5 key things you should know about computer security

March 6, 2013

Computer security does not come easily.  It requires awareness of the ways in which computers and data are compromised.  To guard against loss, there are 5 key things you should know.

1.   Anti-virus programs are essential, but they’re not enough.

Anti-virus programs will not keep you safe from all attacks.   They are good for blocking older, known viruses, but they’re only as good for that if you keep them up to date.  Since there are always new viruses out there, the time between the virus discovery and an updated version of the virus library is a vulnerable period.

To maximize the effectiveness of your anti-virus program, update it every day.

2.   Vulnerability to malware is PRIMARILY a human-knowledge problem

Many scams are perpetrated by email “phishing” attacks.  These attacks work because the emails look to be legitimate, such as from your bank or a known vendor, complete with logo.

Even worse, it isn’t too hard for attackers to learn about your company by researching public information, and then targeting specific individuals in your company with “spear-phishing” emails.  These emails sound even more convincing because the person’s role is known and maybe even the person’s boss’ name.

There is no substitute for caution: Never click on a link in an email without first examining the detail of where it is going to take you.  You can do this in most browsers by hovering the cursor over the link.  When in doubt, don’t click!

3.   Passwords are often inadequate

When we log in to online services, we depend on passwords to identify and protect ourselves.  But we don’t want to bother with passwords that are long and un-memorable, so our logins are vulnerable to guessing.  In addition, we often use the same password over and over, so once one service is compromised, others can soon follow.

To protect yourself, use a password-generating program to make passwords long and un-guessable.  You can buy a program (such as “1Password”) and use it to keep a secure list of passwords on your computer.  Then you don’t need to remember your passwords and in addition you’ll have a central repository for all of them.  And you won’t use the same one over and over.

4.   Data loss is often caused by human action

There are lots of ways to lose data, and only some of them are caused by hardware failures.  For example, you may mistakenly delete a file, or you may modify data in a file without having a backup.  Also, you may delete your backup files.  Pay attention to what you’re doing when you’re moving or deleting files.  Make extra backups before doing a lot of file operations.

Then of course, you may not have any backups at all, because you haven’t set up an automatic process.  This is unwise.  Always set up an automatic mechanism that will back up your files.

5. Nothing can stop an insider who wants to cause damage

Pay attention to disgruntled employees & visitors.  Be aware of which computers are accessible to anyone who comes to your desk (or other desks).  Set up automatic “log-out” mechanisms, so that if you leave your computer, it will require a password to log back in.  And, of course, know who your visitors are.

Security depends a lot on what you know, what you do, and your willingness to invest the time and money to have the right tools.  Don’t blame insecurity on the malware.  Fix the tools and procedures in your own shop.

 

John will be on a panel Startup Candy: How to Be the Startup Everyone Wants to Work For on March 27 at 6:00 PM in San Francisco.  For a free ticket, visit Founders Space and enter “Levy” as your promotional code.  See you there!

The fastest way to kill your startup is with B players.  How can you attract–and hold onto–hot talent? Get ideas, real-life stories and advice on increasing your odds of funding, innovation, and success when you add smart, creative people to your team.  Our panel will discuss:

  • Why your team matters to investors
  • How to create a killer team
  • How to showcase your team to investors, partners and customers
  • How to identify and reach out to talented individuals
  • How to keep your team engaged
  • How to keep your talent from jumping ship for better opportunities
  • How to position your company as a hot career opportunity

Presenters: Josh Breinlinger of Sigma West Venture Capital; Max Shapiro of PeopleConnect; and John Levy of John Levy Consulting.

Filed Under: Agile Management, Painless IT Tagged With: , , , , , , , , , ,

Avoiding mishaps with Data in the Cloud

November 28, 2012

What might happen to your data while it is in the cloud?  In the last article, we discussed why you might want to have software and data in the cloud.  In this article, I list 9 things you can do to keep your data safe

What can happen to my data when it is in the cloud?

Most of these things can also happen to your data while it is on your desk or in your own data center.  It’s not necessarily the fault of the cloud that mishaps occur.  The focus of the following is choosing the best countermeasures to cloud-based data mishaps.

Here is a list of things that could happen to your data while it is in the cloud:

Mishap #1: My data is temporarily inaccessible

When your data is in the cloud, you may not be able to access it.  This can also happen when your data is in your own data center.  The reasons for inaccessibility can be any of these:

  1. Scheduled maintenance (downtime) — The system is offline for maintenance that was planned & scheduled.
  2. Unscheduled maintenance (outage recovery time) — The system is offline while recovery is performed for an unscheduled outage.
  3. Administrator error (system offline) — The system is offline because an administrator of the system made a mistake.  The specific causes range from configuration errors to improper responses to simple failures that would normally be recovered quickly.
  4. Failure of a storage system (but there is a backup copy) — Your data is temporarily inaccessible while the system switches over to the backup copy.
  5. Loss of internet access — You can’t get to your data because you have no access to the Internet.
  6. Overload on a cloud server.  Causes of this (overload) mishap can be any of the following: (a) Inadequate resource planning at cloud vendor; (b) The storage servers ran out of capacity (for storage or for accesses) due to inadequate planning for growth; (c) Denial of service attack (general) — A malicious person or entity has created excess demand for service from the servers your data is stored on.  The attack is aimed at the service provider or one of the provider’s other customers, without regard for the fact that you and your business are affected; (d) Denial of service attack (specific to me and my data) — A malicious person or entity created excess demand for service from servers your data is stored on, and the purpose is specifically aimed at disabling your business.

Mishap #2: My data is lost forever

  1. There was a failure in a storage system and the data was not backed up.
  2. There were multiple failures, and both the primary copy and the backup copy are gone.  This very unlikely, except when there was an administrator error after a storage system failure.

Mishap #3: Accessed by unauthorized person

  1. Accidental access from within the cloud vendor’s domain. — Someone in the cloud vendor’s data center accessed the data by accident.  Typically, this does not result in any loss, but the event should be reported so that it can be avoided in the future.
  2. Malicious attack — Someone outside of your company and your cloud vendor accessed your data, usually with the intention of misusing it.  This is a serious breach that may have to be reported to state or federal authorities.

Mishap #4: Data was corrupted by storing the wrong information

This can be caused by human error or by software error.  Human error may be as simple as someone entering the wrong data into a form, or by someone misunderstanding the meaning of some data.  It can also be caused by software error, either by some sort of error termination, or by a database transaction that fails to complete and leaves the data in an inconsistent internal state.

Things to do to prevent or minimize losses

Here are 9 things you can do to help your organization keep your data safe.

Understand how data is stored in virtual environments

Be sure your IT people know what sort of storage is provided in the virtual machines and cloud-based storage that your organization is using.

Plan for failures

Follow the rule that everything that can fail will fail.  Use regular disaster drills, including actually taking live data offline to see how the systems and people react.

Know your SLAs

Understand the implications of your service-level agreements in your cloud vendor’s contract.  Make sure that you are not putting critical data in a storage system that has only “normal” uptime commitments, such as you might get with a single disk drive.

And read the fine print of your contract.  Is an “outage” defined as more than 10 minutes of unavailability?  Can your business stand to have multiple outages that are 9 minutes long?

Know where your data is

Be aware of your cloud data storage vendor’s locations, levels of redundancy, and what the backup and recovery procedures are.

Also, since data is often corrupted by human error, it’s not enough simply to have backup copies – they will all be wrong if someone has entered the wrong information.  You also need checkpoints where the whole consistent set of data was backed up and can be retrieved after something has gone wrong.

Data recovery service

Since many cloud and virtual storage vendors don’t include recovery from software or human-caused data corruption, add a data recovery service provider in your contingency plans.

Arrange for education & education

Ask your cloud storage vendor to train or educate your staff on how to recover from a data disaster or handle data recovery in the cloud.

Prepare for vendor switching

Make sure that you have a plan for moving your data from one cloud vendor to another.  This includes knowing what it takes to download your data from the current vendor (or your backups) and then to upload it to a different vendor.  Anything less than this will leave you locked in to the current vendor and vulnerable to their shortcomings.

Implement stringent system access controls

While you want everyone who needs it to have access to data, you should restrict access to the data center systems, software and applications to the few people who need to manage those systems.

Don’t underestimate the cost of cleanup

After you suffer a security breach in your data, you have a lot of things to do to clean up and re-secure your data.  There may also be reporting to be done.  A recent survey found the cost of this kind of cleanup to be over $200 per data record.  Take this into account when you are justifying training and/or other security measures for your data storage.

Don’t let all of these potential disasters keep you from storing data in the cloud.  You can count on cloud vendors to be highly motivated to keep your data safe, and often they will spend much more on security than you would in your own data center.  But arm yourself with information, so you know what could happen and what to do about it when it does.

Filed Under: Painless IT Tagged With: , , , , , , , , ,

Bring your own device (BYOD)

October 23, 2012

The 10 Danger Signs of a Failing IT Project – webinar on Oct. 30

Learn the red flags you should watch for in major IT projects.  I’ll share with you insights about identifying and responding to problems in management of IT projects.

Join me in this free one-hour webinar on October 30 at 10 AM Pacific time.

Register here

 

“Bring your own device” (BYOD) is the latest watchword in corporate IT.  For mid-sized companies and organizations, how should we think about mobile Apps?  Are we ready to embrace them?

Back in the good old days (before the iPhone, for example), companies only worried about laptops and their applications, and about lost BlackBerrys.  Applications did not change more than once every 3 to 6 months at the most frequent, so IT departments could spend a fair amount of time vetting the applications before deploying them for use at the office and away from the office.

Now, everyone has a smartphone and everyone wants to use one for access to the company’s databases.  This opens up a lot of security and usability issues.  Here are some of them:

Security – Can unauthorized people get access to the databases?

Portability – Will access from a smartphone compromise the effectiveness of the data because input is less reliable?

Accessibility – Will access from a smartphone make it difficult for the user to read or use the information?

Now that the Apps are in a small portable device, we have to worry about both old and new threats to security:

Spam – unwanted messages coming into our network

Phishing – malware injected into portable devices and crooks getting access to valuable data or login information

Data leaks – loss of valuable data by accident

Lost devices –  loss of the mobile device itself, together with its data and login information

Should I try to control the Apps?  The answer is yes and no.  Yes, make sure that you thoroughly test Apps that are to be used to access corporate data.   And no, don’t prevent people from downloading what works for them.  If and when you run into problems with a particular App, you can always ban its use.  Of course, this means that you should monitor which Apps are being used.

How can I avoid disaster?  Here are a few general principles:

Develop a list of trusted partners & suppliers for mobile Apps.  Also develop an in-house capability for testing and verification of operation (and problems).

Also develop a program of training for everyone who uses a mobile device for accessing corporate databases.  Make sure they understand the company policies about access and sharing of data.

Perform regular review of security policies and procedures.  The policies don’t have to be extensive, but they should be clear and enforceable.  Don’t try to enforce policies related to activities that you can’t monitor.

When introducing new capabilities, start by rolling out a new App on a small group first.  Monitor the new App more closely than you do for mature Apps, and make quick corrections when there are problems.

We are at the beginning of the mobile device era. PCs will have less and less influence on the future of IT interactions, while mobile devices will have more and more influence.  There is no way to stem this tide, so you may as well embrace the mobile devices and their Apps.

Filed Under: Agile Management, Painless IT Tagged With: , , , , , , , , ,

Software, software everywhere

January 23, 2012

Software is different from other technical stuff.  It’s abstract, invisible, and runs at extremely high speed.  So the people who are good at working with software tend to be different from “ordinary” engineers.  They have to be good at visualizing the abstract processes and the mathematical algorithms that make up the procedures implemented in software.

Software people are different, so their managers need to be able to deal with the difference.  Effective software managers know what’s critical to a well-functioning software team and those managers get good at providing it, even in the face of obstacles.

Obstacles come from upper management that doesn’t understand how software, and software people, is unique.  As a result, they assume that a manager who has skills in Operations can just as well manage software.

I’ve seen IT shops where the best software people left the company quickly after being treated as if they were call-center operators.  For example, the management assumed that the software people could be located anywhere in the building, that they didn’t need any special whiteboards to keep track of their project information.

Why should you care? After all, can’t you just hire the brains you need for software?  Well, not so fast.  You’re competing with every company in the world for the same kind of brains. Unless you’re in an entrepreneurial, fast growing, innovative company, software people will not prefer working for you over going to work in a more exciting environment.

IT is undergoing rapid change, primarily driven by the availability of cloud services.  But the cloud just moves the data centers to somewhere else. If you look closely at internal IT activities, you will realize that IT is itself a software-intensive activity.

This sounds self-evident, but it’s not a joke.  It’s a reality that many financial and operations executives fail to understand.  Everyone, from the business analysts to the website deployment people are not just software users – they have to understand software principles to do their work.

Business competition will come from new players, and from old players who master software tools and the business possibilities opened up by software.

As software becomes an integral part of business, there is a subtle shift in what management has to do and to know.  You now need staff – or consultants – who are knowledgeable about software and its workings.  And from them you need to learn what software means for the future of your business.

Is there something you’ve learned recently about software?  I welcome your comments.

Filed Under: Painless IT Tagged With: , , , , , ,