SIDEBAR
»
S
I
D
E
B
A
R
«
How To Get The Most Out of Small Business Security On A Shoestring Budget
Jan 23rd, 2015 by aperio

Those of you with IT security responsibilities in small businesses often resemble the stereotypical Scotsman, trying to stretch a penny as far as humanly possible. With an IT security budget that is likelier tighter than a Tom Brady spiral pass, how do you make effective use of your limited spending capabilities?

Small business security teams have to deal not only with limited budgets but resources are equally scarce. Prioritizing your security controls and needs based on risk is the obvious starting point. However, you don’t have the manpower to perform the risk assessments and gap analyses. Given these constraints where does someone even start?

Arguably, one of the best resources that security teams should utilize is the SANS Top 20 critical controls. SANS has done all the heavy lifting in identifying an extensive list of the foundational security controls. This is wonderfully laid out document that greatly helps in laying out implementation road map and how to best integrate the controls into your security infrastructure. SANS has done all the work for you – in describing in great details what each control accomplishes, all you need to do is best identify what controls are would address your most pressing security concerns.

It is actually quite amazing the level of detail that SANS went to in describing how to implement the controls, automate them, how to measure their effectiveness (metrics), how to validate, as well as a process for implementation.

Each control is broken down into sub-controls that can be implemented over multiple phases following a natural progression. The sub-controls are classified as quick wins (can be implemented fast and cheap), visibility/attribution, configuration/hygiene (basic security measures), and advanced. Based on your needs your can progress to the advanced stage of the different controls. This is a great way to form the foundational aspects of the control and then over the years to naturally evolve the capabilities.

How can one effectively manage and visualize what controls (and sub-controls) you have implemented and what areas still need addressing. There is an awesome interactive Excel worksheet from Tech-Wreck blog that makes tracking your progress with the SANS Top 20 an absolute breeze (plus it used graphs that you can give to management so they can easily see the status of the different controls.)

The SANS Top 20 security controls list coupled with the Excel spreadsheets that capture the progress make a formidable tool for ensuring that you can stretch your security dollars and spend wisely on the controls that will best address the information risk within your organization. Try it out, good or bad, I’d like to hear about your experiences.

Photo Source: Leonardo Rizzi
Article By: Dominic Vogel

Office 365 combined with cloud storage and mobile tools can save millions
Jan 19th, 2015 by aperio

On Wednesday, Mecklenburg County, North Carolina’s most populous county, announced it has bet big on the Microsoft platform by selecting Microsoft Office 365 as its communications and collaboration platform, Windows Azure as its cloud storage solution, and Microsoft Surface Pro for its mobility needs.

Together, the seamless mobility, productivity and flexibility aspects of these solutions have already helped various departments within the county collaborate better with staff, integrate across a number of crucial systems, and streamline and improve daily responsibilities. For instance, the county’s Youth and Family Services department is reporting $3.2 million in productivity savings per year due to Mecklenburg’s Surface Pro pilot launch. Meanwhile, by switching to Windows Azure, the county’s cloud storage costs have reduced dramatically.

“With the mobility factor of Surface Pro and Office 365, we are able to do so much more,” said Cliff DuPuy, technical services director at Mecklenburg County. “Not only do our Youth and Family Services folks love the devices for the flexibility and productivity the combination provides to them, but they appreciate the toughness of the devices, the touch aspects and the ability to document benefits while they are visiting clients. We are working toward ensuring that all our employees have their own device, and we can’t keep up with the demand we’re receiving from excited workers. It really has helped to increase their enthusiasm around how they do their jobs.”

Just as important, the county’s technical services director, Cliff Dupuy, acknowledged that these modern devices and services have increased employee productivity and excitement. In addition, the investment in Microsoft technology enables the county to reap all the benefits of the cloud while maintaining its commitment to privacy and security.

In addition to the Department of Youth and Family Services, a number of other departments within the county have recognized the value and mobility benefits provided by the Surface devices when combined with Office 365 and custom-built apps specific to each line of business. For example, the county’s Food Services Department has used these solutions to ensure Food and Restaurant Inspectors can utilize state applications, while the county’s Medical Examiners are benefitting from the note-taking abilities with their tablets. Meanwhile, Mecklenburg County’s Parks and Recreation employees, all of whom are moving to Surface 2 devices, are using these solutions to help them collect payments, book venues easily and tie seamlessly into the county’s financial system. In addition, due to an overwhelming demand for more devices, the county will increase the number of Surface Pro devices it is using to more than 1,000 by Aug. 1, 2014.

With 1.6 million emails sent per day by county employees, the cloud storage that Office 365 provides and the ability for employees to use Office on up to five devices has proved beneficial to all levels of employees within the organization. The emphasis on privacy and security in the cloud was a driving factor for the county to select the Microsoft solution. Similarly, the ability to use Surface Pro tablets with Office 365 has been a killer combination for the county: The Youth and Family Services Department is reporting $3.2 million in productivity savings per year after participating in the county’s Surface Pro pilot launch.

Selecting Windows Azure for its cloud storage was a natural fit for the county — its interoperation with Office 365 and Surface makes the user experience seamless. In addition, with key disaster recovery capabilities, Windows Azure makes more sense from a planning perspective, but also from a cost savings point of view. For instance, the county can ramp up quickly and take significant workloads out of its local datacenters, saving significant dollars.

“The cost savings with Windows Azure are tremendous,” DuPuy said. “Our storage costs used to be $21 per GB; now, with Windows Azure, we are around 30 cents per GB.”

“Mecklenburg County is leading the way in harnessing the power of the cloud and new mobile device form factors to deliver better government services to citizens, while at the same time lowering costs,” said Michael Donlan, vice president of Microsoft’s State and Local Government business. “Whether it’s field inspection, delivering better services to youth and families, or making it easier for business and citizens to enjoy the county’s parks and venues, Mecklenburg is using Office 365, Windows Azure and Surface to transform the business of government all within a solution that best meets their requirements for security and privacy.”

Across the board, county employees have embraced the switch to the cloud, and they have been vocal in their support.

“We have people telling us on a consistent basis that these mobile and flexible solutions, tightly tied together, have collectively changed their working lives,” DuPuy said. “Whether they have used these tools in the past, or they are just learning the breadth of Microsoft’s capabilities, we’ve consistently heard that our teams are really enjoying the new lease on productivity and efficiencies that they now have. That’s really humbling for us IT folks.”

Across the nation, state and local governments are constantly pressured to deliver more services with fewer resources. They are tasked with finding and investing in modern and secure solutions that help them save time and money, while ensuring employees can use these tools in the office and on the go. With Microsoft’s suite of solutions, Mecklenburg County is helping address these challenges.

Who Left Their Charger At Work Today?
Jan 16th, 2015 by aperio

This very unsuspecting phone charger is actually a Spy Device that was built to sniff out all the keystrokes off your wireless keyboard.  Yes this little tricky fake charger is known as a Key Sweeper and its whole purpose is to find out your private personal information like email, password, social security and credit card numbers.  Obviously the list can go on and on when put in the hands of a maleficent being.  Currently it can only be used on Microsoft Wireless keyboard that specifically use 2.4 ghz.

This charger lights up if you plug a usb device into it and it will charge whatever usb device you’ve plugged into it.  However, if you unplug the charger from the wall it is still capable of recording keystrokes.  That’s because inside of the wall unit is a rechargeable battery.  It will record every single keystroke on a memory card inside the charger or for a little extra money it will actually send alerted phrases via SMS or text messages to wherever in the world.

This sophisticated type of invention could be used to potentially cause high levels of chaos in this new age of technology so its best to properly educated yourself and be more aware of the situations, people and objects around you.  Keep that in mind next time you see a lonely charger or someone walking around with an old school pager

Is Your’ Internet Connection or Wireless Network Letting You Down?
Jan 12th, 2015 by aperio

My business relies on the Internet; my phone is an IP phone, it uses the Internet. If the Internet goes down so does most of my business until it comes back up in maybe hours or days. It doesn’t stop there though because even my TV uses the Internet these days and then there’s all those cloud services which means some of my data may not be on any of my computers. I’m running a cable Internet connection and it’s pretty fast especially when it comes to downloads. The faster the broadband the more we can do with it and the more we rely on it. And… it doesn’t even stop there either! Laptops, mobile phones, tablets, TV’s, set top boxes, NAS drives, stereo systems, cameras etc. use wireless so wireless is really important too.

If you are running an Internet dependent business or would really miss your Internet connection at home you won’t want it to go down ever! Well, maybe when you are on holiday… uh oh, got a remote security camera linked to your phone through the Internet or some other device, maybe a remote Internet linked pet feeder or something.

I think most of us want reliable all the 9’s uptime for our Internet but of course that’s not always easy to achieve. Making it 100% reliable I cannot promise in fact even all the 9’s is not that easy but I can probably show you how to make your Internet faster, have a higher capacity, make it more reliable and improve your wireless whilst keeping costs reasonable!

A Common Problem

Most homes and small businesses have 1 Internet connection, 1 line and 1 router that functions as a router a switch and a wireless access point… true? If any of those elements go down then so might your Internet access. You could go ask the neighbour if you could sling a wire through to your business from their supply or ask for their wireless password and maybe sometimes this is OK, it’s a temporary solution of a sort. If you want to be self-reliant though you’ll probably need a better solution.

What happens if…

Your router fails

Simple, go get another router, configure it up (hope you know where your broadband login details are) or better still, have another router on standby, just in case! From my experience most people or businesses don’t have a spare. Your current router might be a bit special but anything will do to get you back up and running if a direct replacement is not to hand.

Your Internet connection fails

It could be your ISP, a fault on the line or a JCB digging outside. Either way it’s down to the service level agreements of your provider. You’ll probably be down for a few hours, maybe a few days and if you are really unlucky, a few weeks, it happens, especially if the road needs digging up.

Flaky Wireless

Wireless has come a long way but it’s still a flaky service. It depends on lots of things, how many people are already connected, what’s in your building, atmospheric conditions, the type of wireless network you have and the capabilities of the devices you are trying to connect to it etc.

It’s also not so great when you have more than 1 wireless access point but your device stays connected to the access point you were near 2 minutes ago and which is now nearly out of range. You could be standing next to another access point on the same network but still not connect to it unless you manually do so.

Does all or some of this sound familiar?

A Solution

There are very fast Internet connections with high up-times and excellent service level agreements that mean if your Internet connection does go down it gets fixed quickly but of course that can cost a lot of money and a JCB going through the cable is probably going to scupper even that plan for a while. There’s WiMax, line of site links and even satellite connections but, well, it’s a bit expensive and maybe a bit over the top for many.

My suggested solution below is not new but it has improved over time and costs less than it used to. Not all brands and/or models will let you do this but the right devices are readily available and affordable.

More than 1

Broadband is pretty cheap so how about 2 supplies over different networks so that if it’s the ISP or just 1line that fails then the other is likely to continue to work. Just to make it belt and braces how about feeding in a mobile broadband supply just in case that clumsy JCB comes your way and cuts all the cables to your premises (don’t laugh, this happened to a company I worked for).

In this case you should have 2 broadband feeds going into the same router which will balance all your Internet traffic using the 2 services giving you more speed and capacity. If 1broadband service fails then the other carries on until the failed service comes back up. If both services fail then the mobile broadband cuts in.

The mobile broadband does depend on the mobile signal you can get where your router is located and whether it’s 3G or 4G but at least it will let you access the Internet. If it’s 4G this could be pretty good! You will need to watch your mobile broadband use depending on the tariff you are using but at least you are still up and running.

What if the router fails? Well of course this can happen so for the cost of it I would keep a second router as a backup. You can backup the configuration of the router in use and load it onto the second router. You can backup the configuration each time you change it and either load it onto the second router or at least have it ready. For some devices, there are extended warranties available where they will replace your failed device the next working day with no quibbling. You could even use the second router as a second modem if you configure it correctly but that’s a subject for another day.

Improving Wireless Connectivity

Wireless or WiFi has improved over time. The range is greater, it’s more reliable and easier to connect to than it used to be but it’s still a variable and sometimes quirky technology. If you need a consistent service over a defined area then you’ll probably need to overdo it with wireless coverage.

Many routers are not just routers; they are routers, switches, modems and wireless access points. The wireless part of your main router will provide all you need in a small space but as an operating space gets bigger you will need further wireless access points to cover the area. Wireless access points can be obtained for both indoor and outdoor environments and can work well in a campus environment.

Two Variants

There are two main variants which we can call push and pull systems. To use a couple of techy terms, the wireless system we’ll call the server and your mobile phone, laptop tablet or other wireless device the client.

Pull

Most domestic or small office wireless systems are pull systems which means you manually connect your client device to a wireless server. For example, an office or house has 2 access points, 1is a wireless router downstairs and the other is a wireless access point upstairs. When your client device is connected to the downstairs router (the server) it stays connected to it until it goes out of range so if you walk upstairs you may need to manually disconnect from the downstairs router and connect to the upstairs wireless access point. It works but it’s clunky and moving smoothly from 1wireless zone to another does not occur. Both wireless access points are part of the same system but the connection to them isn’t managed automatically. You could say that you have to pull connections.

Push

Using the same scenario now the wireless system is being managed and pushing connections. The effect is that when you walk up the stairs the wireless management software built into the system monitors it’s connections and as the signal from 1wireless access point becomes weaker and another stronger it pushes connection to the stronger wireless access point to your client device such as your phone.

Another great thing about Managed Wireless is that it will share the load so if several devices are in range of more than 1access point those access points can be made to share the wireless traffic instead of 1being overloaded and the other hardly used.

Now you can walk up and down stairs with your client device and stay connected without having to think about it. Where two or more access points are located to manage a lot of wireless traffic they can look after the traffic loads so the user gets a good solid wireless service throughout the operating area.

Sounds Expensive

Managed Wireless used to be expensive but it’s not now. It does cost more than pull wireless but not much more and is well within credible cost for domestic or small business users. If you need it it’s well worth the modest extra cost.

You will need routers and wireless access points that can all function as part of a Managed Wireless system and you will need 2 x broadband supplies which can be a mixture of ADSL max, ADSL2+, Fibre known as FTTC or some other suitable broadband/Ethernet supply. You can use cable broadband. 2 lines carrying BT like broadband will give you 2 lines of voice as well.

 

Article Source: http://EzineArticles.com/8851919

Photo Source: http://pixabay.com/en/users/stux-12364/

Business Lessons Learned From The Sony Hack Attack
Jan 5th, 2015 by aperio

The hack attack on Sony has been a business disaster for the movie company.

In addition to leaked emails, revelation of salary data, and unfortunate disclosure of various private opinions regarding movie stars and upcoming films, the company’s stock price fell by double digits.

Sony’s business is of course entertainment and the media has had a field day with all the secret details regarding Hollywood celebrities. The nightly newscasts have played out like a soap opera and the company’s attempts to plug the gaps have been futile at best.

It remains to be seen how all this will play out long-term both internally and externally. Certainly relationships have been stressed to the maximum with corporate executives. Movie makers and “A” list actors may be hesitant to do business with the company.

While many cyber experts, including the FBI, have been quoted as saying this attack was planned and executed at a very high level of sophistication, reports indicate the company was not in full lock-down from a potential breach.

In fact its PlayStation network suffered an attack in 2011. Personal information on millions of PlayStation games were stolen. The network was down for weeks. Many question whether these issues were ever fully addressed.

Admittedly Sony is a worldwide organization and high-level cyber attacks are more likely targeted against larger well-known companies. JP Morgan Chase and eBay were both recent targets.

Still most companies of all sizes can take appropriate steps to ensure the highest levels of security protection are in place.

These include…

1. Investing appropriately in cyber security. Many large corporations don’t allocate the resources for high levels of security. They wait until disaster strikes and then make the appropriate investment in firewalls, anti-viral programs etc. The same holds true for smaller organizations. Unfortunately smaller companies may not have the luxury of an easy of a bounce-back as a multi-national giant. Small firms could lose sales, contacts and key data. A small business could be down for days or even weeks. Such a breach for a smaller organization could make the difference between ensuring a year of profitability or falling into the “red”.

2. Preparing for a well-planned response. All businesses should have a back-up system in place. Electronic off site back-up utilizing the cloud, for example, is a solid way to retain all records and data should records be breached, stolen and/or lost. Proper back-up enables a company to maintain business operations with little downtime as possible.

3. Creating a crisis communications plan. Chances are your firm will not be the subject of intense media scrutiny should a breach occur and important, private data made public. Still in this litigious environment it makes sense to have a plan in place should a crisis occur. This should involve a technology component to discover how the breach occurred and to take the proper IT related steps to prevent it from happening in the future. It should also involve a media component to properly address inquiries from print and television reporters. The document should be reviewed and updated periodically. Hopefully this plan will not need to be enacted but is money well spent should disaster occur.

The hack attack on Sony is a good reminder that an attempted breach can occur to almost any company at any time. Executives should not be hesitant to invest in the highest levels of Internet security no matter the size of the business.

 

Article Source: George Rosenthal
Photo Source: Christopher Skorr
SIDEBAR
»
S
I
D
E
B
A
R
«
»  Substance:WordPress   »  Style:Ahren Ahimsa