What to do when you’ve been stolen

This week we’ve been working with the parents, of an employee, of a client. Do we usually do this? No. But when something extraordinary presents itself and we can help we will. Long story short. They were scammed, the home computer was infected (a MAC, btw) and their identify was stolen the first indication of which was the filing of a false tax return in which someone (not them) got a handsome check from the government. It happens all the time. A friend of mine in my neighborhood had the same thing happen to her. In fact thousands of people are now finding that they’ve been hacked and usually they are finding out when they go to file their tax return and the response is sorry you’ve already filed.

Where did they get the information? Was it your computer, a website, your bank, your library card, your insurance company, a credit card, mortgage company? Since you don’t know how or where someone got your identification from you have to cancel everything.

Start as if you’ve lost your wallet. This means new credit cards; new everything.

Then close your bank accounts and open new ones. Keep a permanent suspicious activity alert on those accounts. Consider removing online banking from the accounts. I keep two sets of accounts; one that has online banking with very limited funds and another than does not. Both require in person only account changes.

Follow the FTC recommendations.

http://www.consumer.ftc.gov/features/feature-0014-identity-theft

Follow the IRS recommendations.

Get An Identity Protection PIN (IP PIN):

http://www.irs.gov/uac/Get-An-Identity-Protection-PIN

Taxpayer Guide to Identity Theft:

http://www.irs.gov/uac/Taxpayer-Guide-to-Identity-Theft

ID Theft Tool Kit: Are you a victim of identity theft? If you receive a notice from the IRS, please call the number on that notice. If not, contact the IRS at 800-908-4490. Fill out the IRS Identity Theft Affidavit, Form 14039. (Please write legibly and follow the directions on the back of the form that relate to your specific circumstances.) http://www.irs.gov/file_source/pub/irs-pdf/f14039.pdf

Change your passwords…everywhere. Have your computers formatted and reloaded.

Above all take this seriously. It’s a giant hassle but it will never go away unless you go through this process and do it with some speed.

-Amy

Equus and Cryptolocker Virus

I realize how that subject line reads so just so no one panics these are two separate topics completely unrelated.

Equus: While travelling recently in California I had the pleasure of taking my Third Tier team to be the speakers for the October SMBTechFest and since I was in the LA area I paid a visit to the Equus manufacturing facility. This is where complex custom server configurations, OEM machines and Laptops are built. They build $4.5 million dollars of equipment each week. This location is the largest of their build centers. I was given the tour by the facilities manager and national sales manager; it was very impressive. Not only for the method but for the results. In a year they have less than $1000 inventory loss and .01 failure. That is amazing considering how the value of computer equipment plummets with every passing day. Besides the equipment that we order from them, Equus also designed and builds all of the equipment for NetFlix. We saw machines being loaded with the entire NetFlix library. Now that’s some data transfer! Next time you rent a movie from NetFlix remember that it is being loaded from Equus equipment just like in your office. I witnessed the LEAN manufacturing process and how staff changes jobs to maximize efficiency at different times of day. As an ESOP the employees own this company and the value of their stock has doubled every year and it might even triple this year! Equus remains a strong American manufacturing company with a commitment to small and medium business. I’m happier than ever that we work with them to provide you with the best computer products available.

Cryptolocker: Cryptolocker continues to rage through the land. This virus arrives as an attachment and then proceeds to encrypt any files that the person logged into that computer has access to in the network. Anti-Virus software does not catch it because its behavior isn’t unusual in any way. It installs like normal software and it uses only the rights that the logged in person already has. This means it doesn’t break any rules. While not breaking any rules, it is still an attachment and it is still software. Using information provided on its behavior by bleepingcomputer.com we were then able to develop some precautions. We have done this via a new Group Policy deployment to your computers and a change in the backup permission settings. In addition, if you are a Harbor Secure Cloud subscriber then the attachments themselves are also blocked from your corporate email account. While nothing is 100% we believe that we’ve taken very good precaution to protect you.

I then took our procedures, the policies and an accompanying paper written by a member of my staff at Third Tier and put them together into what I called the Cryptolocker Prevention Kit and published it on my technical blog. It has been downloaded between 800-1000 times per day by other IT professionals around the world since. It has also been highlighted as THE solution by GRC, CNBC, SpiceWorks, Redmond Magazine and other prominent news sources. Unfortunately it has also been copied and published by others claiming authorship. The funny thing is that the policy puts a link to Harbor on the desktop. I’ve been getting some interesting calls and email from people that got the Kit from a stolen source and are now wondering how they got Harbor on their desktop! They lack the document that explains how to put their own information into the policy before deploying it since they obtained our Kit from another source. The moral there is to never deal with pirates only the original source.

We freely shared this information with our peers in the IT industry because we felt a need to do so. There was a lot of fear and uncertainty and since we had what we thought was a good solution we shared it. Better that more businesses get protected from disaster or extortion than fewer.

Next week I will be attending Microsoft MVP Summit in Redmond, where I’ll have many opportunities to provide input into new technologies being developed there.

-Amy

Time to Dedicate a Computer to Banking

Credit card processing organizations and banks are beginning to demand a dedicated PC that resides on a separate network from the rest of your computers in order to process a credit card transaction or access online banking. We have seen two instances of this so far and based upon the trend and industry reports from others we think that this requirement is going to spread quickly.

It means purchasing a computer just for this purpose. It means separating the wiring that the computer connects to from the others in the LAN. It means isolating the computer.

As far as isolation goes, most of you will be all-set. The Calyptix firewalls that we recommend have at least 4 networks available and all of the security tools necessary to create and protect the isolated space. For the computer, we are going to experimenting with a couple of very inexpensive devices – a PI and a thin client. We’ll be taking this project up in our lab to build and configure very simple inexpensive devices to service the purpose of online banking.

The PI is the same device that we’ve configured for our digital signage solution and the Thin Client is the same that we recommend as PC replacement for accessing terminal servers. In this case we’ll look to create a different configuration using these tried and true devices.

It’s our goal to stay ahead of the trend. So we’ll be ready with a solution when your bank issues the requirement or when you are ready to move to higher security banking.

-Amy

Corporate Privacy Takes Another Hit

It seems like every time you browse the news headlines these days there’s another story about a corporation being hacked and losing their bank account, customers credit card accounts or identity. These kinds of loses are all perpetrated by people external to your organization. But last week, security researchers uncovered that Android devices store and backup to Google wifi passwords in clear text. It does this as part of the phone backup. Google provides a pretty slick backup and restore option for your phone so when you get a new one all of your applications, files, settings and yes wifi passwords are there for you. Nice from a user perspective.

Why is this important?

We have to think about what that means for your business. When an employee comes to your office and connects their phone to your LAN wireless then the Android is storing that password and sending a copy of that password to Google. As we know from previous disclosure by Google about their use of the data they collect, Google now has the right to sell, display, publish a connection to your network. This also makes Google the worlds largest holder of corporate wifi access credentials.

Will Google intentionally do something evil with this power? Probably not. But an individuals password could be guessed and the data harvested. It could be handed over to law enforcement or become part of government security data gathering. Imagine if you were a hacker and you got a list of those passwords. Now that the word is out that Google has a giant list of corporate access passwords you can bet that there’s plenty of bad guys trying to get their hands on it. It would make a really nice new rainbow table. (Rainbow table is the name given to lists of potential passwords that an automated tool will cycle through when attempting a hack.)

What should we do?

The danger is there. The way to mitigate the risk is to not allow phones of any type to connect to your corporate wifi. If you’d like them to be able to connect to a wifi while in the office, then we should connect them to a guest wifi that is segmented in the firewall from the internal network.

I would tackle this in the two ways. First by policy. Employees are likely to know and need to know the password to the corporate wifi. It would then be easy for them to add that to their phone. Your acceptable use policy needs to include a statement that phones should not be connected to the corporate wifi under any circumstances. Second we should lock down the corporate wifi to only specific MAC addresses or trusted machines with an installed certificate. Both methods will allow you to know that only devices and people that you trust have access to your corporate wifi and the data in your corporation.

- Amy 

SSL Certificates, DNS and Domains

We have fixed a price gouging issue. It wasn’t that long ago that we were able to obtain SSL certificates from GoDaddy at a very reasonable price for a basic certificate to protect remote access to the websites hosted on your servers. We turned to GoDaddy to supply these after running into pricing issues with other suppliers. This worked until now. But this year prices jumped at GoDaddy from $19, to $29 to $69 for renewals. So we went on a hunt and decided that it was time to register ourselves as resellers of these services and protect our clients (you) from this price gouging.

We are now registered with ENOM a bulk reseller of Comodo, Symantec and GeoTrust, TrustE, and SiteLock. They have the bulk pricing from these companies that we can pass along to you at very reasonable rates. For example, instead of a $69 SSL certificate renewal it will only be $30 for a basic certificate. We can also host your DNS records, websites and do domain registrations too. All will be at similar bulk rate pricing as compared to the general public pricing.

There’s no need to make any changes immediately. But as your domain renewals come due, SSL certificates expire we’ll be offering to renew them through this new service. I think that we have a win-win here and we’re happy to provide it to you.

- Amy

Dangers of OnLine Banking for Businesses

It’s me again to remind you of the dangers of online banking for businesses. I feel like I’m starting to sound like a scratched CD (also know as a broken record) but this is very important.

Recall from my last post on this topic that FDIC insurance does not protect you from fraud. It only protects you from a failed bank; not from having your account emptied through online banking.

http://krebsonsecurity.com/2012/11/cyberheists-a-helluva-wake-up-call-to-small-biz/?utm_source=twitterfeed&utm_medium=twitter

There’s an article that demonstrates how easy it is to become a victim. This company was infiltrated by a link in a single email. Through that infection the bad guys were able to obtain the banking credentials the next time an employee logged in to the bank account. Next the bad guys initiated a payroll distribution and the bank processed it. $180,000 was several times regular payroll but the bank doesn’t care. “You” asked them to process it and they did. Your money is gone.

Please check your insurance and add coverage for online banking fraud. Please keep your online banking to an absolute minimum for business transactions and please keep very little money in that account. The law says that the onus is on you to protect access to your account, not the banks.

p.s. these same rules apply to your personal accounts too

Securing Your Facebook Account

Online services are inherently insecure because they are applications that you are sharing with others on the same server. In this information age, your information is a valuable commodity. Information about where you vacation, where you live, the names and ages of your family members is a marketing goldmine and it has a value of a few pennies to a few dollars depending on how complete the information is. So when your Facebook account gets hacked someone makes money off of you, all of your friends get very annoyed and you might even loose your account completely and have to start all over again.

Now that many businesses are using Facebook to communicate with their customers the loss of your account can really hurt.

Facebook has been steadily adding security features to help combat this problem. I’m going to suggest a few and also recommend that you check your account settings pages on a regular basis for new security features and add them as they come along.

1. Use a long password and remember if you are using your Facebook ID to log into other websites than when you read that, that site has been hacked (like Dropbox) then you need to change your Facebook password too.
2. Add a security question. This way when changes are made to your account there will be a second hurdle to jump.
1. Click the account menu at the top right of any Facebook page and choose Account Settings. From the left column menu, click Security. Click on the Security Question section
3. Turn on secure browsing. This will keep your Facebook browsing encrypted so when you are in a public space the content can’t be viewed by sniffers.
1. Go to your Security Settings page ( Account Settings > Security) Click on the Secure Browsing section. Check the box provided and save your changes
4. Turn on Login notifications. With this setting on you will get a notification every time a device logs into your account from a different IP address. If you are notified that a device you don’t recognize has logged in go immediately to your Facebook page and change your password.
1. Go to your Security Settings page ( Account Security > Security) Click on the Login Notifications section. Check the box next to the type of alerts you'd like to receive and save your changes

Those settings will be enough to keep your account from being the lowest hanging fruit. In the Account Settings/Security section you will see many other settings you can also add. Whether you need those or not will depend upon how you are using Facebook. Browse through them and implement any additional security features that appeal to you and consider the list I provided a baseline starting point for all Facebook users.

A Must Read–Don’t Let This Happen To You

This article might sound very technical to most of you but I hope that you will bear with me and read it through because the concepts are very important.

http://www.wired.com/gadgetlab/2012/08/apple-amazon-mat-honan-hacking/all/

Basically, the "hackers" liked his Twitter handle, @mat. So they found his email address mat@gmail.com, and went to Gmail to see what they could find. His Gmail password recovery was an @me account. Next using Internet search they found his address, called Amazon, added a fake credit card to his account, which then on another tech support call they used to gain access to his Amazon account. Access to his Amazon account showed his real Credit card number, which combined with his address they were able to get Apple to reset his @me password. Which then they could log in, wipe his phone, ipad and MacBook. At this point not only is his Internet identity owned by someone else but all of his personal data is gone. Oops. But wait, he has a backup, right? Not exactly. His backup is in iCloud. Which he can't access. Because they reset his password and all of his security questions. Then they used his accounts to post racist and worse information in his name.

Many people are saying this could have been prevented if he had used two-factor authentication to log into his Google account, or if it wasn’t so easy to get around Apple technical support security questions or if he’d had a backup of his MacBook and the data in iCloud. But it really isn’t that easy.

We all have multiple accounts that are tied together by virtue of them being ours. Like it or not we all now have an online identity and when it gets stolen it is as bad or worse than having your physical identity stolen.

Securing your Internet identity and the information housed within it is difficult. There is no quick fix and every Internet based application has its own rules for best practices. I’d like to help you solve this problem, so we’re going to do a few things:

1. We are involved in the early development stages with a product that will backup a copy of your employees and your businesses cloud stored data. This will eventually include things like gmail, facebook photos and friends lists, file storage and will be able to interface into almost any hosted service provided the service make API’s to allow it. (an API is a programming interface)
2. We are going to begin to develop best practices sheets on how to secure various types of Cloud services that you’ll be able to follow to help secure your Internet identity.
3. We are investigating a service that will let us setup secure two-factor authentication on any hosted service that supports SAML. (saml is a standard authentication protocol and two-factor authentication is your password plus a one-time PIN which you will get from a key fob or a small app on your phone)
4. We are working to redesign our Internet backup solution to provide more flexibility to allow you to also backup your laptops whether they ever come into the office or not. These backups can also be centrally stored in your office as well as in the Cloud.

Most of these new things are going to ride under our new umbrella, Harbor Secure Cloud. Hopefully that will keep it simple as well as secure.

Emergency Patch Alert

We have just been made aware of a new vulnerability in the Remote Desktop Protocol (RDP). RDP is the protocol that is used for remote access to computers.

If you access your computer from home, then you are using RDP. If you access your computer with your iPAD, then you are using RDP. The proliferation of slate devices (like the iPAD) in networks means that RDP is more common than in the past. This has made it a target for hackers to attempt to also access the computer in search of valuable data such as credit card, social security and other personal identification information.

Microsoft has released an emergency security patch for RDP. We will be applying this update over the course of the next two days. It is required to be applied to the computers directly, so we will be contacting those people that have RDP enabled on their computer to apply this patch. It will only take about 5 minutes of your time to allow us to secure it.

Email and Website Problems Likely

Yesterday morning we noticed some problems with email delivery with a couple of our clients. The caused was determined to be unreachable DNS records. Many of you have your DNS records hosted with the largest DNS hosting solution, Network Solutions. Being the largest they are a favorite target but fortunately due to the redundant nature of their servers they are usually able to fend off the attacks. However the current attack is much more significant.

As a result we will see:

• Email delayed or undeliverable
• Websites that are unreachable

This problem can occur with your email or website or also with the person or company that you are trying to reach. There is not a thing that we can do about it, except wait. We are keeping an eye on the developments and if there comes a point where we feel that a move needs to be made we will do so.

Network Solutions has been keeping us informed of their progress in the fight against the hackers via twitter and facebook.

Harbor Featured for Backup Expertise

Harbor Computer Services is being featured by Symform as an expert in offsite Internet based backup services. We have been involved with Symform and other online backup companies since the concept first came to light. Over time we have refined the process for moving data offsite for secure storage. Owing to security and bandwidth challenges, online data storage is a difficult problem to solve with grace and reliability. We’re pleased that Symform, a provider of Internet backup services, considers us an expert on this topic worthy of featuring in Channel Pro Magazine this month.

 

	Look inside >
June 2011

Security in the Spot Light

This week has brought forth the following security breaches.

• Sony
• LockHeed Martin
• RSA SecureID
• International Monetary Fund
• CIA
• Citibank

An excerpt from yesterday’s hearing: Testifying before members of the U.S. Congress in confirmation hearings to become the next Secretary of Defense, Panetta said a large-scale cyber attack on critical infrastructure such as the power grid, financial sector or the government could amount in the next "Pearl Harbor," and that such an event is now a "real possibility."

Now I’m not one to put on my tin foil hat often and say that we’re under attack. But we are and we can expect it to increase. Some of these attacks are suspected retaliation for the StuxNet attack that has crippled the Iranian nuclear program. Israel and the USA are generally considered the ones behind this attack. Once this Pandora's box has been opened there’s no closing it and in as many words that is what our next Security of Defense, and current Director of the Central Intelligence Agency said at yesterday’s hearing.

So how do we protect ourselves from becoming a causality of a war that doesn’t use guns or bombs? A new type of shelter is required.

• Great Firewall that protects the edge from all angles
• Staff education on how not to get sucked into scams that result in security breaches
• Redundancy for Internet dependent business critical functions
• Careful password development and management
• Limited recreational Internet use at work

I think that we can consider this our new reality. This is not just another temporary flare in activity so on going awareness will be required. Be careful out there.

Change in Default Mobile Security Stance and Mobile Device Acceptable Use Policy

Mobile Device Security Stance Change

Following recent notification from one of the servers we manage that an attempt was made by a rogue mobile device to connect to it we have changed the default security stance of all Exchange and Small Business Servers when it comes to Mobile devices.

By a mobile device I mean a mail enabled mobile phone or an iPad or similar slate device. Heretofore, the default security stance was to allow these devices to connect and then attempt to authenticate. However, given that mobile device connections are now becoming a favorite target we have decided to modify the default security stance of these servers and disable all mobile device connections for all users that are not specifically authorized by you to make such a connection. This will reduce the risk footprint considerably for all servers.

We have completed this work and will be sending you a list of mobile devices that have made connections to your servers and the user account that they are associated with. We will be asking you to verify that you have approved these connections. If you have not approved these connections we have two ways to proceed: disable the device from receiving future email, calendar, contact lists from the server or disable the device from receiving future email, calendar, contact lists from the server and wipe it of the data that it currently holds.

Mobile Device Acceptable Use Policy

On a related note our client, Community Legal Resources, recently distributed a large number of mobile devices to their employees and developed a well thought Mobile Device Policy. They have agreed to make this policy available to all of you in boilerplate form for your use. I would strongly encourage everyone to implement a mobile device acceptable use policy sooner rather than later. These devices are holding a significant amount of your companies corporate data and intellectual property and an acceptable use policy can help you secure it. I have made this document available to you via download from a new Sharepoint site that we have created to hold documents that we think you will find useful. Please download the policy and modify it for your individual business needs.

The website is ssl, username and password secured. Please ask or send an email to your technician for the account information.

I hope that you will find this boiler plate and the site helpful.

Who is the most common target?

Today I am reading the incident and compromise report for 2010 by Verizon and the US Secret Service. It’s a good read if you are in my business. It gives me the pulse of what the bad guys are attacking and let’s me know if we’re doing the right thing to try to keep our clients out of harms way.

The good news is that in 2010 the incident of compromised data is down. But the bad news is rather dramatic.

Of all of the cases that they evaluated in 2010 a HUGE percentage of the data attacks occurred on small businesses. So why is this?

It’s the same old thing with crime, whether physical or virtual. The solution is simply don’t be an easy target. This says that far too many small businesses are leaving themselves unprotected but also that getting out of harms way isn’t difficult. The marketplace for crime in small business is wide open, so if you’re the company with a quality firewall, update to date anti-virus software, good acceptable use policies for the Internet and are filtering spam – you are not the low hanging fruit and the criminals will go elsewhere. But if you don’t have locks on the doors the criminals will walk in your door.

What are they looking for? When a cyber-criminal robs you they don’t ransack the place. They try to leave it as clean and untouched as when you left it so you won’t even notice that they’ve been there. There are two important statistics here.

Less data was stolen from servers. Why? Because not all data resides on servers anymore. A lot of data now resides on laptops, netbooks, phones and ipad type slates. Its easier to steal from those locations than it is from your server, so guess where crime has shifted to?

Most data thefts were not discovered by the business whose data was stolen and this is up by 25%. That means the bad guys are getting better at what they do. They are more adept at getting what they want without breaking anything in the process. The thefts are generally reported by consumers or business associates. They are the ones that end up with the stolen identity or the confidential business process that suddenly everyone knows how to build. They are the ones that suffer.

So what does the report recommend besides don’t be an easy target?

Notice the word mitigation in the title of this figure. It is about mitigation. The bad guys are smart and they change tactics frequently. Security can’t be guaranteed but you can move yourself from harms way. The first item is a big one for many of our clients. We know most of you take our advice when it comes to security efforts, but few take our advice when it comes to data storage. Data archiving is a form of data protection. If there is one item that we should discuss with you beyond our usual recommendations it is this.

If you’d like to read the report for yourself, you can find it at http://www.verizonbusiness.com/resources/reports/rp_data-breach-investigations-report-2011_en_xg.pdf

Phones: A New Security Issue

Not very long ago, smart phones were rare. Businesses purchased smartphones for very few employees and those that had them were generally business owners. Today, we are seeing that smartphones are being purchased for everyone in the company. The other trend is for employees to connect their personal smartphone to their employers network.

What’s a smartphone? They are phones that do more than allow you to answer a call. Think iPhone, Windows Phone, Android and Blackberry. iPads also fall into this category.

These phones collect email, contact lists and files from your network and stores them. This introduces a security problem because these devices are holding your critical data.

If you have a small business server then we have a solution. We can wipe these devices of ALL data and configuration settings. This is a great feature and it can protect your data from leaking in the event the phone is stolen, lost or the employee leaves employment. We can prevent that data from getting into the wrong hands.

This is great for business owned devices. But there are some pitfalls that need to be planned for in advance. If we wipe the phone:

• Any personal email will also be deleted
• Music and video is deleted
• Everything is deleted

Now, what if the employee owns the phone and the phone has been connected to your network? Can you legally protect your data? Can we wipe it clean?

Both of these scenarios are human resources issues and require an acceptable use policy. You should consider having your employees sign an acceptable use policy that allows you to wipe any device connected to your network whether is it owned by the employee or the business. Employees that desire to have a connected device need to be forewarned that should it be lost, stolen or when they leave your employment that the device will be wiped clean.

It is this document that will allow us to use the remote wipe tool to protect your data that is now living on mobile devices outside of your office.

__________

Connect with us! www.facebook.com/harborcomputerservices

The weather outside is frightful

Property damage is from winter storms one thing. As you can see it’s easy to tabulate and throw into a graphic. But business productivity is another. It’s a larger number but because we don’t report to our insurance companies it doesn’t get measured.

Business productivity doesn’t get the glamor shot in news articles. Unless it’s the government, or how many flights airlines had to cancel.

Office of Personnel Management chief John Berry has said each snow day costs taxpayers $100 million in lost productivity from federal workers.

So if a snow day costs the Federal government $100 Million, how much does it cost you? If someone can’t make it into the office because there’s snow on the road how much did that cost your business? If you decide to send everyone home early so they can avoid a rush hour of slipping and sliding and hopefully live another to work another day, how much does that cost you?

I know it costs a lot. We can help to mitigate those costs by implementing some things that you probably already own.

 Now might be a good time to review how your staff can access company resources to work from home.

Free or nearly free options:

• Outlook Anywhere, if they have a laptop or smartphone
• Outlook Web Access, if they don’t have a laptop
• Sharepoint can be accessed from the web for some or all
• Remote access to their computer in the office
• Remote access to shared files and folders, if you have SBS 2011

Additional options:

• Dedicated remote computers. A small bank a computers specifically for remote access.
• Remote Services: to provide whole desktop experience
• Remote Services: to provide access to a specific application

Poor Choices:

• VPN – provides remote access but potential for infection is very high
• LogMeIn or GoToMyPC: Why bother when remote access is free and built into the operating system of your computer and provides better security

We can help you implement these solutions or train you on how to use them. We can also secure them. The trade-off in allowing remote access to be certain that we’ve secured it properly. Once secure your employees can work from home and be as functional as in the office.

__________

Connect with us! www.facebook.com/harborcomputerservices

The Reasoning Behind Complex Passwords

We have always gotten a lot of push back on enforcing complex passwords. Believe me as a person that works with a lot of passwords every day, I understand completely. But the data speaks for itself. In the picture below, note the difference between only lowercase and all characters.

What’s the most shocking of the statistics below? It’s that 4 digit pin number to your bank account, isn’t it? Absolutely insecure and under the best of circumstances broken in 1.36 minutes. See if they’ll let you use a longer one.

There is however, another very important take-away that you need to know about…

it’s the definition of All Characters. All Characters means that your password contains upper, lower, numbers and symbols and the letters do not form any known word.

So it’s something like !)@ftlgjsro2BB which is just awful to type and remember but it will take a hacker 154,640,721,434 millennia to break it. Perhaps it is worth committing to memory?

Still I have a easier solution to this problem. It’s the one that we use internally. It’s a formula and it goes like this: symbol symbol word word symbol symbol or symbol number word word symbol number

Here are a couple of examples of easy to remember complex passwords that do not contain any known word.

$$TreePhone))      ^6FlipHanger0)

But those are words, you say? Yes but No, they aren’t. They are two unrelated words that when put together make nonsense and aren’t found in the dictionary. Complex password don’t have to be difficult and we do have to enforce them. If it wasn’t important we wouldn’t harp on it so much.

To the Cloud, and Beyond!

The “cloud” is all the talk in computing these days. They talk about it as if it’s something new. I suppose in once sense it is. It is a new term in marketing and boy are they pushing it. Microsoft’s “to the cloud!” commercials have been a hit, a kin to Apple’s I’m way cooler than a PC commercials were a couple of years ago.

So what is this cloud thing? Well, as you know there are many different types of clouds and some clouds are more pleasant than others.

 

In IT marketing speak there are two types of Clouds that have formed. Public Cloud and Private Cloud. Both are very simple concepts and neither is new.

Public Cloud = The Internet

If you are reading this, then you are using a public cloud. The cloud allowed me to upload this document into Harbor’s blog. The cloud allowed me to tell my blog to send a copy of this blog post to the members of our client mailing list. Your email server received the message from the cloud and is displaying it to you right now. You’ve probably been using the public cloud for years.

Private Cloud = Virtual Servers in your Office

A virtual server is the same server software only it runs as a file and it uses virtual hardware. Because it uses virtual hardware, we can run multiple servers on one physical piece of hardware. It saves some money because we don’t have to purchase so much hardware anymore. We increase the efficiency of your hardware purchases. Several of our clients with multiple servers, are running a private cloud.

Cloud Computing = Applications that are housed on the Internet or that use the Internet for some of their function.

This one is tricky. It’s in the cloud – it must be good. The cloud IS good at some things, it is not good for some things, and it’s impossible for other things. That’s the uncertainty. The only certain thing about the cloud is that it requires compromise.

At Harbor we have moved in the direction of the cloud in our recommendations for some items, when it makes sense for our clients business needs. Our remote support tool that allows us to connect to your PC remotely, is one such example. We’re recommending a cloud version of Trend for anti-virus. We have some smaller client using Exchange in the cloud – it’s a great solution for small businesses that couldn’t afford Exchange otherwise. We’ve got phone apps integrated into Sharepoint using a cloud connection. The cloud is everywhere and we’re tuned into.

We can do almost anything in the cloud these days. The problem is that it doesn’t always make sense – or cents. Using the cloud isn’t free, it’s a lease. Using the cloud isn’t without risk, you give up control. Using the cloud isn’t without downtime, you just can’t do anything at all about it except wait and hope for the best when it happens.  Using the cloud isn’t secure – it’s not your building, not your server hardware, not your people maintaining it or configuring it, not your backup system, not your upgrade schedule, not your data security plan, etc.

Therefore, it’s best not to trust the cloud. But the good news is that we don’t have to trust it to use it. We only have to plan accordingly, make allowances for the lack of trust and the relinquishing of control over our own data and applications.

As always we need to be careful and make wise decisions. We can harness this cloud and make it work for us. We’re already doing it.

Part Two: Outlook Social Connector. Why you should care, even if you don’t use it.

This post is a continuation of this one: http://smalltechnotes.blogspot.com/2010/11/things-you-need-to-know-about-outlook.html If you aren’t familiar with the Outlook Social Connector then you should read that post first.

Here are few people that I am not connected to. Let’s see what they look like.

The above people are randomly pulled from mailing lists I belong to on Yahoo and ISAServer.org. They didn’t even send email to me directly. Rather they posted it to a mailing list and that mailing list gets delivered to folder in my Outlook mailbox.

This guy above didn’t email me either. He was simply copied on an email that someone else sent to me. There’s his photo.

At this date in history about 1/2 of the email I receive has a photo attached to it. I know what these people look like even though I am not friends with them on Facebook. I know this because they choose to allow basic information in their profile to be shared. This includes their profile photo.

So what if you don’t participate in any social media? Well then this is what you look like to me.

Is not participating in social media the way to go? I can’t see your photo, is this a good thing? Today you’ll be in good company in my inbox because only about 1/2 of the email I get has photo. But riddle me this…in the near future when your clients look down the list of people in their contacts and they see your ghostly outline instead of your smiling face, how are they going to feel about you? I’ll argue that they won’t be drawn toward you. They’ll probably pass you over.

So what does this mean for your business? It means that the profile photos you post ANYWHERE will be seen by your business contacts. It means that what you do in social media IS part of your business right now and that same goes for anyone in your company that has an email address. There is very little separation between private, public and work anymore and very soon there will be none at all.

Does this pose a bit of a human resources problem for your company? Oh boy, the times are a changin’.

Headlines read malware attacks in 2010 greater than all previous years combined

From http://www.computerweekly.com/Articles/2010/11/17/243967/Malware-growth-reaches-record-rate.htm

Malware growth has reached its highest levels, with an average of 60,000 new pieces of malware identified every day, according to the latest threat report from security firm McAfee.

Cyber criminals are becoming more savvy and attacks increasingly more severe, said the threat report for the third quarter of 2010.

The Zeus botnet is identified as one the most sophisticated pieces of malware to plague users, with US small businesses losing $70m to Ukrainian cybercriminals.

Most recently, cybercriminals unleashed the Zeus botnet aimed at mobile devices, designed to intercept SMS messages to validate transactions. As a result, the report said criminals can perform the full bank operation, stealing funds from unsuspecting victims.

 

And the rates are just continuing to climb…

http://www.securelist.com/en/analysis/204792146/Monthly_Malware_Statistics_October_2010

First, a big congratulations for surviving and not getting more malware infections than all previous years combined. We did not spend more time fighting malware infections than in previous years. That means that we can all feel good that we’re going something right. Please keep it up.

As a refresher, here’s how you avoid letting the bad guys steal from you:

• Have a good properly configured firewall that is smart enough to catch malformed packets
• Have current anti-virus software
• Keep your PC’s' and Server operating systems current
• Keep all software fully patched
• Keep your eyes open for websites that don’t look quite right
• Don’t click on attachments in email
• Don’t click on ads in webpages
• Don’t believe everything you read in email or on the web

Things to avoid:

• Facebook – Be careful who you “like”. If you don’t know them don’t accept them as friends. There are fake user accounts out there whose sole purpose is to steal your account.
• Facebook – Who viewed your profile? This is malware. Once installed it will steal your account and start posting in your name. Beware of Facebook ads in general.
• Fake Updates – found mostly on porn and sports websites where videos are displayed, a fake update for the video player of your choice will pop up. This is not a update for your video player, it is malware asking you to install it.
• UPS, Amazon,  and other sites – After visiting you may receive an email with information about your “purchase” or shipment. It’s a fake. They are after your account information or credit card information.
• IRS – The IRS is going digital and the criminals are really coming out of the woodwork to try to redirect your dollars. They can only do this with your help. An email comes letting you know that there was a problem with your monthly deposit. Click the link and go to a VERY real looking website and resend it – to the criminals. 

You may have noticed that it’s no longer your computer that’s the problem. It has become very difficult for a virus to install itself. These things get installed and cause harm because they have fooled you into thinking that they are legitimate. They ask you to install them because they can no longer do it themselves. Small business is the main target of cyber crime today. Why? Because they know that most small business don’t take security as seriously as larger businesses do and so small business and home computers are viewed as the easily picked low hanging fruit. Sure, there’s not a lot of dollars to be had from any individual or small business, but that doesn’t matter because these guys don’t attack one person at a time, like a pick pocket. They use the power of the Internet to pick a million pocket simultaneously.

"With great power comes great responsibility." – Spiderman

If only they used their power for good. These malware writers are smart, it’s too bad they are also greedy. Be careful out there and call us if you see anything that you are unsure about.