User login
Courtesy navigation
Search
Blog posts in IT security
Can you trust your staff?
May 10, 2012
We all trust our staff 100%, right? We’re not in any way worried that they might run off with our data, or email it to their personal email address the week they leave.
Unfortunately most companies can’t be so trusting. Data theft is a huge concern for many business owners. If someone steals your data and passes it to a competitor then you could be left with a major problem.
How to stop data theft
A few years ago data leakage prevention (DLP) technologies were considered only suitable for larger companies that could afford to spend thousands on sophisticated software and hardware to prevent their data being stolen.
But today things are changing. You may already have data leakage prevention technology at your disposal.
The data leakage risks
There are three key areas where your business is vulnerable:
- Email. Many smaller businesses keep customer data in spreadsheets. Perhaps you just save all invoices to a shared folder somewhere. In that case, it’s the easiest thing in the world for an employee to grab the data, attach it to an email and send it to themselves or someone else.
Really cheeky employees just use their work email address to share sensitive company data with outsiders!
You can stop this by doing two simple things. First of all, you can create rules so that all email sent out of the business to certain addresses needs to be approved by a manager. If someone sends a mail to anything@hotmail.com it can be sent for approval first. Or if someone tries to send an Excel spreadsheet to this type of address, you can send it for approval. There are lots of options here.
- Social media. Twitter and Facebook can be fantastic tools for your business, but they can also be risks. What if someone says the wrong thing, or posts something you’d rather your customers didn’t read? Well, it’s easy enough to prevent access to social media sites for those people that don’t need access to them.
- USB sticks and portable media. You can fit a huge amount of data on to a USB memory stick these days. It’s quite possible for someone to copy all of your company’s key data onto one in minutes. So consider disabling these copying functions altogether.
There are, of course, other data risks in your business. But those are three key areas to start when protecting your business from data loss.
- It’s time to loosen up your business IT
- Five mistakes you may be making with your IT security
- Action list: secure your IT system
Lee Wrall is founder and MD of Everything Tech, an IT support and service provider based in Manchester.
Friday Donut tip: secure remote working
May 04, 2012
Every Friday we bring you a great business IT tip. From nuggets that make repetitive tasks easier to easy ways to banish tech annoyances, we’re here to help.
If there’s something you’d like our help with, send an email to info@itdonut.co.uk or just leave a comment on this post. We’ll try and cover it in a future IT Donut tip.
Safer remote working
As remote working becomes more common, businesses are having to cope with some new security risks. There’s the possibility of laptop theft, of course, and using insecure wireless connections means anyone could be eavesdropping on your data.
And what if your laptop gets rained on, or you leave it in a taxi by accident? You won’t just lose your laptop, but you’ll lose all the data on it too – and that could be a big blow to your business.
To avoid this happening, whenever possible, don’t save important documents and data to your laptop. If your business has a network server, you should have space on there to save everything. If you don’t have a network drive available on your computer, ask your IT supplier to set one up and put a shortcut on your desktop so you can find it easily.
Of course, it’s not always possible to save to a network server. If you’re not in the office, you need to be connected remotely to your company network so you can access your resources. If you’re working without a connection, save files to your laptop and make sure you copy them to the server once you’re back online.
Use the power of the cloud
If your company doesn’t have its own network server, you can achieve a similar effect using cloud storage. Services like Dropbox and Box let you create a special folder on your computer. Anything you save in there automatically gets copied to a server on the internet too. So if you lose your laptop, you don’t lose your data.
Finally, here’s one last tip for laptop workers: if you’re stepping away from your computer, make sure you lock it. In Microsoft Windows, just hold the Windows key and tap L. That’ll make sure nobody can meddle with it while you’re not there.
Shopping list: what you need to back up your data
April 23, 2012
Backing up your data doesn’t have to be that difficult. It doesn’t even have to involve expensive-sounding ‘backup solutions’ or wrestling with 300 individual CDs, each of which contains a small but crucial portion of your company’s data.
Here are some straightforward ways to get started. Obviously, they’re not your only options – so it’s a good idea to chat to your IT supplier to make sure you’re backing up everything you need to.
After all, there’s nothing worse than smugly telling everyone you’re all backed up, then realising you’ve lost your ground-breaking 400-slide PowerPoint presentation.
The cheap and cheerful option for home-based businesses
Sure, it might be cheap and cheerful, but this approach will get the job done for you.
Buy yourself two external hard drives. These can be attached to your PC, allowing you to copy data to and from them. Do this regularly. Daily if you can.
Copy all your important data, including accounting data, word processing and spreadsheet files, plus your email, calendar and contacts.
Some hard drives come with software to make this a bit easier for you. If you use Windows, you can get Microsoft’s free SyncToy software to automatically copy selected folders across to a second hard drive.
Why two hard drives? It covers you against the risk of fire, theft and other physical damage (like dinosaurs attacking your house). Keep one drive on the premises and keep the other one somewhere else – like with a friend or family member you trust. You’ll probably need to back up to that drive less regularly, but doing so weekly will ensure you can get most of your data back.
The other good option is some sort of online backup service. Over time these services usually work out more expensive than buying a couple of hard drives, but they are convenient. Try Dropbox, Mozy or Carbonite.
Something suitable for office-based companies
Ok, so you’re a business with its own premises and maybe a few employees. You’re right to think that you need something a little more advanced. But don’t worry – you still have a number of choices.
Again, online backup can be a really good place to start. But you have to be careful. You want a company you can rely on (because backups are the things you turn to as a last resort). And check the costs carefully. Many online backup services copy non-essential files, pushing up your monthly bill.
The main in-house option is – again – hard drives or tape drives. Tape drives have traditionally been used by companies to back up large amounts of data, but we tend not to recommend them so much these days because hard drives are so cheap.
A good set up is to have seven hard drives. Five of them do your daily backups during the week (Monday – Friday). Use the other two to take regular archives, but make sure at least one is off the premises all the time. Keeping it at your home is the obvious thing to do.
Again, software is available to make this process more straightforward. I usually recommend BackupAssist, because it can back up all your email, calendar and contact folders, and it’s reliable. Which, let’s face it, important
Here’s the most important thing…
From unlikely dinosaur attacks to the more plausible floods, fires, virus attack, hackers, computer crashes and accidental deletion, there are plenty of threats to your company data.
So the most important thing to do after reading this article is to act on it. Otherwise, by the time you realise you really need a backup system, it’ll be too late to do anything about it.
Craig Sharp is managing director of Abussi, an IT company based in Birmingham.
Data loss kills businesses
March 08, 2012
Your data and IT infrastructure play a key role in the continued success of your business, regardless of the size of your company.
That’s underlined by a statistic I came across recently from the Department of Trade and Industry revealing that 70% of UK businesses that suffered a catastrophic data loss were closed within 18 months.
Bad IT is disrupting business
At Dell, we’ve just published a report in conjunction with Intel which looks at the server and storage needs of small businesses in Europe. We commissioned the research because we wanted to learn more about the attitudes of smaller companies towards servers and storage.
The report reveals that two-thirds (66%) of European small businesses are heavily dependent on their IT and almost a third (32%) of these say it is critical to their business. And most businesses are miles off achieving a failure-free IT system with 93% of respondents indicating that they have experienced IT problems which inhibited their ability to continue doing business.
We asked about how often disruption occurs, too: 17% claim it happens at least once a week (that must cause some serious problems), but the better news is that 40% say it only happens rarely.
Can new tech improve things?
We also looked at small business’ attitudes towards new technologies such as cloud computing. Our findings suggest adoption rates are low, but it would be interesting to investigate how many companies use cloud services without even realising it.
According to our research, only 17% of small businesses said they had started using cloud computing and 28% said they had no intention of moving their infrastructure to the cloud. Security and privacy were the most commonly cited concerns, although performance and availability were also significant.
You can read the full report, Manage Your Changing IT Needs, at Dell’s new online portal for European small businesses, Dell’s Small Business Centre.
How hackers target your passwords
February 08, 2012
When you enter a gym’s locker room, there are hundreds of lockers. Each has its own combination lock. Without giving it too much thought, you open your locker using the combination only you know, which is the same combination you provided when you signed up at the gym.
Similarly, a password is a shared secret between a user and a service. When the user wants to connect to the service, they identify themselves with their username and prove that identity with the password.
The service checks the password. If it matches, the user is allowed to access the service.
We can think of the service as the locker, the username as the locker’s number and the password as the lock’s combination.
Problems occur, of course, if someone else has your combination. It could be that you use a very popular combination, or someone saw you using the same combination on your bag.
Alternatively, it could be that someone broke into the gym and saw the list of locks and combinations. Let’s take a look at these aspects in the virtual world.
How hackers break your passwords
On the internet, some passwords are more common than others. Hackers use lists of the most common passwords to increase their chance of guessing a user’s password quickly. The hacker tools used to guess these passwords are called crackers. Two types of crackers exist - online and offline:
- Online crackers use trial and error to break into a service, testing different passwords until the right one is found. The speed at which they can test passwords is limited by the speed at which the service accepts and handles requests. In many cases, online crackers can only try a few passwords because most services lock accounts after a certain number of incorrect passwords have been entered.
- Offline crackers are used when passwords are stolen from an online service, but are stored in a digested format. This means the service stores a mathematical transformation of the password rather than the password itself – it’s an extra security precaution. An offline cracker repeatedly chooses different passwords, transforms them to their digested format and compares them to the list. Offline crackers can run incredibly fast, depending on the power of the computer running the cracker.
To reduce the effectiveness of offline crackers, many services add a step to the process called salting. Using a salt, a different digest is created each time, even if the password is the same. So although salted passwords are not completely hack-proof, they’re much harder to guess.
How to secure passwords in your business
So, that’s how passwords get cracked. Now, how do you stop that happening to your business?
On an individual level, always use strong passwords – and don’t use the same password on different websites. Think about what information the password is protecting. You want a really strong one for your online banking, PayPal and other online services you consider sensitive.
Use a really strong password for your email too, as getting access here can allow a hacker to wreak havoc by resetting your passwords on lots of other sites.
In your business, it’s important to realise that you can’t trust your users to choose strong passwords themselves. If you give them the choice, they’ll simply choose weak passwords. In fact, two years ago a database containing 32 million passwords was leaked to the web. Analysis of these passwords showed that 20% of users chose the same passwords from a pool of 5,000 words.
It’s up to you – or your IT administrator - to keep the passwords secure. Here’s how
- Enforce strong password policies. Force passwords to have a minimum length, ban common passwords and require a mix of characters (digits, letters, uppercase, lowercase, etc).
- Make sure passwords are not transmitted in the clear. Passwords are vulnerable to interception if they’re transmitted across networks or the internet. Always use encryption, or use a technique that ensures the password itself never travels through the network.
- Don’t store passwords in plain text. Doing so means that if a hacker breaks into your systems, they can just grab and make off with your passwords. Salt and digest a password before storing to the database.
- Detect and block brute force attacks. Put obstacles in the way to stop online crackers trying lots of different passwords for user accounts. Use CAPTCHAs and restrict the number of times people can retry their passwords.
- Force people to change passwords regularly. Many businesses require users to change passwords every couple of months, or when they suspect an account has been compromised.
- Allow and encourage passphrases instead of passwords. That means using sentences instead of passwords. Although that may be longer, they’re easier to remember. And because they’re longer, they’re more difficult to break.
Implementing many of these precautions will require help from your IT staff or IT supplier. But if you’re going to maintain the security of your systems and website, it’s vital you think carefully about enforcing a strong password policy.
Noa Bar-Yosef is Senior Security Strategist at Imperva.
Information is the lifeblood of business, so why don't small companies protect it?
February 02, 2012
Information is the lifeblood of a business. Without it, everything else you need to make a business tick - like sales, customers or profit – stalls permanently. So making that information easily accessible is vital.
As it’s so important, you’d expect the information to be easily available to the people who need it, and protected from those who don’t. However, the reality is different: at last year’s IP Expo, 60% of people surveyed by my company City Lifeline said they had lost access to their company’s IT system following an unexpected incident. Oops.
In 40% of these cases systems were down for six hours or more, bringing the business to a halt for an entire working day. Just think of all the things your business uses IT for in just one day. Imagine not being able to access your email, check customer documents or view essential data.
Losing access to your data hurts your pocket too. Symantec’s 2011 SMB Disaster Preparedness Survey found that losing access to data and electronic communication systems costs small companies an average of £7,500 a day in lost business and productivity.
Prepare for the very worst
Unplanned downtime can stem from something as innocent as a workman cutting through a power cable or as sinister as a malicious cyber attack. Whatever the cause, they all have one thing in common: the element of surprise.
The best business owners not only prepare for the things that are going to happen, but also for things that could happen. “I didn’t know it was going to happen,” is not much of an excuse when faced with an angry customer or an office full of staff who can’t get their work done.
If your business’s information is adequately backed-up, the chances are good that your IT systems will be working by the end of the day. But if not, the consequences can be disastrous. In a worst case scenario the lost data can never be recovered, and neither can the business.
Some research suggests up to 70% of small businesses that lose data in a major incident are forced to shut within a year. Yet the Symantec report mentioned above also shows that less than half of smaller businesses bother to back up data every week. A mere 23% take daily backups.
Risks are part of business, but...
Taking the odd risk is part and parcel of being in business, but risking the safety of your information is equivalent to cutting off your oxygen supply. Huge corporations often have the money, expertise and resources to escape from a tricky IT gaffe. Quite often, smaller businesses do not.
This vulnerability makes investing in off-site data backup vital. It only takes a one-off incident to disable access to your IT systems. And it only takes one major incident to cripple your business forever.
If you lack the time and resources to create a backup strategy from scratch, it may be worth working with an IT supplier which can store your data securely in a different location. Some suppliers operate or have space in colocation data centres, highly secure buildings specifically designed to keep your information safe. (The company I work for, City Lifeline, offers colocation services.)
Do your business justice by investing in your information in the same way you would invest in a new computer or member of staff. Your information is key to your company’s viability, so return the favour and look after it just as well.
- Continuity planning and backup options
- Find the right backup methods
- Five mistakes you may be making with your IT security
Roger Keenan is MD of City Lifeline.
Can you prove who you are?
January 30, 2012
Despite all the exciting online companies out there, we’ve got a problem with online business: currently, it’s hard for companies to be confident they know who their online customers are.
When you sign up for a credit agreement in a shop, you can show a proof of identity like your passport. This is called the primary identity check. But online, that’s impossible. The best most online businesses can do is to consult another database, like the electoral roll or a credit reference agency.
Although great for validating information about you, these do not prove you are who you say you are in the same way that photo ID does.
Primary identity checks and your business
For online businesses to perform to their full potential, we need better primary identity checks online. My company, miiCard, is finding ways to do this. And I believe better ID checks can benefit smaller online businesses in several ways:
- Fairer competition with big companies. Smaller businesses often don’t have the real-world premises or workforce to process paper documents. Just look at signing a contract or agreement: enabling true digital signatures gives you an identity you can prove, all without having to handle any paper or meet in person. It opens up all sorts of possibilities in areas like employment contracts, real estate, legal and financial services.
- It’s easier to build real trust. Trust is a two-way street, but it starts with the business, not the individual customer. It’s easier for larger businesses with well-known names to establish trust online. If you don’t have a recognised brand or big budget to invest in marketing, it is hard to provide the trust people look for when shopping online. Having a credit card logo on your site isn’t enough. Fraudsters are sophisticated and so small businesses need to do more to give customers confidence.
- Better risk management. Again, with higher value, riskier or regulated services you need to know who you are selling to. Credit card fraud and other scams can cost your business. Getting assurance up front that you are selling to a specific person can easily prevent these and have a real impact on your bottom line. Just think what a difference it would make if you could meet every customer personally and shake them by the hand. Better identity checks can create the same sort of confidence.
- Going international is less intimidating. The internet is a global marketplace which can open new avenues for small businesses. A global identity service lets you do more in countries where you don’t have a physical presence. It’s not just about selling - it can be about outsourcing too.
By building trust through better online identity management, businesses can benefit from increased conversion rates, reduced costs, higher-value sales, and additional fraud protection. Only then will the full potential and convenience of online trade be fully realised.
- Convert reluctant customers online
- Secure your online shop
- Where to start when you protect your business
James Varga is CEO of miiCard.
It's time to loosen up your business IT
November 11, 2011
Put your feet up and relax about your business IT (Image: Cristian Borquez on Flickr)
There's nothing wrong with being risk averse, and there's nothing wrong with not wanting your staff to do silly things or waste time with their company computers.
Those are the - perfectly logical reasons - why many businesses lock down their systems tightly. They want to stop employees opening the wrong kinds of files, installing dodgy software or accessing social networks.
Fine. But as someone who's fairly IT literate, I've always found locked-down PCs highly offputting. By and large, I know what I'm doing and I know what I need to do my job. I just want the IT department to let me get on with it.
Young workers want more flexibility
A recent piece of research has got me wondering whether this might be a growing sentiment. The 2011 Cisco Connected World Technology Report suggests that young workers (by which it means students and professionals under 30) take many factors into account when deciding where they want to work.
It's not all about the salary - the internet, flexibility and social networks can all make a difference. For instance:
- More than half of students either wouldn't accept a job offer from a company that banned access to social media, or would find a way to circumvent the ban.
- One in four employees say that not being able to work remotely and flexibly would influence their job decisions - they might leave a job sooner, for instance.
- Two out of five people would opt for a lower paying job over a higher paying one, if it offered more flexibility over use of IT and social media, and more mobility.
The overall impression is that younger workers want more choice over what IT they use and how they use it at work.
They want more flexibility in where and when they work. And they want to be allowed to use social networks because they believe services like Facebook and Twitter are key communication tools.
Is it time to loosen up your IT?
I can almost hear the tuts from IT managers at the idea of loosening restrictions, allowing people to use their own devices and turning off web blocking software.
But here's the thing: it's happening already, whether you like it or not. If you've blocked Facebook on your work computers, your employees will just be accessing it on their phones.
Then you've got mobile devices. You might think you've banned staff using their own mobile gadgets for work. But what's to stop them loading documents onto their iPad to review on the train, or connecting a smart phone to the company Wi-Fi?
Times are changing for office IT
Times are changing. The so-called 'millennials' - the next generation of workers - have grown up using IT and computers their entire lives. We don't need to teach them how to use it at work, because they already know.
Maybe, just maybe, if we open systems up and give people more freedom to use the tools and devices they want, they'll be able to do better work.
Keeping your PCs shut to online criminals
October 13, 2011
With the number and complexity of cyber threats steadily rising, particularly with the growth in mobile devices, it’s becoming increasingly difficult for SMBs to find the right in-house resources to protect themselves. For a medium-sized business a single financial attack could irrevocably cut into annual profits but it could be make or break for a smaller business.
Businesses need to have the right network security solutions in place but also comprehensive endpoint security to defend against new and existing cyber threats. This is especially important given that we’ve seen hackers move from attacking networks to attacking the PC itself.
Every organisation should be re-evaluating its current security precautions on a regular basis and making sure these measures are communicated company-wide.
Here are some simple precautions to kickstart your security strategy:
- Use a dedicated computer for financial matters such as online banking and bill pay that you don’t use for activities such as sending and receiving emails or browsing. Web exploits and malicious email are two key infection vectors for malware
- Avoid clicking on links or attachments within emails from unknown sources. Even if you recognise the sender, confirm they’ve sent the specific email before clicking if an attachment is unexpected or looks suspicious
- Reconcile your banking statements on a regular basis with online banking and/or credit card activity to immediately identify abnormal transactions that may indicate account takeover
- Browse with care. Be wary of sites that have a disclaimer warning that you browse at your own risk and that authors are not liable for any information you might see on the site
- Protect your browser. As the primary interface between a user’s computer and the Internet, browsers have become a key target for security threats. Tools such as Dell’s free-to-download Secure Browser protect your browser through virtualisation
- Install regular allocation and operating system updates and ensure you have your security protections in place throughout the organisation
- Do your homework before selecting an anti-virus vendor. Invest in an anti-virus product instead of using trial versions which are good for testing products but don’t receive updates, leaving you vulnerable to new viruses or new versions of viruses.
Earlier this year the BBC reported on the fourth and ‘almost indestructible’ iteration of the TDL virus which reached 4.5 million PCs within the space of three months alone. Targetting Windows PCs with code that ‘hides’ in places rarely examined by security software, the changes introduced in TDL-4 made it arguably the ‘most sophisticated threat today.’ Examples like these highlight the importance of ensuring you select an anti-virus vendor that responds quickly with protections when new threats are introduced.
Security has proved to be one of the number one pain points for SMBs but the bottom line is: don’t wait until the late minute to find out how essential security precautions are. After all, it’s much more expensive to deal with the consequences of a financial breach than it is to prevent one.
20 inspiring and insightful Steve Jobs quotes
October 07, 2011
1 “What made the Macintosh great was that the people working on it were musicians and poets and artists and zoologists and historians who also happened to be the best computer scientists in the world”
2 “Be a yardstick of quality. Some people aren't used to an environment where excellence is expected.”
3 It’s not the consumers’ job to know what they want.”
4 “Your time is limited, so don't waste it living someone else's life. Don't be trapped by dogma – which is living with the results of other people's thinking. Don't let the noise of other's opinions drown out your own inner voice. And most importantly, have the courage to follow your heart and intuition. They somehow already know what you truly want to become. Everything else is secondary.”
5 “Things don’t have to change the world to be important.”
6 “Being the richest man in the cemetery doesn't matter to me. Going to bed at night saying ‘we've done something wonderful’, that's what matters to me.”
7 “We don’t do market research. We don’t hire consultants. We just want to make great products.”
8 “The most compelling reason for most people to buy a computer for the home will be to link it into a nationwide communications network. We're just in the beginning stages of what will be a truly remarkable breakthrough for most people – as remarkable as the telephone.” (speaking in 1985)
9 “Simple can be harder than complex. You have to work hard to get your thinking clean to make it simple, but it’s worth it in the end because once you get there, you can move mountains.”
10 “My model for business is The Beatles: They were four guys that kept each other's negative tendencies in check; they balanced each other. And the total was greater than the sum of the parts. Great things in business are not done by one person, they are done by a team of people.”
11 “What a computer is to me is the most remarkable tool that we have ever come up with. It's the equivalent of a bicycle for our minds.”
12 “I'm the only person I know that's lost a quarter of a billion dollars in one year. It's very character-building.”
13 “You can’t just ask the customers what they want and then try to give that to them. By the time you get it built, they’ll want something new.”
14 “Your work is going to fill a large part of your life, and the only way to be truly satisfied is to do what you believe is great work. And the only way to do great work is to love what you do. If you haven't found it yet, keep looking. Don't settle. As with all matters of the heart, you'll know when you find it.”
15 “You have to trust in something — your gut, destiny, life, karma, whatever. This approach has never let me down, and it has made all the difference in my life.”
16 “When you're a carpenter making a beautiful chest of drawers, you're not going to use a piece of plywood on the back, even though it faces the wall and nobody will ever see it. You'll know it's there, so you're going to use a beautiful piece of wood on the back. For you to sleep well at night, the aesthetic, the quality, has to be carried all the way through.”
17 “It’s really hard to design products by focus groups. A lot of times, people don't know what they want until you show it to them.”
18 “Innovation comes from people meeting up in the hallways or calling each other at 10:30 at night with a new idea, or because they realized something that shoots holes in how we've been thinking about a problem. It's ad hoc meetings of six people called by someone who thinks he has figured out the coolest new thing ever and who wants to know what other people think of his idea.”
19 "I don't think I've ever worked so hard on something, but working on Macintosh was the neatest experience of my life. Almost everyone who worked on it will say that. None of us wanted to release it at the end. It was as though we knew that once it was out of our hands, it wouldn't be ours anymore. When we finally presented it at the shareholders' meeting, everyone in the auditorium stood up and gave it a five-minute ovation. What was incredible to me was that I could see the Mac team in the first few rows. It was as though none of us could believe that we'd actually finished it. Everyone started crying.''
20 “Stay hungry, stay foolish.”
Would you lay out the welcome mat for hackers?
September 19, 2011
Would you be happy setting a hacker loose? (Image: John.E.Robertson on Flickr.)
The idea of willingly inviting hackers to break into your company website or server may seem odd. However, if the intentions of the hacker are good and they don’t intend to use what they find to exploit your business, it can be an effective way to identify and seal up weaknesses in your IT security.
White-hat hacking hits the news
The practice of ‘white-hat hacking’ hit the news recently with the launch of Facebook’s Bug Bounty programme. This offers rewards to people who find and report holes in Facebook’s security.
In the first three weeks of the project, Facebook paid out over £24,000. They obviously reckon the cost of the programme is significantly less than the potential loss they could suffer if sensitive data were to fall into the wrong hands.
Inviting hackers to your business
If you’re not a company with the size and status of Facebook, it’s probably not a good idea simply to announce in public that you’d like people to try to break into your site. That could invite all kinds of problems.
However, you can enlist the help of a professional ‘ethical hacker’ to help test your security.
The best of these will hold Ethical Hacker Certification from the International Council of Electronic Commerce Consultants. This ensures your chosen hacker is a skilled professional, who uses the same knowledge, techniques and tools as a malicious hacker.
They will know how to probe for weaknesses and vulnerabilities in your systems. And you’ll know that they have signed up to an ethical code that means they can be trusted with your data.
Would you be willing to put your website to that sort of test?
- Five key website security checks
- How to perform an IT security risk assessment
- Action list: secure your IT system
Steve Nice is technical director at ForLinux, an open source hosting and Linux solutions provider.
The cookie crumbles: making sense of new EU law
September 12, 2011
No, not that sort of cookie
The new EU law on website cookies came into force on 26 May. But there’s been little clear guidance of what’s expected of website owners or what the penalties might be if you don’t comply.
For business owners who might not even know what a cookie is, expecting them to interpret this new law seems a little much! It’s frustrating, so we’ve tried to make some sense of what you need to do to comply with the law.
What is a cookie, anyway?
A cookie is a small piece of information that a website can place on your computer when you visit it. Cookies are used for all kinds of things - most commonly, for web analytics, to track what people do when they’re on a website.
However, they can also be used by sites to remember what was in your shopping basket last time you visited, or to show you particular adverts or content depending on what you’ve looked at before.
The principal behind the new cookie law is that people have a right to know and decide what’s downloaded to their computers. When they first visit a website, they should see an explanation of the cookies that site uses and be able to choose which should be used.
And that’s where it gets tricky. Many website owners don’t know what cookies their sites use themselves. There will be cookies used to smooth the browsing experience, cookies that collect information on user habits, and increasingly, third party cookies used by services like Google Analytics.
Audit your cookies
This confusion means the best way to start is to audit your website, so you know what’s there. There’s some good advice about doing a cookie audit here, and a free tool that can help too (although you’ll need to be using Google Chrome as your web browser).
If your website was built by a web developer or designer, they should be able to help you understand what cookies it uses. Your IT supplier may be able to offer advice too.
Decide which cookies you actually need
Once you have a list of all the cookies your website uses, decide which you actually need, and think about which ones your visitors are likely to accept.
For instance, do you need cookies for web analytics (yes, probably – without them you’ll struggle to learn more about the people who visit your site), or for social bookmarking services?
Then you need to work on telling visitors about the cookies you decide to keep. How do you explain each in a way that encourages people to accept them? In my experience, people can be understanding when they realise the benefits cookies bring them. So, with careful wording, you can make sure most are accepted.
You should list each cookie and link to information about it to have a greater chance of it being accepted. There’s a good example at the top of the Information Commisioner’s website:
“The ICO would like to use cookies to store information on your computer, to improve our website. One of the cookies we use is essential for parts of the site to operate and has already been set. You may delete and block all cookies from this site, but parts of the site will not work. To find out more about the cookies we use and how to delete them, see our privacy notice.”
The message is followed by a simple check box which users can tick (or not). If they tick it, the site can activate all the non-essential, but useful cookies.
A big change
There’s no denying this is a big change. Some web designers have serious concerns about its impact.
For now, we can just advise you to manage these issues as well as possible, with the aim of making it easy for visitors to understand what your cookies are and why they are important. As more websites start to make these changes, people will become savvier – as individuals, we’ll discover our own cookie comfort levels and work from there.
Finally, don’t panic. There’s a year-long grace period for websites to get things in order. But what happens after that – in terms of penalties – is unknown. So our advice is to do the work now, while you have time to think it through, and before you are forced into doing it.
Why you need a security policy
July 21, 2011
Not a secure way to store passwords. (Image: Nina Matthews Photography on Flickr.)
News just in. Your computer system has been broken into! Yes, your impregnable firewall, amazing anti-virus and 99.9% secure password have all been breached. How could this be? Step forward your company employees.
Recent studies have compounded old research highlighting the astounding ignorance and negligence of employees when it comes to security. Read on to see three ways your employees can undo all your investment in security, and to find out where you may be at risk.
Strangers in the office
A Computer Weekly survey reported that only 4% of employees would challenge a stranger walking into their office and sitting down at a computer. What's more, only 3% would actually ask them for identification.
I'd hope those figures would be higher in smaller businesses, where it's more common for everyone to know everyone else who works there. But it still demonstrates why you need a system of identification of authority - like ID cards - in the office.
Passwords are key
Password security is another key aspect. Aside from the oft-discussed need to use upper and lower case letters, numbers and other random symbols in passwords, it’s how your employees remember logins that can fall short.
A common approach is to write passwords on post-it notes, then stick them under phones or keyboards. Worse, some people stick them in plain view. This gives any intruder a reasonable chance of gaining access with no tools or knowledge of your systems.
One reason passwords are such an issue is that people don't see them as being particularly valuable. One survey found 90% of commuters were happy to exchange their passwords for a free pen!
Sure, some passwords may have been fakes to get a free pen. But the statistics still show a lack of understanding about the damage even a low level user’s password can do in the wrong hands.
Approve all hardware and software
A Valentine's Day study provided random workers with CDs, claiming they contained a promotion to win a romantic holiday. In reality, the CDs sent people to a website promoting security.
The point of the exercise was that the people behind the CD were able to run unauthorised software on computers situated within a company's IT system. According to the study, 75% of people ran their CD.
And a more recent study by the US Department of Homeland Security involved leaving unmarked pen drives and CDs in company car parks, then letting curiosity do the work.
Again, no malicious code was run, but the potential for wrongdoing was there. CDs and pen drives were inserted by 60% of people. If the CD or pen drive had a logo on it, that figure rose to 90%. Scary stuff.
Get your security policy right
I hope these stories have opened your eyes to how even the simplest, most innocent notions can compromise your company’s security. Have you been hit by negligent employees? Do you think you’re at risk? Leave a comment below to let us know.
John Sollars is MD of Stinkyink.com
2011: the year of the data breach?
April 08, 2011
Are you taking care of data properly? (Image: Flickr user dawnzy58 under Creative Commons.)
If the first months of 2011 are anything to go by, this could be the year of the data breach. It almost seems like companies are falling over each other to give away information about their customers.
Here are three high-profile data breaches that have hit the headlines in the last month alone.
While you read about them, think about how many smaller incidents may go unreported or even undetected. Then stop to consider if your business does enough to safeguard its customer data.
1. The Epsilon effect
Epsilon runs huge email marketing operations for clients like Citibank and Marks & Spencer, yet still managed to have millions of customer email addresses stolen when someone got into the company's systems without authorisation.
What we can learn: the information stolen during this breach belonged to Epsilon's clients, many of whom have since warned customers that they may receive more spam as a result.
So, if your business shares data for marketing purposes or joint ventures, make sure you only work with partners you trust, and ask searching questions to find out how they protect the data. Get a strong contract in place that - if possible - places financial liability for data breaches on their shoulders.
2. Don't Play with your data
Hugely-successful Jersey-based online retailer Play.com suffered embarrassment last month when users reported receiving junk email to addresses they'd only ever used on the site. It soon emerged that a company responsible for some of Play.com's marketing communications had suffered a breach.
What we can learn: spotted the pattern yet? Just as with the Epsilon breach, although Play.com customers were affected, the leak actually occurred at another company.
However, Play.com's subsequent customer communications are an exercise in good damage limitation. They apologised quickly, explained what went wrong and described the possible consequences for customers.
3. Losing data the old-fashioned way
York City Council adequately demonstrated that you can lose data without turning to high-tech hackers. All you have to do is print it out and then send it to the wrong place. The council was criticised this week for accidentally posting personal information to a third-party.
What we can learn: hard copies can cause problems too, especially when left lying around. If you have to print out sensitive information, grab it from the printer quickly, then keep it somewhere it can't get mixed up with other paperwork. Once you're done with it, shred it.
Don't print your way into trouble
March 11, 2011
The rise of the internet has created a repository of knowledge and services that are accessible from nearly anywhere in the world.
Of course, none of this comes free. So, almost any service you use online will require you to surrender some personal information. The companies who use this data have to protect it at every stage.
If your business stores and processes sensitive data (and let's face it: whether it's your accounts or customer database, most do), are you sure you know all the places it ends up?
What's hiding in your printer?
Did you know that printers and scanners store information sent to them?
They do this for performance reasons; to minimise the amount of data being transferred or to reduce the time it takes to get ready to print.
For instance, imagine you send a print request for ten copies of a document. Your printer will save the document once, then print the additional copies from this memory. This means it doesn't have to receive and process ten individual files.
The same happens when you scan, fax, or utilise pretty much any feature on offer from your reliable office all-in-one device. When you tally the amount of print requests you send, the information at risk can soon mount up.
How does this affect your company?
Take a quick guesstimate: how many customer-related documents are sent through your printer each day?
If you’re thinking of a number higher than zero, this issue should be of concern to you whenever you are looking to replace your office hardware.
Disposing of equipment responsibly, paying particular attention to any memory built into it, will protect you from future problems. At Stinkyink.com we crush the memory chips of any printer we discard.
It’s the only way we can guarantee that the 100,000 people on our customer database are fully protected, to the same level we ourselves wish to be.
Did you know your printer memory could hold hidden secrets? Do you know of anyone who has struggled with security issues like this? Are you concerned about misuse of your own information?
John Sollars is MD of Stinkyink.com
(Image of a printer graveyard from Flickr user wonderferret under a Creative Commons Attribution licence.)
Small business technology advice, tools and resources | IT Donut
Copyright © 2010-2012
