security

Password Basics

loginscreen.png

You can have all the locks on your data center and have all the network security available, but nothing will keep your data safe if your employees are sloppy with passwords.

There are many ways data can be breached, and opening some link they shouldn't is one of the most serious security sins employees can commit, but today we’ll just talk about passwords.

Here are some basic practices that you should require your employees to follow. These are basic tips. System administrators should implement other policies, such as those that forbid using passwords previously used and locking accounts after a few failed attempts to login. But just for you as a manager, here are a few tips.

  1. Change Passwords - Most security experts recommend that companies change out all passwords every 30 to 90 days.
  2. Password Requirements - Should include a of mix upper and lowercase, number, and a symbol.
  3. Teach employees NOT to use standard dictionary words (any language), or personal data that can be known, or could be stolen: addresses, tel numbers, SSN, etc.
  4. Emphasize that employees should not access anything using another employee's login. To save time or for convenience, employees may leave systems open and let others access them. This is usually done so one person doesn't take the time to logout and the next has to log back in. Make a policy regarding this and enforce it.

These are just a few basic password tips, but they can make a big difference in keeping your business's sensitive data safe.

Series: Ransomware Part 1

thumb-12.jpg

The daily reports of cyber-crime are important reminders about the need to protect your business from malicious behavior that could threaten the success of your business. There are so many different things that can attack your computer, steal your data, and wreck your day. One of the most troublesome has been the development of ransomware. (FYI. Ransomware isn’t actually all that new-- some version has been around for decades)  Ransomware is a type of computer virus that takes your data hostage and like any kidnapping scheme, demands money for the release of your data.

Why is ransomware so nasty? Because it steals the most important thing your business possesses. Data. Worse, once infected there isn’t generally a way out. No one can “disinfect” your machine. You aren't going to be able to call in IT support to solve the problem. Basically, you have three options.

  1. Pay the ransom. This payment is usually via credit card or bitcoin (a digital currency). Some ransomware viruses even provide help lines if you're having trouble. Of course there are no guarantees your will get access to your data–these are thieves you’re dealing with.
     
  2. Don’t pay and lose your data - This has its obvious downsides, unless…
     
  3. You have a safe, clean backup. In that case, you are stuck with the nuisance of restoring your data with the backup, but you aren’t out any money. However, this comes with a caveat: your backups have to be clean. The problem with ransomware viruses is that just making backups may not be sufficient to protect your data, as the backups can be infected also. In the next blog, we will address your need to add an additional layer of protection to handle ransomware attacks.

Cloud or dedicated server? Where is the smart money going?

Should you be entrusting your data to the cloud or keeping it down to earth on your own servers? This is a decision facing every CIO. And it’s one they’ll be forced to justify and revisit regularly for the foreseeable future. That’s because there’s been no knock-out blow in the argument between the cloud and the in-house server. There’s plenty to be said for both, which makes the question one of what’s right for you.

Looking cloudward

Surely the chance to ditch your servers and outsource to someone who is steeped in server management seems like a gift from the universe.

The arguments in favor of cloud computing are easy to make, especially to someone frustrated by the intellectual overhead and raw cost of maintaining their own servers.

The promises of the cloud include the following.

  • You pay only for what you use, so it’s incredibly flexible; you can scale up or down at will.
  • Security, upgrading, and server configuration are in the hands of experts.

In these days of everything being “as-a-service,” the idea of owning anything like a server seems downright old-fashioned. If Uber can run the world’s largest taxi service without owning any taxis, why on earth would you need to own servers?

Where to look closely

There are a few things you need to factor in to make sure you’re comfortable with any potential compromises.

Power: Cloud providers can’t match the power of a dedicated server that’s properly configured.

Speed: The scalability of the cloud has to do with getting more or less storage, not faster storage, which might be a concern when another customer is flogging the server you’re on.

Latency: If your cloud host uses dispersed locations or it’s not nearby, you might have latency issues

Taking a dedicated approach

The promise of cloud computing is most clearly seen in companies meeting one or more of the following criteria.

  • Tight budgets
  • Growth they can’t predict
  • Business-to-consumer models
  • Jobs that don’t need lots of computer power or storage or much time to run

A company that has a business-to-business model or has well-established usage needs and predictable growth will likely find running its own servers cheaper and more efficient. This is something you can quickly run the numbers on, and the results might surprise you, considering that “cheaper” is a clarion call of the cloud industry.

The issue of security

It’s also worth running the decision through the filter of security. Hackers fish where the fish are, which makes cloud hosts attractive targets. You’re not just outsourcing server configuration and the like. You’re trusting another company with your security. If security is a concern, you’re probably better off keeping your servers in-house, where you can tailor security to your needs.

Keeping Kids Safe Online

As the world of technology moves ahead at breakneck speed for all of us, our children are left increasingly vulnerable to screen-time addiction, online bullying, and adult content. We could watch over our kids’ shoulders while they are on the computer, but frankly, the thrill of watching my fourteen-year-old play Minecraft is gone. Fortunately, there are some excellent programs to help concerned parents.

All four of the programs tested offer basic protections for Windows and Mac. They will all allow you to block website categories, such as gambling, violence, pornography, etc. In addition, you can add specific websites to block or allow. The parent will also be able to schedule hours when the child is allowed to use the computer, and the length of time the child is allowed each day.

Norton Family Free

Norton Family Free provides all of the basic tools needed to monitor internet activity and control access. The interface is modern, clean, and easy to navigate. Setup is a breeze.

Norton was the only program I tested that the time restrictions applied to the child’s use of the computer, not just the internet. Another great feature is the remote management. I can make changes to the child’s access from any internet browser, and it takes effect as soon as the child updates their rules. There is even a handy smartphone app.

The reports provided are excellent, except for the over-reporting of blocked advertisements and such. It makes it cumbersome to sort through the blocks to see which are real issues and which are not.

Norton Family Premier

Norton Family Premier has all the functionality of the free version, with a few key additions. With the Premier edition, you can see exactly which videos your children are watching on YouTube, receive weekly detailed reports, and manage Android devices.

Net Nanny

The Net Nanny interface is fairly easy to navigate, and installation is simple. It provides the ability to block website categories, with an added functionality to warn. For instance, you may allow a teen to browse to a site about alcohol, but you can give them a warning to tread carefully. You can also mask foul language. So if your child is reading comments on Facebook or YouTube, they will see “What the %@#” instead of the curse word. Pretty cool.

But surprisingly, Net Nanny does not offer a category to block social networking sites. You can create your own category and spend your spare time researching social networking sites to block. Or, if you allow your kids to use social networking, you can monitor that for an extra fee.

I found the Net Nanny YouTube videos and webinars to be useful tools. Check out their video called “8 Tech Tips for Parents with a Clever Kid”. Your clever kid does not want you to watch this video.

Safe Eyes

Safe Eyes by McAfee provides all of the basic parental control features, but it is difficult to find anything else positive to say about this program. The first impression was the very dated interface. Getting the settings entered was a little awkward, but I managed. We spent way too much time trying to get Minecraft to work until I let my daughter login with my account. The design of this program is such that when the child’s time is up, they lose access to the internet, but they still have access to the computer. However, you could use the built-in parental controls in Windows or Mac to limit access to the computer itself.

Another problem with Safe Eyes is the lack of remote management. The program must be managed on the device. So, if my son calls me at work, and he needs access to a website, there is nothing I can do about it until I get home.

How to Choose?

In some ways, Net Nanny is more advanced than the other parental controls tested. Net Nanny strives to block content, not just specific websites. That is very appealing. But the fact that I cannot totally block social networking makes Net Nanny impractical for our family.

Safe Eyes is rather clunky and since it does not provide remote management, I would not choose this one. The free version of Norton Family provides a better product.

I found Norton Family Premier to be the best of the four parental controls tested. It is easy to use for both the parent and child. Of course, there is the high cost to consider.

Norton Family Free has enough unlocked features to provide a good deal of control for most parents.  I have settled on Norton Family Free for now, and if I decide down the road that I would like more reporting, then I will probably upgrade to Norton Family Premier.

What I like best about all of these programs is that every time my children log in to the computer, they are reminded that they are being monitored. That may be enough in many cases to keep them in the safe zone.