The Importance of a Good Backup Strategy

One of the lowest rungs in many SMB’s IT budget is a proper and reliable data protection strategy. In a recent poll of small, medium and large business, almost half (49%) of small business reported they do not have a daily backup strategy. This poll was conducted throughout Hong Kong, Singapore and Australia, but here in America the numbers are most certainly the same, if not higher.

This is despite the fact that nearly half of all participants had experienced data loss in their workplace in the past two years, and 36 per cent felt that data loss could have a significant impact on their business.

The excuses as to why a business doesn’t have a back system in place are as numerous as the businesses themselves. “We’ve never had a problem.” “We have a system, but we always forget to change the tapes/discs around.” We can’t afford to put in a system for backing up.” In today’s data driven business climate, it amazes me people fall back on these excuses. Think about every program you use each day. Think about all of the irreplaceable documents, emails, accounting and databases (just to name a few) that you and your staff use. If you don’t have a good backup system in place, a Disaster Recovery Plan, and regular testing of both, all of your data is a risk, and in the event of a catastrophic failure, it is gone forever. Viruses, malware, rogue or uneducated employees and hardware failure are some of the most common causes for valuable data to be unusable or inaccessible. Even completely innocuous things like OS deterioration and program corruption can cause issues with data consistency. Unfortunately, there is often no sign that something is about to go wrong. One minute everything is fine and the next-it’s not. Backup systems don’t have to be expensive. For a few hundred dollars and the cost of a full test every quarter you can feel secure about your ability to recover from catastrophic failures. Your data is one of the most important pieces of your business. Audits, adherance to the laws, record keeping and basic peace of mind are all good reasons to protect your data.

10 essential e-mail security measures

An excellent article on a few “best practice” techniques for email. Of course running an anti-virus and not opening unexpected attachments, no matter who they’re from, are definitely first and foremost in your arsenal of staying safe, but here are a few more tips for you:

#1: Never allow an e-mail client to fully render HTML or XHTML e-mails without careful thought. At the absolute most, if you have a mail client such as Microsoft Outlook or Mozilla Thunderbird that can render HTML e-mails, you should configure it to render only simplified HTML rather than rich HTML – or “Original HTML,” as some clients label the option. Even better is to configure it to render only plain text. When rendering HTML, you run the risk of identifying yourself as a valid recipient of spam or getting successfully phished by some malicious security cracker or identity thief. My personal preference is, in fact, to use a mail user agent that is normally incapable of rendering HTML e-mail at all, showing everything as plain text instead. #2: If the privacy of your data is important to you, use a local POP3 or IMAP client to retrieve e-mail. This means avoiding the use of Web-based e-mail services, such as Gmail, Hotmail, and Yahoo! Mail for e-mail you want to keep private for any reason. Even if your Webmail service provider’s policies seem sufficiently privacy-oriented to you, that doesn’t mean that employees won’t occasionally break the rules. Some providers are accused of selling e-mail addresses to spamming “partners.” Even supposedly security-oriented Webmail services, such as Hushmail, can often be less than diligent in providing security to their users’ e-mail. #3: Ensure that your e-mail authentication process is encrypted, even if the e-mail itself is not. The reason for this is simple: You do not want some malicious security cracker listening in on your authentication session with the mail server. Someone who does this can then send e-mails as you, receive your e-mail, and generally cause all kinds of problems for you (including spammers). Check with your ISP’s policies to determine whether authentication is encrypted and even how it is encrypted (so you might be able to determine how trivial it is to crack the encryption scheme used). #4: Digitally sign your e-mails. As long as you observe good security practices with e-mail in general, it is highly unlikely that anyone else will ever have the opportunity to usurp your identity for purposes of e-mail-but it is still a possibility. But if you use an encryption tool, such as PGP or GnuPG, to digitally sign your e-mails, recipients who have your public key will be able to determine that nobody could have sent the e-mail in question without having access to your private key-and you should definitely have a private key that is well protected. #5: Avoid unsecured networks. If, for some reason, you absolutely positively must access an e-mail account that does not authorize over an encrypted connection, never access that account from a public or otherwise unsecured network. Ever. Under any circumstances. Be aware of both your virtual and physical surroundings when communicating via e-mail. Be careful. Trust no one that you do not absolutely have to trust, and recognize the dangers and potential consequences of that trust. Your e-mail security does not just affect you; it affects others, as well, if your e-mail account is compromised. Even if the e-mail account itself is not compromised, your computer may be if you do not take reasonable care with how you deal with e-mails – and that, in turn, can lead to affecting both you and others adversely as well.

Click HERE to read the rest of the article and 5 more good email security tips.

Thin Clients: A Desktop Alternative

A little background, in case you have no idea what a thin client is. Wikipedia defines a thin client as a computer or client software in client-server architecture networks which depends primarily on the central server for processing activities, and mainly focuses on conveying input and output between the user and the remote server. What?!? In laymen’s terms this translates to a very small, very quiet piece of hardware about the size of a traditional text book that gives you a desktop view of a server sitting locked in a closet far, far away. All main processing takes place on the central server, the thin client simply gives you a view of it. Thin clients or dumb terminals as they have also been known, were more popular in the late 80′s and early 90′s when desktops were not practical. For a while they fell out of favor as PC’s became cheaper; however they are now making a bit of a comeback. Two influencing factors of the resurgence in popularity are reduced upfront purchase costs and reduced on-going maintenance costs. A typical PC appropriate for use in the Domain environment of an office will run about $500. The cost for a thin client in this situation: around $300. If you have several PC’s to replace or purchase this can amount to substantial cost savings. In addition, with the PC you will probably end up replacing a component or two over the life-time due to heat, wear and tear or power surge. This is not at all uncommon, and not only is there the cost to make the repair, but also any potential down-time for employees while they wait for the repair. Thin clients have no (or few) moving parts and extremely low heat output. The result: not only are there few parts that have any chance of failure, but there is less likelihood of failure due to heat issues and power surges. Finally, they are very “green” due to low heat output and the fact they consume 10-15% less power than the traditional PC. Over the life of a PC I estimate the cost savings (including a little extra for the reduced power consumption) to average about $75/per year of ownership with a thin client. Today, securing your company data and protecting your workstations from intentional (and unintentional) rogue software installs is very important. This job can be made more difficult with individual PC’s. Also, custom software, off the shelf software, any software upgrades or replacements can be time consuming with the traditional desktop. Individual PC’s leave some data unprotected not only from possible theft or misuse, but also left out of the nightly backups. In a thin client environment all programs run in the secure and protected environment of the server and all of the data is held there as well. Individual user data is easily made part of your backup scheme and backed up nightly. Software upgrades are simple-run the upgrade on the server and viola’ it is instantly rolled out to all your users at next log on. No more walking from workstation to workstation to install the latest Office upgrade. Want another example? How about that custom interface sitting on top of your Access database-would you like to make a change to it without having to walk up and down all those steps? Make your change, copy it to a folder or your management software and again, like magic, the next time your users log on they get the latest and greatest interface. It is true that thin client computing is not appropriate for every user in every environment, but for some situations it could be an excellent alternative. If you have a server based network, an interest in lower costs (both immediately and on-going), central software and data management, and a “green” alternative to the traditional PC, check into thin client computing.    

Email Scams Abound for Users

I was reading this week about two new exploits that are possibly appearing in an inbox near you. They are both propagating through email, phishing as it is known, and they are both capable of doing some pretty serious damage. In fact, while they are not exactly the same, they do exploit users in similar ways: by duping the user into believing the email has come from a trusted source (on from LinkedIn and one from Microsoft) and executing an attachment included with the email. These tactics are pretty old school; however their effectiveness is clear; users continue to open these attachments and infecting themselves. The payload for both is to open up your computer to attack from the outside and stealing usernames and passwords from your computer. Unfortunately, people rely far too much on their anti-virus, anti-spyware programs to protect them; blindly opening attachments without a thought to the consequence. As I have told clients time and time again: I would not run my computer without these programs but NOTHING is 100% effective and someone always has to be first in a new (or re-worked) exploit. I don’t want it to be you. End users have to be very careful and responsible with any attachment, from any person or entity, at any time, for any reason. You have to examine the email content; you have to think about the likelihood that the promised information makes sense or was even requested. For instance, the exploit “from” LinkedIn contained wording in the email that the contact list “you requested” was attached. Somehow I doubt that everyone infected by this email requested a contact list-this is the first clue-if you did not request it, do not open it. The email “from” Microsoft was supposedly a security fix MS was emailing to you. So this one is two-fold easy to spot: 1) MS NEVER, EVER, emails security patches to you. Never. 2) If this exploit was to be believed, it would mean that Microsoft has the email address of every single Microsoft user everywhere. Now I realize people find Microsoft is far too powerful and all knowing, but this is a stretch. I often hear from people that the reason they opened an attachment is because it came from someone they knew or trusted. Please be aware that this is one of the most common ways to get infected. Someone you know gets some malware and that malware emails itself to everyone in that address book. You always have to be on the lookout-even when it comes from Mom.

Acceptable Use: Securing the Office

Often I am in the position of being the “bad guy” at most of our clients. Case in point, we installed a firewall and web filtering for an office this week. They had been hit pretty hard by some malware a month or so ago due to some improper computer use by one or more employees. Like so many small offices, this one has no Acceptable Use Policy, they go on trust, and (until we took them on) they were not having regular checks and maintenance performed on their machines by a qualified professional. Of course, when I do something like this or advise a business owner what steps they should be taking to protect their office, user’s often get mad at me. It doesn’t really bother me, users don’t send me checks and users are not who I am there to protect-businesses are. Unfortunately, most end-users do not understand the ramifications of what they do, nor do they care. These days the lines between work on the office computer and the home computer-for many user’s-is becoming blurred. Worse yet, the line is being completely ignored by some users. According to some recent data, more than half of users in a business environment have changed settings on their work machines to allow more liberal access to the things they want to access, in particular on the Internet. 35% felt it was not the companies business what they were doing. (see: http://www.darkreading.com/document.asp?doc_id=164974&f_src=drdaily) Unfortunately, it IS the companies business and more over it is the companies responsibility to protect their interests. (read “data” and “confidential information”) I’m pretty sure these same employees would be extremely upset if they found out the company let THEIR personal information out on the Internet. This is what those users are exposing to the Internet-someone else’s confidential information! By failing to take proper precautions in securing office machines and the network, companies everywhere could be at risk for exposing other peoples private information and/or their OWN information to people who can (and will) sell or otherwise use that information for nefarious purposes. Another case in point-I was reading an article the other day where the writer was talking of someone impersonating them on the Internet and leaving inflammatory comments on various web sites. This particular user tracked the rouge person back to their place of work by getting the IP address that was left behind every time this rouge person left a comment somewhere. I hope the rouge users place of work realizes THEY are responsible for everything this user did while using the corporate network. This is just one more glaring example of why companies MUST protect their own interests. Users should not be allowed-to the extent possible-to do any personal email, or web browsing, or downloading or-you get the point. If your users do something illegal or untoward there is not only a possibility, but a strong likelihood that it can (and will) be tracked back to you. Finally, the cost involved in cleaning up from a malware or virus infestation is not cheap. There are cases where the machine simply cannot be wiped out and every effort must be made to restore it to it’s original condition. Had the office we took on the other day installed the firewall and web filtering some time ago, they could have used that $300 to put toward the purchase of the firewall to start with. In the long run, it will always cost more to clean up problems than it would have to just protect against them from the beginning.

« Previous Page — Next Page »