Several clients learned some hard lessons this week. First and foremost, no one is immune from malware, no matter how much money and time is invested in security. If you still don’t believe this, you might be surprised to know that the White House was hacked recently. Granted, I made fun of government-run websites and their pitiful security, but one has to imagine that the Secret Service takes POTUS security very seriously, and yet Russian hackers seemed to be able to access sensitive information by fooling someone through a phishing email. Yes, email. That indispensable tool that we can’t live with and can’t live without. While we are frequently the agents of our own demise (surely this email from this overseas lawyer about a long lost inheritance is real this time), we can also be the agents of our own salvation as well.
Let me testify!
Above all, stop opening attachments sent via email, and likewise, look for ways to stop sending attachments via email. There are tons of secure file sharing options out there (keep in mind we don’t consider the free Dropbox among them…yet), but as long as the business world continues to rely on attachments to get things done, cyber criminals will exploit your willingness to open things sent to you via email. Resist the urge to open attachments even if you recognize the sender, and verify via phone if they indeed sent the attachment. Here’s an important clue: financial institutions, law enforcement, government agencies and just about any large consumer-serving company will not send you an attachment in order to get you do something or notify you of important information. FedEx nor UPS do not send you delivery confirmations as attachments. Neither your bank or credit card company will send you an attachment asking you to open them. If you receive what you believe to be a legitimate attachment from a company with which you do business, call them to verify they sent you that file. Ninety-nine times out of one hundred, they did not send that file. I guarantee that you will receive emails that look and read 100% legitimate, but will in fact be clever attempts to trick you into nasty malware infection. Even the best anti-malware software won’t be 100% effective all the time. The criminals who send you attachments anticipate you have some form of protection installed, and their payloads are designed to turn that “foot in the door” into a full-scale home invasion, anti-malware or no.
The best management coaches say to always pair a “stop doing this” with a “start doing this”. Are you backing up your data? If not, you need to start, right now. If you are, have you checked your backups lately? Tried restoring a file? Are your backups stored offsite? One of the clients mentioned above was thoroughly decimated by the infamous cryptolocker malware. Not only did it take out a principle workstation and all data, it also kidnapped their server data and mangled their backups, primarily because they were onsite and not designed to go back more than a week before being overwritten. Cryptolocker is infamous for hiding out for days before making its presence known, precisely to destroy local backups in this fashion. If you are using proper offsite backups, either through rotating media offsite manually or by using a cloud-based platform, this form of infection is annoying but survivable. Do yourself a favor and review your backup strategies immediately!
Image courtesy of Stuart Miles at FreeDigitalPhotos.net
In 1986, Ronald Reagan is quoted as saying, “The nine most terrifying words in the English language are, ‘I’m from the government. I’m here to help you.'” As relevant as that sentiment was in his day, it’s still ringing true, this time with at least three government websites that are doing you no favors in terms of protecting your identity. Krebs on Security has an alarming report of identity theft and fraud via the IRS.gov website wherein he shares the story of a taxpayer who discovers someone has already filed a fake tax return under his name, for the purposes of stealing his tax refund. At fault is a identity authentication standard known as KBA, or “knowledge-based authentication” which is pretty widely used in the credit reporting and finance industries. Basically, you prove you are you by answering questions that supposedly only you would know, including former addresses, loan amounts or payments, and other personal data that is – surprise, surprise – readily found on the internet. By anyone.
What this means for you:
Ironically, people avoid creating accounts on websites because they are afraid of their data being leaked. And now you get to be afraid of NOT creating an account on a website for fear of someone else creating it for you, with the added “bonus” of this fake account further decreasing the probability of you being able to prove you are actually who you say you are. “Invasion of the Body Snatchers” anyone? What makes this situation alternately terrifying and ludicrous is that it’s our own government creating this mess in an effort to provide better reporting, accountability, and accessibility. The other two sites that are also potentially weak to this “account snatching”? How about the Congress-created AnnualCreditReport.com and another federal behemoth: the Social Security Administration website. Brian Krebs’ recommendation is to make sure you get an account established for these three website pronto, if only to prevent someone else from pretending to be you and creating accounts that will be used to commit fraud and money laundering. Unfortunately for most of us, the surge of interest created by this article (and blogs like this one) have essentially paralyzed (are you surprised?) the account creation process of these websites, but keep trying, if only to let them know we actually care about our identities enough to want properly secured government websites.
On April 24, Apple’s latest gadget will be available for sale. Their smartwatch will put the hurt on your wallet to the tune of at least $349, and if you happen to be made of money, you can buy the solid gold version for a cool $10,000. While the Apple faithful have already set aside their regular tithe to their silvery master, many, many more have yet to see a need to invest in this bit of technology. Believe it or not, smartwatches have existed in some form for decades but essentially have languished in relative obscurity until 2013, when most major consumer electronics companies began to openly develop and market wearable technology. Even still, most Americans scorned the earliest progenitors of today’s smartwatch, primarily because of clunky design and poor integration with existing phones. But can Apple turn nerd fashion into the new hotness? If anyone can, Apple can, but they still have some hurdles to clear.
Before you buy one, ask yourself a hard question: Do you need one, or do you want one?
Make no mistake, even the $10k Apple watch is no Rolex. In terms of long-lasting value, it may not even measure up to a more humble Seiko or Timex. Whereas a decent quality “regular ole watch” will continue to function for decades or more, your smartwatch is likely to be much less useful in less than 2-3 years, and might actually be end of life in five, much like today’s smartphones. And let’s “face” it, smartwatches are huge on the average wrist, and if you have delicate bone structure, your wrist is going to look like this millennium’s Flavor Flav. For most folks, this is a fashion don’t, Apple shiny or no.
For reasons why you might “need” a smartwatch, consider how you use your smartphone. For the on the go professional, especially those that keep their smartphone in a bag or deep pocket, being able to see who’s calling or texting without having to dig for your phone could be very useful. For someone like me who frequently has both hands tied up with handfuls of computer guts (figuratively and sometimes literally), being able to quickly glance at my wrist is infinitely more convenient than stopping what I’m doing to fetch my phone. For the physically active among us, Apple’s fitness tracking capabilities have some promise, especially if it means eliminating a less versatile device from our daily carry. To top it off, the promise of Siri literally being your right hand (or left) may be sufficient to cement this deal.
If the promises of this last paragraph overshadow the drawbacks of the preceding one, you may be able to graduate your “want” to “need” with minimal guilt. Don’t kid yourself – you are doubling your technology gadget tax by investing in this latest trend. At best, you may be able to alternate upgrading your smartphone and smartwatch each year, but until they can figure out how to cram everything we’ve come to love about our smartphones into an elegant watch or snazzy (and surreptitious) sunglasses, you’ll need both to take your geek chic to the next level. And here’s the real gotcha of nerd high-fashion: last year’s models are soooo passé.
The internet revolutionized the way we shop for things. Whether it’s researching cars, travel, homes, technology or just our next meal, many of us pull out our smartphone before we pull out the wallet. While this can sometimes lead to superb deals and fantastic discounts for many useful things, it’s also contributing to the “commoditization” of technology goods, which can be a double-edged sword. On the one hand, this trend helps drive down prices on useful and powerful technologies. Remember when you bought that 5GB hard drive for $500? That same amount of money can buy you 3000 times the storage space today. Remember when only certain staff were allowed access to the internet and email? When only Wall Street traders and big time drug dealers had car phones? Today I see grade school children with mobile devices that are orders of magnitude more powerful than the devices we used 10 years ago. On the flip side of this is a more subtle, negative effect, where costs become the primary determining factor in making technology choices, often to our detriment.
Let me ‘splain:
Apple’s iPhone line, from the start, required a proprietary cable to sync and charge itself. As one would expect of Apple products, it was priced accordingly (ie. high), and as one would expect of things that are small, and plugged into awkward corners under desks and behind furniture, frequently replaced. Enter the third party manufacturers who produce replacement chargers and cables at a fraction of the price of Apple’s. “I just bought this $5 charger and cable for my ($800) iPhone. Look! It’s charging just fine!” Maybe it is, and maybe you bought a product from someone who just won a race to the bottom, and it’s a safe bet they didn’t get there by innovating.
There’s nothing wrong with being a smart shopper, nor with saving some money, especially on technology, but make sure you weigh the value the technology delivers for you or your business against your budget requirements. When purchasing computers for your business, do you really want to buy the cheapest available? When considering a monitor, do you value screen size and quality against the fact that you’ll probably be staring at this device for hundreds, if not thousands of hours? When it comes to technology, low cost does not always equate to the best value, and in many cases it may lead to longer term headaches. Remember the low-cost iPhone chargers I mentioned earlier? What if that $5 charger shorted out the battery in your shiny iPhone, something that might end up costing you 20 times the cost of the charger to rectify, not to mention a rather large inconvenience. I’m not saying that great bargains don’t exist in the technology world, but just be prepared to make some lemonade along the way.
Image courtesy of Stuart Miles at FreeDigitalPhotos.net
I get this question frequently: “Is Wi-Fi dangerous to my health? Am I putting my employees/customers/family at risk?” The short answer is “no” but most folks immediately follow up with, “But I heard it’s on the same frequency as microwaves! Aren’t those things shielded so we don’t irradiate ourselves when heating something up?” This fact is true, but Wi-Fi access points and microwave ovens have very little in common past the fact that they both use radio waves that oscillate at 2.4GHz, as do many other things in your house, including cordless phones, baby monitors, remote controlled toys and bluetooth devices. The primary difference between dangerous and harmless is the amount of energy the radio wave is able to transmit from source to target.
Let me ‘splain:
Microwave ovens use high voltages and short distances to transmit a large amount of energy via the 2.4 GHz radio wave. The same radio wave broadcast by a Wi-Fi device is approximately 100,000 times weaker than the microwave oven, primarily because it’s using very low voltages, and it is affected by a physical principle known as the inverse square law, which states that energy rapidly dissipates the further it gets from the source. Even if your Wi-Fi router were to get hit by a freak power surge, the components would burn out long before it could emit anything approaching microwave oven-strength signals.
Numerous (25,000 in the past 30 years) studies on radiation, including waves in the 2.4GHz range, indicate that there is no reason to believe that constant exposure to low-level electromagnetic fields contribute significantly to health issues. You might be surprised to know that even if you were to move somewhere completely free of electronics, you’d still be bathed in a constant 2.4GHz field of cosmic radiation. The only way to completely block this form of electromagnetic energy would be to live in an aluminum foil suit deep underground in a lead-lined cave.
This being said, there is still some grumblings about cellphones and bluetooth headsets, both of which are held close to the head. In the case of your average cell phone, it’s 20X more powerful than a Wi-Fi device. As I linked earlier, there’s still no evidence that the radio waves cellphones emit contribute in any statistically meaningful way to health issues. You are actually more likely to be hurt or killed from using your mobile devices in situations where divided attentions can lead to accidents. In this way, just like commuter dining and drive-time makeup application, Wi-Fi might be dangerous to your health, but not from the electrical fields that it uses to get its job done.
Last word: I am not a doctor, but I’m pretty certain you’ve more to worry about from exploding smartphone batteries and careless drivers than Wi-fi devices. Heck, you are more likely to be killed by a cow than Wi-Fi radiation.
Image courtesy of Stuart Miles at FreeDigitalPhotos.net
Over the past twenty-plus years that I’ve been working in the industry, the “personal computer” has gone from from obscurity to commonplace. Some of you may have been in the workforce long enough to remember when your organization first started using email, desktop publishing, and spreadsheets. At the time, everyone needed training, and often it was requirement before anyone was allowed to use or even requisition a computer. On top of this, they were very expensive, and justifying the ROI often meant they were only used for very specialized parts of the business. Today, having PCs in the workplace is taken for granted. Likewise, I’ve seen an increasing expectation that all employees know how to use a computer, and in some cases, a high level of proficiency is just assumed, regardless of training, background, experience or industry.
While it’s largely true that computers have become much easier to use than in decades previous, they have also become much more complex – both in functionality and in how intertwined they have become with modern life. Remember the “golden days” of automobiles where any red-blooded American could roll up their sleeves and work on their own cars? Nowadays even professional mechanics rely heavily on computers to figure out what’s wrong with your car. Most people were never even presented with the opportunity to “pop the hood” of their computers, and despite the prevalence of modern technology everywhere we look, only a miniscule percentage of us ever go beyond cracking the case of our computer to blow out the dust bunnies with canned air.
Why this is important to business owners and leaders:
Do you remember when being proficient in computers was considered “geeky” or “nerdy”? Now the opposite is true – we joke about folks that struggle with their smartphones and computers. The assumption that “everyone” knows how to use a computer can lead to other more dangerous assumptions about your organization’s security. In today’s technology security environment, humans remain the weakest link, and the bad guys know this.
Do you assume your employees know to not use work email for personal use?
When email was new to the workplace, this rule was strictly enforced, but times and workplace culture has changed. Now that everyone has email, computers and smartphones, enforcing this practice has often been de-emphasized in the pursuit of “work-life balance” or outright dismissed by companies attempting to shed “uptight” business culture roots. Unfortunately, co-mingling personal and business technology can result in significant security risks for both the business and the individual.
Do you assume your employees know what do when they get a virus infection?
Depending on your company’s culture, the employee might be too scared or ashamed to admit they’ve been compromised, even if you have an IT person or department ready and waiting to help them. An unreported security breach can lead to Sony-sized hacks on your organization.
Do you have a technology usage and/or security policy for your company? If yes, do your employees understand and adhere to this policy? How do you know?
The most dangerous assumption here is that making your employees sign an agreement acknowledging this policy equates to enforcement. Proficient technology use requires training, and using this same technology securely requires regular training and checks. Just like technology itself, the practices and office culture surrounding its use are constantly changing, and both the company policy and the employee’s knowledge should be updated regularly.
Image courtesy of pakorn at FreeDigitalPhotos.net
Chinese computer manufacturer Lenovo (IBM’s former hardware division) is making headlines this month, but not the kind that most companies covet. Until as recently as January 2015, Lenovo has shipped a large number of computers with pre-installed software from adware company Superfish. In and of itself, this isn’t an uncommon practice – hardware manufacturers commonly reduce manufacturing costs for their consumer products by striking deals with various companies who pay to have their software installed on brand-new computers. As initially reported by security researcher Marc Rogers, the Superfish partnership was a bad one for Lenovo, not only because the software itself was already notorious for being adware, but also because it compromises the built-in security of your computer’s SSL protocols to do its dirty work. Lenovo initially tried to downplay the problem, but pressure from the security community and the resulting media attention has since caused Lenovo to reverse its position 180 degrees. The CTO apologized in an open letter, and the company has issued a fix that completely removes the vulnerable software.
What this means for you:
Unless you are really into the technical details, the “what” and “how” of the Superfish vulnerability is much less important than the “why” and the “who”. In this case, we know why Lenovo installed Superfish – presumably they benefitted financially in some fashion. The real problem behind this fiasco is that Lenovo (a “trusted” brand – I use a Yoga 3 while I’m out seeing clients) missed the security flaws in this arguably useless piece of software and endangered thousands of its customers for no other reason than to make a buck. Can any hardware manufacturer be trusted to have our security in mind when making and selling their products? If the most recent NSA hard drive firmware scandal is to be believed, I’d say the answer is a resounding “no”. As we’ve seen with numerous other industries, when a company is held more accountable to shareholder profit (or “patriotic” duty?) than to consumer wellbeing, the only person we can trust is ourselves.
Unfortunately, manufacturers like Lenovo, Dell and HP have made a bed that is now very uncomfortable in which to lie. Their practice of installing “bloatware” on their equipment have driven prices down to a level that may be very difficult to maintain if they can’t lean on the dollars gained by these pre-installed software deals. At minimum, they’ll have to be much more discerning on what they pre-install, which, in turn, will drive up costs and narrow their margins even further.
Russian security firm Kaspersky has just released details of an elaborate, multi-year, multi-country heist that netted hundreds of millions for the group orchestrating the crime. Rather than a series of spectacularly violent bank robberies, this campaign played out quietly and slowly on the technology infrastructure of over 100 financial institutions in 30 different countries. Unfortunately for us, Kaspersky and the banking industry are keeping specific names out of the public spotlight, as expected. It can be assumed that the organizations involved don’t want to damage their reputations, and authorities typically refuse to comment on onging investigations. How did the criminals gain such unprecedented access? Simple malware campaigns targeting employees and officials, which eventually led to a fully compromised infrastructure that allowed the criminals to quietly funnel away millions and leave very few traces behind.
What this means for you:
It may sound a bit cliched to trot out the saying, “There are 2 types of companies, ones that have been hacked, and ones that have been hacked and don’t know it,” but in this case, the criminals were able to steal vast amounts of money by staying well under the radar, an approach that is at direct odds with the normally disruptive and in-your-face style of malware and hacking many people have encountered previously. By lurking quietly in the background, the criminals gained complete familiarity with organizational procedures and employee habits, allowing them to digitally impersonate privileged officials and processes to move money around and out of the organization with impunity. Without a smoking gun, shell casings, fingerprints or DNA evidence, the only trail authorities could follow was the money one – a trail that was obfuscated by digital sleight-of-hand and spoofed internet addresses. Even though your organization may not be targeted for this kind of heist, there are many other types of data cybercriminals value, and it’s in their best interest to not get caught. Don’t look for the obvious malware symptoms – those types of attacks are analogous to vandalism and random, impersonal pollution. The real cyberattack you need to worry about is the one you can’t see.
Image courtesy of 1shots at FreeDigitalPhotos.net
If you didn’t hear it on the news, you probably got an email from Anthem letting you know that your personal information has been exposed in a massive data breach that impacts over 80 million people served by the medical insurer. According to Anthem’s own website established to address this breach, no medical records or credit card information was stolen (that they know of) which is a faint blessing in the face of what was stolen: names, addresses, birthdates, social security numbers, phone numbers, email addresses and employment history. In other words, everything a thief needs to steal your identity.
What this means for you:
As before with other large data breaches, there’s not a darn thing you could have done to protect yourself from the attack. If you just happened to not be a current or former Anthem-covered individual, it’s likely your information was stolen previously in any of the numerous other breaches from last year. Anthem will be offering free credit monitoring to all affected individuals, something that is going to sting their deep pockets signicantly, but will do little good in the long term. Why? Well, unlike credit card numbers, addresses or phone numbers, 80 million people aren’t going to change their names, dates of birth or social security numbers. Identity thefts can outwait the one year of monitoring (still unconfirmed, one year is my guess) that Anthem will provide. You can bet a large number of people won’t continue that service on their own dime, but you might want to consider factoring this type of fee permanently into your annual budgets. Or at least until someone can figure out how to secure our identities and credit better.
From a business standpoint, Anthem’s plight illustrates an important lesson. Though current legislation recommends this sort of data be encrypted, it is not a requirement. Shouldn’t Anthem have taken the extra step to protect your data? Does the government need to mandate common sense and best practice? Will Anthem’s current nightmare convince you to enforce more strict security practices in your own work and personal life? I don’t think you need me to tell you that if you want a prosperous and sustainable business protecting your sensitive data is no longer a recommendation, it’s a requirement.