Information Rights Management - At your Fingertips with Microsoft

Human beings are by their very nature are inquisitive. There will therefore always be the temptation for a person to open and view information that may not have been intended for that particular person. In addition, the distribution of information using electronic formats provides ample opportunity for quick and easy copying and distribution of information, meaning that organizations need tools that will help them safeguard information and restrict access to it where necessary.

What is Information Rights Management?

Information Rights Management (IRM) is an information protection technology that is an existing feature of Microsoft Office and which works in conjunction with Rights Management Services (RMS) in Microsoft Windows Server.

IRM, along with RMS, gives organizations and users more control over how information distributed within Microsoft Office documents and email messages can be used by recipients. With IRM, the creator or sender of a document or message can specify who can open it and whether those allowed access can make changes to it, print, forward or copy it or perform other actions with the information it contains.

Digital Rights Management vs. Information Rights Management

There is sometimes some perceived overlap between the two, but in a nutshell, Digital Rights Management (DRM) refers to business to consumer products such as music, video and any other forms of rich media. Information Rights Management (IRM) on the other hand refers to business to business information, communications and intellectual property.

How IRM is Used in the Workplace

The IRM component in Microsoft Office applications works in conjunction with an RMS server to restrict specified uses of documents and messages that are created by and opened using those applications.

When IRM is enabled, users can assign access permissions to certain types of files created with Office applications. Permissions can prevent recipients of those files from:

·         Forwarding

·         Copying

·         Modifying

·         Printing

·         Faxing

·         Cutting and pasting content to or from the restricted file

·         Using the Print Screen key to copy the content

When IRM protection is applied, the restricted actions are greyed out as menu options. You can also set an expiration date on IRM-protected content so that it cannot be viewed or used after that date.
 
IRM protection can be applied to:-

·         Word documents

·         Excel workbooks

·         PowerPoint presentations/templates

·         InfoPath forms

·         Outlook email messages. 

You can apply various restrictions in one document, depending on your needs. IRM permissions can be set on the following bases:

·         Per user

·         Per document

·         Per group (requires Active Directory)

·         Per library (in Microsoft SharePoint Server)

IRM permissions stay with a document when it is sent across the network and when it is saved on the server. To ensure complete peace-of-mind and heightened security, when you apply IRM protection to an email message, attachments to that message that were created with Microsoft Word, Excel or PowerPoint are also automatically IRM-protected.

When Should I use IRM to Protect Data?

IRM can be used to protect data in the following scenarios:

• You need to provide a user in a part of the organization the ability to view a spreadsheet containing financial information but you want to limit his or her access to the file so that it will be unavailable after two days.
• You need to send a confidential email message with a sensitive attachment to another internal user but you want to restrict that user from forwarding the message to anyone else or save a copy of the attachment.
• You need to allow a colleague within the organization to review a report in the form of a Word document that contains sensitive information, but you want to restrict the colleague from making any changes to the document.

Understanding the roles of IRM and RMS

Microsoft’s Rights Management Services provides the foundation on which organizations can build a strategy for protecting documents and email messages created in Microsoft Office from being inadvertently mishandled by recipients.  An RMS server running Microsoft Windows Server serves as a central repository for information used to identify what rights have been granted to particular users and to verify the credentials of those users. Information Rights Management is the component in the RMS-enabled application that enforces those rights

Each time that you attempt to open a document, workbook, or presentation with restricted permission, you must connect to the licensing server to verify your credentials and to download a use license. The use license defines the level of access that you have to a file. This process is required for each file with restricted permission.

RMS uses digital certificates to validate the identities of users. The certificates are issued by the RMS server based on Windows authentication. Rights management protection works at the file level, so that even when the file goes outside the organization or network, the protection is still built into the file itself.

MMC and IRM

MMC has successfully implemented IRM solutions which has enabled organizations to efficiently secure company sensitive information.

IRM used with Microsoft SharePoint Server or Windows SharePoint Services provides organizations with a central location to more effectively manage and share company information which is also safely secured and protected.

Please contact Anthony Simons of our Business Intelligence Department at MMC if you would like to explore how Information Rights Management could benefit your business. Telephone 021 530 1600 or email anthony@mmc.za.com

10 Excellent Tips for Microsoft Excel 2010 (with pictures)

Excel is, without a doubt, one of the most powerful, complex, and tricky desktop apps ever designed. Mastering Office 2010's spreadsheet app can take years; fortunately, we've got 10 very cool shortcuts to Excel mastery.

Our ongoing series of Tips for Microsoft Office 2010 has given little consideration to Excel 2010; that's because this giant, complex spreadsheet app is worth an entire collection of tips all to itself. With its cool new Sparklines displays and enhanced pivot table tools, Excel is a more powerful part of Office 2010 than ever. But our tips concentrate on the basics—you don't need to write complex formulas to take advantage of them, and, since basic functionality mostly hasn't changed, you can use most of our tips with older versions of the app, as well.

1. Display formulas instead of results

A single keystroke lets you toggle between Excel's normal display, which shows the results of the formulas in the spreadsheet, and a display mode that shows the actual formulas. The keystroke is Ctrl-tilde (tilde is this key: ~); press it once, and Excel displays formulas instead of results. Press it again, and the results appear again. This single keystroke is a lot quicker to use than the alternate method of displaying formulas, which is to open the File menu, go to Options, then Advanced; then scroll down to Display Options for this Worksheet and check the box next to "Show formulas in cells instead of their calculated results." Uncheck the box to display results again.

Bonus tip: when you use this tip to display formulas in cells, select a cell with a formula, and Excel outlines the cells that are referenced in the formula.

2. Display the actual cell values when creating or editing a formula

The previous tip shows how to display formulas in the entire spreadsheet. Here's how to switch between displaying the cell addresses in a formula and the actual values in each cell. Use any method that displays a formula—for example, when the formula of the current cell is visible in the formula bar, or when you're creating a formula for the first time, or after pressing Ctrl-tilde to display formulas throughout the worksheet. In the formula you want to find out about, select the cell addresses, and press F9. The highlighted addresses are replaced by the values of all the cells referenced in the formula. Press Esc to return to normal display. The screenshot above shows a formula that normally displays the address D12:O12, but when I selected that address and pressed F9, the actual values appeared.

3. Highlight all cells referenced by a formula

When you're debugging a worksheet, you can easily navigate through all the cells referenced in a formula. Highlight the cell and press Ctrl-[ (that's Ctrl-open-square-bracket). Excel highlights all the cells referenced by the formula, and moves the current selection to the first of the referenced cells. Press Enter, and the selection moves to the next referenced cell, and continue to press Enter to move though the rest of the referenced cells. In the screen shot, I was originally in cell D35 and pressed Ctrl-[. This highlighted D12, D26, and D35; and D12 became the current cell.

4. Highlight the formulas that reference the current cell

The previous tip explained how to use Ctrl-[ (Ctrl-open-square-bracket) to see all the cells referenced by a formula. What if you want to do the reverse, and see the formulas that reference the a cell, select the cell, and press Ctrl-] (Ctrl-close-square-bracket). As in the previous tip, the selection moves to the the first formula that references the cell. Press Enter repeatedly to navigate to the other formulas that reference the cell. In the screen shot, I was originally in cell D3. I pressed Ctrl-]. This highlighted B3, D12, and D35, and B3 became the current cell.

5. Add content or formatting to multiple sheets at once

You can add content or apply formatting to two or more of the sheets on a multisheet worksheet by "grouping" the sheets together. When you group multiple sheets, any content or formatting that you add to one sheet also gets added to all the other sheets, so you can add a row of headers to one sheet and have it automatically appear on all the sheets that are grouped together with it. To group all the sheets in a worksheet, right-click on any of the tabs in the lower left of the window, and click Select All Sheets. If you only want to select two or more individual sheets, hold down the Ctrl key and click on the tabs of the sheets that you want to format or edit at the same time. When two or more sheets are grouped, Excel adds the word "[Group]" (in square brackets) after the sheet's name in the title bar.

6. Be careful when working with grouped sheets

Grouping is a powerful but dangerous feature. If you delete the contents of a cell in one grouped sheet, the contents of the cells at the same location in all the other grouped sheets will also be deleted. So before you start editing in a worksheet with grouped sheets, right-click on one of the tabs at the lower-left and choose Ungroup Sheets.

7. The standard "Select All" key doesn't work the way you think it does

Experienced Windows users know that Ctrl-A is the shortcut key that selects everything in a window or document; the A in Ctrl-A stands for All. Ctrl-A works this way in every application you can find—except Excel. When you press Ctrl-A in a worksheet with data in it, you select the current region (that is, all connected cells), not the whole worksheet. But wait—if you immediately press Ctrl-A a second time, you select the entire worksheet—unless the worksheet contains a table, in which case your second press of Ctrl-A will select the current region and the summary rows (typically the headers) of the current table. And if your second Ctrl-A selects the current table and its summary rows, then you'll need to press Ctrl-A a third time to select the entire worksheet. In the screen shot, I pressed Ctrl-A once, and only the table got selected.

Bonus tip: the one-step way to select the entire worksheet is to the click on the gray box at the upper left corner of the worksheet—the one at the corner of the lettered columns and numbered rows.

8. Use the Ctrl-key for quick navigation

When you want to move quickly to the left, right, top, or bottom cell in a data set, just press Ctrl and one of the arrow keys. Let's say you want to select the cells in the current row of the data set, but only the cells with numbers, not the labels—for example, sales figures for January through December. If the current cell is in the middle of the row (for example, the cell with the sales figure for May) press Ctrl-Left to go to the first data cell in this set (the cell with the sales figure for January), then hold down the Shift key and press Ctrl-Right to select all the sales figures for January through December. In the screen shot, I started in cell G12, pressed Ctrl-left, then Shift-Ctrl-right to select twelve months of data.

9. The quickest way to see a sum or average

Type a few numbers in some adjacent cells, or highlight some numbers in existing cells. Now look down at the status bar at the foot of the window. Excel displays the average of the numbers, a count of the cells, and the sum. You can also use this trick with non-adjacent cells. Here's how: click on one cell, then hold down the Ctrl key and click on a cell with a number that you want to add to the number in the first cell. Continue to add numbers by Ctrl-clicking in additional cells. The average, count, and sum in the status bar get updated each time you click another cell. By the way, when you use this tip, Excel ignores any cells you click that contain text or graphics instead of numbers.

10. Tidy up your charts

If you've ever created two or more charts on a worksheet, you know how tricky it can be to align them and make them all the same size. Here's the easy way. Click on the first chart to select it, then hold down the Ctrl key and click on the other charts that you want to align with each other. When all the charts you want to align are selected, right-click on any one of them and choose Size and Properties. This opens the Format Shape dialog, and the measurements that you enter in the dialogue will be applied to all the selected charts. After making the charts the same size, go to the Drawing Tools tab and click on Format. Use the Align dropdown menu on the ribbon to align the selected charts and to distribute them evenly either horizontally or vertically.

PC Mag

How to Plan a Successful Data Centre Relocation

Estimating data centre relocation costs accurately is a challenge that is facing an increasing number of organisations that are being forced to relocate their data centres due to the space, power and cooling limitations of their current facilities. Here, Knowledge Center contributor Kris Domich explains how to plan a cost-effective and successful data centre relocation.

In the past two years, I have had the pleasure of scoping and executing more than 130 data centre relocations. During this time, I have participated in every facet of the relocation life cycle, including application and business process discovery, application bundling, scheduling, logistical planning, physical move execution, and vendor recertification. Regardless of where one is within this life cycle, hidden and often unforeseen gremlins lay waiting for the opportunity to sabotage your move.

OK, well, maybe it's not that dramatic, but the result of these gremlins may be equally as fatal to the success of your data centre move. Understanding the risks of any data centre relocation event, anticipating them, and ultimately planning for contingencies are the best complements to even the most well-planned relocation event.

1. Planning relocation: everyone is a stakeholder

More often than not, I have observed reluctance on the part of organisations when it comes to investing in a proper planning regimen before physically executing a move. Across the last 100+ relocations I have managed, no less than 60% to 70% of the total relocation cost was attributed to planning.

Frankly, physical logistics involves both art and science; planning is all science. You must know the implication of removing any cable, network device, server, storage volume, database, application, service or person within your core business during your move.

Planning a data centre move often begins within the IT or facilities department. In recent years, IT growth and the significant increase in power and heat compaction have stressed data centres to the point of exhaustion when it comes to power and cooling. Many data centres have yet to reach physical capacity before the supporting environmental systems reach maximum capacity.

This reality is usually the basis for a facilities-driven need to relocate to an area that can better accommodate the power and cooling demands – and often comes to the surprise of the IT department. Because of the delicate nature of the service provider relationship that IT has with both the facilities department and the business units, a successful relocation project must have stakeholder representation from each of these three areas of the organisation.

In even small and mid-sized data centres such as those with fewer than 100 racks, IT assets are often placed in a seemingly random manner. At one point there may have been an attempt to group assets logically (by application, department or function, for example) but, over time, gating factors such as power density, form factor and other considerations resulted in assets being placed wherever they would fit.

Consequently, the physical plants resemble an interwoven fabric of delicate communication paths, risking service disruption if any one of these paths is disturbed. This is metaphorically consistent with the integration of workflows, services and applications supported by the physical infrastructure. Because of this, data centre migration planners must rely heavily on the quality of the documentation about the application environment, as well as the tribal (and often undocumented) knowledge within the minds of the system designers, administrators and owners.

2. Logic, then physics

Relocations can be achieved in a number of ways and often employ a combination of the following three methods:

Method No. 1: The lift and shift

The simplest, the lift and shift, involves taking a verified, successful backup of a system, powering it down, moving it and powering it back up.

Method No. 2: The swing move

Another, more complex method is the swing move. This method entails setting up temporary systems at the target site and replicating data to those systems in order to shift an application or service to the target site quickly – and then powering down and relocating the equipment from the source site.

The temporary equipment is retired once the service or application is again running on its original equipment. This method is commonly used when the time it takes to physically relocate a system exceeds the organisation's tolerance for downtime of the application or service.

Method No. 3: The logical move

Another method that is gaining widespread popularity is the 'logical move', which does not involve physically relocating any assets. Logical moves are used for existing virtual machines or as an opportunity to migrate physical systems to virtual platforms. Many organisations find that data centre relocation creates opportunities to gain increased efficiencies such as those that come from consolidating physical systems.

Moves of this type involve setting up platforms to host VMs at the target data centre, performing physical-to-virtual (P2V) migrations at the source site, and transferring those virtual instances to the target site over high-speed links. The VMs are then started at the target site and users are pointed to the applications and services running at the target site.

Regardless of the method employed, an organisation must always go through the exercise of defining the logical components of each service and application. It must map those components back to physical devices. This process, commonly referred to as 'application bundling', allows the relocation planners to develop a picture and logical sequence of events that must take place in order to move an application or service. It also helps to flesh out the logical and physical dependencies that applications and services have on one another.

3. Preparing the target site

Many organisations will find that some portion of existing assets is not worth moving. This may be because the assets have reached end-of-life (EOL), are being virtualised or are otherwise decommissioned. Regardless of the reason, any change in the number or type of assets that will reside in the target site will have an effect on the physical and environmental requirements of the target site.

The bundling exercise will indicate what needs to move, what doesn't, and what accommodations may need to be made for swing equipment. From this, a physical space plan can be derived and the necessary calculations for space, power and cooling can be performed.

Since most equipment racks are designed to be stationary, the systems must be removed from the racks prior to physically relocating them. As previously mentioned, a bundle may be composed of systems from multiple racks at the source data centre. This means there may not be a free rack available to move with the systems of a given bundle. For this and other reasons, most relocations will require some new racks to be pre-deployed at the target site in order to receive incoming systems from the source.

Some organisations may opt to leave all racks behind at the source and deploy a uniform system of new racks at the target. This offers many advantages that may outweigh the costs such as standardisation, the ability to easily integrate environmental sensors or rack-level security, and a uniform aesthetic in the target site.

When specifying the requirements for the target site, it is important to keep in mind the opportunity for improvements and the ability to correct shortcomings that developed over time and as a necessity to sustain growth in the source site.

One area in particular is the cable plant (OSI Layer 1); data centre relocation gives an organisation the option to hit the reset button on how they deploy and manage Layer 1. Companies must pay special attention to pre-patching each rack with the proper colour coding and labelling scheme prior to relocating systems to the target. Having each rack pre-patched will save a considerable amount of time and minimise troubleshooting headaches on move days when time is precious.

4. Execution: scheduling and logistics

Compared to planning, move execution can be surprisingly less painful, especially with the right logistics partner. While it is possible for an organisation to perform the necessary discovery, arrive at a solid set of move bundles and develop a timeline, few organisations specialise in the complexities of scheduling, managing and coordinating the logistics of data centre relocation.

Scheduling requires tight coordination with business units and application owners. The schedule must be governed by the organization's tolerance for downtime of the application or service that is moving.

Downtime begins when the application or database is taken offline – and includes the time necessary to relocate assets, perform and verify a backup, replicate data (when required), power down the system, pack and transport, rerack and reinitialise. Within this timeline, a rollback plan must also be factored.

Some platform vendors may require you to have vendor assistance with powering down and reinitialising a system. This fee-for-service arrangement – often referred to as 'recertification' – is required so there is no lapse in warranty and maintenance. Many equipment vendors will offer relocation services, which include the recertification service.

However, it behoves an organisation to compare the costs of an OEM move versus a non-OEM move with recertification services taking place after the fact. When using a proven relocation partner in conjunction with an OEM for recertification, risk is appropriately mitigated and the costs are commonly reduced.

Insured and secure transportation of assets is also critical to risk mitigation. Data centre assets differ from furniture in the way they must be handled, packed, secured and shielded from electrostatic and electromagnetic damage. As such, only qualified personnel and the appropriate packing materials should be used when transporting data centre equipment.

Any party transporting data centre assets must provide full replacement value insurance for theft, damage, or loss. Plus, this insurance must be applied to each conveyance (that is, each vehicle or vessel transporting equipment) as opposed to tying the insurance to the event itself, which may be comprised of multiple conveyances.

The industry average default insurance is approximately 60 cents per pound of cargo, which won't cover the loss of any data centre asset. Ensure that your carrier or relocation partner can provide conveyance-based insurance equal to or greater than the value of the conveyed assets.

5. Data centre relocations today

Over the past two years, I have seen a dramatic spike in the frequency of data centre relocation requirements. This is expected to continue for at least the next few years because the convergence of increased physical compaction of IT systems and the mean age of a typical data centre will continue to force many data centres into early obsolescence.

More than half of the data centres I have seen relocated in the past two years are facilities that are seven to 10 years old. The typical planning horizon for a commercial building is 20 years. Today's equipment power densities were not considered seven to 10 years ago. These power densities continue to be on the rise, with some analysts predicting greater than 40kW per rack and beyond. Unless your data centre could easily handle that density today, chances are you, too, will be moving sometime in the next few years.

Data centre relocations are an exceptionally high-risk concept. The level of effort put into the planning phase by those who specialise in orchestrating these migrations is directly proportionate to the amount of risk mitigated. It is an exercise that requires collaboration with areas of the business with which one might not normally interface.

Keep in mind that everyone is a stakeholder and approach the discovery exercise with patience and an open mind. These two guiding principles are critical to uncovering all of the information needed to accurately identify dependencies and understand the sequence of events required to move your assets. Chances are you'll probably need to assemble a team comprised of more than just two guys and a truck.

Kris Domich is the principal consultant of data centre solutions for Dimension Data North Americas. Domich has over 16 years of technical and consulting experience in data centre migration, design, management and operations. His data centre migration clients include many Fortune 100 companies as well as federal, state and local agencies. In addition to the US, his repertoire spans continents, with significant experience in Europe, Middle East, Asia, Australia and Latin America.

Recognised globally for a strong business acumen and profound technical knowledge, Domich has served as a direct advisor to the executive leadership of numerous Global 1000 companies. He is a regular speaker at international trade shows and events, and often publishes articles on data centre design, electro/thermal considerations, virtualisation and other data centre trends. He can be reached at kris.domich@us.didata.com.

IT Web

Secret Google Tricks: How to Search Smarter

I like to think that my vocabulary and usage skills are above average; I am, after all, a professional writer. But a little known search function in Google showed me that I've been misusing "peruse" for years. And it taught me that when a teenager says he's "pwned" me, it wasn't a compliment.

Google is full of useful functions and search tricks that you probably don't know. I recently spent some time with Google engineers Jake Hubert and Dan Russell, learning ways to get more out of Google search. These are tips you'll find useful, whether you're wondering how to convert Centigrade to Fahrenheit before you head for the beaches in the south of France, or need to look at a patent for a technology innovation.

We had hardly started our conversation, when Russell gave me his first, and over-arching, tip: If you want to know something about Google search, simply search for it. "Don't bother to remember a URL. I don't," he said.

[ For advice on how to do up-to-the-minute searches, see CIO.com's Real-Time Search: 5 Alternatives to Google, Bing. ]

Let's say you want to know something about a patent. Simply type "Google patents" in a search bar, and the first hit you get will take you to Google Patent Search. Google and the U.S. Patent and Trademark Office have struck an agreement, and you can now have access to more than 7 million patents, including drawings.

Narrowing By Date and Time

I've often wished that I could sort search results by date. It turns out that you can, but it takes an extra step. Let's say you're interested in an announcement Bank of America made a few months ago about credit card rates. Start by typing "Bank of America and credit cards" in the search bar. You'll get millions of hits, of course.

Now look at the left-hand navigation bar. You'll see a heading "any time." Expand it and you'll quite a few date options. Choose one, run the search, and then notice on that same left-hand bar that you've got the option to sort by date.

Similarly, it's possible to search Twitter and zero in one a particular time. This morning, for instance, I noticed that a Democratic congressman is pushing a bill that would allow states to collect sales tax. I started at the usual search bar with "internet sales tax," and when I got results then went to the navigation bar and clicked on "updates." Google has a very slick slide device that let's you pick an exact time and see who Tweeted what about the subject that interest you.

In fact, looking at the navigation bar is always a good idea; check to see what can be expanded and you'll often find options that you didn't know existed.

Calculators and Conversions

I was surprised to see how many new things you can do from a Google search bar. Google Calculator, for instance, is a hidden feature of Google search. You can type math expressions, unit conversions and many other questions that have a unique answer.

Like any decent calculator, the Google calculator will solve problems ranging from basic arithmetic to trigonometry--but this one is free, and you never misplace it. Here's a page that will show you how to use it, including which operators work with different types of problems, including gnarly calculations.

One thing that's particularly cool is the calculator's ability to do conversions using plain English queries. Simply type in a query like 128 kilometers in miles and you'll get the answer (79.5 miles) without searching. Or type "270 euros" and before you've finished it will tell you that the equivalent in U.S. currency is $338.90. There's also a real currency conversion tool.

What else can you do from the search bar? Plenty. For example, typing "weather 94107" (my Zip code) serves up a forecast for San Francisco, while "CSCO" (the stock ticker for Cisco) gives you a quote. And to find out what "pwned" means, simply type "define: pwned" and you'll find out. That function looks at more than standard dictionaries; it includes for example, the Urban Dictionary, a good place to find slang, like pwned, that has not yet made it into the mainstream of the language.

Inside Legal and Academic Journals

It's not always easy to find works published in an academic or legal journal. Through the years, I've spent a fair amount of money using a variety of paid services to dig out information I've needed for articles. While Google Scholar probably won't take the place of a Nexis Lexus or WestLaw, it offers a number of sophisticated search possibilities.

If you're looking for legal decision, Scholar lets you search for either federal or state court opinions, while using pull down menus that allow the user to narrow the search by date, or by author, or a particular state. Or you can search legal journals. Scholarly and specialized publications in 24 categories are accessible by subject.

Google government search, with the sly URL www.google.com/unclesam, lets you search across U.S. and state governments, including domains such as .gov, .mil, and those of the states, such as .ca.

And as to perusal, it actually means examine or consider with attention and in detail, not as I thought, to browse or look at something casually. Ooops. Google has pwned me.

San Francisco journalist Bill Snyder writes frequently about business and technology. He welcomes your comments and suggestions. Reach him at bill.snyder@sbcglobal.net.

CIO

Why Executives are the Easiest Social Engineering Targets

Security managers are often concerned about employees who use Facebook at work and fall for the 419 "I'm trapped in London and need money" scam. Others might still have some in their organization who are convinced it is the Prince of Nigeria who wants to share his fortune. And with spear phishing, a targeted email attack in which messages are created to look like they come from an employer, bank or other trusted source, now a common criminal technique, the need for effective awareness programs for employees has become paramount. But those concerns, according to Jayson Street, a security consultant and CIO of Stratagem 1 Solutions, shouldn't be the chief worry. That's because the biggest social engineering threat is the top executives in a company -- and they're the ones who need to be educated the most.

Also see: 9 dirty tricks: Social engineers' favorite pick up lines Street, who conducts penetration testing and gives advice on what he calls "patching the human problem" said with access to sensitive data and confidential information, C-level executives are the juiciest targets for criminals, and they are putting the company at serious risk. These vulnerabilities won't go away until everyone understands security, from the bottom of the organization, right up to the top.

"We need to have executive buy-in of these risks," said Street. "Executives need to understand what can happen and how to avoid it."

Street details the four reasons why top executives may be the most likely target for a social engineering attack.

Also see: Social engineering:The Basics

They expect not to have to follow security rules

They are the most important people in the company, their jobs are extremely demanding, and they expect to be exempt from all of those inconvenient rules and policies that the security people have put in place, said Street.

"They are the ones who expect they don't need the firewall blocks as much, or that they can go to the web sites others can't," he explained. "They don't want to be filtered, logged or monitored, so they don't want to go through the web proxies that also protect them from compromise."

The problem is these executives are often no more security smart than your average employee and can be compromised with many of the common social engineering scams. And because they are executives, the social engineer is much more likely to make the attack targeted and personal, going as far as to send an email that appears to be from a legitimate source, but actually contains a bad attachment.

They think you're going to protect them

Once the executive has opened up that attachment and infected their machine, they're going to ask why security didn't protect it, said Street.

"When an executive is compromised and causes a loss for the company, he is not going to say 'Oops, my bad.' He is going to say 'Why didn't you protect me from myself?'"

Street recently completely a series of penetration tests for two hotels and gained access to the server room by sending a forged email to hotel employees which claimed he was the CEO of the hotel's tech support supplier.

"Afterward, I asked them 'Why did you let me in?' and they said 'This is how the owner does things. He sends emails like this all the time!'"

The point is: The executive, or in Street's example the hotel owner, may not realize what they are doing poses risks (in this case not having a system to verify emails) because they assume security knows better and will always have their back.

They use the latest technology

CIOs are the best targets for social engineers because they are the ones working with newer technology, said Street.

"Who is going to be using the newest iPhone before it's approved in the company?' he said. "Who will have the iPad working on the internal network, getting their email? It's going to be those C-level people. They are getting the laptops that aren't standard. They want the ultra-light or the one that can do a certain thing."

The problem is, the newness of these technologies mean they haven't been properly vetted for security risks and haven't been configured into the network securely, said Street. The problem is compounded by the previous point; the executive's assumption that IT already has the proper security in place to deal with the device, when they often do not.

"They might actually think because it's newer it's more secure, which it's not. And then they still want to log their laptop into their home network and then the trust model changes completely."

They have family who don't know they are targets

The attacker is looking for the easiest way in, and since the network administrator will mostly likely have restrictions and is doing some monitoring, it's much easier to go after the CIO's wife, husband or kid on Facebook, said Street. These family members often use computers that are shared by the CIO once he or she is home. (Also see: How security professionals monitor their kids)

"Why not compromise the wife's computer system and then, when CIO brings his laptop home, he is now on the internal network. The home network is more of a private network, which is more trusted. And that means the firewall lets more stuff in. It makes more sense to compromise the CIO that way."

Street says social engineering awareness has to extend out to these family members who unfortunately may become unwitting victims in a criminal act. "If you've got millions of dollars at stake, and you are doing corporate espionage and want to steal secrets or money, you don't go after your target only, you go after everyone in your target's network, too." 

CSO

The Pros and Cons of Windows 7 Security

Businesses are eyeing a transition to Microsoft Windows 7, and with a wealth of security features that are part of it, it's worth figuring out the good and bad about each of them, says Gartner analyst Neil MacDonald, who notes in some cases, third-party security products might be the better fit

.

The AppLocker feature in Windows 7 offers an application-control capability that lets the IT manager set up a list of applications allowed to run, said MacDonald in his presentation at the Gartner Summit & Risk Management Summit 2010 last week. Often called whitelisting, this type of security control offers a possible lock-down technique, but the downside is that applications used within organizations by employees tend to grow, "and the trick is managing the whitelist over time."

"Care and feeding of the whitelist becomes cumbersome over time," MacDonald said, noting that there are several vendors in the application-control market, including Bit9, CoreTrace and McAfee (which acquired SolidCore) .

BitLocker, Microsoft's full-disk encryption capability for protecting system files and data, will be another security feature that businesses will want to evaluate in Microsoft Windows 7, MacDonald said. Calling it "good but not great," he noted that on the minus side of BitLocker, it has no self-service key recovery, no Windows single sign-on, and no smart card support for boot drive.

"By license restriction, it cannot be used where operating system virtualization is used," MacDonald pointed out. In addition, there's no support for non-Windows machines or Windows Mobile.

"It's another of those good but not great technologies," MacDonald said. "You should be encrypting all mobile devices."

Enterprises might want to look at product alternatives, including http://www.networkworld.com/news/2007/100907-mcafee-buys-safeboot.html ">McAfee Safeboot, Sophos-acquired Utimaco, Credant Technologies, and PGP and GuardianEdge, both of which Symantec recently announced it was http://www.networkworld.com/news/2010/042910-symantec-pgp-guardianedge.html ">acquiring.

Prices for this type of desktop encryption product have been dropping from $75 to $90 five years ago to today's range of about $10 to $15, he noted. Encryption today is often something "thrown in to get your business from the antivirus vendor," MacDonald said.

Windows 7 BitLocker has not yet been certified under the federal government's FIPS 140 program though it's in process to receive that certification, he pointed out.

Other security controls in Windows 7 also have their pros and cons, according to MacDonald.

For instance, the user-account control, which limits the ability of either applications or users to make unsanctioned system changes, has been improved to minimize prompts. But on the downside, it won't prevent someone running as a standard user from still installing software, so application control may still be needed.

Network World