Whatever the case, security is in the media forefront and that brings both pros and cons.  Malaise can set in from overexposure to “just another security incident” or denial in that users think they will never be “targeted” because of their seeming anonymity.  Businesses and websites are continually being scanned and probed for open security vulnerabilities.  Are those openings producing more breaches, likely not, but with compromised businesses delaying or avoiding disclosure the statistics are debatable?  Advanced computer and network security exploits are certainly more readily available today than they were just a few years ago.  Not all tools are designed for nefarious purposes, see metasploit, but nonetheless there are seemingly good tools and others that even elementary computer users and criminals may implement to breach a company’s server, bring down websites and more commonly steal user data.

So what are typical users and business to do?  Are they at risk or it is only towering conglomerates and DoD contractors?  What businesses need to understand is that the initial scans and probes are completely automated and will eventually hit their servers, websites, etc.  If those automated tools find open vulnerabilities then additional higher-level tools may be implemented or even a real person may be alerted to the possibilities of exploiting your site.  That is why it is so important to keep up with current patches and security updates for your routers, firewalls, servers, computers and other devices.  If you keep the most obvious holes plugged you are better off than many businesses and users.

Another common unwanted entry into systems and accounts is from poor passwords.  We’ve all been bothered and badgered by different systems requiring 8 or more characters in a password, and sometimes using uppercase and special characters.  There are different thoughts to the usefulness of changing passwords frequently, another common practice, but the length and especially complexity of passwords does help to mitigate threats.  Depending on the security in place, some passwords can be cracked in under 10 seconds and many in under 17 minutes (again this is all done by automated programs checking for common passwords and lower security systems).  Realistically, your password is more likely to be exposed from a larger database hack, seen from several breaches of banks and online commerce sites.  If you use the same password at many, or all, sites as a significant number of people do then all your data can be compromised.  The recent CitiBank hack and some of the gaming and pornography site hacks had the stolen passwords posted to the Internet with a suggestion for others to try logging in with the exposed email addresses and passwords on the users’ Facebook accounts, etc.

There is obviously a need for skilled computer and network security professionals to implement best practices but the above shows us that an old adage of “an ounce of prevention is worth a pound of cure” is true for online and data safety.  If you keep up with the current best practices for known threats and secure passwords you can help yourself, and your data, have a better chance of staying safe and secure.

Do small businesses need to focus on computer and network security?  Many think that only large organizations, such as Sony or CitiBank (see ** below), that boast about secure networks and taunt underground hacker organizations need to worry about network and computer security, right…? But what about the rest of businesses, the ones that are local or regional in size and scope, are they at risk and are they experiencing the same security failures and incidents?

A very telling article I read recently stated 80% of businesses experienced some data loss in the last year due to some security lapse or breach.  I absolutely believe the assertion of the article and the survey results:

• It indicates that customer information (52 percent) is the most common type of sensitive information compromised in data leaks
• followed by intellectual property (33 percent)
• employee information (31 percent)
• and corporate plans (16 percent)

Are large black hat organizations, such as the Anonymous hacker collective or LulzSec, targeting local Indiana business, not likely?  What smaller and medium sized business needs to worry about when it comes to security is internal security threats and more realistically lost devices.  This is what I see as the largest and easiest hole to plug in the dam to secure company data, simply securing mobile and movable devices with sensitive data.

What are the threats, then, and how can they be hardened to minimize data loss?  There are three main devices or device types to address when looking at mobile data and mobile devices.

1. Laptops – in this category is included netbooks, notebooks and tablet devices.  Many new laptops have more processing power and storage capacity than servers of just a few years ago.  With that increased size and power comes the ability to store vast amounts of data in spreadsheets, documents, mail and other communication programs, etc.  So what then is the threat?  Should you be worried about being hacked while checking email at Starbucks, downloading a trojan or virus form a colleagues email?  Not really.  The most common scenario of data loss for laptops is simply losing the device.  A laptop stolen from a car is a common incident that can embarrass companies and compromise their data.  When the laptop is lost it allows hackers (crackers are the bad guy hackers) or criminals unlimited time to creak into the device and glean the important data(read important as sellable so they can make money – for instance selling credit card info to other criminals on the Internet).  Simply password protecting your laptop on login does little to secure the device.  There are several ways to crack the password in under a minute or the disk may simply be pulled from the device and read from another computer without making any other changes.  The laptop hard drive, or other device, should be fully encrypted so that the disk is unreadable if pulled form the device and also protected by complex passwords.  There are many encryption programs available for a nominal fee that are essentially unbreakable.  I state essentially because there is always someone or some government working to crack the latest security software.  As an aside, the Chinese government has a large stake in Symantec, which owns PGP one of the standards in disk encryption and other security software.
2. Mobile phones and smartphones – tablets can be considered a crossover into this category and as smartphones increase in power (several models now have dual core processors, etc) they may be more apt to consolidate into the laptop category.  Mobile devices present some similar issues as laptops but then also present different challenges based on their primary uses.  Phones do not often have the same amount of data in documents or spreadsheets but within the stored email of the user may be those documents as well as sensitive communications, contacts, and access to other accounts such as banking form downloaded applications.  What is chilling about the increasing usefulness of the advanced mobile device is that they are often not protected with even a basic passcode or password.  So then, that must be the first step to manage security on mobile devices for business.  On top of that, there are applications and utilities available for phones (Android, iPhone, Blackberry, etc) to lock the phone, encrypt data files if needed and remotely wipe the contents of the device if it is lost.  Many applications will automatically wipe the device if an incorrect passcode is entered a set number of times.  Obviously you want to have a validated backup routine in place, but that is just another piece of the security and business continuity plan.
3. Offsite hard drive or tape rotation – this category is slowly shrinking as large Internet connection make online data backup over the wire possible to offsite data centers for redundant backup.  The scenario is similar again to laptop data loss.  A courier or trusted employee is transporting a tape or hard drive offsite as part of a company’s disaster recovery plan and the device is stolen most commonly from their car.  The irony of losing large amounts of sensitive data (what you decided was critical enough to backup) as part of a disaster recovery plan and doing the right thing is not lost on me.  Many backup programs can encrypt the backup or at least password protect the backup but even password protection not always implemented by the company.  If current encryption best practices are followed this threat can be almost reduced to zero even in the event of a lost or stolen backup device because the data on the tape or disk is rendered unreadable without the ability to unencrypt the data.

So we can see that small business is still at risk or data loss, security breaches and other incidents.  There are some fairly easy and inexpensive steps to implement prior to a security event to minimize loss and embarrassment.  It is well worth the time and effort to go ahead and take care of security before something happens.  However, most people and companies still react to security rather that prevent issues.

** Sony has been on the receiving end of multiple hacks (at least 6 times) over the past month or more and CitiBank has just recently disclosed a major databreach from about a month ago.

Again, to add the weather widget to your Droid’s home screen press and hold in an empty area on your screen and be sure you have empty space on your main screen for the widget to display.

I hope that helps a few Droid users and some computer techs too.  Enjoy.

So I’ll highlight another route that cyber criminals take in an attempt to steal your identity during the holiday season, shipping confirmation emails that appear to come from FedEx, UPS or the USPS.  Again, with many gifts shipped from homes and business along with increased online purchases, identity thieves send out spam emails asking you to verify sipping information with your credit card or ask for personal information to receive and confirm packages.  If you ever receive a request online to confirm any account or personal information, you should open a new browser window and type in the sites address, such as www.fedex.com, and then proceed or call their customer service department.

If you think just because  a link in an email says it it from fedex or goes to bankofamerica.com look out.  In my original example of the Bank of America Alert, there is a link to update your account info, but the link actually goes to awilmer.net not bankofamerica.com.  It really is difficult to differentiate between valid emails and phising scams aimed at stealing your identity and personal information.  Remember though that banks, credit card companies and other valid companies will not request personal, account or credit card info by email.

Here is the Bank of America Alerts email for reference:

Dear Bank of America Customer,

This email was sent by the bank of america server to verify your e-mail address. You must complete this process by clicking on the link below and entering your account information . This is done for your protection , because some of our members no longer have access to their online access and we must verify it. To verify your e-mail address and access your bank account, click on the link below.

Update Info  (http://www.awilmer.net/inc/scurepdat/index.html)

Please fill in the required information.
This is required for us to continue to offer you a safe and risk free environment .

Thank you
Accounts Management

Bank of America, N.A. Member FDIC Privacy Promise Terms & Conditions
Copyright © 2009

Business technology really can help your business and not just exist as a necessary evil. If you’re interested, you can learn more by talking to us and our customers.

• Compare Windows 7 editions.
  

  Windows 7 Home Premium

  Windows 7 Professional

  Windows 7 Ultimate

Some good news on Windows 7 are the new features Microsoft piled in to the new OS.  One example is the Direct Access VPN connection to Windows Server 2008 R2 systems.  Instead of dedicating a VPN device to handle the encrypted tunnel, if IT admins implement IPv6 and IPsec (IP security) machines, such as remote offices and remote laptops, can connect directly as if there were inside the office on the company network.

Another point to note is the enhanced power management options for systems running Windows 7.  Microsoft and others are touting between $50+ – $107 energy savings per computer each year.  That justifies the upgrade cost of the license and install time for many tech managers.

There are also several more security enhancements included in Windows 7 such as BitLocker for USB thumb drive encryption, AppLocker to disable programs and DNSSec extensions which many security researchers agree is the next large scale vulnerability to computers and networkds.

With all the hype and bad press form Vista, it appears Microsoft may have overcome the past failings and developed a solid business computing platform.  The big question though is still, will large enterprises and small business adopt the new OS and drive the migration from XP to the new Windows 7?

Print screen from your iPhone:

• To take screenshot on your iPhone hold down lock/off button on top of phone & click the home key; saves it to your camera roll.

*

How to print from your iPhone:

• Here are some limited options to send items to a printer directly from an iPhone or iPod, along with options to print to shared printers on a MAC and how to run applications on a PC or MAC that enable printing from your iPhone.

*

MacWorld’s iPhone section provides some more good help and tips for your iPhone.

These are just some of our business technology tweets, follow us for more Indianapolis business consulting news and advice.

If you have some more tips please let us know or send us your questions to utilize your iPhone within business.

As a business executive, CIO or business owner do you know where most threats are coming from that target business networks, computers and users?  Most likely it is not something you have seriously researched.  As business consultants, we focus on knowing as much as possible about threats to business so we can effectively combat their tactics.

Most people, including many IT professionals, assume spam most predominantly originates in China, Nigeria and the former Soviet Republics such as Russia.  Oddly enough spam, its viruses and more importantly rootkits/trojans that allow those criminal enterprises free access to steal information from your computers and use your computers to launch other attacks that steal from additional business originate in some countries not usually associated with online threats, South Korea, Brazil and… the United States.

There are definitely larger and more aggressive threats targeting business networks as well as their servers and computers.  But you cannot minimize or dismiss the serious consequences of a single computer on your company’s internal business domain network.  The reason is, that single compromised computer can be used as a pinhole opening for criminals, either foreign or domestic, to launch more complex and sophisticated attacks to steal your business data, personal employee information or make it appear your computers are attacking other organizations.

Knowing what you know is as important as knowing what you do not know.  If you have any doubts about your business’ current security posture ask a qualified business consultant.

- Tsung Tzu, Art of War, Chapter 3 “Attack by Strategem”

“So it is said that if you know your enemies and know yourself, you can win a thousand battles without a single loss.
If you only know yourself, but not your opponent, you may win or may lose.
If you know neither yourself nor your enemy, you will always endanger yourself.”

What are the implications and affects on business technology from such a drastic policy as forcing all employees to work remotely from home?  Some items to consider:

• What is your server resource, licensing and bandwidth capacity for remote access through secure remote VPN access?
• How will workers collaborate?  Can they share documents, conference call remotely, effectively carry out daily business tasks?  It most likely will not be as efficient as working together in the office, but can it even be done remotely?
• What about security?  If many users have remote access, are the security policies and settings in place to restrict sensitive data from being downloaded remotely to their home computers or offsite to laptops?  This is a legal issue for some industries as well as an individual business secrecy issue for all.

There are many others but the above examples illustrate how daunting the task will be if in fact some of the more dire predictions come to pass.  Some companies may think cloud computing or hosted solutions are the answer.  Just remember the Google Gmail outage this past Tuesday and other cloud computing issues identified in the past.  Still though, recognize that even with Google’s recent Gmail outage their uptime service still beats most enterprises.

If you need advice on technology planning for your organization, you can always contact our parent company, L5 Solutions.