Tag: iphone

Open Letter to Apple or Darkware , the new frontier…

Open Letter to Apple or Darkware , the new frontier…

channel_3_section_110_panel1_0_fullsize-1349183829

Problem: There needs to be an easy way to sync your existing iPhone and or iPad with a new computer, and here is why?

I met Steve Jobs years ago when I was working at an agency that used Next Step computers.  Steve was an out of the box thinker “creating things in his garage” before the first apple anything ever was created.

Apple enjoys being one of the “big dogs” today not because of the mac, although it didn’t hurt but, the iPhone and of course tablets which they have excelled at.

Recently when the hardware crashed on my PC, even though I had a backup of the data, the iTunes files system to me was lost as it was tied to that computer. The OS with Microsoft dies with the computer so you get to buy everything over again.

images (3)

One of the success stories of Microsoft was and is, to keep their software “intuitive and consistent.”  Apple does this as well, once you know the basics, you can fumble your way through the rest.  When however; you have an issue like this, what are the workarounds?

Error-iTunes-0xE8000065

I need to move my data over to a new computer, migrate my iTunes stuff to the new computer, install the newest version of iTunes and sync the phone, iPad etc. right?

Folks, it should be this easy.  It should not take more than just a couple of steps in keeping with “apple simplicity.” To recover from something like this.

images (4)

I do not want or need a laundry list of things including standing on one foot while reciting the star spangled banner backwards, pressing a combination of half a dozen keys in separate sequences and purchasing some “Darkware” program that has no guarantee of working because, it too was invented in some basement by some pimple faced kid.

darkware

There is in fact no way that I can see to do this without wiping out the phone, iPad (s) and starting from scratch which would not aid me in importing my contacts into Outlook at all! I also have no idea how much data that is on the phone / iPads that I would lose!

Outlook by the way has an equally convoluted way of doing this but, at least they have a way!

1853

Outlook, why don’t you write a program to do this all “programmatically” for your faithful users?

I de-authorized the dead computer but when I tried to authorize the new one, no such luck, still too many computers authorized!  3, three computers authorized and there are still too many!  Out of a possible 5, 3 is too many!  So, I de-authorized everything!  Now what!? Now you have to wait something like 90 days to re-authorize things…..?

year

Doing the normal search thing, reading the blogs, researching all of the work around(s), I became frustrated to the point of thinking, “maybe it is time for a switch!”

Maybe, just maybe I really don’t need a smart phone at all.  How about a flip phone that just makes calls and receives calls!?  Have we come to that?  Have we come full circle?

screenshot-2014-06-17-11-58-00

Not only do I need a device that works as I expect it to but, I need it to play well with other operating systems.   I should not be forced to follow the threads of other frustrated users until I discover some clandestine piece of software that could cause your device to no longer work! I need something that “Apple” has invented, created or has included with iTunes as an easy way for people like me to recover from!

warning-sign11

If I have to search the web and buy some third party software to fix Apple’s short shortsightedness for convoluted way of keeping people from sharing their songs with their teenage girlfriends, we have gone too far!

163

I would much rather find another product that has already done that.  Things break and there needs to be some part of the program that allows for this.

This is Apple’s problem and they need to create a solution.  A solution that does not include forcing people like me to drive to the mall and to wait in line at the Genius bar to find out how much of a genius they are or are not.   Also to find out that I should simply  “google the problem, someone may have written something!”  Really, is that the best you got!?

sesame_street_google_logo

One of the first issues I had with the iPhone is I needed a way to organize my apps with the computer.  Do you think for a minute there is a way to contact Apple to get their attention?  I posted the idea for “free” to them in a public forum and I will be damned in about nine months’ time, it was there.  What would you care to guess that some employee who read my post offered the idea us as his?

87766840

Well Apple, here is another free Idea, just fix the damned thing so I can get on with my life!

Thanks!

-Best to you and those that you care about.

Copyright 2015 All rights reserved

Www.guard-protect.com

Www.timedok.com

Advertisements

Technology, Have we gone too far?

There are days that I long for the twisted pair; you know the POTS line or (plain old telephone service.)  Yes, the one that hooks up to the one phone, on the wall or in the hallway in that special little nook that was designed by the architect for it. I would even go back to the dial phone, as I think that it was not only a simpler time, but probably a more reliable form of communication. OK, maybe not, but since we were not on it all of the time we had no idea when it was not working.  The phone after all was not for kids..

6a0120a85dcdae970b0120a86db463970b-pi

I don’t know how many of my friends had a dial phone but, if you did not, you missed out.  Calling a radio station to be the 25th caller was a real chore back in the day.  If you won and I did once, it was a real conquest!

Speaking for me personally, I have at least 6 email addresses, the cell phone, the business phone, fax lines, house phone and of course SMS text messaging and even IM on FaceBook.  I am also a ham radio operator and have half a dozen radios that can all be going at the same time, but most of the time not.

hamoperator

No, not me, but my station back then looked a lot like this!

It would seem that I should be able to be reached.  Back in the day, I had a pager as well although, that thing was really nothing more than an electronic leash; for whoever had the number.

images

When I was a kid if I wanted to talk with a friend, I would go get on my bike and ride to their respective homes and ask the “parent who answered the door” is “fill in the blank” home and can they come out and play?  Yes, a little like the Cleavers..

Beav20

When I was a little more sophisticated, (8years old,)  I used a Walkie Talkie to talk with my friends that lived within a half mile or so.  That in a large part prompted me to get my ham radio license at a whopping 13 years old.  With that; I have visited with thousands of folks all over the world, but that is another story for another day.

My_First_Walkie_Talkies2

The Smart phone, which is why I am writing today, is a marvel of technology.  It is the Swiss army knife of communication!  With that device I can call anywhere in the world from just about anywhere.  I can send text messages and pictures of whatever interest me.  I can get them as well.  I can send a video to someone or receive the same.  With Facetime or Skype, I can live video chat with people too!  I can watch movies or play games and yes, I can poke someone on facebook from the waiting room at the Dr.s office. The camera quality is such that if I had the mind to I could take a “quality picture of my dinner” and post it on facebook as we all want to see what you ate for dinner, right? Wink wink.  The camera part is really quite true, it is a really decent camera for a phone!

Mobile

There are some issues with this however; of which I wish to expound upon.  First and foremost, SMS text messages (at least with my phone and service) are not guaranteed to make it.  Back when e-mail was new, the common greeting on a phone call was “did you get my e-mail?”  E-mail is not 100%, it never has been, and it never will be.  E-mail is more reliable today as the servers are more persistent and the internet is more robust.  It is still not guaranteed to get there.

internet

Text communication whether SMS or e-mail or chat on some service can be dicey as you don’t get the facial queues that you do; well… in person.  One can discern some queues in tone of voice when on the phone but, without emoticons and “LOL,” we might not know if the person was serious or kidding!  That type if communication leaves lots of room for miss-communication.

?????????????????????????????????????????????????????????

We are in fact a world in transition regarding our communication. I have many “friends” on Facebook but, how many of them know me personally?  How many of them know my favorite colour or type of food, or I theirs for that matter?  So one has to ask, just how good of friends are we?  Would they even want to be my friend in person?

Facebook_Waning

When is the last time that you spoke with your neighbors?  Do you know their names or anything about them?  I have two new neighbors of which I have made a point to introduce myself to, welcome them etc but, I also made a point to know their dogs name, and introduce myself to him as well.  You should have seen the owners face light up when I took the time to get to know his pooch! I am not bragging about myself; or chastising you, I mention this because I realize that most of us pull into the garage, and close the door behind us.  We leave the same way and “in my case” I use a lawn service so I don’t even have the opportunity to meet while I am butchering my grass. “hence the lawn service, I ruined the yard when I cut it the first time.”   It was tiff grass I think, and my mower was not made for it…. I think.  That is my excuse and I am sticking to it!

Don’t depend on text or e-mail as it is not super reliable.  There are times my phone will go off in the middle of the night, with all sorts of text messages, from days ago!  I keep it with me most of the time but I have to admit, it too feels a little bit like a leash at times.

You know the old story about the lost invitation to the party, it may really have gotten misplaced.  If something seems out of character with the person that you know, trust your instinct and call. If the invitation to the party does not arrive, call.  If you were not invited well, re-evaluate that friendship.  If you sent them a text, they may not have responded because they did not get it!

Finally, turn off the computer, phone, and tablet and unless you are watching a movie with the family, turn off the TV too.  Spend time with those that you love, as you never know when or if you might have the opportunity to do it again (if ever.)  Life is too short to have regrets and when I see complete families out at expensive restaurants, all on some phone, or some device well….it makes me a little sad for them.  What memories will the children have?  What about mom and dad when the kids are gone?

To me eating out is an event.  To some, who do it all the time it is simply eating.  I can eat at home but there is the preparation and the cleanup.  If I eat out I am “served!”  There is not preparation and no cleanup and there is also the friendly exchange of conversation not only between whom I am eating with but, I also make a point to learn the servers’ name, and use it.  While they are, “serving me;” I make certain that they know I appreciate them.

dining

Life is about making memories.  Good or bad, life is what it is.  One day, not too many years ago I was taking my daughters friend to a college across town.  After we left her college I picked up a bolt in one of my tires which left me and my daughter stranded on the side of the road in a less than great area of town.  It was summer about 110 degrees on the side of the highway.  It was about 300 after I got the car jacked up and about 500 when I discovered that the oil change service that rotated my tires had not put the tire lock key back in the glove box!  We had no water, and now I was back out in the heat taking the jack back from under the car all the while having her call the auto service. You know *4357… Yeah that one.

After getting back in the car, the auto service had no information on me or the account and would not send a wrecker.  Even after I told them that I would pay the wrecker just please send one! They refused to help because I was not a customer they were not obligated to lift a finger.  The auto service was paid for through the cell phone carrier and it is insurance that you pay for monthly.  We were a customer and the customer service girl just fat fingered it when she looked up the phone number, you know the 10 digit phone number that should have been on the screen in front of her!?

Very long story short, after witnessing drug deals, going through gas to keep the air on and doors locked and wondering if the car would overheat, and having to go to the bathroom, we finally got a wrecker right at 5 in the afternoon, rush hour traffic!  We had been out since 9am without food or water or bathroom, on the side of a busy highway since about 10 am.

Even though that was not a great memory, it is a memory, and I did get to spend the entire day with my daughter with no computer to compete for my time with her.  OF course in retrospect, I don’t think either of us was real great company…

smartphone-manners

Is a poke on Facebook, or a text to someone, more important that being with friends or family in person?  I too am guilty but, I try to be aware of it and resist the temptation.

-Best to you and those that you care about!

Virus for Macs, iPhones and Tablets?

While it is not unheard of, they are rare.  Today we learned that a virus has been unleashed to attack Apple products including Iphones, Ipads and of course anything running the MAC OS.

The Virus effects MAcs and Smartphones and I suspect was written for the Chinese as they have Jailbroken their phones and are downloading apps from other sources besides ITunes.

While one could speculate that such a virus that only affects those devices that are Jailbroken might be written to punish those that do this type of thing; or to discourage those who might want to do this, you would really have to be a conspiracy nut to think this way.

That would be like thinking that most viruses are written by the folks that make the antivirus programs.  Totally nuts…. right…nuts… why would they do that?….Crazy talk….!  Have you purchased antivirus software lately.  $50 and up for one year!  With millions of computers and millions more smartphones and tablets, those that write anti-virus software have a goldmine and a half!

To write viruses one must necessarily have intimate knowledge of the code that makes up the OS.  Likewise, if one wants to foil and antivirus program, one would need intimate knowledge of that code.

While I have no doubt that groups like the Russian Mob who made more money on hacking and getting information from people’s computers then selling drugs might find this work easier, some of these hacks are just crazy.

Who does this kind of thing?

I have Trend Micro for my phone and iPad and I update the OS after a short period of time that the new release has been tested by those a little more eager than I, you can still not be too careful.  While I would like apps on my phone that Apple will not host, I have not even thought about jailbreaking it.

If your secret family recipe for chocolate cake is on your phone, and you want it secure; you might want to look at Trend or some other anti virus software for your MAC products.   It is more than simple recipes however; people store all sorts of information on there including banking, health, credit card info, passwords for your online accounts, text messages, e-mails; all of which is vulnerable.

If you want to talk conspiracy, what if the bad guy wanted to listen in on your conversations; could the microphone be turned on, or worse yet, the camera?

How often do you find your smartphone warm to the touch and the battery almost exhausted and you have done nothing to get it that way?

There was a case not too long ago where some school sent kids home with laptops. Someone was turning on the built in cameras remotely and watching them in their home, bedrooms etc.  This was most probably and immature geek that lived in his mothers basement, or was it.

Folks, smart devices have tons of information including your coordinates down to a few feet!  If Apple does not make this thing where I can pull the battery; I am seriously thinking about going away from Apple to another type of smart phone that will let me A) pull the battery if I want to make certain that the thing is dead and B) change the battery “easily” when it no longer holds a charge!

The same is true of the tablet devices.  These toys are for my amusement, not for some “hacker” or twisted peeping tom to use for their entertainment or source of revenue.

-Best

c All rights reserved 2014

Security

Happy Friday!

Today I want to talk about security.  With the recent events involving our President, along with major companies data base’s of credit card holders being hacked, it seemed timely.

Companies either focus on cyber-security, physical security or both or neither.  I realize that this statement seems ambiguous but, the simple facts are that few companies think about hiring a Security Officer, much less installing the systems to make certain that their physical plant is secure; not to mention their Data infrastructure. A security Officer is well rounded and incorporates all facets of security into their repertoire.

Part of a Disaster Recovery plan is an audit of security measures taken.

Thanks to recent hacks by various outside entities, companies are becoming more in tune with things like passwords that change, that the user sets, as well as administrative passwords that also are forced to change and be “strong in nature.”

Instead of vilifying some of my clients practices which; many would find audacious, some entertaining, and some down right stupid; allow me to pontificate about “security in a nutshell.”

Let’s start with the employee.

All employees (present and future) should have a background check completed.  Are they who they say that they are and do they have any criminal history?  What is their credit score and, can they pass a “drug test” now and at some future date?

What someone writes on their resume is not a legal document therefore; you must necessarily have them fill out an application for employment which “is a legal document.”  You can buy these at Office Depot, so there is really no excuse not to do this.

The resume is an instrument to get a person in the door for an interview, not to hire them by. What one writes on the application are grounds for termination, if fabricated.  I can write that I am King of the Emirates on my CV, if that gets me in the door, so be it.  Once I write that on an application, I have committed fraud..  Some would argue that the CV should me more sacrosanct than it is.  That would be nice but the truth is, that few do.

There is a complete art regarding your CV and making it stand out among others.  Like English 101, it is subjective, research the company to whom you are sending it to.  That is why one must have several different resumes.  I will not belabor that point or this subject here, suffice it so say, if it gets me past the first cut that is all that I care about.   Until you are sitting in front of a person who gets to know you personally and uniquely from the masses, your resume is one of tens of thousands languishing in a sea of anonymity.

Once your HR department is satisfied that this person is a viable candidate for the job at hand; then and only then, should the hiring manager start the interview process.

Q. What difference does it make if the person has a less than stellar history?

A.  If they have a track record for making bad decisions, there is nothing to stop them from doing so again. Once you hire them, they represent you and or your company.

Q.  What difference does it make regarding their credit score?

A.   If they have a lousy credit score that simply means that once again they have a higher probability of making poor decisions and even more germane, might be someone who has character issues.

One company I know of ran reports of how many coffee creamers, sugar and toilette paper their individual branches went through. They tied that data together with the branches that had “shorts.” (Shorts meaning the cash drawer did not balance, was missing money.)  The interesting thing was that the branches that used more supplies, had more shorts thus; the criminal element was behind the counter.

Q. Piss Quiz? What does a little pot, or drinking, have to do with a person being a good and faithful employee?

A. Once again we are looking at character traits. If a person plays loose with the rules, they too will have a proclivity to play loose with your rules. Good behavior should be rewarded. If someone plays by the rules, they should be first up for the job.

Q. What about pre-employment test?

A. Having total empathy for those of us who suffer from test anxiety, I am more interested in a person’s history and track record. The EU is really big on all sorts of pre-employment test to get the “brightest and best” however; as a hiring manager for most of my adult life, I am here to tell you that test are not the end all be all. If HR does their part, I trust that I can weed out the rest.  While a test may give you some idea of a person’s character, remember that if they are nervous or not feeling well that particular day, the results will be skewed. You may in fact be overlooking a diamond.  Get to know the person.

Once a long time ago I interviewed with Microsoft.  As it happened I was suffering from bronchitis, had not slept well but; I would have still gone to work as I could function so why not go on the interview.  There were several parts of the process including test of different parts.  Did I know the materiel?  In truth I was over qualified for the job in so many ways but I thought that working for Microsoft would be a good thing so I went through with the interview.  The last part of the interview some very attractive young lady brought me into an office and ask me “Why was a pothole cover round?”  In the haze of DayQuil and the anxiety of the entire process, the question threw me.  I chucked at her and looked at her like I was waiting for the real question like “what are the different layers of the OSI model and how are they relevant to data communications?”  That question I could have handled and was expecting; not why is a pothole cover round.

After a short period of silence which seemed like an eternity I realized that she was quite serious. “I had never thought about before.” i said, “I suppose that it might have something to do with the fact that if it were any other geometric shape, it could fall in.”

That answer was met with a dis-approving  look, which again threw me; as I could not think of any other reason why.

She then started asking me another question about a farmer, and a boat, and grain, and chickens, and a fox, and a river..

At this point in the process I ended the interview.  I was not feeling well and this to me seemed like games that one might play with someone who had never worked in the industry before; not someone who had the years doing this that I had.

My next job was that of an IT Director (instead of working at Microsoft) , where I would be the one in charge of purchasing tens of thousands of dollars at at time of software from “Microsoft.”   Microsoft has a tendency to hire a lot of young pretty girls to do their bidding, much like the drug industry does to push their pharmaceuticals  to doctors.  It is good to be a customer.

Physical Security

Physical security should be well thought out. I know of some companies that think this is too-expensive or don’t want to invest in this.  They have a key pad entry that they change once a quarter or so, if they think about it.  I have seen others who simply use a lock and key and they don’t even change them out when they have employee turnover.

Q. What should my building security look like?

A. Depending upon your business, let’s take a typical office environment.

The reception area has your normal door locks for after hours as well as video surveillance. Today we have technology that allows surveillance to be somewhat obscure but not so much so that the people who come into the lobby don’t notice it.  Today’s casinos for instance have tons of cameras and you know that if you scratch yourself someone somewhere watched you do it.  My point is that they are barely noticeable.  They are there and you know that they are there but you quickly might forget.  Your lobby should not be intimidating because your customers come through there too however; it should be obvious that you have security.

Each entrance to areas past the reception area should be hard keyed with electronic pass devices that respond to individual key cards.  Piggy backing of employees traversing these doors should be discouraged however; video surveillance of these doors from both the inside and outside will allow you to track employee movement should the need arise.

Electronic time clocks which use RFID or even bio metrics are not only good for payroll but, once again a good way to track employee movement.  Again the clock(s) should have video cameras in them and pointed at them so there is no way someone could be clocking in someone other than themselves.  The more secure the area is, the more visible you should make your security.

Depending upon your organization doors, controlling access to certain areas aka HR, development, data center etc should be keyed to allow only people with a need for entrance to that area.  Again these doors are also under video surveillance from both the inside and outside.

Employee cards should have a picture of the employee on them and should be visible at all times when the employee is on campus.

With unique employee key cards and programmed entrance to the areas that each unique employee will need, the only changes to the system will be when that employee leaves and it only has to change with that one person.

Not only does this give your physical building / plant a security that this day and time calls for but, it allows you to track your employees movements if the need arises.

Q. Why would I need to track an employee?

A. Lets say you have an area of production that is suffering and you don’t know why. What if you pulled a report and found that your manager of that area was spending a lot of time in places other than where he or she should be? This actually happened at one of my clients. They had several thefts one night and found that by tracking the people that came and went and correlating those times with security footage were able to actually see the person perpetrating the crime.   This person spent some time behind bars and the company was quickly able to remove undesirable elements from their work staff.

Q: Is there any other physical security measures that I should look at?

A:  Glass breakage detectors, motion detectors, smoke and gas detectors and I like to add water detection equipment.  The later inclusion would have come in handy a couple of times in my career.  We were in the middle of a remodel and one of the plumbers forgot to solder a fitting.  They turned on the water and it held pressure so they left.  Sometime over the weekend the fitting let loose and the entire building was flooded.  Water detection sensors would have kept the damage to a minimum instead of flooding an entire high rise.  Since most fire suppression system are water, this too would let you know if something failed with that system.

Note: there are several different fire suppression system and water is good for general purpose however; a data center needs a little more thought.

How about your computer systems?  While the above is an abbreviated look at employee and physical security, what about your data?

  • Passwords that change
  • Cable infrastructure
  • Admin passwords that change and are strong
  • Firewalls with the appropriate updates and configurations
  • SNMP manageable devices that are updated and set to user specific user name and passwords
  • Physical cable plant that is locked down to only allow access from expected devices.
  • WiFi that is locked down
  • VLANS segregating departments and traffic
  • Servers with specific access to files and or data needed by departments and or users.
  • S.A.M.  (Software Asset Management) in place and kept up to date
  • VPN encrypted access with security token
  • All outside connections to the network identified and locked down.
  • Roaming profiles up dated and checked for security
  • No remote control software on company computers either remote or host.
  • Admin access to user computer restricted or not at all.
  • Thumb drives and laptops encrypted.

You would be shocked if I told you how many times I find loose if not non-existent password policies.  It is almost as if they are begging for industrial espionage or begging  some disgruntled employee to have their way with them.

Much like having a PC without a locking screensaver is down right idiocy; these folks beg to be burned.

User passwords must change every 90 days at max and should be strong, meaning special characters, numbers and so forth.  One company that I know of keeps a spreadsheet of everyone’s assigned password that never changes. That keeps the sys-admin from re-setting passwords but opens the company up to so many security violations it is unbelievable.  This practice is in direct violation of policies set forth for publicly traded companies, and those that follow ISO standards. 

Admin or super user passwords should also change on no particular date but often, more often than every 90 days but with no predictability.  There might be some inventive programmer who could write an app that would randomly go off and invoke a password change for administrators and not let you continue on until you have done so.

Another ambiguity with our illustrious data folk is a lack of documentation with their data plant.  Why is that important?

In the server room that contains the switches should be a map.  This map should contain a map of each floor and the data drops.  Not only should these drops be labeled as such they should be secured.  How do you secure a data drop and why?

Let’s start with the Why?  If I were a bad guy I might come in disguised as a janitor.   I would have a small laptop and that would have on it some software to sleuth your network with my goal being to get into your servers.  The first thing that I would do is find a data port that had nothing in it and plug right in “assuming that there was no wifi that I could get into.”

Now if you do your cable management correctly, that vacant port that I just plugged into is not hooked up via the patch panel.  That forces me to go unplug a computer or printer and try it there as that is an active device so it is cabled..  In our switch we can have it only talk to the device if it is the MAC address that it is programmed to expect.  The idea is to make it is difficult as possible for the would-be intruder to gain access to your data.

In most shops, we have no idea what drops are live, and where they are or what they are, much less what is plugged into them.

With VLAN’s we offer yet another layer of security in that if this guy plugs into some port that the secretary uses, he will not be able to get access to the engineers VLAN.

Many times I see networks where more ports were needed so a switch was just thrown into the drop, problem solved.  This is poor on many levels.  Anyone with any networking sense knows better but yet I see it every day.  You take a multi-thousand dollar cable plant and install a $30 switch screwing up collision rates, security, traffic throughput and so forth rather than do it right.

Jumping down the list to S.A.M.  While most things on this list are common sense S.A.M. might not be that intuitive.

Q. Why do I need to keep up with what is on each and every computer and how does that relate to security?

A. Really good question. In running an audit of all software on all computers within an organization you will quickly find that your organization has a lot of software that the business owner is responsible for. If some disgruntled employee calls the Business Software Alliance http://www.bsa.org/ and reports that you are using pirated software; it then becomes your responsibility to prove otherwise.

  • Can you show proof of purchase for all software within your organization?
  • Can you show the license keys for that software, if so, prove it to yourself.
  • Do you know what each and every executable is on each and every desktop?
  • Do you have software on computers that is not being used?

The long and the short of this exercise is that I do an inventory of software on PC’s as part of a DR.  While this is a painful exhaustive process, it is important because you have to know what you have, if you want to re-create it in the case of a disaster.

I always find software that the company was unaware of.

I most always find Trojans, viruses, games and more importantly, I find remote control software.

While this is a real good reason why people should not have access to the administrative rights on their computers, it is also a real good reason to do this inventory.

The normal computer user does not need to modify their computer to use word, excel and power point.  IT should be in charge of adding software and then the PC should stay fairly static.

Remote control software is used to either allow a user to take control of their computer from outside the building or control another PC outside the building or inside the building.  Maybe that is perfectly legitimate or very possibly it is not.  That Is why I insist that things like copy inhibit, and auditing, be enabled on the servers. If forensic investigations are needed down the road, we have the tools to do so, we simply must use them.

Industrial espionage is real and the business owner should take it real seriously.  There are “certifications for data security experts” out there.  What I know of this stems from over 30 years of doing this. It actually might be interesting to go through the class and see what I have not thought of.

A word about industrial espionage.

People often wonder if I struggle with paranoia.  I assure you that I am purrrfectly normal, I don’t struggle, I submit to it; everyone has their children followed, and thinks that their cats are spying on them, right?

So I am not a comedian..

The idea that I wanted to mention here is really from WWII.  “Loose lips sink ships.”  The idiom means “beware of unguarded talk.” No, I am not that old but; I am a student of history among other things.  We live in a high-tech world and we live in a social world.  We have several areas of town where there are high tech industries and where employees of those industries gather for lunch, or to have a beer and shoot pool after work.  Too many times I am in ear shot of engineers talking shop, in public.  If you own or manage a company that has “secrets” I would caution your employees about talking shop in public.  There are most likely posters that someone sells that you could hang on the wall as a subtle reminder about this subject.

someone-tweeted

The above picture proves that this concept is not lost on today’s companies.

 

If I worked at company Y who had company X as a competitor, I might very well have someone go down to the area where company X was and scope out restaurants where there were known hangouts for their engineers or technical guys.  I might also; if I were unscrupulous, have someone go stake out the place and make certain that I had them there when their folks had lunch.  In this day and age where there is a complete science behind “blending in,” it would be rather easy to go eaves drop.  In this day of technology, bugging someone would not be out of the realm of possibility.  When fountain pens that are a self-contained Digital Video Camera / Recorder which can record up to an hour per charge are less than $20; you had best beware that your cats may very well be spying on you.  Ok, not your cats, but certainly your employees or strangers.

Thinking back to Mission Impossible, where the tape recorder would start spewing smoke out ten seconds after the message had been listened to, devices are worth mentioning here.

Devices that leave the confines of the building; in this case laptops and thumb drives need to be secure.  Folks it is downright foolish not to have these things encrypted.  We have so many different types of encryption techniques available today.  Encrypting your data should it fall into the wrong hands will still make it useless to those who take it.  Even the smart phone has a failsafe built into it.

Because we store so many things on our Smartphone’s, they are more than just a phone. The courts recently rules that police can no longer take your phone and access it to see what you have been up to as the phone is so much more than a simple phone.  My iPhone for example after X attempts to guess my password will wipe itself.  Can we write such security programs for thumb drives and laptops?  Not a programmer; well since COBOL, but I am guessing that it is do-able.

Is the Cloud safe?

At this point in time, I would say no.  As much as we hear how safe that it is, each and every day we also hear about how it was violated, or how some major organization was hacked.

Back up your data and send a copy to your safe deposit box at the bank.  Make certain that your safe deposit box is a few miles from your office or residence so that if a tornado or other type disaster takes out your business or residence, your data stored in that safe deposit box and is still there.  Utilize a service to take your data off site if you like, or set up your own “cloud” via a secure tunnel over the internet to another location.

Hard drives are cheap and UNIX or Linux is not all that difficult to use to set up an FTP server.  While anything is better than nothing, have a strategy and test it; even if you do use the cloud.

With the White House being violated by a crazy person, the president in an elevator with a known criminal with a gun, not to mention the secret service allowing him to go to Mandela’s Funeral and speak just a few feet away from the translator who was not who he said he was, we must question everything.

The only way to really trust that your data is safe and for that matter your business or residence; is to test your plan once you implement it.  There are people you can hire “good guys” that will test your security from different angles as well as your disaster recovery plan.

The framework above is an excellent starting point. Trust me when I say this, many CEO’s have no idea how vulnerable they are as they trust that their CIO or SysAdmins know this stuff.  Each and every DR that I do, I find that most do not. The more that I dig; the more truculent these folks become and are really happy when I leave.  They don’t want their boss’s to know the truth. While I would happily work with them to fix these things and offer as much, they would rather hide the facts from those that should know their vulnerabilities.

If you are a CIO or head of a company that is interested in this, read my blog “attention CIO CEO ….

-Best to you and those that you care about!

Good Luck Jim

Copyright 2014 All rights reserved

The below is an addendum to this article which really puts things into perspective…

FOR IMMEDIATE RELEASE

Tuesday, September 30, 2014

Four Members of International Computer Hacking Ring Indicted for Stealing Gaming Technology, Apache Helicopter Training Software

Four members of an international computer hacking ring have been charged with breaking into computer networks of prominent technology companies and the U.S. Army and stealing more than $100 million in intellectual property and other proprietary data.  Two of the charged members have already pleaded guilty.  The alleged cyber theft included software and data related to the Xbox One gaming console and Xbox Live online gaming system; popular games such as “Call of Duty: Modern Warfare 3” and “Gears of War 3”;  and proprietary software used to train military helicopter pilots.

Assistant Attorney General Leslie R. Caldwell of the Justice Department’s Criminal Division, U.S. Attorney Charles M. Oberly III of the District of Delaware and Special Agent in Charge Stephen E. Vogt of the FBI’s Baltimore Field Office made the announcement.

“As the indictment charges, the members of this international hacking ring stole trade secret data used in high-tech American products, ranging from software that trains U.S. soldiers to fly Apache helicopters to Xbox games that entertain millions around the world,” said Assistant Attorney General Caldwell.  “The American economy is driven by innovation.  But American innovation is only valuable when it can be protected.  Today’s guilty pleas show that we will protect America’s intellectual property from hackers, whether they hack from here or from abroad.”

“Electronic breaking and entering of computer networks and the digital looting of identities and intellectual property have become much too common,” said U.S. Attorney Oberly.  “These are not harmless crimes, and those who commit them should not believe they are safely beyond our reach.”

Nathan Leroux, 20, of Bowie, Maryland; Sanadodeh Nesheiwat, 28, of Washington, New Jersey; David Pokora, 22, of Mississauga, Ontario, Canada; and Austin Alcala, 18, of McCordsville, Indiana, were charged in an 18-count superseding indictment returned by a federal grand jury in the District of Delaware on April 23, 2014, and unsealed earlier today.  The charges in the indictment include conspiracies to commit computer fraud, copyright infringement, wire fraud, mail fraud, identity theft and theft of trade secrets.  The defendants are also charged with individual counts of aggravated identity theft, unauthorized computer access, copyright infringement and wire fraud.

Today, Pokora and Nesheiwat pleaded guilty to conspiracy to commit computer fraud and copyright infringement and are scheduled for sentencing on Jan. 13, 2015.  Pokora was arrested on March 28, 2014, while attempting to enter the United States at the Lewiston, New York, Port of Entry.  Pokora’s plea is believed to be the first conviction of a foreign-based individual for hacking into U.S. businesses to steal trade secret information.

According to the superseding indictment and other court records, from January 2011 to March 2014, the four men and others located in the United States and abroad allegedly hacked into the computer networks of Microsoft Corporation, Epic Games Inc., Valve Corporation, Zombie Studios and the U.S. Army.  The defendants and others allegedly obtained access to the victims’ computer networks through methods including SQL injection and the use of stolen usernames and passwords of company employees and their software development partners.  Once inside the victims’ computer networks, the conspirators accessed and stole unreleased software, software source code, trade secrets, copyrighted and pre-release works and other confidential and proprietary information.  Members of the conspiracy also allegedly stole financial and other sensitive information relating to the companies – but not their customers – and certain employees of such companies.

Specifically, the data cyber-theft allegedly included source code, technical specifications and related information for Microsoft’s then-unreleased Xbox One gaming console; intellectual property and proprietary data related to Xbox Live, Microsoft’s online multi-player gaming and media-delivery system; Apache helicopter simulator software developed by Zombie Studios for the U.S. Army; a pre-release version of Epic’s video game, “Gears of War 3;” and a pre-release version of Activision’s video game, “Call of Duty: Modern Warfare 3.”  The defendants also allegedly conspired to use, share and sell the stolen information.

The value of the intellectual property and other data that the defendants stole, as well as the costs associated with the victims’ responses to the conduct, is estimated to range between $100 million and $200 million.  To date, the United States has seized over $620,000 in cash and other proceeds related to the charged conduct.

In addition to those charged in the United States, an Australian citizen has been charged under Australian law for his alleged role in the conspiracy.

An indictment is merely an allegation, and the defendants are presumed innocent unless and until proven guilty in a court of law.

This case is being investigated by the FBI, with assistance from the Criminal Division’s Office of International Affairs, the U.S. Department of Homeland Security’s Homeland Security Investigations and Customs and Border Patrol, and the U.S. Postal Inspection Service.  The investigation also has been coordinated with the Western Australia Police and the Peel Regional Police of Ontario, Canada.

The case is being prosecuted by Trial Attorney James Silver of the Criminal Division’s Computer Crime and Intellectual Property Section and Assistant U.S. Attorney Edward J. McAndrew of the District of Delaware.

“Schools are a pipeline to prison.”

 Those words were spoken by our not so illustrious AG, not so long ago.  I don’t know where this man got his degree but, I firmly suspect it came out of a package with a little blue man with a dog by his side as the logo.

 

The problems in our society are not a mystery as to how they happened and the “fix” is really not that esoteric either.  The simple facts are that there is no easy fix.

 

To repair the problem one first has to identify where the problems started and reverse the trend.  Any pilot knows that when you get into trouble or off course or what have you the first thing is not some knee jerk response but, slow small course corrections.  

 

It still boggles my mind that we are where we are at and the AG makes such a lame statement on national TV.  The answer he says is to “give minorities a pass.  Don’t correct them as harshly as you would someone who is not a minority.”

 

There are two basic problems.  The breakdown of the family unit, (no dad around) and the schools have been neutered by those that feel that grading with red pens or reprimanding children or heaven forbid, spanking a child is just simply not done!  You might damage their self esteem!  The parents have gone as crazy by giving into their children’s empty threats of “give me my way or I will hurt myself, I will cut my self and then you will be sorry!”  “Oh ok honey, here is your iPhone back and I have upped your data plan, please don’t hurt yourself.”  Kids have taken “I will hold my breath” one step further to cutting or worse.  If they do this parents, they need more help than you can give them with your parenting skills, seek help!

 

Consistent boundary setting is a lost concept today.  “Explain to the “child” I really wish you wouldn’t do that because there will be consequences to your actions if you do but, that is your decision.  I am keeping the phone for X weeks as I told you, because you did not do what you were supposed to….” 

 

When you set their expectation that “if they do or don’t do” as the case may be the consequence will be X,Y,or Z than you must follow through each and every time.

 

The legal system is real good about setting boundaries for all of us in that if we speed, and get caught, we will get a ticket which cost us money, time and yes it could be embarrassing.

 

When I was in school if we did something that was even slightly egregious, it usually meant a visit to the dean, coach or principal which usually ended up with a few swats and depending upon the offence, may be followed up with after school detention.

 

If you check the charts of people in prison in this country today you will see that there is a direct correlation between that rise in prison population and this drive to neuter the teachers from disciplining your child!  There are 2.2 million people in prison in the US, 75K from non-violent drug offenses.  If you could do the math you would quickly see that we have made an industry out of housing inmates! 

 

Let’s take that one step further, of the people that are currently on the government dole, how many of them could have benefited from a little “course correction” in school?  There is such a thing as character, and I think that between missing dad’s or sperm donors; and the lack of programs for young people and quite frankly the “Stuff” that these teachers are forced to teach, you have the elements for the perfect storm of mediocrity and or “failure as a people.”

 

For instance, if we could re-direct some of that money currently going out to welfare or to house prisoners and put it towards the space program, we no doubt would have people living on MARS by now.  Instead we have to waste our precious resources housing prisoners and paying people not to work. 

 

How about educating those “Americans” that would like to learn, before worrying about educating illegal aliens?  This is not a diatribe against Hispanics or others who come here to have a better life; it is however a statement that those that are here “legally” should have fist shot and not the other way around as we are currently doing in Texas and Mr. Christie is proposing doing!

 

The goal of school is to turn out taxpayers.  School by definition is part of the process and tax payers invest in you, your children and so forth in hopes that you will be a productive citizen. While I doubt few get up in the morning and say, “today I want to be a better criminal,” there are probably some who do, and that is a real loss, not only for them but for all of society.

 

Give the schools the power to discipline all children equally.  That means make the course correction in a way that will get through to that child.  If the consequence is embarrassing and painful enough, the odds of the kid doing something to earn it again are much lower than if you simply throw them onto the street!  You were right about one thing MR AG… We need to show these kids that “we do love them and care for them, and one way you do that is by not sparing the rod!

 

The numbers don’t lie and I am aghast that no one has put it together and done something about it.  So get out those red pens teachers!  Not everyone wins a trophy and some need to see a big red “F” to get their attention.  No child needs to be on the street or swept aside in some “program” that is indeed a pathway to prison.  Make some course corrections before it gets that far.  How about spending some of that money allocated for “prisons” on programs aimed at working with those families with “no dad at home.”

 

It is not rocket science MR Holder but, if we would take some steps now, just maybe we could get to teaching “rocket science” instead of “how to look innocent in a lineup.” What kids see at home today they will no doubt re-peat in their lives thus adding to the already growing prison populations, broken families and homes and “Detroits,” all over America!  Stop the madness!

 

Happy 2014!