The internet revolutionized the way we shop for things. Whether it’s researching cars, travel, homes, technology or just our next meal, many of us pull out our smartphone before we pull out the wallet. While this can sometimes lead to superb deals and fantastic discounts for many useful things, it’s also contributing to the “commoditization” of technology goods, which can be a double-edged sword. On the one hand, this trend helps drive down prices on useful and powerful technologies. Remember when you bought that 5GB hard drive for $500? That same amount of money can buy you 3000 times the storage space today. Remember when only certain staff were allowed access to the internet and email? When only Wall Street traders and big time drug dealers had car phones? Today I see grade school children with mobile devices that are orders of magnitude more powerful than the devices we used 10 years ago. On the flip side of this is a more subtle, negative effect, where costs become the primary determining factor in making technology choices, often to our detriment.
Let me ‘splain:
Apple’s iPhone line, from the start, required a proprietary cable to sync and charge itself. As one would expect of Apple products, it was priced accordingly (ie. high), and as one would expect of things that are small, and plugged into awkward corners under desks and behind furniture, frequently replaced. Enter the third party manufacturers who produce replacement chargers and cables at a fraction of the price of Apple’s. “I just bought this $5 charger and cable for my ($800) iPhone. Look! It’s charging just fine!” Maybe it is, and maybe you bought a product from someone who just won a race to the bottom, and it’s a safe bet they didn’t get there by innovating.
There’s nothing wrong with being a smart shopper, nor with saving some money, especially on technology, but make sure you weigh the value the technology delivers for you or your business against your budget requirements. When purchasing computers for your business, do you really want to buy the cheapest available? When considering a monitor, do you value screen size and quality against the fact that you’ll probably be staring at this device for hundreds, if not thousands of hours? When it comes to technology, low cost does not always equate to the best value, and in many cases it may lead to longer term headaches. Remember the low-cost iPhone chargers I mentioned earlier? What if that $5 charger shorted out the battery in your shiny iPhone, something that might end up costing you 20 times the cost of the charger to rectify, not to mention a rather large inconvenience. I’m not saying that great bargains don’t exist in the technology world, but just be prepared to make some lemonade along the way.
Image courtesy of Stuart Miles at FreeDigitalPhotos.net
I get this question frequently: “Is Wi-Fi dangerous to my health? Am I putting my employees/customers/family at risk?” The short answer is “no” but most folks immediately follow up with, “But I heard it’s on the same frequency as microwaves! Aren’t those things shielded so we don’t irradiate ourselves when heating something up?” This fact is true, but Wi-Fi access points and microwave ovens have very little in common past the fact that they both use radio waves that oscillate at 2.4GHz, as do many other things in your house, including cordless phones, baby monitors, remote controlled toys and bluetooth devices. The primary difference between dangerous and harmless is the amount of energy the radio wave is able to transmit from source to target.
Let me ‘splain:
Microwave ovens use high voltages and short distances to transmit a large amount of energy via the 2.4 GHz radio wave. The same radio wave broadcast by a Wi-Fi device is approximately 100,000 times weaker than the microwave oven, primarily because it’s using very low voltages, and it is affected by a physical principle known as the inverse square law, which states that energy rapidly dissipates the further it gets from the source. Even if your Wi-Fi router were to get hit by a freak power surge, the components would burn out long before it could emit anything approaching microwave oven-strength signals.
Numerous (25,000 in the past 30 years) studies on radiation, including waves in the 2.4GHz range, indicate that there is no reason to believe that constant exposure to low-level electromagnetic fields contribute significantly to health issues. You might be surprised to know that even if you were to move somewhere completely free of electronics, you’d still be bathed in a constant 2.4GHz field of cosmic radiation. The only way to completely block this form of electromagnetic energy would be to live in an aluminum foil suit deep underground in a lead-lined cave.
This being said, there is still some grumblings about cellphones and bluetooth headsets, both of which are held close to the head. In the case of your average cell phone, it’s 20X more powerful than a Wi-Fi device. As I linked earlier, there’s still no evidence that the radio waves cellphones emit contribute in any statistically meaningful way to health issues. You are actually more likely to be hurt or killed from using your mobile devices in situations where divided attentions can lead to accidents. In this way, just like commuter dining and drive-time makeup application, Wi-Fi might be dangerous to your health, but not from the electrical fields that it uses to get its job done.
Last word: I am not a doctor, but I’m pretty certain you’ve more to worry about from exploding smartphone batteries and careless drivers than Wi-fi devices. Heck, you are more likely to be killed by a cow than Wi-Fi radiation.
Image courtesy of Stuart Miles at FreeDigitalPhotos.net
Over the past twenty-plus years that I’ve been working in the industry, the “personal computer” has gone from from obscurity to commonplace. Some of you may have been in the workforce long enough to remember when your organization first started using email, desktop publishing, and spreadsheets. At the time, everyone needed training, and often it was requirement before anyone was allowed to use or even requisition a computer. On top of this, they were very expensive, and justifying the ROI often meant they were only used for very specialized parts of the business. Today, having PCs in the workplace is taken for granted. Likewise, I’ve seen an increasing expectation that all employees know how to use a computer, and in some cases, a high level of proficiency is just assumed, regardless of training, background, experience or industry.
While it’s largely true that computers have become much easier to use than in decades previous, they have also become much more complex – both in functionality and in how intertwined they have become with modern life. Remember the “golden days” of automobiles where any red-blooded American could roll up their sleeves and work on their own cars? Nowadays even professional mechanics rely heavily on computers to figure out what’s wrong with your car. Most people were never even presented with the opportunity to “pop the hood” of their computers, and despite the prevalence of modern technology everywhere we look, only a miniscule percentage of us ever go beyond cracking the case of our computer to blow out the dust bunnies with canned air.
Why this is important to business owners and leaders:
Do you remember when being proficient in computers was considered “geeky” or “nerdy”? Now the opposite is true – we joke about folks that struggle with their smartphones and computers. The assumption that “everyone” knows how to use a computer can lead to other more dangerous assumptions about your organization’s security. In today’s technology security environment, humans remain the weakest link, and the bad guys know this.
Do you assume your employees know to not use work email for personal use?
When email was new to the workplace, this rule was strictly enforced, but times and workplace culture has changed. Now that everyone has email, computers and smartphones, enforcing this practice has often been de-emphasized in the pursuit of “work-life balance” or outright dismissed by companies attempting to shed “uptight” business culture roots. Unfortunately, co-mingling personal and business technology can result in significant security risks for both the business and the individual.
Do you assume your employees know what do when they get a virus infection?
Depending on your company’s culture, the employee might be too scared or ashamed to admit they’ve been compromised, even if you have an IT person or department ready and waiting to help them. An unreported security breach can lead to Sony-sized hacks on your organization.
Do you have a technology usage and/or security policy for your company? If yes, do your employees understand and adhere to this policy? How do you know?
The most dangerous assumption here is that making your employees sign an agreement acknowledging this policy equates to enforcement. Proficient technology use requires training, and using this same technology securely requires regular training and checks. Just like technology itself, the practices and office culture surrounding its use are constantly changing, and both the company policy and the employee’s knowledge should be updated regularly.
Image courtesy of pakorn at FreeDigitalPhotos.net
Chinese computer manufacturer Lenovo (IBM’s former hardware division) is making headlines this month, but not the kind that most companies covet. Until as recently as January 2015, Lenovo has shipped a large number of computers with pre-installed software from adware company Superfish. In and of itself, this isn’t an uncommon practice – hardware manufacturers commonly reduce manufacturing costs for their consumer products by striking deals with various companies who pay to have their software installed on brand-new computers. As initially reported by security researcher Marc Rogers, the Superfish partnership was a bad one for Lenovo, not only because the software itself was already notorious for being adware, but also because it compromises the built-in security of your computer’s SSL protocols to do its dirty work. Lenovo initially tried to downplay the problem, but pressure from the security community and the resulting media attention has since caused Lenovo to reverse its position 180 degrees. The CTO apologized in an open letter, and the company has issued a fix that completely removes the vulnerable software.
What this means for you:
Unless you are really into the technical details, the “what” and “how” of the Superfish vulnerability is much less important than the “why” and the “who”. In this case, we know why Lenovo installed Superfish – presumably they benefitted financially in some fashion. The real problem behind this fiasco is that Lenovo (a “trusted” brand – I use a Yoga 3 while I’m out seeing clients) missed the security flaws in this arguably useless piece of software and endangered thousands of its customers for no other reason than to make a buck. Can any hardware manufacturer be trusted to have our security in mind when making and selling their products? If the most recent NSA hard drive firmware scandal is to be believed, I’d say the answer is a resounding “no”. As we’ve seen with numerous other industries, when a company is held more accountable to shareholder profit (or “patriotic” duty?) than to consumer wellbeing, the only person we can trust is ourselves.
Unfortunately, manufacturers like Lenovo, Dell and HP have made a bed that is now very uncomfortable in which to lie. Their practice of installing “bloatware” on their equipment have driven prices down to a level that may be very difficult to maintain if they can’t lean on the dollars gained by these pre-installed software deals. At minimum, they’ll have to be much more discerning on what they pre-install, which, in turn, will drive up costs and narrow their margins even further.
Russian security firm Kaspersky has just released details of an elaborate, multi-year, multi-country heist that netted hundreds of millions for the group orchestrating the crime. Rather than a series of spectacularly violent bank robberies, this campaign played out quietly and slowly on the technology infrastructure of over 100 financial institutions in 30 different countries. Unfortunately for us, Kaspersky and the banking industry are keeping specific names out of the public spotlight, as expected. It can be assumed that the organizations involved don’t want to damage their reputations, and authorities typically refuse to comment on onging investigations. How did the criminals gain such unprecedented access? Simple malware campaigns targeting employees and officials, which eventually led to a fully compromised infrastructure that allowed the criminals to quietly funnel away millions and leave very few traces behind.
What this means for you:
It may sound a bit cliched to trot out the saying, “There are 2 types of companies, ones that have been hacked, and ones that have been hacked and don’t know it,” but in this case, the criminals were able to steal vast amounts of money by staying well under the radar, an approach that is at direct odds with the normally disruptive and in-your-face style of malware and hacking many people have encountered previously. By lurking quietly in the background, the criminals gained complete familiarity with organizational procedures and employee habits, allowing them to digitally impersonate privileged officials and processes to move money around and out of the organization with impunity. Without a smoking gun, shell casings, fingerprints or DNA evidence, the only trail authorities could follow was the money one – a trail that was obfuscated by digital sleight-of-hand and spoofed internet addresses. Even though your organization may not be targeted for this kind of heist, there are many other types of data cybercriminals value, and it’s in their best interest to not get caught. Don’t look for the obvious malware symptoms – those types of attacks are analogous to vandalism and random, impersonal pollution. The real cyberattack you need to worry about is the one you can’t see.
Image courtesy of 1shots at FreeDigitalPhotos.net
If you didn’t hear it on the news, you probably got an email from Anthem letting you know that your personal information has been exposed in a massive data breach that impacts over 80 million people served by the medical insurer. According to Anthem’s own website established to address this breach, no medical records or credit card information was stolen (that they know of) which is a faint blessing in the face of what was stolen: names, addresses, birthdates, social security numbers, phone numbers, email addresses and employment history. In other words, everything a thief needs to steal your identity.
What this means for you:
As before with other large data breaches, there’s not a darn thing you could have done to protect yourself from the attack. If you just happened to not be a current or former Anthem-covered individual, it’s likely your information was stolen previously in any of the numerous other breaches from last year. Anthem will be offering free credit monitoring to all affected individuals, something that is going to sting their deep pockets signicantly, but will do little good in the long term. Why? Well, unlike credit card numbers, addresses or phone numbers, 80 million people aren’t going to change their names, dates of birth or social security numbers. Identity thefts can outwait the one year of monitoring (still unconfirmed, one year is my guess) that Anthem will provide. You can bet a large number of people won’t continue that service on their own dime, but you might want to consider factoring this type of fee permanently into your annual budgets. Or at least until someone can figure out how to secure our identities and credit better.
From a business standpoint, Anthem’s plight illustrates an important lesson. Though current legislation recommends this sort of data be encrypted, it is not a requirement. Shouldn’t Anthem have taken the extra step to protect your data? Does the government need to mandate common sense and best practice? Will Anthem’s current nightmare convince you to enforce more strict security practices in your own work and personal life? I don’t think you need me to tell you that if you want a prosperous and sustainable business protecting your sensitive data is no longer a recommendation, it’s a requirement.
Like the predictable “tick-tock” of a clock, reports are coming in of an infection spreading rapidly through Facebook via a fake Flash Update. The “tick” in this case was the report last week of a zero-day Flash vulnerability, and the subsequent legitimate update of the Adobe Flash plug-in. Not wanting to miss an opportunity, cybercriminals have released the “tock” – a video on Facebook is tricking clickers into installing a set of malware that can take complete control of the victim’s computer. Over 100k have fallen for this scam which is only 2 days old as of this writing.
What this means for you:
If you see a warning pop up on your computer that software on your computer may be out of date, it may be legitimate, and it may not be. With Adobe Flash, it’s very easy to check by going to Adobe’s own Flash website http://helpx.adobe.com/flash-player.html. Also be wary of the source of the update warning, such as that which comes from clicking on a dodgy link on Facebook or in an email. Doublecheck it against a legitimate source. Not sure what that source might be? Your trusted IT professional is only a quick call away. Spending five more minutes to vette that update warning is certainly worth avoiding a malware infection, right?
Microsoft has announced that Windows 10 will be free for users upgrading from Windows 7 and 8. There is an asterisk behind that statement however, and depending on your world-view, it’s a big one. First off, it won’t be free forever – only for a year after its release. It’s not clear what that means if, for example, after upgrading your Windows 7 machine to 10, you need to wipe the hard drive and reinstall. Do you have to reinstall 7 first and then upgrade to 10? Is there a cost if that happens after that initial year has lapsed? Microsoft has also been deliberately vague on what this means for enterprises and organizations with large installations of 7 or 8. Do they get it for free?
What this means for you:
Some experienced industry analysts predict that there will probably be a different “flavor” for the corporate world, especially as Windows 10 will come hard-coded with Microsoft’s new update/upgrade “Windows as a Service” model where improvements and fixes will come at a more rapid pace than most IT organizations have traditionally been willing to follow, and that “versions will no longer matter.” While this might sound like music to the average consumer’s ears, trends like this are rarely viewed favorably in tightly controlled IT environments, especially when it means maintaining compatibility with legacy apps and systems. Microsoft is still fuzzy on when Windows 10 will arrive – “later this year” is the current expectation, but you can bet that most large enterprises and organizations will probably forgo an immediate upgrade, as they have traditionally done for previous iterations of Windows. If you want to see Windows 10 right away there is a preview build which is still in very early development, but unless you are a stalwart early adopter and understand the pitfalls that lie ahead, I’d recommend waiting until it’s officially released. You can also watch Microsoft’s 2+ hour long presentation on the latest build of Windows 10 online.