Video of Leap Motion

February 28, 2013

LEAP MOTION WANTS TO MAKE MOTION CONTROL YOUR NEXT MOUSE. HERE’S A LOOK AT WHAT THE DEVELOPERS OF THE TO-DO APP CLEAR HAVE DONE WITH THE SDK.


A hacker’s dream: two-thirds of SharePoint users have no security policy

February 28, 2013

Even though Microsoft SharePoint is widely deployed throughout enterprises and SMBs as a collaboration platform, a shocking two-thirds of SharePoint-using companies in a recent survey have admitted to having ‘no active security policy’ in place for the application.

The situation translates to a smorgasbord of opportunity for a hungry information-hijacker, but one which could soon turn into an all-you-can-eat buffet. The study, carried out by Emedia and provided to Infosecurity on an exclusive basis, investigated a wide range of businesses from 25 through to 5000+ PC users. The study found that while about half (52%) of those surveyed were currently using SharePoint, the other half planned to adopt the application once its social networking enhancements were live.

“This is a data leakage time bomb,” said security specialist and UK Accounting Standards Board member Steve Bailey. “SharePoint is a very widely-used medium, and it’s growing fast, so it is remarkable that IT-savvy users are disregarding the security implications. This could be down to complacency, confusion as to where the responsibility for developing such a policy lies, or simply lack of awareness.”

Whatever the root cause, he noted that in many organizations, SharePoint use has grown organically to “become part of the fabric of the business without being subject to mainstream security controls.”

The employees themselves are part of the problem, but how to implement an IT policy that makes sense is a conundrum for many IT professionals – contributing to the lack of IT policy.

“Banning data sharing is not the solution – that’s both impractical and undesirable,” said Martin Sugden, CEO at Boldon James, which sponsored the study. “In fact, refusing to share data is inefficient and potentially dangerous. What’s important is striking the balance between the need to protect information and the need to share it.”

The survey concluded that a protective marking solution for labeling the data’s level of sensitivity needs to be implemented. Many government agencies use protective marking to minimize inadvertent disclosure of confidential information, while commercial organizations employ protective marking to control intellectual property or information containing customer data.

By clearly identifying sensitive information using a classification solution, it becomes easier to ensure that access control methodology is correctly connecting the right users to the right data, Sugden noted.

Yet the study discovered that 65% of respondents are not yet marking any of their data. A very low 9% of respondents said they protectively mark all emails, and the same percentage said they do the same for all documents. Only 17% of respondents said they mark all email and documents.

“When you consider that hundreds – and even thousands – of users could be accessing your SharePoint server, it makes sense to have a solid SharePoint security policy in place,” added Sugden. “[SharePoint] is a superb tool for creating routes into your data, but you can’t let your user group have unfettered access to data without giving them some method of understanding how sensitive it is – that’s why you have to label.

Steve Bailey warned, “Any business that relies on SharePoint to store sensitive or confidential data should always ensure that its users understand their responsibilities for the safe handling of that information. With the advent of BYOD this extends to employees and associates.”

He cautioned that recent high-profile breaches should serve as object lessons. “Otherwise we’ll have more examples such as the Police email that, according to the [UK's] Information Commissioner’s Office (ICO) ‘contained 863 pieces of personal information’. Police accidentally sent the email containing the results of 10,000 checks with the Criminal Records Bureau (CRB) to a reporter when a staff member copied the wrong person into a message.”

Thanks to http://www.thethreatvector.wordpress.com


Start Sweating the Small Stuff

February 27, 2013

In his recent New York Times article, “That Daily Shower Can Be a Killer,” renowned geographer Jared Diamond observes how Americans tend to greatly exaggerate risks that are sensational and beyond our control—like plane crashes and nuclear radiation—yet underestimate the mundane, but more common risks that we can control—like slipping in the shower or falling from a ladder.

In my geek-centric mind, I immediately drew a corollary to computer security.   We’ve all met the engineer who will spend weeks obsessing over which password hashing algorithm to use, but fail to implement a solid password policy.

If you find yourself being hyper-paranoid about dangerous, but implausible attacks…stop!  Do a quick risk/frequency gut-check to determine whether you’re wasting time.  You shouldn’t be debating the strength of SHA-256 while your employees are emailing trade secrets to a Nigerian Prince.

XKCD: Security

What are some of the fall-in-the-shower type risks when it comes to data protection?  Our State of Data Protection Report from last year highlights a few:

  • Only 26% of companies are very confident their data is protected
  • 18% weren’t confident at all
  • 23% of companies were not confident or unsure where their critical business data resides
  • 27% of companies did not monitor any access activity on file servers and SharePoint sites
  • 13% of companies never revoke access to data when an employee leaves the organization
  • 61% do not scan their environment for sensitive data

Based on our results, there’s clearly a lot of room to tighten up these fundamental areas of day-to-day risk.  Just as Mr. Diamond’s goal is to reduce life’s common accidents to 1 in 1,000, we should strive to minimize common data security risks, like insider theft, by implementing soundsecurity programs.

Want to learn more about risk analysis?

Here are some good resources:


4 ways mobile health could save $400B in health costs

February 26, 2013

The latest and greatest in mobile technology is on display this week at the Mobile World Congress (and you can see my colleagues’ coverage of that here). But so are the applications of that technology. Health care, education, urban planning and other sectors stand to benefit from mobile technology and a report out Monday from the GSMA and PricewaterhouseCoopers gives a snapshot of how mobile technology could save money, increase opportunities and enhance health and safety in the coming years.

In Sub-Saharan Africa, one million lives could be saved over the next five years with mobile health initiatives that help patients stick to their treatment plans and access information, as well as aid workers in monitoring the available of medication and follow treatment guidelines, according to the report. For example the Mobile Alliance for Maternal Action (MAMA) enables health care workers and pregnant women to share health information via SMS; TxtAlert in South Africa helps HIV patients and healthcare workers comply with Anti Retroviral Therapy programs, cutting missed appointment rates from 27 percent to 4 percent, the report says.

 

The article can be found at http://gigaom.com/2013/02/25/4-ways-mobile-health-could-save-400b-in-health-costs/

 


Cybersecurity Now Top of Mind Around the World and Network Security is Taking Center Stage

February 26, 2013

It’s no surprise that in the wake of the rapid increase in cyber attacks, governments around the world are moving towards strengthening their cyber security, and even taking steps to mandate better collaboration on security issues between the private and public sectors. Here is a sample of the most recent initiatives:

  • US – Feb-2013: Obama Orders Cybersecurity Standards for Infrastructure
  • European Union – Feb-2013: EU Unveils New Cybersecurity Policy
  • Italy – Jan-2013: Italian Government Approves Cybersecurity Measures to beef up strengthen online security and protect critical infrastructure from increasing cyber assaults
  • India – Jan-2013: India Developing National Cybersecurity Architecture. India is in the midst of developing a national cybersecurity architecture aimed at preventing sabotage and espionage of its core IT systems and networks
  • Australia – Jan-2013: Australia toughens stance on cybersecurity
  • Russia – Jan-2013: The Russian Federal Security Service gets empowered to create a state system for the detection, prevention and liquidation of the effects of computer attacks on the information resources of the Russian Federation

There are important common factors in all the above:

First, a global appeal for stronger collaboration between the public and private sectors to share intelligence on cyber attacks. Under existing EU rules, telecommunication companies are already required to report significant security incidents. Wade Williamson, one of our in-house experts on cyber threats recently wrote in this blog about “Combating Emerging Threats Through Security Collaboration”

Secondly, a shared understanding that the global economy is highly dependent on critical infrastructure that might not be as secure as initially thought. For example, the U.S. executive order specifically mentions power grids, pipelines and water systems.

Finally, full awareness that much of the critical infrastructure supporting a thriving, modern economy relies on a set of interconnected networks and systems that must be closely monitored and protected. The proposed European directive calls out the need for resilient, safe, and stable networks and systems.

One takeaway for our customers is that network security is being more systematically called out in cybersecurity discussions worldwide and is even taking center stage. Some analysts have commented that network security will remain the largest cybersecurity submarket for the next 10 years.

Why? Even as SaaS applications, social networking, mobile devices, or cloud-based computing become mainstream and push the limit of the traditional enterprise perimeter, the network and the firewalls remain the one place where organizations in both the public and private sectors can see all traffic and actually enforce security policy.

via cybersecurity, cyber security, network securityPalo Alto Networks Blog.

Thanks to http://www.thethreatvector.wordpress.com


[Tech] It’s Official: Google Glass Is Here!

February 25, 2013

While Apple iWatch rumors continue to slog their way through the blog-o-sphere, Google has upped the ante. Google’s Glass is not a rumor, it’s real. In addition (according to Google) you can get one by the end of 2013 by entering and winning a special contest.

At least, Google calls it a contest. There are some unique rules. First, you have to pay $1,500 for your Glass, if you win. Also, you have to travel to New York, San Francisco or Los Angeles to pick your prize up. (UPS is not available.)

If that isn’t enough, you have to come up with a really creative idea about how you will use your Glass. If you need help coming up with ideas, Google has released a video entitled How it Feels [through Glass] that provides a behind-the-lens view of the Glass experience.

Google hasn’t specified how many “winners” there will be – supposedly, that will depend on the number of “really creative ideas.”

CNET reported that Glass will be able to connect via Bluetooth to both Android phones and the iPhone, while pulling data from Wi-Fi and using the 3G/4G feeds from the connected phone. Glass will not have its own cellular radio.


What is really at risk that we need to protect it ???

February 25, 2013

The most important thing you can identify is re-think the way you look at data and security. You must understand what is really at risk and then protect it.  Below are five key principles that you must remember when it comes to protecting your data:

Fit your PC with “Lock” to protect your privacy now!

1.    ALL data has value.
No matter how harmless or insignificant a bit of information may seem, it can probably be used by someone and they are willing to pay for it.

2.    Data” means all communication or information.
This may include many things that some may not have considered data such as VoIP calls, e-mails, etc.

3.    You must assume all data sent in the clear can be easily collected, mined replicated and stored.
Over time, mass amounts of data can be collected and sifted through to gain a pretty good view of an organization.

4.    Once stolen, data can be sold and used repeatedly by multiple people or groups.
Just because your data is stolen once, doesn’t mean it will only be used once.

5.    Security measures should focus on protecting “the thing of value” rather than preventing “events”.
You can’t predict how, when or where an event will take place. This type of defense is always reactionary. Sometimes the event is undetected.

Posted by 


Email: The Bane and Boon of Modern Communication

February 25, 2013

Recently, we conducted a survey on digital work habits, specifically around email and its ubiquitous (and overwhelming) role in business communication. The survey results were eye-opening to stay the least. We found that a constantly increasing volume of emails are forcing knowledge workers to allocate significant time and effort to managing their inboxes.

Moreover, we were interested in getting feedback from experts in the productivity arena to learn how our results lined up with email productivity data at-large. When one of the top productivity gurus expressed an interest in writing about our findings; we were more than happy to oblige.

Below is productivity and time management expert Tara Rodden Robinson’s commentary on the Varonis Digital Work Habits Survey findings.

——
Email is both the bane and boon of modern communication. According to a recent report, 144 billion (yes, billion, with a “b”) email messages are sent each day and nearly 70% of that traffic is spam. In a corporate setting, email still provides many benefits: it’s quick, provides documentation and information trails, and it’s convenient. But the continuous inflow, volume, and “leanness” of communication (that is, it’s lack of tone and context) make email one of the most complicated areas of information management in the business environment.

The Varonis survey on digital work habits sought to explore daily volume, how people manage their email, and determine the frequency and severity of email “mistakes” (such as a reply-all goof or forwarding sensitive or offensive materials to the wrong recipient). One of the key contributions of the resulting report was the division of results by job category; this is one of the few studies that offers insight into how C-level executives handle their email. (However, their sample size of C-level respondents was quite small so caution should be used in generalizing from these data.)

Here, I provide a commentary on the report based on my expertise with productivity and time management as well as my experience and background in coaching knowledge workers, including executives. I call out some highlights in the findings, make comparisons with data from other sources, and draw some conclusions.

Highlights From the Report

When a new client comes to me for coaching on time management, one of the first questions I ask is: How many emails do you receive each day? According to the Varonis survey, 67% of respondents received 50 or more emails per day with a small percentage (~5%) receiving more than 300 emails daily. Extrapolated, this amounts to 250 – 500 messages weekly or 1,000 – 2,000 messages per month. This makes it easy to see how an inbox can become inundated quite quickly. If representative, then it’s no wonder when people (sheepishly) report the number of emails stored in their inboxes as in the thousands.

The Varonis survey didn’t ask respondents how many total emails were in their inboxes but only how many “unread” emails there were. The vast majority of employees and managers reported having very few (less than 10 or zero) unread emails (~59% and ~70%, respectively). A small number of respondents claimed to be automating their email management with rules leaving me to surmise that practically every email message received must be reviewed individually in order to mark it as “read.” If, indeed, only 30 minutes are spent on email each day, as was reported, and a respondent receives, say, 100 messages daily, that would require a lightning fast processing time of 18 seconds per message.

When asked how they were processing email, the survey classified respondents into three categories: “filers” who empty their inboxes daily (presumably into some system of folders and deleting the remainder), “hoarders” who never delete anything but file and/or tag some proportion of their messages, “hybrids” who do a combination of filing and hoarding, and those who have “given up” on managing their messages. One might imagine that “filing” would be the most time consuming style, however, 65% of the filers reported spending 30 minutes or less each day on this task. (And I don’t know what to make of the 2.3% of filers who claim to spend “no time” on their email–they must use magic or have minions to do the work for them.)

The data for C-level respondents presented quite a different picture from the other two categories. In stark contrast to employees and managers, half of the C-level respondents report spending 30 minutes or more daily on email management. (The majority “employee” and “manager” respondents (59% and 63%, respectively) claim to spend 30 minutes or less each day on email.) One third of C-level respondents reported spending more than an hour each day on email (compared to 18% and 11%, employees and managers, respectively). Sadly, email management style (filer, hoarder, etc.) by job category was not included in the report. The number of unread emails for C-level executives was quite different from the other two groups as well. All C-level respondents reported having some unread emails (as opposed to a large number of employees and managers who claimed to have none); most C-level respondents had 10 or fewer, roughly 25% had 100 or less, and (gulp) nearly 20% claimed over 20,000 unread messages (one wonders what their boards would think if they knew!).

Comparisons with Data From Other Sources

Similar to the Varonis survey, the Radicati Group reports [pdf] that the average corporate employee receives roughly 60 emails per day. Thus, according to the Radicati Group, a worker processes roughly 100 emails per day (sent and received, together), a distinction that was not explored in the Varonis study.

According to the McKinsey Global Institute (MGI; 2012) report entitled The social economy: Unlocking value and productivity through social technologies, knowledge workers spend an average 28 hours each week (or roughly 5.6 hours per day) “writing emails, searching for information, and collaborating internally.” This includes “28% of work time reading, writing, or responding to e-mail,” which would break down to 13 hours a week (their average work week was 46.5 hours) or approximately 2.6 hours per day. In contrast, only 16.7% of the respondents in the Varonis survey report spending more than one hour per day on email however, the survey asked only about time spent managing email and didn’t specifically examine the time invested in other sorts of email related work.

Conclusions and Recommendations

One key question that is unanswered by the Varonis survey is: “How much of your work (that is, tasks) comes to you as email?” The number of requests that become actionable tasks varies greatly across the corporate landscape. In addition, the ability to delegate also varies from high (at the C-level) to none at all (for many managers and perhaps the majority of employees). Thus, knowing how much work (outside of the actual reading, writing, and managing) email represents would have been extremely useful to know.

In any event, I strongly recommend that workers separate task management from email management. The email inbox makes a very poor task management tool: the constant inflow of new items pushes unfinished work out of sight and messages must be read repeatedly to ascertain what is requested or is actionable. If workers are committed to being reliable and following through on what is requested of them, then the best way to track those commitments is to maintain a task list.

A second, widely reported email headache that went unexplored was the “cc” issue. When speaking to corporate audiences, excessive use of copying others on messages is one of the most vociferous complaints and one of the biggest drivers of volume. Thus, the number of emails received may be decoupled from the amount of actionable task content but messages may still demand a substantial investment of a worker’s time and attention. Surprisingly, a move from email to using social media may be a useful solution.

Luis Suarez, the IBM poster-child for going email-less, has reduced his inflow of email to practically nil and moved the vast majority of his communication to open, social channels. His rationale is that if his communications are openly available, fewer people will need to contact him directly. This reasoning is at the heart of the recommendations of the MGI report as well. By reducing the amount of information “locked up” in people’s inboxes and folders, MGI estimates that email use could be reduced by 25% (although Suarez’s personal experiment suggests individual gains could be much greater). This is an idea with legs: there are indications that numerous corporations are contemplating variations on social media that may reduce the primacy of email.

###

Tara Rodden Robinson, Ph.D., is a productivity and time management expert. As an executive productivity coach, she provides one-on-one and team coaching services as well as speaking and training for corporate audiences. You can follow her on Twitter @TaraRodden or learn more about her by visiting her website: TaraRobinson.com


PCI-DSS: New Mobile Security Guidelines Released

February 22, 2013

Last week the Payment Card Industry Security Standards Council (PCI  SSC) released an important document on best-practices for mobile payment security. Merchants have been rapidly adopting mobile devices—tablets, smartphones, notebooks, and other consumer gadgetry—as point-of-sale (POS) systems instead of using proprietary solutions. The trend will continue with experts predicting a $1 trillion mobile payment market by 2017. Unfortunately, this new breed of mobile software and hardware is not yet up to PCI-DSS compliance, so the PCI folks came up with a series of guidelines to help merchants and service providers reduce security risks.

For the IT savvy, PCI’s best-practices for mobile will be second nature. Non-tech savvy merchants, though, may mistakenly assume that off-the-shelf payment solutions based around IOS or Android will provide the same level of security and trust as purpose-built environments. That’s not the case. In 2011, PCI SSC agreed not to certify mobile payments until the appropriate standards are developed.

So what can merchants do in the mean time? One of the most important measures they can take is to use approved scanners and readers that encrypt the PAN or credit card information at the point of interaction, so even if the mobile device acting as a reader/scanner is stolen, the personal transaction data won’t be compromised.

In any case, the new guidelines are a good starting point for those looking to secure their systems and reduce the risks of a breach. I’ve listed some of the key points below:

Secure the device

Simply put: make sure the mobile device is in a physically secured location when not in use. As a consumer-level gadget, it’s more open to hacking threats, and one of the easiest is for unauthorized users to get actual access to the device and install malware.

Authenticate users

Employ a PIN, pattern, or password that authorized users must enter to gain device access. Enforce re-authentication after a period of time.

Scan for malware

A key thing for merchants and vendors to remember is that a general purpose mobile computer can run more than just payment software. The PCI SSC guidelines not only recommend that merchants remove non-essential applications, but that they also install anti-malware and anti-virus software, as well as keeping it all up to date!

Prefer online transactions

Don’t store transactions on the mobile device for later transmission. This opens a potential security hole if the device is hacked or stolen.

Monitor logs and reports

Even if a merchant has taken all the steps in the guidelines, it’s still critical to detect for intrusions or other hacking exploits by scanning logs for unusual activity. This would typically be the responsibility of a service provider doing the back-end transaction processing. Merchants should make sure to ask their processors for activity reports or even, if available, real-time alerts.


How do you Google? [Infograph]

February 20, 2013

Get more out of google


Follow

Get every new post delivered to your Inbox.

Join 752 other followers