centers out on the Internet in a cloud. So, the cloud is really just a bunch of servers, which are just computers, located in a big building with specialized cooling, power backup generators, fire suppression systems, etc that allow users to access their data from anywhere on the Internet.

The cloud can be a good idea for you and your business or maybe not such a good idea.  It really depends on your view and needs regarding security, availability and other factors.  If you consider that something like Google’s Gmail or Yahoo mail is really just a cloud mail application then it is easy to wrap your head around what the cloud is and what it offers.  In the above two examples, your mail is stored on servers and you may access it from any Internet connected computer with a web browser.  As some Gmail users experienced over the past year or so, sometimes your mail is not accessible if the servers are down or there are Internet connection issues to the servers.

Why you should care about the cloud matters how you use technology. One example of how the cloud benefits business is that it allows mobile/remote users to access information through the Internet directly. That may not seem all that revolutionary because many businesses already allow remote users access to business information, and I agree.  However, for some small businesses without IT experience they can quickly and inexpensively setup document sharing and email for their employees.  There are always caveats, though, such as, are your emails and documents being crawled, stored and searched by the companies hosting your information on their servers?  That may be disturbing for some users and especially for some businesses.

I don’t want to give the impression that the cloud is bad in all respects and I recently came across a particularly useful cloud application scenario: storing virtual server backups and even hosting the virtualized servers during disaster recovery situations.  This is an example that illustrates both some of the advantages and limitations of the cloud.  Utilizing on site servers and data storage in most cases reduces costs and allows for faster access.  Internet connection speeds have come a long way but sitting in your office at 100Mbs or even 1000Mbps is much faster than an air card or a wireless connection at Starbucks (trust me I frequent the coffee titan daily).  However, in the event of a disaster having your server data and images of the server drives stored online in the cloud can literally save a business if their server room or entire building is destroyed or more commonly the case, flooded.

I’m beginning to digress, into the technical world, so I’ll wrap up by reiterating; the cloud simply allows you to store data on servers out on the Internet.  Again, this is not revolutionary, we’ve been storing mail on the Internet for many years.  The revolution, if it does happen, is when most of your applications run from, and store data on, the Internet and not on your computer.

So what are businesses and home computer users to do if just visiting a legitimate website has the potential of infecting your computer?  The first step is to make sure each computer has an anti-virus program installed and updated, such as AVG Internet Security 2011 – 20% off!, with the most recent threat definitions to hopefully block the infection from installing on the computer.  With that in mind, it is usually a good idea to run an anti-spyware program, such as Spybot Search and Destroy, along with an anti-virus program.  Again, the spyware detection program must be updated with the current version and most recent threat definitions to combat the latest threats on the Internet.

So the next issues becomes, what happens if you do everything you’re supposed to: run updated anti-virus, run updated -anti-spyware, go to only “safe” websites, etc… and you still get a virus on your computer.  It is always best to save your data (hopefully you already have a good backup of your computer data) and re-install your computer’s operating system, like WindowsXP, Windows7, etc.  For many reason, I know it is not always feasible or realistic to reinstall Windows if your computer is infected.  In that case you should try to restore your computer to an earlier time, before your computer was infected.  In Windows it is called system restore and does not restore your computer’s data to an earlier time, but restores the underlying settings, in the registry, to the way they were before the virus.

There is too much to write about removing viruses, which is why it is much more important to spend time on blocking them before the infect your computer.  Just like grandma used to say, “an ounce of prevention is worth a pound of cure.”  Take the few minutes necessary to install and setup your antivirus and other security programs to automatically update and protect your computer in the hope you don’t need to spend many hours removing the virus or reinstalling your system.

The technology side should be easy, at least from my standpoint.  Implement a proven backup and disaster recovery process to securely protect your data.  By that, I mean you need to have a stable server or platform to store your current data.  Next, your current working data needs to be backed up to another stable device onsite with large storage capacity to not only recover current data but also archived data in the event you need to restore files from a long while back.  The last point in the process is to securely transfer and store the backup data at an offsite location.  This last part of the process is the true disaster recovery preparedness in any good business plan.  If your current location is fully or partially lost, for example in a fire, you can recover data from the offsite location and resume business in a relatively short period of time.

The business side of a backup and disaster recovery plan should be equally as simple.  However, in reality, nothing is as easy at it seems.  Backup software and hardware devices require resources, not only money to purchase the applications and servers but also time to research, implement and test. The failure of so many businesses to address their data backup and recovery need lies with the disproportionately low value they place on their servers and computer systems that store their company data.  Every business, regardless of industry, is reliant on their computers to perform daily business operations.  With my previous statement, I am continually amazed at how many companies have inadequate or no backup plan or process in place.

For instance,

• many companies do not review what data is backed up.  The consequence of this is usually discovered when they attempt to recover a needed file and it is not there because the data they need was never part of the backup routine.
• many companies do not test their backups.  This is the most often frequent issue with backups I’ve seen with desperate companies. Many businesses still use notoriously unreliable tapes for backup because that is what has always been used in the past.  Did you know tapes have failure rates often cited at over 50%?
• many do not backup data offsite.  Offsite or online data storage used to be very expensive, but that is not the case anymore.  There are still places that charge $3-$5 per GB of offsite data storage but that is no longer the norm.  If your data is only available on the server or system and a drive close to that same location, a small event may destroy both instances of your data, both your current and backup storage.  For example, power events, like lightning strikes or power surges are the most common event to destroy data and water damage such as a water pipe breaking or sprinklers are close behind.

What are the results if a business tackles both the technology and business side of safely securing their company data for any event?  Easy, their data is always available to them. Their data is recoverable whether they accidentally deleted a file and need to recover it from yesterday , or a mail server crashes and all their documented correspondence is gone until they quickly recover from their onsite backup, or better yet run a virtual mail server off their backup device until their mail server is restored.  And in the rare event of a true disaster, their data is immediately available online, fully encrypted, from any Internet connection. Additionally, a new backup server, fully loaded with images of their servers to run virtual machines, is overnighted to any location.

Are you interested in comprehensive and secure backup and disaster recovery options?  Contact us for proven data backup solutions.

I’m often asked which smartphone is best for small business users.  My gut response from dealing with pretty much every make and model of mobile phone and smartphone is the Apple iPhone.

With that said, there is often a better answer for small business users than simply stating the iPhone is best.  If you are a small business owner or sales person traveling far from major metropolitan areas, the accompanying and mandatory AT&T mobile service may not be the best fit for you due to smaller coverage areas outside big cities and major highways.  If AT&T’s coverage is a deal breaker, then I suggest going with Verizon and one of their smartphone options.  I’ve managed, configured and used Droid phones and am not a big fan of the size of the devices.  There are other smaller, and less expensive mobile device options that will serve the same purpose and more easily fit into your pocket.  I’m several sentences into an opinion on choosing a mobile phone for small business and have nary a mention of the ubiquitous Blackberry; the crown jewel of enterprise business users and the leader of the free world.  I am not a big fan of Blackberry devices.  However, I do see many successful business owners and companies using Blackberries who all love them.  And that is really where the gut reaction of my first sentence could be completely wrong for a particular user.  If you “grew up” on a “Crackberry” then that is likely the best mobile device for you.

As a side note for Blackberry users: If you’ve always wanted the experience of the Blackberry Enterprise Server that large organizations use but didn’t know how or didn’t want to pay for the data plans and licensing you’ve got another option now.  Blackberry offers another option, Blackberry Professional & Express Server.  Get real-time synchronization of mail, calendar and contacts to your company’s Microsoft Exchange mail server.  Here is the best part, though, you do not need the upgraded and more expensive BES (Blackberry Enterprise Server) data plan anymore for all the advanced sync features.  On top of that, the new Blackberry Server option is FREE.  Correct, 100% free licensing for the server and user licenses.  If you want more information on how to sync your Blackberry to your Exchange mail server with no license fees or upgraded data plans just let us know.

If you are open to change and are not put-off by the AT&T iPhone data plans, then I strongly recommend opting for an iPhone.  It does not need to be an iPhone 4 or even the iPhone 3GS.  The iPhone 3G and the newer ones mentioned all provide a large screen to more easily read emails, pdfs, web pages, view pictures, follow the built-in map function and GPS and obviously has a whole truckload of available apps.  Oddly enough, as cool as the multitude of iPhone applications are, and as entertaining as so many apps can be, there are actually many useful iPhone apps available to grow your small business and allow you to be more productive and effective in your daily work.  But, alas, that is for another post.  Cheers.

Again, to add the weather widget to your Droid’s home screen press and hold in an empty area on your screen and be sure you have empty space on your main screen for the widget to display.

I hope that helps a few Droid users and some computer techs too.  Enjoy.

One point to note with Windows 7 launch is the confusion about the upgrade process and compatibility with business networks and domains.  Below is a graphic from Microsoft’s website detailing the Windows 7 upgrade & install process.

Use this chart to determine whether you should do an upgrade or custom (clean) installation.

UPGRADE TO:		Windows 7 Home Premium	Windows 7 Professional	Windows 7 Ultimate
Windows XP, all editions
Windows Vista Home Basic
Windows Vista Home Premium
Windows Vista Business
Windows Vista Ultimate

Upgrade available Custom (clean) install required

To upgrade an earlier operating system than Windows XP (for example, Windows 95 or Windows 2000) you will need to purchase a full license of Windows 7 and perform a custom installation.

Speaking with several clients we still hear some misconceptions about upgrading from Windows XP to Windows 7 and upgrading from Vista to Windows 7.

Windows XP – Home and Professional Versions

As noted in the info above you cannot perform and in place upgrade from any version of Windows XP to Windows 7.  That means you will need to save data from the Windows XP install to an external drive and then install Windows 7, which will erase everything on the disk including Windows XP and all the data.  This is the same as upgrading or migrating form Windows XP to Windows Vista.

Windows Vista upgrade to Windows 7

With Vista you can perform in-place upgrades to Windows 7.  This means you simply insert the WIndows 7 installation media, CD, DVD, and upgrade with a valid license to start using Windows 7.  The graphic above shows the different versions of Vista and the upgrade options to Windows 7.  One nice thing Microsoft did was to change the names back to the Windows XP version names of Home and Professional editions.

So there is not any confusion for business users, Windows 7 Professional and Windows 7 Ultimate may be joined to a Windows server domain.  Windows 7 Home Premium, the only home edition, cannot be joined to a business network Windows domain.

Windows 7 easily works great for home as well as business users.  The professional and Ultimate editions of WIndows 7 may be joined to your Windows business network domain, including SBS, with ease.  It is a solid alternative to XP and Vista and provides compatibility with older Windows XP programs if needed.  One other point to note when looking to upgrade or change to Windows 7 is to make sure you get the correct version regarding business use as well as 32 bit or 64 bit for your hardware and programs.

Let us know if you are interested in upgrading or moving to Windows 7 computers for your business network.  We can help. Indianapolis computer service provided by L5 Solutions.

So I’ll highlight another route that cyber criminals take in an attempt to steal your identity during the holiday season, shipping confirmation emails that appear to come from FedEx, UPS or the USPS.  Again, with many gifts shipped from homes and business along with increased online purchases, identity thieves send out spam emails asking you to verify sipping information with your credit card or ask for personal information to receive and confirm packages.  If you ever receive a request online to confirm any account or personal information, you should open a new browser window and type in the sites address, such as www.fedex.com, and then proceed or call their customer service department.

If you think just because  a link in an email says it it from fedex or goes to bankofamerica.com look out.  In my original example of the Bank of America Alert, there is a link to update your account info, but the link actually goes to awilmer.net not bankofamerica.com.  It really is difficult to differentiate between valid emails and phising scams aimed at stealing your identity and personal information.  Remember though that banks, credit card companies and other valid companies will not request personal, account or credit card info by email.

Here is the Bank of America Alerts email for reference:

Dear Bank of America Customer,

This email was sent by the bank of america server to verify your e-mail address. You must complete this process by clicking on the link below and entering your account information . This is done for your protection , because some of our members no longer have access to their online access and we must verify it. To verify your e-mail address and access your bank account, click on the link below.

Update Info  (http://www.awilmer.net/inc/scurepdat/index.html)

Please fill in the required information.
This is required for us to continue to offer you a safe and risk free environment .

Thank you
Accounts Management

Bank of America, N.A. Member FDIC Privacy Promise Terms & Conditions
Copyright © 2009

• Compare Windows 7 editions.
  

  Windows 7 Home Premium

  Windows 7 Professional

  Windows 7 Ultimate

Some good news on Windows 7 are the new features Microsoft piled in to the new OS.  One example is the Direct Access VPN connection to Windows Server 2008 R2 systems.  Instead of dedicating a VPN device to handle the encrypted tunnel, if IT admins implement IPv6 and IPsec (IP security) machines, such as remote offices and remote laptops, can connect directly as if there were inside the office on the company network.

Another point to note is the enhanced power management options for systems running Windows 7.  Microsoft and others are touting between $50+ – $107 energy savings per computer each year.  That justifies the upgrade cost of the license and install time for many tech managers.

There are also several more security enhancements included in Windows 7 such as BitLocker for USB thumb drive encryption, AppLocker to disable programs and DNSSec extensions which many security researchers agree is the next large scale vulnerability to computers and networkds.

With all the hype and bad press form Vista, it appears Microsoft may have overcome the past failings and developed a solid business computing platform.  The big question though is still, will large enterprises and small business adopt the new OS and drive the migration from XP to the new Windows 7?

According to some local telecom providers, new customer interest and demos are growing, with significant increases in the past several weeks.  Telephony is a good barometer of the overall business climate because nothing is more basic and necessary as voice and data connectivity to a business.  With that said, voice and especially data purchasing has been down significantly since the recession hit and was realized in Oct of 08.  So when business cut back even on the basics the overall cascading affect hit most businesses, some harder than others.  Again, the point to note is that business executives and small business owners are increasingly optimistic about the direction of the economy and business in Indiana.  According to several online job sites, new job postings are up, but to temper expectations it is also reported that there is only 1 job for every 6 job seekers.

So with those tempered expectations, I think that with the recent experiences over the past year we’ll see businesses focus more on vetting their business partners, vendors and other relationships more thoroughly.  What that will mean is a leaning out of local small businesses.  A few will prosper and the others will most likely struggle or fail.  The successful businesses will drive each others bottom line and grow together.  Will we see Indianapolis business again invest in their core processes, business infrastructure and technology?  The indicators look good.