Which browser and search engine are the best for privacy?

I get this question all the time. As a privacy advocate I appreciate that most users want to avoid having every interaction on the Internet being tracked and recorded. The truth is that if you really want to avoid all the tracking technology, you will need to take additional steps beyond changing your browser and search engine. Even so, it is an excellent and easy start. The less trail of cookie crumbs that lead back to us the better. 

Here are my suggestions:

Browser

The browser built for privacy is the TOR browser. Because all of your web surfing traffic is encrypted and anonymized, it can be slower than other browsers. Your IP address can be used to identify you, and this browser does address that concern. Even so, you may discover websites that block you from viewing them when using the TOR browser. Chances are you will need to use another browser besides TOR from time to time.

Firefox is a non-profit that creates the browser that TOR uses as its base. If TOR is not for you, then use Firefox. Install add-ons such as HTTP Everywhere, UblockOrigin, Noscript, and Disconnect. These add-ons will make web surfing with Firefox even more private and secure. Unlike TOR, with Firefox your IP address will not be anonymized.

If you love Chrome but want privacy, then you must stop using Chrome and switch to Iridium. Chrome is actually an open source project fork from the Chromium browser but both are funded by Google. That means that Chrome and Chromium track your Internet activity and send the telemetry back to Google. The Iridium browser starts as Chromium but all of the Google tracking is stripped out and what is left is a "Chrome" like browser without Google spying. Like Firefox, your IP address will not be anonymized.

Configuring Firefox and Iridium is also critical. You want to avoid third party cookies and as much browsing history as possible. Go through the settings and allow only those cookies you absolutely need and configure the history to be erased upon closing the browser.

Search Engine

DuckDuckGo and Startpage are both excellent choices for search engines. Neither maintain records of your search requests. They both encrypt your connection so your ISP can't view your inquiries either.

Next Step
 
When you are ready the next step in your journey to better privacy is using a VPN and changing your DNS provider. I will cover that in a future post.

Europe Is Far Ahead of US In Data Protection

   On May 25th of this year a shift in data protection practices and policies will be required throughout the business world as the European Parliament regulation known as General Data Protection Regulation becomes enforceable law.  Even businesses operating outside of Europe will be affected if they have customers who live in Europe.  This kind of law has been long overdue in the US.  If businesses in the United States wish to remain competitive they should heed the principals of the General Data Protection Regulation or GDPR.
   In the United States, the ramifications of Supreme Court decisions have severely limited privacy protection. When considering the vast troves of information held by corporations and government, such limited protection means almost nothing is confidential.  Legally, within the United States information has no privacy protection when provided to a third party like Facebook, Google, Yahoo, telephone company and even your bank. There are exceptions for a limited and specific type of information such as Social Security Numbers, Credit Card account numbers, and medical information. Outside those narrow parameters, all other data can be shared with others without requiring your consent.  It doesn’t matter if that breaks the social protocol of confidentiality; it is legal and can be done. What’s more, private information, such as medical conditions, has been determined by someone’s shopping habits, location information, and phone call logs. Internet users lack of awareness of the aforementioned does not mean those users condone having their information, which was provided in confidence, shared with anyone and everyone indiscriminately.
   With a millennium of social protocol, people assume that information shared with an individual or organization means that the receiving party will respect the privacy of the giver of that information.  The collectors of our Internet activities are no longer benign advertisers interrupting our viewing or listening with advertisements.  Our information has been thrown into the oven of massive databases where our activities are analyzed.  That analysis eventually leads to conclusions.  From conclusions come decisions upon which action is taken. There is always a danger when analysis, conclusions, and decisions are done in the dark by mostly large institutions that have power and profit as a motive.
    The openness that is the notable characteristic of the Internet is being subverted by opportunists using that very openness to promote their own interests in secret using expropriated information as a means of control, manipulation, and exploitation, which is at odds with the very reason users are drawn to the Internet. What people know about criminals breaking into databases is just the tip of the iceberg. The privacy invaders that have emerged could be characterized as Virtual Peeping Toms, Cyber Criminals, Spys For Hire, Blackmailers, Data Snatchers, Bait and Snitch Data Sellers, Black Market Data Brokers, and Surveillance Spooks.  They all view information in whatever form - be it text, database, video, audio - as a means to an end.  They collect it, sell it, broker it, and most definitely use it.
   The information that is used always benefits the user of the information, and most notably at the expense of privacy and an individual’s self-determination. Internet users have difficulty imagining how their personal information could be used other than to provide a service. They have no clue as to the multiple uses of information beyond its original intended use.  Some may be devastated to find out the re-purposing of their data by unknown third parties has very real consequences impacting their lives in subtle ways. Others understand that misuse and abuse of information will lead to real harm.  This is why 93% of adults say that being in control of who can get information about them is important according to a Pew Research poll.
  One method to prevent harm is to restrict access to information to only those you trust.  However, in the United States of wild west of data protection common sense has been brushed aside.  The computer security experts tasked with protecting data are often plagued with conflicts of interest. In the parlance of information security, the acronym CIA has been the CYA for computer technicians for decades.  For clarification for the uninitiated, CIA does not stand for the Central Intelligence Agency which admittedly is the more infamous “CIA”.  The acronym is known as the triad of information security: Confidentiality, Integrity, and Availability.  For too long computer security technicians have focused on data integrity and system availability as the CYA for their job security.  After all, end users do notice when systems are down or data is incorrect.  But, violation of confidentiality may only be known when private information falls into the wrong hands, and that information is abused or misused.  Since data is simply copied when an information breach occurs there is no service disruption.  It lacks the immediacy of a system crash and therefore has been treated with a lower priority.
   Given the current political climate in the United States, it appears that the GDPR is our best hope to improve the dismal state of data protection.

Don’t Take Away My Netflix and Hulu! Why “Net Neutrality” Means Consumer Choice and Freedom of Expression

Without Net Neutrality sites like You Tube, Netflix, Hulu and Spotify may not even exist today. Cable companies like Comcast would prefer to choose what websites you could access by implementing censorship or slowing down the access to the point you would never visit the website. AT&T, Comcast, Verizon and other Internet Providers want to dismantle “Net Neutrality” so they can play middleman in order to make more money. They will find ways to charge you more for getting the same Internet service that you get right now.

• According to Fight For The Future…Cable and phone companies like Comcast would be able to: 
• Slow video streaming sites, causing your videos start and stop unexpectedly. 
• Add new fees to your Internet bill. Imagine paying extra for YouTube! 
• Censor videos or content they don’t agree with, like political blogs. 
• Throttle any new sites or apps they don’t own or invest in. 
• Make your connection painfully slow, and charge you more to make it work again. 
• Force streaming sites like Spotify, Netflix, or Hulu into a slow lane, causing them to buffer constantly. 
• Slow online gaming. Call of Duty would lag and glitch without paying more to your ISP. 
• Charge big sites special “prioritization fees” and slow down everyone else. 
• Take you out of the driver’s seat, and control what you see and hear online. Make the Internet look a lot more like cable TV. 
• And, worst of all, become the first gatekeepers of the Internet in US history. 

Net neutrality says we get the *entire* web without interference – no gatekeepers, no tollbooths, no slowlanes. This is why it is considered the First Amendment of the Internet. It protects our free speech in the digital age.

Let the Federal Communications Commission know that you support Net Neutrality. Visit the website gofccyourself.org and submit a comment in favor of Net Neutrality.

How Easy is it to crack an iPhone password?

Our smartphones increasingly contain a wealth of information about us. We make phone calls, send emails, visit websites, send texts, take photos, connect with Facebook friends, and share files. They have become mini-computers. Our smartphones go where ever we go, unlike our desktop computer that rests on a table top safely in our home. That means access to the phone is just a moment of physical theft or loss away.

How safe are the contents of your smartphone anyway? Take the iPhone, which has been in the news lately, with FBI wanting Apple's help to access the contents of an iPhone. Apparently, the FBI is having some difficulty getting into that iPhone. Does that mean that the iPhone is impenetrable? Not exactly. The answer is that it depends.

First of all you need to password protect the phone. With iOS 9 Apple has created some impressive security to prevent repeated guesses of the password. After five wrong guesses, the phone's software makes the hacker wait one minute before guessing again. After nine wrong guesses, one will have to wait an hour. And depending on how the phone was set up, it might delete all its data after ten wrong tries. Even if the aforementioned security measures were disabled, Apple has another security feature that makes automated password guessing difficult. When you enter a passcode into your iPhone, the processor makes a calculation to check if your code is correct. What Apple has done is make the math so complicated that it takes about 1/12 of a second for the phone to crunch the numbers. That may not seem like a long time to humans, but to a computer it is an exceedingly long wait. “This means it would take more than 5 ½ years to try all combinations of a six-character alphanumeric passcode with lowercase letters and numbers,” according to Apple security guide.

The iPhone security is impressive, but can be rendered useless if you choose a weak password. Six lowercase letters and numerical digits can be arranged in 2.17 billion combinations. A six digit alpha and numeric password at about 12 attempts a second, will take an encryption cracking tool five and a half years to go through all combinations. Compare this to a six digit, numbers only, password. Six numerical digits can be arranged in only one million ways. Such a simple six-number passcode can be cracked within just 22 hours.

The lesson here is that complexity of a password is essential. Secondly, the longer the password the harder it is to crack. On iPhones with only a four-digit numeric passcode, there are only 10,000 combinations. It would only take 13 minutes for the FBI to try all the different possible passwords. Compare that to a six character passcode where you mixed in capital letters in addition to lowercase letters, and numerical digits. Then there would be 56.8 billion possibilities, instead of 2.1 billion. Instead of 5.5 years, it would now take 144 years to crack such a passcode!

The Easiest Way To Avoid Being Hacked

For decades we have been told by security professionals that the best way to stop from being hacked is to be careful when opening e-mail attachments, to install anti-virus software, and use a firewall. That has been the security mantra since the 1990s. If you’ll notice, we are not in the 1990s anymore. Hackers have had over 20 years to poke holes in those defenses, and have largely been successful. It is time for a new approach.

At a recent security conference, Avecto, a security product manufacturer, conducted an analysis of Microsoft Security Bulletins from 2015, focusing only on the security vulnerabilities labeled “Critical”. What they discovered is that 85% of the vulnerabilities exploited to hack a computer, can be mitigated by removing administrator privileges from the current user. In other words, if you use a "standard" user account as opposed to an "administrator" user account, malware could be stopped from being installed on your computer 85% of the time. What is the difference between "standard" and "administrator" user accounts? A "standard" user account cannot install software or make configuration changes to your computer. Only an "administrator" account can do that.

When you create your user account in Windows, you have a choice whether to create a "standard" or "administrator" user. You can also change the account type by going to Control Panel > User Accounts > Change Your Account Type. There has to be at least one “administrator” user on a computer. That means you will need to create two user accounts; one “standard” and one “administrator”. You use the “standard” one for your everyday activities and the “administrator” account just for making changes or installing software.

So, why don't most people use standard user accounts? The answer is convenience. They want the immediate gratification of installing software or making changes on the fly. Most users are not aware that Microsoft has already made it more convenient to user a standard user account. Since, Windows 7 you can now operate in your standard user account and install software by right clicking on the installation file and selecting from the menu "Run as Administrator". You will then be prompted to enter your administrator username and password. That means you can still stay logged in your standard user account, but invoke the administrator account when you need to without logging off and switching accounts.

Working in a standard user account is essential for keeping the hackers from invading your computer. Consider these other findings:

● Of the 251 vulnerabilities in 2015 with a Critical rating, 85% were concluded to be mitigated by removing administrator rights ● 86% of Critical vulnerabilities affecting Windows, can be mitigated by removing administrator rights ● 99.5% of all vulnerabilities in Internet Explorer, can be mitigated by removing administrator rights ● 82% of vulnerabilities affecting Microsoft Office, can be mitigated by removing administrator rights ● 85% of Remote Code Execution vulnerabilities, can be mitigated by removing administrator rights ● 82% Critical vulnerabilities affecting Windows 10, can be mitigated by removing administrator rights ● 63% of all Microsoft vulnerabilities reported in 2015, can be mitigated by removing administrator rights.

Best Privacy Policy Statement Ever

Being a privacy advocate, I am one of the few people who actually read the privacy policy of a website.  Most privacy policies are so convoluted with legalese that the average person can't make any sense of it.  I was pleasantly surprised when I came across a privacy policy statement that was simple, easy to understand, and clearly states the privacy protection principles of the business. The privacy policy statement below belongs to www.gongs-unlimited.com.  (Why I was looking for a gong is a whole other story, which may be an entertaining story, yet irrelevant to discussing privacy policies. So, I will do the reader a favor and not digress.) Like all good privacy policies this one states what information the company collects and if they share that information with a third party.  What makes this one stand apart is the personable language that plainly states why they believe in protecting their client's privacy. Admittedly, I also like the emphatic and irreverent tone spiced with just the right amount of humor.  Read it below for yourself....

THE GONGS UNLIMITED PRIVACY POLICY

Everyone at Gongs Unlimited treasures their privacy and we trust that our customers treasure their privacy as well.  If you are anything like the 15 year old daughter of the Head Mallethead here, you really really treasure your privacy.  Because we are just a retail store. You come in and buy a gong. That's all we want to know.

We will never give your email address or any other information you used to purchase a gong to any third party. And not any fourth or fifth parties either.  Screw them! If you wanted Spam, you'd go to Hawaii and order some with eggs!

If you bought a gong at a local mall, you wouldn’t expect to be hounded by salespeople from other stores chasing you to your car, calling you and yelling into your phone, or filling your mailbox with garbage. We believe that you shouldn’t have to experience that in your computer when you buy a Gong either.

Data Breach: Vacaville Housing Authority

When and Who

Organization Name: Vacaville Housing Authority (VHS)

Date(s) of Breach (if known): Monday, August 24, 2015

Date(s) of Discovery of Breach: Tuesday, August 25, 2015

What Happened

This data breach is an example how one innocent mistake can expose personal identifying information.  A VHS employee sent an email with a file attachment, that included Social Security Number information, accidentally to the wrong recipient.  Fortunately, when the recipient viewed the email she notified VHS and deleted it from her inbox.  As required VHS did report the incident to the local police, California's Attorney General's Office and to HUD.  The local police did confirm that the recipient deleted the email. 

One lesson that can be drawn from this incident is to be careful to review who you are sending an email to in order to avoid this kind of mistake.  After all, not all recipients may be as conscientious as the recipient in this data breach.  In all fairness, mistakes do happen, and it is better to have a process in place that takes into account potential mistakes.  For example, using file encryption that requires the recipient to enter a password to view the file could have prevented this incident.   

What Kind of Data Was Breached 

Social Security Numbers

Who Is Affected

Number of those affected were not mentioned in notification of breach by the organization to those affected. 

More People Believe Privacy Has Been Lost

A recent CBS News/New York Times Poll indicated that most Americans believe that the right to privacy in general has been compromised. 52% think the right to privacy is under serious threat, and another 30% think it has already been lost. Only 16% think it is still safe.

According to a Pew Research poll, 91% of adults think that consumers have lost control over their personal information used by companies.  Given the perception of lost privacy, the majority of Americans express negative views about companies collecting personal information about individuals, including what they buy, their credit histories, and income information. When presented with the reasons for or against such practices, only 13% think it is mostly good because it allows companies to better serve their customers and process financial transactions quickly, whereas 83% say that it is mostly a bad thing because it makes it easier for the information to be shared inappropriately. 


Americans clearly think the government ought to be doing more to protect their information; 68% think the federal government is not doing enough to regulate the personal information that can be collected about people. 14% think it is doing enough, and 11% think it ought to be doing less. Even so, the political gridlock in Washington DC makes the passage of stronger privacy legislation a remote possibility any time soon. 

A Pew Research Poll indicated that 61% say they "would like to do more" to protect their privacy.  Given the dearth of online privacy options and software, many are left without information about the choices to protect their privacy.  A recent survey conducted by GlobalWebIndex showed that only 28% of the online population using tools to disguise their identity or location.  Clearly, there is a gap between the desire to protect privacy and knowledge of how to do so.

How Fast Can a Hacker Snag Your Data?

You have one minute and 22 seconds to stop all communications with the Internet from you computer once you open that malicious attachment in your email. Otherwise, attackers will start exfiltrating the data from your computer.  This is according to an annual report conducted by Verizon that analysed data involving nearly 80,000 breaches contributed by 70 different organizations including law enforcement agencies as well as government and industry computer incident response teams worldwide.

Everyone thinks that they will never be fooled into opening that suspicious attachment. We feel confident that we can spot those emails from Nigera offering to transfer millions to our bank account. Sorry to burst your bubble of email bliss.  Verizon noted that 23 percent of recipients open nefarious messages containing malicious attachments or links. Even so, simply opening an email won’t necessarily install malware on your computer. Ever more dangerous are the 11 percent of recipients who go so far as to click on malicious attachments. Attackers have become experts at creating convincing emails that appear to be from a trusted source. There are malicious emails concocted for mass distribution and those that are cleverly targeted and thereby appear trustworthy. In security professional terminology the difference is between "phishing" emails and "spear-phishing" emails. 

"Spear-phishing is a more targeted form of phishing", according to Kim Zetter in her article "Hacker Lexicon: What Are Phishing and Spear Phishing?" published in Wired Magazine. "Whereas ordinary phishing involves malicious emails sent to any random email account, spear-phishing emails are designed to appear to come from someone the recipient knows and trusts—such as a colleague, business manager or human resources department—and can include a subject line or content that is specifically tailored to the victim’s known interests or industry. For really valuable victims, attackers may study their FaceBook, LinkedIn and other social networking accounts to gain intelligence about a victim and choose the names of trusted people in their circle to impersonate or a topic of interest to lure the victim and gain their trust."

And, it's not just email we need to worry about.  The same techniques can be used by hackers using social media sites like FaceBook, Instagram, SnapChat, and so forth. The attacker just needs you to open a file, photo, music recording, or video.  If you have a one in ten chance of getting fooled in opening a malicious file and your anti-virus only has a 55% chance to detecting the malware, eventually some hacker is going to gain access to your computer. Clearly, the security methods and tactics that worked in the past are simply not as effective today. It's time for products to be redesigned with added security and we need to move away from putting all our digital goodies in one basket.

The TV That Observes You

Imagine that you can talk to your TV and it response to your commands. The technology has finally arrived at a store near you. Samsung's SmartTV uses voice recognition technology to enable voice commands.  No more hand remote! Amazing!

Not so amazing is the caveat that comes with the technology.  It is better described as disturbing.  Buried in Samsung's privacy policy, is a disclosure that reads, "if your spoken words include personal or other sensitive information, that information will be captured and transmitted to a third party."  Notice the phrasing is NOT "could be" or "accidentally".  Rather it clearly states "will be captured and transmitted". 

Just when you finished covering your webcam to protect your privacy from hackers accessing your laptop camera, now you need to deal with your TV snooping on you as well.  At least someone has to hack into your laptop.  Not so with the Samsung SmartTV.  The spyware is already embedded and will be capturing and transmitting your spoken words to a "third party".

Expect more of the same to come with the "Internet of Things".

Ten Essential Smartphone Security Practices

Be Smart with Securing Your Smartphone

Today, there are more mobile phones than there are laptop and desktop computers.  Our smartphone is like a mini-computer.  We don't just make phone calls anymore.  We surf the internet, check our email, text messages, take pictures, make videos, check Facebook, and much more.  This treasure trove of personal as well as business information is a lucrative temptation for a cyber criminal or data broker.   If you don't want to have your emails, Facebook postings, text messages, and the like pilfered for someone else's profit or potentially used in an exploitive way, then you need to start being smart when it comes to securing your mobile phone.  Below are ten essential security practices you should follow.

Smartphone Security and Privacy Tips

1. Use a password on your phone to prevent unauthorized access.
2. Configure your smartphone to auto-lock when not in use.  Your password won't provide protection unless your device is locked.
3. Turn off Wi-Fi or Bluetooth when not in use.  Alternatively, place your device in "Airplane" mode. These platforms are essentially open connections to your phone; so if you don’t need to use them, turn them off.
4. Turn off auto-connect to Wi-Fi networks. There are a lot of unsecured Wi-Fi networks out there, and your phone can automatically connect to any Wi-Fi network that is in range. Only connect to trusted networks.
5. Download apps from only trusted sources such as the Apple Store or Google Play store.
6. Check app permissions individually to be aware of what data apps are accessing on your phone.
7. Perform regular software updates on all apps and your phone’s OS. This patches possible security vulnerabilities (aka backdoors) that can give hackers access to your phone.
8. Do regular backups of your phone. This will prove helpful in the event that your device gets lost or stolen.
9. If your device happens to get lost or stolen, make sure you have software that allows you to remotely lock, and if necessary, wipe the data from your phone.
10. Install mobile security software on your phone as an extra layer of security.

Why Net Neutrality is a Victory for Small Businesses

As a small business owner you are now free to set up an outrageously successful website without having to cough up extra money to your Internet Service Provider that would add no additional value to your service.   

Net Neutrality is the concept of keeping the Internet a level playing field with no "fast lane" or "slow lane" treatment to some kinds of traffic.  Large Internet Service Providers (ISPs) wanted to insert a "Middle-Man" service, that would stand in between the consumer and a Cloud provider such as NetFlix.  Currently, a user visits a website of their choice with no such Middle-Man obstruction.  Large ISPs wanted to implement another means to make money by charging a toll charge for website access.  There was no functional reason for this toll charge.  The Internet is working just fine.  Stopping short of censorship, the ISP could make access to a website so slow the result would be in users going elsewhere.  Eventually, the website host would have to pony up the extra money.  

It was no surprise there was widespread support for Net Neutrality as demonstrated by 99 percent of the 1.1 million comments on "Net Neutrality" submitted to the Federal Communications Commission were in favor of it, according to analysis by the Sunlight Foundation.

Steve Wozniak, co-founder of Apple Inc., explains why he favored Net Neutrality and why he thinks it is a victory for consumers. 

http://www.bloomberg.com/news/videos/2015-02-26/wozniak-this-is-a-victory-for-the-consumers

Antivirus Is Dead, What Do I Do Now?

Brian Dye, senior vice-president for information security at Symantec, has declared antivirus as “dead”. With a detection rate of only 45%, you can’t rely on antivirus to protect your computer from malware infections. Now what?

Being careful with opening email attachments and what websites you visit is important but doesn’t mean you will never be fooled. If you have ever watched a magician perform a trick and couldn’t figure out immediately how that trick was performed, then you are capable of being fooled. Experienced cyber criminals are experts at scamming and the art of illusion. Besides, most people use Facebook and other social media sites which have become a popular attack approach. Cyber criminals have enjoyed a 70% success rate with malware spread through social media.

If you assume your computer will crash or will suddenly experience performance issues, and that is how you will know you’ve been hacked, think again. Cyber criminals will NOT crash your computer. That would defeat their purpose. Their aim is to infiltrate your computer to pilfer data. After their done they will use your computer to cover their tracks so their attacks on other computers will appear to originate from your computer. Besides, even if your computer performance takes a dump, how are you going to remove the infection if the antivirus or similar detection tool can’t find the source of the infection?

Obviously, a new approach to computer protection is required. First, would be an operating environment that is impervious to infections. One approach would be to change you operating system to Linux. Millions of malware infections are roaming around on the Internet designed for Windows. There are fewer malware infections designed for a Mac. Still the number of malware designed for a Mac is close to one million. Linux on the other hand has had less than 100 malware designed to attack it. Part of the reason is due to Linux lack of use along and the numerous different versions. Linux has had a reputation of being difficult to learn and use. However, there is a new version that has been designed for Windows users called Zorin. Even so, you may still find learning a new operating system to much of a challenge.

A new technology known as virtualization may provide an approach that has promise. The technology isolates an application from the rest of the operating system. It can also isolate and entire operating system environment. The benefit is that whatever happens in that isolated environment stays in that environment and won’t affect the rest of your computer. An example of software that uses application virtualization is Sandboxie. If you open your browser (Internet Explorer, Firefox, Chrome, etc) within Sandboxie, and if you go to a website that has malware, the malware will be isolated in the Sandboxie environment and will not infect your computer. Sandboxie can be configured to erase all activity in a session so that you can start with a clean slate each time you open a program. That means any malware will not only be isolated, but at the end of the session will be erased. This technology is still relatively new and still needs some work in the area of usability for the average user. But, power users should have no problem installing it and using it.

I will have more suggestions in future blogs, so stay tuned.

Check out…

Sandboxie

http://www.sandboxie.com/

Zorin 

http://zorin-os.com/

If Antivirus Is Dead, How Do I Know If I've Been Hacked

Antivirus “is dead”, declared Brian Dye senior vice-president of information security at Symantec. Industry experts agree that antivirus protection is only 45% effective in detecting malware. If you have been relying on antivirus protection as your only approach to protecting your computer from intruders, then you might sleep less comfortably at night.

So, if you go to a website, open an email attachment, or download a file where there is malware present, there is a 55% chance your computer will become infected without you knowing about it. If you can’t rely on antivirus protection to detect an infection, how will you know if you’ve been hacked?

Chances are you won’t know you’ve been hacked. Most people assume that their computer will crash or will suddenly experience performance issues. That assumption is a myth. Cyber criminals will NOT crash your computer. That would defeat their purpose. Their aim is to infiltrate your computer to pilfer data. After their done they will use your computer to cover their tracks so their attacks on other computers will appear to originate from your computer. They may also add your computer to their network on infected computers. That network is referred to as a “botnet” and your computer is referred to a “zombie”. With a network of hundreds of thousands and even millions of computers, hackers have the power to launch attacks on networks and websites that can render them inoperable. There is absolutely ZERO benefit to the cyber criminal in crashing your computer.

If you think that being careful with opening email attachments and what websites you visit will protect you, think again. Most people use Facebook and other social media sites. According to industry experts the use of social media to spread malware has become ubiquitous. Cyber criminals have enjoyed a 70% success rate with malware spread through social media.

What can you do besides throw your arms in the air in frustration yelling “why little ol’ me!”. Or, resigning yourself to constant surveillance and saying to yourself “I have nothing to hide” in order to feel less uncomfortable. Obviously, a new approach to securing your computer is sorely needed. There are solutions that I will cover in future blogs. So, stay tuned.

Symantec Exec Declares Antivirus is Dead

 

Antivirus detects only 45% of all attacks which renders the widely used protection ineffective according to industry experts. Brian Dye, senior vice-president for information security at Symantec, has declared antivirus as “dead”. This comes from a company that has been a leading innovator of antivirus products since the 1980s.

Cyber criminals and hackers have simply outsmarted the developers at antivirus companies. At first the industry approach was detect and then protect. That method worked when the amount of malware and viruses being produced was relatively low. Once the amount of malware created per year reached the level of millions of variants the “detect and protect” approach became impractical. At that time a quasi-artificial intelligence called “heuristic detection” was developed. Heuristics worked for the 1990s and early 2000s. But, the bad guys found a way to bypass the heuristic detection. Hackers now use a method called “cypting” that renders malware undetectable to antivirus software and malware tools.

Brian Krebs, a computer security reporter describes this “crypting” method, “Put simply, a crypting service takes the bad guy’s piece of malware and scans it against all of the available antivirus tools on the market today – to see how many of them detect the code as malicious. The service then runs some custom encryption routines to obfuscate the malware so that it hardly resembles the piece of code that was detected as bad by most of the tools out there. And, it repeats this scanning and crypting process in an iterative fashion until the malware is found to be completely undetectable by all of the antivirus tools on the market.”

The cyber criminals and hackers call this kind of malware “full un-detectable” or “FUD” for short. This is the reason antivirus is now only 45% effective. So, if you have been depending on antivirus as your sole means of protecting your computers you are in for a rude awakening. And, if you have felt safe because your computer hasn’t crashed, you are even in for a bigger rude awakening. Professional cyber criminals and hackers will NOT crash your computer. That would defeat their purpose of pilfering your data and using your computer to cover their tracks when attacking other computers.  There is absolutely NO benefit to the cyber criminal to crash your computer.   They may encrypt your data and blackmail your into paying a ransom to get your data back, but they won't crash your computer. 

In future blogs I will discuss alternatives to antivirus protection that is more effective.  Stay tuned.  

Is Your Data Protection Stuck in the 1990s?

Let's be honest.  Business computing can be complex, confusing, and frustrating for the average small business owner.  Is it any wonder why most small business owners want simplicity when it comes to the securing of their business data.  Back in the 90's all one had to do was install a virus protection software that included a firewall and you were done.  Simple.

I hate to burst you bubble, but we are not in the 90's anymore.  Hackers, cybercriminals, and other techno freaks have punched so many holes into virus protection that it has rendered it as a mere annoyance. Cyber criminals have developed numerous end around approaches so they can get past the virus protection and firewalls.  Bottom line is one solution or one protection is no longer enough.  Simplicity gone, sorry.

Remember this Rule: If you make it simple for you, you make it simple for the hacker.

Is Your Business System Protection Stuck in the 90s?  If you answer NO to any of these questions...your stuck in the 90s...

Password Protect Data

• Do you create strong passwords with at least eight characters, mixing in symbols, numbers and uppercase and lowercase letters.
• Do you create unique login information for each of your online accounts.
• Do you change passwords regularly.
• Do you make it a policy to never share your account login information.
• Do you use two-factor authentication processes when they're offered. These require users to sign in with a username and password plus a verification code that's typically sent via text message or displayed through an application on your device.
• Do keep track of passwords with a password manager NOT and excel spreadsheet? (Available as a desktop program or as an app, this tool stores passwords locally and securely, and some even generate unique passwords for you.)

Practice Safe Web Surfing and Cloud Computing

• Do you always back up the data you store in the cloud to a local computer or hard drive?
• Do you update your operating system and/or web browser often to take advantage of security patches and updates.
• Do you invest in anti-virus and malware programs. Do you keep these updated as well.
• If possible, do you customize privacy settings so you control who can view your information and what information they have access to.
• Do you restrict the amount of information you share online. Do you protect sensitive information by keeping it in a separate location with access restrictions.
• Do you avoid directing all password recovery messages to a single address—a practice known as "daisy-chaining." A hacker who gets hold of your email login could gain access to all of your accounts.

Monitoring Removes the Mystery of What is Happening on Your Network

Monitoring Removes the Mystery of What is Happening on Your Business Network

Monitoring is so significant as far as system reliability that even if you didn’t practice maintenance the reliability of your business systems will be noticeably improved.  With monitoring you have an early warning system.  Microsoft has devoted a considerable sum of resources to build into its operating systems “sensors” that detect and record thousands of events occurring on your computer. 

For instance, you can know who accessed a file and when it was accessed.  You can find out what changes were made to your computer system  and when these changes were made. You can know when applications like viruses install on your computer.  Even hardware performance can be monitored for any decrease in performance. There are so many events that can be monitored that the possibilities are practically endless. Even so, in order for this kind of monitoring to be effective, you need to decide what is going to be monitored and enable the monitoring.  Even more important is that someone needs to be paying attention.  What good is computer monitoring if the alarms are blaring and the lights are flashing but no one is paying attention. 

Unfortunately, most small businesses don’t have anyone monitoring their computer systems.  And, certainly, they don’t have monitoring set up or enabled.  This is truly a lost opportunity to vastly improve system reliability.  Wouldn’t you rather be warned that your computer is on the verge of collapsing or would you rather one day come to work and your computer won’t work without any warning?  Monitoring can make that kind of difference!

So, why are most small businesses not monitoring their network and systems?   

Because small businesses hire computer repair techs who make their money by repairing broken computers.  Let’s be honest, if you only pay a computer tech when your computers are broken, what is the financial incentive for the tech to prevent computer problems?…none!  What most small businesses lack, that most larger companies have, is full time salaried computer experts. For large organizations the computer tech’s raises and bonuses are predicated on reducing computer downtime.  If that tech wants a raise, then he better make sure the computers are always up and running.   

So what is the answer for a small business that can’t afford to pay the $90,000.00 salary to get a dedicated salaried computer technology expert who has the incentive to make sure the computers are always up and running?  Here is what you need to do… you need to find a tech support vendor that can be hired on a flat fee basis to do everything including maintenance, prevention and unlimited tech support.  Yes, UNLIMITED TECH SUPPORT is the key!  The unlimited tech support for a flat annual fee means the tech support company has the financial incentive to prevent computer breakdowns.   If the tech support company gets paid a flat fee, then the more computer crashes occur the less per hour the support company makes.  It is like having your very own tech expert on a salary!

So where do you find that kind of tech support company?  

Do an Internet search for “managed services” and you will find one in your area.  How expensive are “managed services”?  Honestly, these kind of businesses do NOT operate like Joe’s Cheap Tech Support.  So, don’t expect to get Walmart prices.  Yes, you may pay more for the expertise they bring.  But, your company will save money in the long run by increased productivity in having computers that work all the time as well as perform better and faster.  And, you get the added bonus of an expert who is on your side.

Reducing IT Costs: Save Money by Managing Change or Change Will Manage You and Your Company

Reducing IT Costs: The Five Pillars of Computer Dependability and Longevity that Save Your Company Money

Part Three: Managing Change

Remember the adage that the only thing in life that is constant is change itself.  That adage equally applies to the life of computer systems.  You company’s computer systems are not static.  They are under a constant barrage of change: new Windows updates, application updates, hardware additions, software installations, configuration changes, virus infections, and the list goes on and on.  In the previous Pillar “Variety is the Wrong Spice” I delineated the challenge of reigning in the complexity of hundreds of products and thousands of product configurations and all the unpredictable results of that multitude of combinations.  Now add change to that cacophony of infinite combinations and you have a potential recipe for disaster.  That is why managing change is so important to keeping IT costs under control and assuring system dependability.  

I want to emphasize that your business computer technician needs to “manage” change with YOUR full support.  Computer system changes should NOT be random or ad-hoc.  Employees should NOT be allowed to install software, add games, or change system settings on a willy-nilly basis.  If that is the case, then you have abdicated any semblance of control over your business systems.  It is possible that you have turned over your computer systems to your employees for them to use as their own personal entertainment centers.  And, if you have, then you’ve opened the door to software installations that may cause instability in your business line of applications, hardware additions that may not play nice with your business systems, and an increase incidents of virus infections.  This will increase your business IT costs that may escalate out of control. 

 Document all changes made.  The main reason for this is to assist in any troubleshooting of problems that may have been caused by the change.

So, YOU the business owner have the responsibility of taking back control of your business computers systems.  Stop treating those computers as discretionary gadgets used for entertainment.  Treat your business computers as production line equipment.  You’ve made a significant investment so protect and properly maintain that investment. 

First step is creating a company policy that prohibits employees to install software or make system changes.  That responsibility will fall to designated “system administrators”.  As far as the average employee, what you are doing is removing the responsibility of caring for the computer system and thereby the responsibility for when their computer crashes and all the consequences thereof.  You are allowing your employees to focus on their jobs. And, that is what you are really paying them for…right? 

By limiting the number of people who make any kind of change to your computer systems it is much easier to keep track of the changes that were made and thereby if any change may have caused problems in the system. 

Next step is to set up a systematic approach to making computer system changes by your designated “system administrators”.  

• Schedule the changes on a regular day of the week, or otherwise communicate each time changes are made to the computer systems.  This way all employees can know that day of the week as “Change Friday” and if that employee notices some unintended consequences of the change that escaped testing they can let you know.  Otherwise, the employee may think it is some random happening.If you have standardized your systems, then you can test any new hardware or software on one system.  Then that one system can act like the “canary in the coal mine” before rolling out that change to all systems. 
• If your computer systems are not standardized, then you will need to methodically roll-out changes in groups of computers rather than all at once.  
• It is best to document your Change Management policy.  Even if that policy fits on one page.  That way everyone knows who is responsible for what and sets the appropriate expectations. Then make sure that policy is clearly communicated to everyone who uses the business computer systems.