New Technology Reviews!.: Companies

Android 4.0 Ice Cream Sandwich Q and A session from Hong Kong

Android 4.0 Ice Cream Sandwich Q and A session from Hong Kong

I’m sure many of you readers were following along during the live broadcast of the Galaxy Nexus and Ice Cream Sandwich just as we were, but...

Steve Jobs and the quality of leadership

<div dir="ltr" style="text-align: left;" trbidi="on">
 
<div style="background-attachment: initial; background-clip: initial; background-color: white; background-image: initial; background-origin: initial; background-position: initial initial; background-repeat: initial initial; color: #444444; font-family: Georgia, 'Bitstream Charter', serif; font-size: 12px; font: normal normal normal 13px/19px Georgia, 'Times New Roman', 'Bitstream Charter', Times, serif; line-height: 18px; margin-bottom: 0px; margin-left: 0px; margin-right: 0px; margin-top: 0px; max-width: 640px; padding-bottom: 0.6em; padding-left: 0.6em; padding-right: 0.6em; padding-top: 0.6em;">
<div mce_style="text-align: center;" style="color: #444444; font-family: Georgia, 'Bitstream Charter', serif; font-size: 16px; line-height: 1.5; margin-bottom: 24px; text-align: center;">
<img alt="" border="0" class="aligncenter" height="118" mce_src="http://img809.imageshack.us/img809/4458/jobsamelio.jpg" mce_style="margin-top: 0px; margin-bottom: 8px;" src="http://img809.imageshack.us/img809/4458/jobsamelio.jpg" style="border-bottom-width: 0px; border-color: initial; border-left-width: 0px; border-right-width: 0px; border-style: initial; border-top-width: 0px; clear: both; color: #444444; display: block; font-family: Georgia, 'Bitstream Charter', serif; line-height: 1.5; margin-bottom: 8px; margin-left: auto; margin-right: auto; margin-top: 0px; max-width: 640px;" width="240" /></div>
<div style="color: #444444; font-family: Georgia, 'Bitstream Charter', serif; font-size: 16px; line-height: 1.5; margin-bottom: 24px;">
Hearing the news that Steve Jobs has resigned as CEO took me back to the mid-nineties, when I was managing a large software project in London. Our company was a pretty big Apple customer, and it was decided that the newly installed CEO Gil Amelio would drop by, shake some hands and discuss Apple's future at our conference table.</div>
<div style="color: #444444; font-family: Georgia, 'Bitstream Charter', serif; font-size: 16px; line-height: 1.5; margin-bottom: 24px;">
Amelio is a smart and impressive man, and he's known for leading the team that developed the first commercial CCD sensors while working for Fairchild Semiconductor. He later became CEO of another chip manufacturer, National Semiconductor, where he was instrumental in restructuring the company and helping it to regain profitability. Amelio was there to give us confidence after Apple had been pretty bruised under John Sculley and Michael Spindler.</div>
<div style="color: #444444; font-family: Georgia, 'Bitstream Charter', serif; font-size: 16px; line-height: 1.5; margin-bottom: 24px;">
It wasn't an encouraging visit.</div>
<div style="color: #444444; font-family: Georgia, 'Bitstream Charter', serif; font-size: 16px; line-height: 1.5; margin-bottom: 24px;">
I remember Amelio going on and on about the past problems at Apple, and how he was going to fix them. Click here for an Apple video of 'the speech.' He had a long list of fixes, but what was lacking was a coherent, compelling vision. He was going to do 'something' about the clones, finally replace System 7, and settle down all the politics and warfare between Apple divisions.</div>
<div style="color: #444444; font-family: Georgia, 'Bitstream Charter', serif; font-size: 16px; line-height: 1.5; margin-bottom: 24px;">
I had some specific questions, but he dodged them. It wasn't convincing, and I wondered if Apple was going to pull itself out of what seemed a certain death spiral. After killing Copland and failing to make a deal for the BeOS, Amelio invested in NeXT and brought Steve Jobs back to Apple. At the end, Amelio got Apple back to making a small profit, after years of losing millions. It was a tiny victory, but certainly not a turn-around.</div>
<div style="color: #444444; font-family: Georgia, 'Bitstream Charter', serif; font-size: 16px; line-height: 1.5; margin-bottom: 24px;">
Amelio was finally ousted from Apple in July 1997 via a boardroom coup engineered by Jobs. The rest is history.</div>
<div style="color: #444444; font-family: Georgia, 'Bitstream Charter', serif; font-size: 16px; line-height: 1.5; margin-bottom: 24px;">
I never met Steve Jobs. But every day he has touched my life. When I check my mail, prepare a presentation, edit a photo, or answer my iPhone, it all happens because Steve had an idea of how I wanted to work. I don't know of any single company or products that have had an equal impact.</div>
<div style="color: #444444; font-family: Georgia, 'Bitstream Charter', serif; font-size: 16px; line-height: 1.5; margin-bottom: 24px;">
Gil Amelio had lots of plans, but plans are not a vision. Jobs laughs at market research, avoids focus groups, and trusts his gut when designing what customers want. That is, what they will want. Other companies try and copy Apple features and designs but usually come up short, because, like Amelio, they had lists instead of a dream.</div>
<div style="color: #444444; font-family: Georgia, 'Bitstream Charter', serif; font-size: 16px; line-height: 1.5; margin-bottom: 24px;">
Jobs is now on the next part of his journey through life, a journey we will all take, sooner or later. It's hard to define exactly the magic that Steve brings to Apple, but it is unique and it is successful. Smart as he was, Gil Amelio could not summon the magic, or as it turned out, much lasting enthusiasm.</div>
<div style="color: #444444; font-family: Georgia, 'Bitstream Charter', serif; font-size: 16px; line-height: 1.5; margin-bottom: 24px;">
Thank you to Gil Amelio for bringing Steve Jobs back. Thanks to Steve for bringing Apple back.</div>
</div>
</div>

Steve Jobs and the quality of leadership

Hearing the news that Steve Jobs has resigned as CEO took me back to the mid-nineties, when I was managing a large software project in...

Google declares war on Microsoft and Apple over Android

<div dir="ltr" style="text-align: left;" trbidi="on">
<span class="Apple-style-span" style="border-collapse: separate; color: #444444; font-family: Georgia,'Bitstream Charter',serif; font-size: small; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: 24px; orphans: 2; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px;"><div style="background-color: white; color: #444444; font-family: Georgia,'Times New Roman','Bitstream Charter',Times,serif; font-size-adjust: none; font-size: 13px; font-stretch: normal; font-style: normal; font-variant: normal; font-weight: normal; line-height: 19px; margin: 0px; max-width: 640px; padding: 0.6em;">
<div mce_style="text-align: center;" style="color: #444444; font-family: Georgia,'Bitstream Charter',serif; font-size: 16px; line-height: 1.5; margin-bottom: 24px; text-align: center;">
<img alt="" class="aligncenter" height="150" mce_src="http://cdn.mos.techradar.com//classifications/Mobile%20Phones/HTC/Flyer_1-200-200.jpg" src="http://cdn.mos.techradar.com//classifications/Mobile%20Phones/HTC/Flyer_1-200-200.jpg" style="border-width: 0px; clear: both; color: #444444; display: block; font-family: Georgia,'Bitstream Charter',serif; line-height: 1.5; margin: 0px auto 12px; max-width: 640px;" width="200" /></div>
<div style="color: #444444; font-family: Georgia,'Bitstream Charter',serif; font-size: 16px; line-height: 1.5; margin-bottom: 24px;">
Google has openly declared war on Microsoft and Apple, with the internet giant claiming that a "hostile, organized campaign against Android" is being waged through "bogus patents".</div>
<div style="color: #444444; font-family: Georgia,'Bitstream Charter',serif; font-size: 16px; line-height: 1.5; margin-bottom: 24px;">
The search giant has accused Microsoft and Apple of getting in to bed together because of the success of Android, in an attempt to make the mobile OS more expensive for phone manufacturers to licence.</div>
<div style="color: #444444; font-family: Georgia,'Bitstream Charter',serif; font-size: 16px; line-height: 1.5; margin-bottom: 24px;">
"Android's success has yielded something else: a hostile, organized campaign against Android by Microsoft, Oracle, Apple and other companies, waged through bogus patents," blogged Google's high profile senior VP and chief legal officer David Drummond.</div>
<h4 style="color: black; font-family: Georgia,'Bitstream Charter',serif; font-size: 1.2em; font-weight: normal; line-height: 1.5em; margin: 0px 0px 20px;">
I want to be a (patent) billionaire</h4>
<div style="color: #444444; font-family: Georgia,'Bitstream Charter',serif; font-size: 16px; line-height: 1.5; margin-bottom: 24px;">
The accusation stems from a mind-boggling auction for Nortel's patents which saw the CPTN group fork out $4.5 billion – some $3.5 beyond the predicted price.</div>
<div style="color: #444444; font-family: Georgia,'Bitstream Charter',serif; font-size: 16px; line-height: 1.5; margin-bottom: 24px;">
"This anti-competitive strategy is also escalating the cost of patents way beyond what they're really worth," added Drummond.</div>
<div style="color: #444444; font-family: Georgia,'Bitstream Charter',serif; font-size: 16px; line-height: 1.5; margin-bottom: 24px;">
"Fortunately, the law frowns on the accumulation of dubious patents for anti-competitive means — which means these deals are likely to draw regulatory scrutiny, and this patent bubble will pop.</div>
<div style="color: #444444; font-family: Georgia,'Bitstream Charter',serif; font-size: 16px; line-height: 1.5; margin-bottom: 24px;">
"We're not naive; technology is a tough and ever-changing industry and we work very hard to stay focused on our own business and make better products. But in this instance we thought it was important to speak out and make it clear that we're determined to preserve Android as a competitive choice for consumers, by stopping those who are trying to strangle it.</div>
<div style="color: #444444; font-family: Georgia,'Bitstream Charter',serif; font-size: 16px; line-height: 1.5; margin-bottom: 24px;">
"We're looking intensely at a number of ways to do that. We're encouraged that the Department of Justice forced the group I mentioned earlier to license the former Novell patents on fair terms, and that it's looking into whether Microsoft and Apple acquired the Nortel patents for anti-competitive means.</div>
<div style="color: #444444; font-family: Georgia,'Bitstream Charter',serif; font-size: 16px; line-height: 1.5; margin-bottom: 24px;">
"We're also looking at other ways to reduce the anti-competitive threats against Android by strengthening our own patent portfolio. Unless we act, consumers could face rising costs for Android devices — and fewer choices for their next phone."</div>
<h4 style="color: black; font-family: Georgia,'Bitstream Charter',serif; font-size: 1.2em; font-weight: normal; line-height: 1.5em; margin: 0px 0px 20px;">
A gun boat in Apple's harbour?</h4>
<div style="color: #444444; font-family: Georgia,'Bitstream Charter',serif; font-size: 16px; line-height: 1.5; margin-bottom: 24px;">
The full statement – on Google's blog – is well worth a read, as it represents perhaps the first shots of a war between the highest profile technology companies on the globe.</div>
<div style="color: #444444; font-family: Georgia,'Bitstream Charter',serif; font-size: 16px; line-height: 1.5; margin-bottom: 24px;">
With the tablet and mobile phone being labelled as 'post PC devices' by no less than Steve Jobs, it is clear that the major players need to a hefty slice of the market and will pay whatever it takes to make sure they remain at the top of the tree.</div>
<div style="color: #444444; font-family: Georgia,'Bitstream Charter',serif; font-size: 16px; line-height: 1.5; margin-bottom: 24px;">
Whether that's with the purchase of patents, huge investment in products (ie Microsoft's Windows Phone 7) or by marketing – it is clear that nobody can pretend that it is good-natured rivalry that is spurring on a now vicious battle.</div>
</div>
</div>

Google declares war on Microsoft and Apple over Android

Google has openly declared war on Microsoft and Apple, with the internet giant claiming that a "hostile, organized campaign agains...

Apple's complaint over Samsung Galaxy Tab earns ITC review

Apple's complaint over Samsung Galaxy Tab earns ITC review

Apple's "look and feel" patent infringement suit against Samsung has gained the attention of the International Trade Comm...

HTC EVO 4G update fixes Netflix, other issues crop up

<img alt="" class="aligncenter" height="212" src="http://img801.imageshack.us/img801/3296/evo4gupdate.jpg" title="evo-4g-update" width="123" />Don’t you just hate it whenever you send your car to the mechanic to have him fix up a particular problem, that driving home after that, you discover another issue has risen? That’s more or less the case with the HTC EVO 4G, having received an update from Sprint which fixed the Netflix and other issues, although said update has caused frustration to users of voice search and Vlingo Virtual Assistant. Nice to know that their complaints have reached HTC’s and Sprint’s ears, with the companies responding that they are currently working on the voice-to-text and compass issues. Problems plaguing various software and issues that arrive with the recent Gingerbread 2.3.3 Software (version 4.24.651.1) update for the HTC EVO 4G will encompass the following – Vlingo Virtual Assistant, Stock RSS widget, voice search, Google Voice-to-text, random apps reloading, issues, compass, Yahoo email and broken folder links. <div><a href="http://feeds.feedburner.com/~ff/ubergizmo?a=B9F8IESXc6w:nTxawN6pn7s:yIl2AUoC8zA"><img alt="" border="0" src="http://img641.imageshack.us/img641/5492/82573025.gif" /></a> <a href="http://feeds.feedburner.com/~ff/ubergizmo?a=B9F8IESXc6w:nTxawN6pn7s:qj6IDK7rITs"><img alt="" border="0" src="http://img36.imageshack.us/img36/8827/60703997.gif" /></a> <a href="http://feeds.feedburner.com/~ff/ubergizmo?a=B9F8IESXc6w:nTxawN6pn7s:gIN9vFwOqvQ"><img alt="" border="0" src="http://img18.imageshack.us/img18/6892/55370949.gif" /></a> <a href="http://feeds.feedburner.com/~ff/ubergizmo?a=B9F8IESXc6w:nTxawN6pn7s:-BTjWOF_DHI"><img alt="" border="0" src="http://img695.imageshack.us/img695/7100/91714197.gif" /></a></div> <div> </div>

HTC EVO 4G update fixes Netflix, other issues crop up

Don’t you just hate it whenever you send your car to the mechanic to have him fix up a particular problem, that driving home after that, you...

Managing Risk in IT Security For Mid-Sized Companies

Get all your IT security questions answered by James Randell in a comprehensive interview.   I have implemented firewalls and anti-virus, are these the main security tools I need? Certainly firewall and anti virus tools are very important for business organisations, but we need to be clear about what they really do. Firewalls are primarily a network access control technology. This is an important function in today's networks, its particularly important that you should set restrictions on who should access your network but its just as important that you look at the content of the 'envelope'.   Antivirus tools are also very important for organisations, they assist them in defending there servers and desktops against attack by malicious software like viruses, Trojans and worms, etc. As long as you're clear about what the tools do, they are important, but not every organisations security challenges are going to be solved by managing network access control and defending against malicious software, so an organisation really needs to take a risk based approach at looking at what security tools they need.   What exactly is security anyway? This is actually quite straightforward but still it confuses a lot of people. Security is about managing risk to your business. Risk might affect your ongoing profitability, your revenues or it might effect your organizational climate. The idea is to manage, control and assess those risks.   What are some of the main security issues faced by companies today? This can vary quite a bit depending on the organisation and what kind of online presence they maintain, but some of the main issues are things like remote network base attacks. There are also legal compliance issues - complying with industry specific regulatory frameworks are also a concern for organisations. The miss appropriation of confidential data or propriety information such as trade secrets and designs are also a major consideration for organisations.   It is very difficult to get straight answers about exactly what I need to do to comply with an industry-specific regulation? Part of the problem here is that compliance framework and compliance requirements can often be given scary names. The thing to remember about these, is that when you look at all the different regulatory and compliance frameworks, most of them share so much common ground. Providing you are approaching your security policies and processes and tool deployments from a best practice and common sense point of view, you're actually likely to be complying with the greater part of nearly all compliance frame works. There are some specific industry variations though which you do need to be aware of, but they are mostly all about best practice and nothing to be too scared of.   Why do vendors keep trying to scare me into buying security products? Its good that the tools are working and that nothing bad has happened but it is still very important to keep security tools up to date. Attackers are continually researching new methods and new ways to attack and compromise systems. However, you should never buy or invest in security products because of, or through vendor's attempts to scare you into buying them.   How do I decide what tools I need to implement, when they seem very similar? This can be a particular problem for buyers of security - the tools all sound roughly the same, having very similar claims, very similarly worded and they all sound like they do the same thing. Yet they can cost completely different amounts. The real thing driving that is the amount of security research that the vendors are investing in their product development, this is one of the key differentiators in the security industry. The vendors who are investing very heavily in original propriety systems and security search work are able to keep their products that much better positioned to protect customers systems and infrastructures against the kind of attack they're going to see tomorrow and provide that kind of protection today. This is one of the main factors in the costs.   Where do most of the threats to an organisation really come from, outside hackers or malicious insiders? We see the headlines being made in the media focusing on hacking attacks from external sources, breaking into systems, stealing confidential data, defacing systems and therefore affecting brand equity etc. however the majority of the money is being lost is through internal attacks, for example where an employee maybe has legitimate access to a database at a high level but then becomes disgruntled they may misuse that privilege or be tricked into misusing that privilege in order to access a huge amount of data which they may then sell on which is why it's the internal malicious insiders that cause the most amount of damage.   How do you train and retain skilled security experts and is this expensive? This can be a real problem for organisations, when you invest in security tools such as firewalls and anti virus systems, you will have access to copious amounts of alert data from them. The challenge is then getting actionable security intelligence out of these tools, this can be outsourced to help you analyze the data and decide if you really are under attack. There are specialist organisations who would own that problem for you, they can hover up all your alert data analyze and process it all and then they can call you if there's something your should be worried about. This is a very easy way to deal with this problem.   How do you understand all the various elements involved with IT security? If you're looking from the ground up, the security industry can seem very complicated. There are firewalls and remote access systems and virtual private networks systems and cryptography tools etc. The answer to this is to look at it from the top down, you need to approach this from the point of view of managing the risk to your business. If you understand what risks your organisation is actually susceptible to and what the consequences are then you can find relatively readily what tools you're going to need.   What is a "security policy" and what do I need one for? A security policy is a frame work and a set of rules and guidelines for an organisation which help it meet any objectives. If you don't know where you're going, how are you going to get there? Is particularly applicable here. This is why a security policy is very important because it helps you understand where you're trying to get to by establishing, what your security objectives are for your organisation.   Why do security technologies seem to focus on "cleanup" when surely "prevention" is better? Prevention is always going to be better than cure. Clean up is very inconvenient, if you just think about your own desktop or laptop, if it gets infected with a virus, it has to be sent back to the IT department and you'll have to do without it all day whilst everything is reinstalled and even then all your data might still be lost. Due to the fact that attackers and attack trends are evolving all the time, its essential that security tools vendors and security development vendors are investing heavily in original security research so that they can ensure that their products are protecting against the kind of threats that organisations will be exposed to tomorrow and prevent the bad things from happening today.   How do I stop security just "getting in the way" of my day-to-day operations? Security tools and processes can seem like they are getting in the way of day-to-day operations. This can be particularly frustrating, maybe those tools have not been properly deployed or wisely chosen or well configured. As long as we are still approaching this from a well grounded risk based point of view for our business then its relatively easy to select proper tools and understand how to deploy them.   I hear a lot about risk assessment being key to budgeting for security spending. How do I even begin to quantify risk? As a society we can be quite bad at assessing risk, sometimes we'll fret about highly improbable risks and then ignore the obvious. For any given risk there are several things you can do, firstly you can mitigate the risk, so you can try to defend against it or control it. You could choose to transfer the risk and pass it to someone else like insurance for example. Or you could chose acceptance, you accept the risk is so unlikely or the cost of the devastation would be too insurmountable and disproportionate to mitigating against it in the first place. These are all perfectly acceptable attitudes towards managing and identifying a risk. In a risk assessment, once you have identified the risks to your business, you can calculate something called an annual loss risk acceptancy which is basically you putting a value on what the impact to your business would be if that risk were to happen, you then make an estimate of how many times of year that's likely to happen. Once you've multiplied these two things together you can work out how much you're likely to loose should this happen as a result of that risk from this you can then work out how much would be practical on dealing with that risk.   As a small to medium business, what are three simple things I could do to quickly improve my security posture? The first really simple thing you could do, would be patching, it is essential to keep your systems up to data with the latest software patches released by the vendors, this is often ignored because it requires down times to apply the patches but it's too dangerous to ignore.The second thing you could do, would be to get really good user control over the accounts and logins and the user passwords systems, make sure no one is using really obvious passwords like name or registration plate. It also very important to remove accounts which are no longer needed, if someone leaves, or changes departments. You also need to set proper access levels, it's a lot easier to just give everyone administration access but its not safe because you're giving them access to far more stuff than they actually need. The third thing you can do may be a little harder; you need to understand whether the alerts you're getting from your tools are valid. This can be outsourced so you don't have to work your way through lots of data. Then the outsourced company would alert you if there were something you need to be aware of.   What is the importance of patching? The issue here is about the skill that the attackers can apply to finding weaknesses in systems and using those in a remote and silent way to get control of your systems. Very skilled attackers can make use of these defects in really devastating ways, they can get control of your systems remotely and access and steal data, they could put some malware on your system which would bring the system down and in the worst cases they could take over administrative control of the system completely which can be devastating, this is why its really very important to use patches and keep systems up to date.   How can I be sure that security vendors are keeping a step ahead of the bad guys? It is here that we can see research work done between the security vendors and technology developers and looking at what tomorrow's attacks are likely to be like and attackers who are constantly advancing the state of their art. For the time being it doesn't look like that race will be over.   Every new technology I implement seems to introduce new security weaknesses, how can I resolve this? It would be a shame for technology deployment and progress to stagnate in the face or fears over security, the answer is to be approaching new technology development from a risk management perspective so a thorough analyses of the kind of risks you may be exposed to as a result of deploying a new technology is absolutely necessary before you embark on the deployment and as long as you do that you can embark on new technologies quite safely and select the necessary security stools processes staff training and other things to help you manage the deployment to make sure it doesn't affect your organisations overall technology stance.   What is "penetration testing" or "ethical hacking" and how can it help me? Penetration testing is really about you understanding what your systems look like from the point of view of an external highly skilled attacker who's trying to break into your systems, there are people who do this as a profession who can assess your systems by using the same techniques a skilled attacker would use, they might try to attack your systems over the network or the might try to trick your people into revealing passwords etc by phoning them and pretending to be from the helpdesk. Penetration testing and ethical hacking is the name used for this and its letting you see how your systems would cope if they were to come under attack.

Managing Risk in IT Security For Mid-Sized Companies

Get all your IT security questions answered by James Randell in a comprehensive interview. I have implemented firewalls and anti-virus, ...

Why Companies Need Ethical Hacking and Better Cyber Security

Judging by the title, many company owners and heads of the technology departments are scratching their heads and wondering why they would want to be hacked. There are a great many people who have never heard of ethical hacking and who only think that hacking is a horrible thing and something to avoid. The fact is that this type of interference in a computer system can actually save a company millions!One of the most important reasons for ethical hacking is for security purposes. How can a company know just how safe their in house network is against truly damaging hacking? A company can hire a cyber security experts that will hack into the network and find the insecure areas so that the company can take the necessary steps to make sure they become more secure. Checking for security leaks covers two distinct areas. These are threats from actual hacking into employee or customer files and leaks that allow in viruses that can shut down an entire network in just minutes. Both of these leaks can cost a company a great deal of money, so this is a very important service. Typically the individuals performing these tasks are knowledgeable in cyber security and trained as ethical hackers.A company that is hacked or attacked by cyber criminals is going to lose business as their customers are going to lose faith in them. If the customers do not feel that their information or personal details are completely safe, they are not going to purchase products or services anymore. This can break a company in just a few weeks of the information being taken. Viruses can be even more damaging. While personal information that is stored may not be shared out this way, the stored information can be lost along with other important documents such as invoices, payroll and company records that are archived. It only takes one virus to wipe out an entire hard drive full of data.The other reason for conducting this type of approved computer breach is to train the IT personnel to spot these weaknesses on their own and to keep them up to date on the latest security software. When there are employees who can spot these holes in the security, then they can be caught much quicker. The problem can be alleviated before it becomes an issue and no records are going to be lost or stolen. The technology in computer systems and networks is constantly advancing. Older systems must be patched. Companies need to stay up to date by hiring penetration testing companies to conduct ethical hacking to ensure that the network is safe and protected. Having personnel who can also do this is a wise choice for any company that relies on a computer network for day-to-day business.

Why Companies Need Ethical Hacking and Better Cyber Security

Judging by the title, many company owners and heads of the technology departments are scratching their heads and wondering why they would...

Are Antivirus Software Companies Responsible For Creating Computer Viruses?

Many people are under the illusion that software companies are in the business of creating viruses. The truth is that so many viruses are turned loose everyday and the battle to combat all this keeps major software companies busy. Companies like Microsoft, Norton, and McAffee are our major protectors against viruses created by those who would do harm to our PC and to our very being. These companies are not in the business to destroy what they have built. The truth is the anti-virus venders have quite enough work to do just keeping up with the new malware variants that the organized crime gangs release upon unsuspecting PC users. Yes, I did say "gangs" not random high school students who are just trying to pull pranks. The first virus was created by a student experimenting with the system. Now it has become a major crime committed by professional criminals. Today is a completely new world we are fighting against professional hackers. Ten years ago or so hackers were just a bunch of smart kids who hacked as a hobby.Today the word is that most Internet criminals are operating from Russia, China and Southern America. It is predicted by security specialists from the major anti-virus software companies that over the next five years there will be an increase in internet attacks from Central America, India, China and Africa. The other hot spot is in Brazil because they have many individuals with sophisticated computing skills but without the more lucrative job market to raise their standards of living. Malware creation hotspots growing in the former Soviet countries such as Russia, Belarus, Ukraine, Kazakhstan, Lithuania and Lativia are the major areas of criminal activity. The online crime often presents a more lucrative path raising living standards for these people that is why it is hard to combat the problem.Major companies like Microsoft would like to introduce a major anti-virus program with their Windows but if they did the U.S. anti-trust commission would charge them with violations. Microsoft tried to introduce Internet Explorer with Windows years ago and got into serious trouble. There is probably no way that our major companies will ever be allowed to offer anti-virus programs that would be included with the PC systems. This is very unfortunate for the general PC users.The idea that these companies create viruses is just a myth. The major anti-virus companies are so busy creating software to combat the criminals we all have to face all around the world. The anti-virus companies do hire ex-hackers ostensibly for ethical hacking in order to check out the potential vulnerabilities of any system in advance. That is why the question about these companies creating viruses is highly controversial. When you see these ex-hackers, producing anti-virus packages that are fighting would be viruses. The fact is that even though these are the ones who help fight against a virus they are also the ones who create viruses. This does not mean that they turn the virus loose on unsuspecting internet users. In order to cure a virus you need to create a replica to experiment with to understand how the virus works. When the hackers know how a virus works then they are able to find a way to destroy, detect, or redirect the virus.	 	 		 			 				 					 						Frederick Musser is the owner of <a href="http://crspros.com/" target="_new">Computer Restoration Services</a>. Providing Expert Laptop Repair and Virus Removal To Kalamazoo Michigan & the Surrounding Area.For more FREE laptop repair tips and virus removal information please visit <a href="http://crspros.com/blog" target="_new">CRSPros.com of Kalamazoo Michigan</a>.Frederick Musser Holds several IT Certifications including Comptia, CIW, and ExpertRated

Are Antivirus Software Companies Responsible For Creating Computer Viruses?

Many people are under the illusion that software companies are in the business of creating viruses. The truth is that so many viruses are...

Data Assurance - A Question of Best Practices In the Wake of TJX Companies Intrusion Event

In May, the American Banking Association will hold its Information Security conference in Arizona. Security officers from every bank of consequence will gather under the warming desert sun eager to share, discuss and examine their security concerns for the coming year. What do you suppose the hot topic will be? We are willing to bet that the TJX Companies' database breach debacle will be center stage in their discussions and provide the fodder for intense scrutiny of a security plan gone terribly wrong.If you haven't heard about the TJX cybercrime, search the archives of Forbes, The Wall Street Journal, or InformationWeek. There is plenty to read and discuss. The attackers were in this case were gutsy, organized and technologically savvy. They perpetrated the perfect cybercrime - a "grape" attack. Much like the shopper who steals a couple grapes off the fruit stand at the market, no one notices until the stalk is bare. In this case, no one noticed until an untold number of credit card accounts were stolen and pilfered for a few hundred dollars each. Most of the transactions were in relatively small amounts, so to fly under the alerting radar. When and if these perpetrators are caught they probably should be rewarded for once again shaking the cybersecurity tree and waking up the occupants.The ramifications of this cybercrime will be discussed and felt for several years to come. The discussion will move from "What happened?" to "How bad was it?" to "What in the world do we do now?" It is the last question that should concern us most. The "Us" in this case refers to consumers, banks, and retailers. Should we be concerned? Yes. Who is to blame? It doesn't matter. Despite whoever is to blame this time, it will be someone else next time. What we need to do is eliminate the NEXT time.Keep in mind, these criminals are smart. Their success confirms what many of us in the information security industry know -- a complete cyber security solution does not exist. Anyone who claims otherwise should be jailed with these hackers for misleading the general public. That being said, certain actions can be taken to protect individuals and make the prospect of cybercrime so arduous and so unrewarding that the risk may outweigh the return.Eliminate the storage of credit/banking informationSmart retailers, virtual or brick and mortar, should adopt one policy immediately. Do NOT save credit card information. There is no need for it. If someone can come up with a good explanation as to why this information has to be retained, we would like to hear it. We all would.We understand that retailers are looking for ways to make our shopping experience easy (read impulsive) but it just got a little too easy. The only way to absolutely insure that this proprietary information is not stolen is to not store it in the first place. In reality, there is no good reason why any retailer should store full credit information pertaining to anyone other than holders of the company's own credit cards. Moreover it would behoove retailers to look into personal identification number (PIN) based systems and the split storage of account number, consumer information and PINs. The compromise of one database system should not yield a complete dataset.Consumers should cringe when a website asks to keep credit card information online and immediately reply in the negative. One can only hope every other retailer who is storing credit card information immediately instructs their staff to delete it all!Note to Congress: Please make the storage of credit information for non-retailer accounts illegal and be done with this issue once and for all.Adopt widespread use of alias accountsRepeat after us, "PayPal got it right."Much like the necessity to store credit card information, the need to actually use any credit card linked to a bank account is essentially flawed. The whole idea of a "credit" card was to have a source of funding that did NOT rely on a bank balance. Debit cards, and the ability to use them like a credit card (i.e. without a PIN) should have been seen as having a very high probability of risk but instead it was embraced. The allure of increased buying power and the resulting transaction fees clearly outweighed the clear possibility of fraud. The monster that has been created is a current buying culture that can't live without them and one that places the onus of fraud responsibility on the fiscal institutions.Industry, at every level, needs to take the next step into alias accounts with consumer controlled funding. By giving every consumer a card without a number but rather with an alias, perhaps an alphanumeric, and a PIN/Password the direct link to personal accounts and data is obviated. This type of card is not linked to a bank account but a "holding account," an account that a bank customer can transfer money into ONLY. In order to use the card, funds must be transferred into the holding account by either physical or electronic transfer. These transfers would not be allowed without the direct input of the customers unique PIN/password.Why an alias? An alias account will protect more than a consumer's money, it will protect their identity.If this is too much effort, we recommend a visit to your local drugstore. Buy a prepaid and rechargeable Master Card or VISA and use it as much as you wish.Banks, Blue Dye & Your DataFile this under the heading of long-term deterrence. How do banks and credit companies stop the widespread looting of electronic data while still allowing normal transactions to continue and without causing their customers any inconvenience? By taking preemptive measures directly focused at making these cyber-thieves the target can financial institutions turn the tide. If banks and credit card companies were to include false and traceable account information within customer data, hacker intrusions would not only be exposed sooner but direct paths could be followed to capture the hackers, Akin to blue dye packs in bank bags, as word of this successful deterrence spreads, data thieves would be more wary of stealing this information.From a hacker's standpoint, they would be unable to know whether the data they were using and the money they had stolen would result in a knock on the door or not. This type of data marking would also allow financial institutions to track the source before attackers realized leading to a greater chance of catching them in the act. Word spreads quickly through hacker channels. It would only take a few arrests to turn the tide.Full Cycle Purchase AuthorizationOne of the biggest problems with credit cards, in any form, is the ability to use it both remotely and in person. With in-person transactions the issue of fraud is somewhat lessened as other forms of identification may be requested to verify the user and owner. The real problem however lies in the use of credit remotely. If credit card information is stolen and used to make electronic purchases, how does the vendor, owner or credit card company really know? Today, they do not. All "remote" transactions are approved based upon the history of the card-owner and the notation of a transaction record. These transactions unfortunately mirror in-person purchases but do not require additional security verifications.In order to provide a real and consistent level of security, the buyer must be virtually present. This can be achieved by requiring that any purchases made remotely be authorized by the original owner via phone or email before the transaction is approved and completed. If a credit card owner were to get an inquiry about a purchase they did not make, then that purchase would be cancelled. All remote transactions would remain "pending" until authorized by the owner. This approach will clearly protect the establishment, the buyer, and the credit company.ClosureUltimately consumers and institutions can only hope that at the ABA security meetings in Arizona, the credit and banking industry will act quickly and through a variety of means to more steadfastly safeguard the financial and personal data of us all. Unfortunately none of these suggested approaches are easy to implement without significant work, validation, and consumer training. Efforts ALL worthwhile for our financial security.The good news is there is plenty of incentive to make these changes. Banks, credit card companies, and insurers have plenty of reasons to quickly adopt new measures. Not to act would be ruinous as they would surely endure more theft, incur diminished customer confidence and face escalating insurance rates. For financial institutions the prime motivator for change is the bottom-line. Decreases in profit margins are always prime movers. For consumers the prime motivator should be in protection their finances and their identities from misuse and fraud. The only remaining question is whether consumers will see the truth of it and be willing to change their habits in order to protect their bank accounts and their ability to consume.	 	 		 			 				 					 						Savant Protection is the industry pioneer in preemptive malware spread mitigation and containment technology for all business environments.Ken Steinberg is the founder and CEO of Savant Protection. He brings a track record of over two decades in computing and high technology. As founder of the company in 2004, Steinberg has responsibility for its day-to-day operations, overall direction, as well as its technological and business strategies. Prior to Savant, he held senior positions with DEC, Hughes, Hitachi, Softbank and at the John Von Neumann Super Computing Center for the National Science Foundation.James Hickey is Vice President & General Manager for Savant Protection. He is responsible for the company?s marketing and strategic partnering strategies. With over 25 years in sales, marketing, and business development, Hickey is directly responsible for the global introduction and launch of Savant technology.

Data Assurance - A Question of Best Practices In the Wake of TJX Companies Intrusion Event

In May, the American Banking Association will hold its Information Security conference in Arizona. Security officers from every bank of c...

Managing Risk in IT Security For Mid-Sized Companies

Get all your IT security questions answered by James Randell in a comprehensive interview.I have implemented firewalls and anti-virus, are these the main security tools I need? Certainly firewall and anti virus tools are very important for business organisations, but we need to be clear about what they really do. Firewalls are primarily a network access control technology. This is an important function in today's networks, its particularly important that you should set restrictions on who should access your network but its just as important that you look at the content of the 'envelope'.Antivirus tools are also very important for organisations, they assist them in defending there servers and desktops against attack by malicious software like viruses, Trojans and worms, etc. As long as you're clear about what the tools do, they are important, but not every organisations security challenges are going to be solved by managing network access control and defending against malicious software, so an organisation really needs to take a risk based approach at looking at what security tools they need.What exactly is security anyway? This is actually quite straightforward but still it confuses a lot of people. Security is about managing risk to your business. Risk might affect your ongoing profitability, your revenues or it might effect your organizational climate. The idea is to manage, control and assess those risks.What are some of the main security issues faced by companies today? This can vary quite a bit depending on the organisation and what kind of online presence they maintain, but some of the main issues are things like remote network base attacks. There are also legal compliance issues - complying with industry specific regulatory frameworks are also a concern for organisations. The miss appropriation of confidential data or propriety information such as trade secrets and designs are also a major consideration for organisations.It is very difficult to get straight answers about exactly what I need to do to comply with an industry-specific regulation? Part of the problem here is that compliance framework and compliance requirements can often be given scary names. The thing to remember about these, is that when you look at all the different regulatory and compliance frameworks, most of them share so much common ground. Providing you are approaching your security policies and processes and tool deployments from a best practice and common sense point of view, you're actually likely to be complying with the greater part of nearly all compliance frame works. There are some specific industry variations though which you do need to be aware of, but they are mostly all about best practice and nothing to be too scared of.Why do vendors keep trying to scare me into buying security products? Its good that the tools are working and that nothing bad has happened but it is still very important to keep security tools up to date. Attackers are continually researching new methods and new ways to attack and compromise systems. However, you should never buy or invest in security products because of, or through vendor's attempts to scare you into buying them.How do I decide what tools I need to implement, when they seem very similar? This can be a particular problem for buyers of security - the tools all sound roughly the same, having very similar claims, very similarly worded and they all sound like they do the same thing. Yet they can cost completely different amounts. The real thing driving that is the amount of security research that the vendors are investing in their product development, this is one of the key differentiators in the security industry. The vendors who are investing very heavily in original propriety systems and security search work are able to keep their products that much better positioned to protect customers systems and infrastructures against the kind of attack they're going to see tomorrow and provide that kind of protection today. This is one of the main factors in the costs.Where do most of the threats to an organisation really come from, outside hackers or malicious insiders? We see the headlines being made in the media focusing on hacking attacks from external sources, breaking into systems, stealing confidential data, defacing systems and therefore affecting brand equity etc. however the majority of the money is being lost is through internal attacks, for example where an employee maybe has legitimate access to a database at a high level but then becomes disgruntled they may misuse that privilege or be tricked into misusing that privilege in order to access a huge amount of data which they may then sell on which is why it's the internal malicious insiders that cause the most amount of damage.How do you train and retain skilled security experts and is this expensive? This can be a real problem for organisations, when you invest in security tools such as firewalls and anti virus systems, you will have access to copious amounts of alert data from them. The challenge is then getting actionable security intelligence out of these tools, this can be outsourced to help you analyze the data and decide if you really are under attack. There are specialist organisations who would own that problem for you, they can hover up all your alert data analyze and process it all and then they can call you if there's something your should be worried about. This is a very easy way to deal with this problem.How do you understand all the various elements involved with IT security? If you're looking from the ground up, the security industry can seem very complicated. There are firewalls and remote access systems and virtual private networks systems and cryptography tools etc. The answer to this is to look at it from the top down, you need to approach this from the point of view of managing the risk to your business. If you understand what risks your organisation is actually susceptible to and what the consequences are then you can find relatively readily what tools you're going to need.What is a "security policy" and what do I need one for? A security policy is a frame work and a set of rules and guidelines for an organisation which help it meet any objectives. If you don't know where you're going, how are you going to get there? Is particularly applicable here. This is why a security policy is very important because it helps you understand where you're trying to get to by establishing, what your security objectives are for your organisation.Why do security technologies seem to focus on "cleanup" when surely "prevention" is better? Prevention is always going to be better than cure. Clean up is very inconvenient, if you just think about your own desktop or laptop, if it gets infected with a virus, it has to be sent back to the IT department and you'll have to do without it all day whilst everything is reinstalled and even then all your data might still be lost. Due to the fact that attackers and attack trends are evolving all the time, its essential that security tools vendors and security development vendors are investing heavily in original security research so that they can ensure that their products are protecting against the kind of threats that organisations will be exposed to tomorrow and prevent the bad things from happening today.How do I stop security just "getting in the way" of my day-to-day operations? Security tools and processes can seem like they are getting in the way of day-to-day operations. This can be particularly frustrating, maybe those tools have not been properly deployed or wisely chosen or well configured. As long as we are still approaching this from a well grounded risk based point of view for our business then its relatively easy to select proper tools and understand how to deploy them.I hear a lot about risk assessment being key to budgeting for security spending. How do I even begin to quantify risk? As a society we can be quite bad at assessing risk, sometimes we'll fret about highly improbable risks and then ignore the obvious. For any given risk there are several things you can do, firstly you can mitigate the risk, so you can try to defend against it or control it. You could choose to transfer the risk and pass it to someone else like insurance for example. Or you could chose acceptance, you accept the risk is so unlikely or the cost of the devastation would be too insurmountable and disproportionate to mitigating against it in the first place. These are all perfectly acceptable attitudes towards managing and identifying a risk. In a risk assessment, once you have identified the risks to your business, you can calculate something called an annual loss risk acceptancy which is basically you putting a value on what the impact to your business would be if that risk were to happen, you then make an estimate of how many times of year that's likely to happen. Once you've multiplied these two things together you can work out how much you're likely to loose should this happen as a result of that risk from this you can then work out how much would be practical on dealing with that risk.As a small to medium business, what are three simple things I could do to quickly improve my security posture? The first really simple thing you could do, would be patching, it is essential to keep your systems up to data with the latest software patches released by the vendors, this is often ignored because it requires down times to apply the patches but it's too dangerous to ignore.The second thing you could do, would be to get really good user control over the accounts and logins and the user passwords systems, make sure no one is using really obvious passwords like name or registration plate. It also very important to remove accounts which are no longer needed, if someone leaves, or changes departments. You also need to set proper access levels, it's a lot easier to just give everyone administration access but its not safe because you're giving them access to far more stuff than they actually need. The third thing you can do may be a little harder; you need to understand whether the alerts you're getting from your tools are valid. This can be outsourced so you don't have to work your way through lots of data. Then the outsourced company would alert you if there were something you need to be aware of.What is the importance of patching? The issue here is about the skill that the attackers can apply to finding weaknesses in systems and using those in a remote and silent way to get control of your systems. Very skilled attackers can make use of these defects in really devastating ways, they can get control of your systems remotely and access and steal data, they could put some malware on your system which would bring the system down and in the worst cases they could take over administrative control of the system completely which can be devastating, this is why its really very important to use patches and keep systems up to date.How can I be sure that security vendors are keeping a step ahead of the bad guys? It is here that we can see research work done between the security vendors and technology developers and looking at what tomorrow's attacks are likely to be like and attackers who are constantly advancing the state of their art. For the time being it doesn't look like that race will be over.Every new technology I implement seems to introduce new security weaknesses, how can I resolve this? It would be a shame for technology deployment and progress to stagnate in the face or fears over security, the answer is to be approaching new technology development from a risk management perspective so a thorough analyses of the kind of risks you may be exposed to as a result of deploying a new technology is absolutely necessary before you embark on the deployment and as long as you do that you can embark on new technologies quite safely and select the necessary security stools processes staff training and other things to help you manage the deployment to make sure it doesn't affect your organisations overall technology stance.What is "penetration testing" or "ethical hacking" and how can it help me? Penetration testing is really about you understanding what your systems look like from the point of view of an external highly skilled attacker who's trying to break into your systems, there are people who do this as a profession who can assess your systems by using the same techniques a skilled attacker would use, they might try to attack your systems over the network or the might try to trick your people into revealing passwords etc by phoning them and pretending to be from the helpdesk. Penetration testing and ethical hacking is the name used for this and its letting you see how your systems would cope if they were to come under attack.	 	 		 			 				 					 						GuruOnline TV has all the answers to your IT security questions. Easy to understand, bite-sized videos on <a href="http://www.guruonline.tv/ibm/ibm-james-rendell" target="_new">GuruOnline</a>

Managing Risk in IT Security For Mid-Sized Companies

Get all your IT security questions answered by James Randell in a comprehensive interview. I have implemented firewalls and anti-virus, a...

Why Companies Need Ethical Hacking and Better Cyber Security

Why Companies Need Ethical Hacking and Better Cyber Security

Judging by the title, many company owners and heads of the technology departments are scratching their heads and wondering why they would...