Multi-Media Computers News

IT Risk Management - Still a Dangerous Afterthought for Many

2011-08-25T14:55:00.000+02:00

From market and credit risks to operational risks, most organisations are prepared for almost every eventuality - with the disturbing exception of IT that is.

While IT may still be seen by many organisations as separate to the overall Risk Management Strategy, our increasing reliance on technology means that it forms the foundation of standard risk management considerations and therefore needs to be incorporated not as a separate concern, but as one that underpins each and every function throughout the business.

"Within the SMB sector in particular, we see so many companies that not only inadvertently place themselves at a competitive disadvantage, but more importantly, compromise the safety of their physical IT assets and intellectual property" says Adam Whittington, Financial Director at MMC.

"A balanced Risk Management Strategy needs to address all risk throughout the business and provide the means for ensuring optimal agility, productivity, profitability and growth" says Adam.

3 Pillars of IT Risk

There are three key areas that an organisation needs to consider when assessing IT Risk within the overall Risk Management Strategy:-

Physical IT Assets

Ensure the correct use, optimal operation and safe-keeping of hardware such as laptops, desktop computers, servers, printers etc.

Software

Ensure various applications, such as your operating systems (Microsoft Windows) server management (eg.. Windows Server), accounting packages (eg. Pastel) etc. are compatible and current thereby enhancing productivity and collaboration.

Data

Manage access to intellectual property including documents, files, emails, databases etc. through ensuring standardised password policies for example and control who can access what information, while tracking employee activity within your IT network.

"By incorporating IT as a strategic consideration, companies are safeguarding their assets, while taking an auditable approach to compliance and their future success" says Adam.

Agility - The Future of Risk

With technology evolving at an increasingly fast pace, businesses wishing to remain competitive must ensure that they can adopt and effectively manage new technologies. Cloud computing is just one example of a technology that features unprecedented benefits, yet left unmanaged, has seriously detrimental implications for business.

Choosing an experienced IT partner that understands the relationship between strategic business operations and modern IT requirements will assist organisations to leverage their success. In determining whether an IT partner is able to deliver results, companies should consider the following:-

Knowledge of Business
Alignment to Best Practice & IT Industry Governing Bodies
Availability and Adherence to Service Level Agreements and Non-disclosure Agreements
History, Proven Abilities, Reputation and Expertise

Established in 1991, Multi-Media Computers (MMC) provides organisations from a diversity of industries with a trusted Outsourced IT Management Service. Based on the Kaseya platform, MMC has customised our Managed Service solution (branded TOTALcare) to suit the unique requirements of South African business. Companies are invited to contact Adam Whittington to discuss their Risk Management concerns or requirements by emailing adam@mmc.za.com or calling 021 530 1600. Visit our website for more information at www.mmc.za.com.

MMC wins 8th Place in MSPmentor Top 10 MSP’s in Africa Awards

2011-06-09T09:34:00.000+02:00

In addition to industry certification, companies have now an additional means of validating service levels when choosing an IT Service Partner.

MSPmentor, an internationally respected authority in the Managed Services Sector conducts an annual survey, in which it collates the business and service level data of over 100 qualifying Managed Service Providers globally. Managed Service Providers are then ranked to conclude a list of 100 top MSP’s across the world according to the size of their business and their ability to deliver proficient services to their clients. A position within the top ten IT Managed Service Providers indicates a high level of customer service, knowledge and expertise in delivering Managed Services.

MMC was ranked the 8^th top Managed Services Provider in Africa for 2011 - an achievement of which we are exceedingly proud.

“This survey and award process is a great step forward as it really sets a benchmark in the Managed Services Sector and provides companies like ourselves, with something significant to aspire to” says Adam Whittington, Financial Director at MMC.

“Our team was so excited as this award is the result of their hard work and dedication to making our Managed Service solution – which we have customised and packaged as ‘TotalCARE’ – really work exceptionally well for our clients” says Adam.

About TotalCARE

Many of the contenders for the MSPmentor awards utilise a common platform through which they deliver services – namely Kaseya. Kaseya is developed in the US, so what MMC has done is to take this platform and customise the service to suit the specific needs of South African business. This makes our service offering not only unique, but also that much more effective.

“The TotalCARE service is structured to give us a really in-depth understanding of our clients business which places us in a far better position to provide services aligned to their actual needs” says Rita Whittington, Managing Director of MMC. “Companies that are serious about growth and alleviating risk need an IT Service Partner that really understands them and can align with their business strategy”.

“Providing Managed Services through TotalCARE enables us to deliver a solution that is based on sound methodology. It requires us to exercise our Project Management abilities, which is a distinct benefit for our client. Break-fix services just don’t offer the same level of depth or consistency as the service is symptomatic. This is something that companies need to seriously consider” says Rita.

What our Clients Say…

“We have a very positive relationship with MMC and this has been based on the fact that they are punctual, knowledgeable and very professional in how they deliver their services. I have found their team to be experienced and highly energetic in how they communicate and work with us - MMC is really on the ball” says Chris Lane, Financial Director at Berry and Donaldson.

“MMC have assisted us in upgrading our entire environment from old, redundant, resource inefficient technologies and unmanaged security issues, to an environment that is secure, operationally effective and cheaper to maintain. I love the fact that they look after my environment while enabling me as the IT Manager to remain in control. Their monthly reports offer specialised information that an IT person needs and these are delivered on time every time. The cost of their service is another big factor and I am happy to say that MMC is very well priced for the service they offer” IT Manager, Cape Town NPO.

Certification Central to Success

Most companies are heavily reliant on a stable and efficient IT environment to compete in today’s dynamic business community. Choosing an IT partner that invests in continually enhancing the skills of its people, as well as remaining aligned with cutting edge technological developments and continually improving service delivery standards is critical to the success of your organisation.

Our technical team members are all ITIL certified to the highest standard within their area of responsibility, with Adam Whittington having achieved the highest qualification as an ITIL Expert. In addition, we are ISO 9000 certified and are members of itSMF International, as well as TruMethods.

Our award through MSPmentor really is the cherry on top.

Companies seeking advice, or who wish to know more about TotalCARE are invited to contact Rita Whittington, Managing Director of MMC on 021 530 1600, or via email at rita@mmc.za.com.

MMC Wins 'Regional Partner of the Year Award Cape 2010' Award

2010-11-26T13:15:00.001+02:00

At a prestigious gala dinner held at the ‘One and Only’ hotel in Cape Town, MMC was awarded the ‘Regional Partner of the Year Cape 2010’ award from MWEB.

“We partner with MWEB because they offer us a reliable service which we in turn, are able to supply with confidence, to our customers” says Rita Whittington, MD at MMC.
MMC would like to express a big thank you to Herman, Rory, Wesley and Reubens from MWEB who have been truly fantastic to work with. We would also like to congratulate our staff members who were instrumental in making this award possible.

Have you joined us on Facebook or Twitter

2010-11-26T13:14:00.002+02:00

MMC recently launched our Facebook page and we would like to invite you to join us! Please click on the following link to view our new page.

We also update our Twitter page on a regular basis, so please follow our ‘tweets’ by clicking on the following link.

Why join us on our Social Media Pages?

Whether it’s an amusing anecdote to brighten your day, a useful tip or important announcement – you will be kept in the loop and won’t miss out on any fantastic opportunities we have on offer for our customers.

Your 3rd FREE Keyboard Shortcut Chart - Download it Now!

2010-11-26T13:13:00.003+02:00

By now you should already have two MMC keyboard shortcut charts under your belt. If you missed them for any reason, fear not, we have inserted our September and October charts below for you to download.

We all use Microsoft Outlook every single day – so wouldn’t it be great if we had a few tricks up our sleeve that could make our experience a little easier? With our November Keyboard Shortcut Chart that is exactly what we intend to do. This is one chart you will really want to download, print and keep on-hand as the shortcuts we feature will make your day easier and more productive.

Please click on the link below to download your MMC Keyboard Shortcut Chart.

This Months Chart

3rd Keyboard Shortcut Chart - Office Outlook

Previous Charts

2nd Keyboard Shortcut Chart - Office Excel

1st Keyboard Shortcut Chart - Windows 7

10 PC Disaster Recovery Tips

2010-11-26T13:13:00.000+02:00

Here's the scenario: one minute you're working and surfing quite happily, the next the Blue Screen Of Death rears its ugly head and your machine won't boot.

Whatever's happened to Windows is serious and the problem is confounded by the absence of backups.

You've been promising to make some but never quite got around to it. Don't panic! Just follow these steps.

1. The easy win

Before you bring out the big guns – which we'll discuss later – it pays to explore the easy options. Try using Windows' own repair and recovery tools, accessible from your installation disc.

Depending on the version of Windows that you're running, the choices will differ. For Windows 7, the key is Startup Repair. This will hopefully "automatically fix problems that are preventing Windows from starting".

2. Leave your hard drive alone

If you're dealing with sensitive data on a crashed PC, it pays to be careful. It's safest to leave the operating system alone and try to access data, files and folders indirectly.

This is particularly true if you suspect you're battling a virus attack. By running the host OS, you give the contagion the opportunity to call home, update and send out more of your data. With all this in mind, we say don't boot a damaged OS – use a Live CD rescue kit instead.

3. AVG Rescue CD

If your PC has been brought to its knees by a virus, getting back into Windows with enough control over the system to remove the contagion can be tricky. Thankfully, there's an easy answer – the AVG Rescue CD. Download the ISO image from here and burn the image to a CD or create a bootable USB key.

Whatever you choose, the Linux-based rescue CD makes it easy to scan and remove viruses. The Inside Security Rescue Toolkit isn't strictly a rescue system – it's more a tool for forensic security analysis.

It can, for example, examine a huge variety of different filesystems, from common NTFS to more obscure systems. The toolkit will scan for viruses and let you get online from a defunct PC. It can also sniff out rootkits.

4. The Ultimate Boot CD

If nothing we've discussed so far has worked, go for the big guns. It's time for The Ultimate Boot CD, a collection of 100 applications that should help even the most knackered PC get back on its feet.

The interface breaks apps down into categories, such as BIOS, CPU, Memory and so on. Follow the menu structure. Given the number of apps on offer, you should be able to find one that will salve your PC's ills.

5. GParted

GParted is a classic among opensource applications. It's essentially a program that lets you move, resize, check, copy, create and delete hard disk partitions.

It's not uncommon for these to be damaged during a serious crash, so having GParted to hand as a Live CD is essential. Despite the program's obvious power, it's extremely simple to use. You can download it from here.

6. Free ISO burner

To turn an ISO disc image into a functional Live CD, you need an ISO burner. Newer versions of Windows feature such tools as standard, but if you're after something more feature-rich, try Free ISO Burner from www.freeisoburner.com. It can burn to a wide range of media.

7. Undelete a file

Pandora Recovery can resurrect deleted files. Use the portable version – installing it natively risks overwriting the data you're trying to rescue. Get it from www.pandorarecovery.com and build a bootable USB version of the program on another PC.

8. Ghost for Linux

Norton Ghost is a classic application – we've used it and loved it since version one. It's a partition-cloning tool and can be vital in a disaster. To experiment with the concept of partition cloning, try Ghost for Linux. It's an open-source project and you can download it from here.

9. A beeping PC

If your PC does little more than beep after its crash, it's sending you an encoded diagnosis of its ailments.
All you need to do – albeit from a different machine – is visit www.computerhope.com/beep.htm, where you'll find a complete guide to beep codes.

10. What went wrong?

When you're back up and running, you need to work out what caused your PC to fall over. Here, the Windows Crash Dump is your friend. Microsoft does offer some help, but for the ultimate insight, visit Crash Dump Analysis.

TechRadar

Top 10 IT Security Trends for 2011

2010-11-26T13:12:00.000+02:00

Software security firm Imperva will release details of its 10 key security trends for 2011 in November. Here is a preview.

Man in the browser (MITB) attacks are a new threat which consumers will face and the hacking industry is widely adopting, especially as many security products are not mature enough yet to deal with this problem.

File security. With Sharepoint being the fastest growing product in Microsoft history and data growing at a 60% annual rate, file security will become the top security issue. With PCI DSS being expanded to refer not only to databases and web apps but also to files, organisations will need to carefully consider how they protect their files.

Smartphones will be the new target in 2011. Hackers are using mobile devices (smartphones and tablets) as a new attack platform. With a number of applications on mobile devices (CRM, Salesforce, Access to work e-mails), these will become more susceptible to attack.

Hackers and security side-by-side in the cloud. As organisations' IT infrastructure moves to the cloud, so will their security controls. However these services will also become hot targets for hackers, with the popular ones being the most data-rich, the security on these services will need to be tightened immensely.

Insider threat. With more job losses set for 2011, there will be more disgruntled employees than ever. Employees are more likely to want to take information to help them with new jobs or as an act of revenge to pass on to competitors.

Social networks have started to blur the notions of privacy and security. 2011 will bring even more confusion when it comes to security and the trust people put in social networks.
Convergence of regulations over countries. Convergence of regulations amongst the OECD countries will lead to standardising laws on data security and privacy.

Security is becoming part of the business process. With the recent acquisitions of McAfee by Intel and Fortify by HP, suppliers are gaining an understanding of the need to apply security throughout the complete process of building a system. Today, cybersecurity can't be separated from business operations. Security teams need to become business process experts to keep the bad guys disarmed while keeping the good guys productive.

Hackers are feeling the heat. Proactive security seems to be the new approach for most security practitioners and due to this more hackers will get caught. However, due to the industrialisation of hacking, hackers will raise their professional bar by "buying" other smaller groups or merging, leaving the more sophisticated hackers in business.

Hacktivism meets industrialisation. Hacktivism as we know it has been very targeted. However, hacktivists are learning from the success of industrialised hackers and will soon follow in their footsteps. The attacks will transition from restricted targets to a wide range of targets.

Computer Weekly

What You Need to Know About New IE Zero-Day

2010-11-26T13:11:00.002+02:00

Microsoft has issued a warning and guidance to guard against a new exploit that impacts Internet Explorer 6, 7, and 8.

Internet Explorer is under attack again. Microsoft has issued a security advisory explaining a newly-discovered exploit impacting most versions of the Internet Explorer Web browser. The security advisory contains details about the threat, as well as some guidance to protect vulnerable browsers pending a patch from Microsoft to fix the hole.

Andrew Storms, Director of Security Operations for nCircle, commented on the new threat, "It's always a serious concern when an IE zero-day surfaces, especially when it affects all versions of the browser. It's a little late for Halloween, but two zero days in one week is almost enough to make IT security teams run away screaming."

Storms added, "There is some good news however; Microsoft says the attacks are limited at the moment and data execution prevention (DEP), a security safeguard in newer versions of Windows, may be able to prevent attack execution."

A spokesperson from Symantec e-mailed me with these details. "A new zero-day vulnerability affecting Internet Explorer 6 and 7 is being used in targeted attacks. In these attacks people receive emails with a link pointing to a page which determines if a visitor is using Internet Explorer 6 and 7. If so, the script transfers the visitor unknowingly to the page hosting the exploit where malware is downloaded and runs on their computer without any user interaction. The vulnerability allows for any remote program to be executed without the end user's notice."

According to a post on the Microsoft Security Response Center blog, the issue also affects Internet Explorer 8, but not the beta of Internet Explorer 9. Microsoft also stresses, though, that while IE8 might be technically vulnerable, its superior security controls make it unlikely that it could be exploited. "Impacted versions include Internet Explorer 6, 7 and 8, although our ongoing investigation confirms that default installations of Internet Explorer 8 are unlikely to be exploited by this issue. This is due to the defense in depth protections offered from Data Execution Prevention (DEP), which is enabled by default in Internet Explorer 8 on all supported Windows platforms."

A Symantec blog post describes the threat, and the e-mails used to initiate the exploit. The discovery of this attack was related to targeted e-mails sent to a limited number of potential victims--indicating that perhaps the attackers were seeking to compromise specific targets rather than any random vulnerable system connected to the Internet.

The Symantec post explains, "Visitors who were served the exploit page didn't realize it, but went on to download and run a piece of malware on their computer without any interaction at all. The vulnerability allowed for any remote program to be executed without the end user's notice. Once infected, the malware set itself to start up with the computer, along with a service named 'NetWare Workstation'. The piece of malware opens a backdoor on the computer and then contacts remote servers. It tries to contact a specific server hosted in Poland for small files named with a .gif extension. These small files are actually encrypted files with commands telling the Trojan what to do next."

The Microsoft security advisory lists mitigating factors and workarounds to help users and IT admins guard against this threat. Microsoft recommends that users read e-mail messages in plain text, rather than HTML. Users of Internet Explorer 7 can turn on DEP--which is present, but not enabled by default--to offer additional protection.
Those unfortunate souls that still rely on Internet Explorer 6 are directed to set the Internet and Local Intranet security zones in the browser to High in order to block execution of Active X controls and scripts. In addition, a custom CSS style can be forced to override the Web CSS style sheets to prevent exploit, and organizations can also use the Enhanced Mitigation Experience Toolkit to take advantage of newer security controls on older, less secure software.

Arguably, the simplest solution, though, is to simply install the beta version of Internet Explorer 9. Then you can protect your PC against this attack, and experience the new features and benefits of IE9 at the same time.

PC World

25 Internet Security Tips

2010-11-26T13:10:00.000+02:00

Only The Paranoid Survive is a tract on corporate fundamentals penned by Intel's ex-Chairman Andy Grove.
The words should, however, be tattooed on the back of every PC owner's mouse hand.

The internet is full of thieves and vagabonds united by one common goal – to separate you from your hard-earned cash. Here's our guide to staying one step ahead of the bad guys. Follow our internet security tips to stay safe online and you can shop, surf and socialise online, and sleep soundly afterwards too.

1. Guerrilla psychology

Don't be fooled into thinking cyber crime is a technical problem with a purely technical solution. A firewall and antivirus software can protect your computer, but they won't keep you and your identity safe.

Social engineering is the black art of influencing people, and it's the hacker's best friend. In essence, hackers can control us thanks to a refined understanding of human characteristics such as trust, ignorance, greed, the need to be liked, the desire to help and plain old gullibility. Not even the most sophisticated software can hope to protect us from ourselves.

In order to stay safe, educate yourself about social engineering. Take a trip to the Symantec website for a brilliant briefing on the subject. If you get keen, check out The Art of Deception: Controlling the Human Element of Security by Kevin Mitnick.

2. Avoid being a mule

Working from home, earn £500 a week commission. It sounds to good to be true, and it is. Scammers pass stolen cash to unsuspecting people, who transfer it back to the thieves via electronic payment. Your job with the work taken out is money laundering. Beware.

3. Set a serious password

If you're struggling to create passwords that will stump a hacker, check out Microsoft's guide to adding complexity to access codes in such a way that you can still remember the logon.

When you've made a password, you should rate its relative security. Microsoft offers an excellent password checking tool, which can be found here.

4. Split your emails

Rather than linking Facebook, Twitter, newsgroups, forums, shopping and banking sites to one email address, use multiple addresses. As a minimum, use one for social activities and one for financial business.

Your social address will rightly draw more attention than your business one – that's the way you want it to be. If the former is hacked, it won't be as nightmarish as losing control of your financial address.

5. Take care on public networks

Never, under any circumstances, use a public network for financial transactions. Only send your personal and financial details over a network you've set up yourself, or one you know to be secure. Who knows what horrors are lurking on the hard disk of that internet cafe machine, or somewhere between it and its internet access point?
Hackers have also been known to set up laptops to broadcast networks with names such as 'Free Internet Access' in hotels. They'll let you pass internet traffic through them and harvest any juicy details as you type.

6. Virtualise

The truly paranoid should virtualise. The idea is simple: create a virtual PC, use it to surf the internet and, when you've done, destroy it, along with any viruses that may have infected it while you were online.

Running a virtual version of Ubuntu from within Ubuntu is likely to be the easiest way of achieving this style of computing, and it's likely to be very safe too.

7. Anatomy of an iffy shop

By making online shops look slick, official and safe, online criminals hope to dupe us into disclosing credit card details. Fake shopping sites, like much online criminality, rely on social engineering.

There are, however, some tell-tale signs that should help you spot an iffy shop. First, avoid sites that ask for cash, cheque or virtual cash payments only – only do business with sites that accept credit cards.

Next, ensure that the shop has a physical address, ideally in the UK – shopping abroad throws up more potential problems.

8. Be wary of Facebook

There are two key areas of social networking security – the technical sphere and the human one. Technical security is about setting up your profile correctly – your favourite site will explain how, so follow its guides. Next is the human aspect of security and our old friend, social engineering.

No quantity of settings and checkboxes can prevent a user from willingly complying with the bad guys, and this is what they depend on. There's one simple rule to follow here: don't do or say anything online that you wouldn't do or say in real life.

9. A price on your identity

If you're in doubt about the value of your credentials, visit www.everyclickmatters.com/victim/assessment.html. Complete the questionnaire and discover what you're worth to a scammer…

10. Beware geeks bearing gifts

Social engineering can be our worst enemy when it comes to making us run malware installers.

On the day StarCraft II was released, security firms reported a huge number of warez downloads for the game that were really wrappers for viruses. On the day Michael Jackson died, sites sprang up claiming video exclusives of the singer's last moments. Again, these were links to malware.

Employing the lure of a hot topic as a means of walking us towards malware is a common hacker tactic. When you're tempted to click a link, follow the old mantra: if something sounds too good to be true, it probably is.

11. Choose your flexible friend

Never be tempted to use or enter details from your debit card – always use a credit card. Section 75 of the Consumer Credit Act (1974) make credit card companies liable to pay if you're the innocent victim of fraud.

Card companies may, however, avoid paying out if you're proved not to have taken 'reasonable' care with your card – doing something like writing down your PIN, for example.

Credit cards themselves also offer different levels of fraud insurance, so shop around before choosing a card and make sure you read the terms and conditions closely.

12. Pump and dump

Don't be tempted to follow unsolicited dead-cert share tips. The senders will probably hold a lot of them. When you and other victims buy, the price will go up. They'll then sell, leaving you holding the baby.

13. Just like that

A common online action site scam is to sell goods that are 'like' top brand goods. Your new watch may be like a Rolex insofar as it ticks, but that could be your lot.

14. Act on your doubts

If you think an online shop or service is dodgy, do some checking. A WHOIS search may let you see the registration details of a site. Visit the website www.whois.net and check out your suspect site.

Companies House also enables you to check out details about company addresses, owners and the like. Look for big discrepancies between onscreen addresses and physical offices.

15. We've found a virus

Bogus security experts call unsuspecting PC owners claiming they've found a virus on their hard drive. All you need do is pay a fee and they'll remotely remove the nasty.

In reality, the scammers are just working through phone lists, planting the seeds of fear and then collecting bucketloads of cash.

16. Ditch IE6

If you're still using Internet Explorer 6, shame on you. Not only are you likely to be getting less from the internet – Google and YouTube have now stopped supporting the ageing browser – but it's also riddled with security flaws. Do yourself a favour and download a newer browser.

17. Check out Virus Total

If you've received a file and are worried about its provenance, upload it to www.virustotal.com. The site will run the file through a number of virus-scanning engines to find any hidden malware. It'll also send you a handy report document.

18. Listen to Bruce Schneier

Renowned security expert, blogger and self-styled security guru Bruce Schneier has a thing or two to say about every aspect of the topic, ranging from the virus right up to national security policy. Visit his blog at www.schneier.com and add it to your bookmarks.

19. Check firewall logs

Firewalls keep logs of traffic they've rebuffed. Check these and look for patterns – maybe a particular IP address is pinging your network or a certain port on your setup is spewing out too much traffic. These sorts of things can suggest a viral infection.

20. Stop redundant services

The more software and services you're running, the greater the risk you could be compromised. Be ruthless – delete or deactivate applications and services you don't use. This will reduce the number of ways into your machine that are available to hackers.

21. Be cautious

If you must use file sharing, do so with the utmost paranoia about security. When you've downloaded a file, isolate it and, if possible, execute it from a virtual environment to ensure it's safe before letting it into your true computing environment.

22. Update software

Windows 7 and most major apps are happy to update themselves automatically, but you should still run their update systems manually to ensure they're working. Smaller apps may need updating manually, so check their makers' sites for updates.

23. Enter your own URLs

Never follow links to URLs emailed to you and don't Google your bank's address. Google can be tricked into moving spoof sites up its rankings table by criminals looking to entice people to sites designed to harvest logon details. Enter important URLs yourself.

24. Check site safety

Download McAfee's excellent SiteAdvisor from www.siteadvisor.com. The browser plug-in has a traffic light system that shows dangerous sites in search results. Following its green, yellow and red site rating icons will help you to avoid compromised web locations.

25. Test your system

Test your antivirus system using the Eicar string. It's a text file that all antivirus engines should pick up, no matter how it's wrapped or compressed. Get it from www.eicar.org. It's completely safe and won't land you in legal hot water.

TechRadar / PC Plus

Tips for Keeping Internet Snoops at Bay

2010-11-26T13:08:00.000+02:00

If you have ever worried about specifically aimed ads that seem aware of your private moments on the Web, such as looking at sites for kitten-heel pumps, eczema medications or how to get out of debt, here is something else to fret about.

Keeping your computer free of tracking programs is not easy because of the ad industry's aggressive and sophisticated efforts, says Jeff Chester, executive director of the Center for Digital Democracy.

"It's like trying to get the room of your teenager clean," he said. "You have to do it all again the next day."

A number of tools can minimize tracking, but using them requires considerable effort and tech know-how.

Online publishers, retailers and other websites you visit often let advertising companies place cookies, a small bit of software, on your computer to track your online activity.

You can remove standard cookies using the features of any major browser, but consider deleting these ad-related cookies manually to avoid trashing those set by your favorite websites, intended to save passwords and personal preferences.

However, advertisers are increasingly using powerful software known as supercookies, such as so-called Flash and document object management (or DOM) cookies, which can hold more information, and Web bugs or beacons, which let sites record statistics like what ads attracted you to the site and whether you bought something.

They are not removed when you clear out your cookies.

To remove Flash cookies, visit Adobe's online Flash Player settings page at bit.ly/cw2roU, click on "Website Storage Settings" panel and remove all or some of the files.

Block or restrict future third-party Flash cookies by going to the "Global Storage Settings" panel.

To remove tracking programs and keep them out, it is better to enlist the help of specialized software, said Pam Dixon, executive director of World Privacy Forum.

She and other privacy advocates recommend a free plug-in known as Taco, available for both Firefox and Internet Explorer, from the privacy-software startup Abine.

Taco helps Web users manage and delete standard cookies, Flash and DOM supercookies and Web bugs. It also lets you see who is trying to follow your online movements and helps you decline targeted ads from more than 100 ad networks.

Other free browser plug-ins include:

• Better Privacy for Firefox, which removes supercookies every time you close your browser.

• Ghostery for Firefox, Chrome and Internet Explorer, which controls Web bugs.

• CCleaner, for all major browsers, which removes cookies and surfing history.

• NoScript for Firefox and the similarly named NoScripts for Chrome can block supercookies, Web bugs and ads (and some security threats).

One way to stop ad networks from gathering data is to use a new feature introduced in the Internet Explorer 8 browser called InPrivate Filtering, which stops data from traveling between you and third parties who ask for it frequently.

Note: InPrivate Filtering has to be turned on each time you fire up your browser; select InPrivate Filtering from the Safety menu.

Firefox's Private Browsing mode and Chrome's Incognito will both block cookies and stop the browser from remembering the sites you visit.

And be careful what information you give out about yourself, whether on-site registration forms, online surveys or on social networks.

Interests you volunteer will undoubtedly be used to tailor ads you see around the Web.

Web searches can also be used to inform advertisers about your likely interests.

Google says it does not use search history in directing specific ads, but both Microsoft and Yahoo do.

Slow down the marketers by spreading your searches among several engines, Dixon says.

Also consider using different companies for search and Web-based e-mail.

For instance, use Google for search if you use Yahoo Mail.

Or sign out of e-mail and clear your cookies and history before you search, so your search data and e-mail data are not connected.

Alternately, use a search engine that does not track users' activity.

Scroogle.org lets you search with Google without being tracked or seeing ads.

Startpage runs simultaneous searches on multiple engines anonymously.

Your online activity is also tracked based on the string of characters associated with your computer, known as an IP address.

If your IP address never changes, advertisers can amass a large history.

If you do not get a dynamic, or regularly changing, IP address from your Internet service provider, reset it periodically by unplugging and then plugging in your modem.

Or mask your IP address using Tor, a nonprofit service that makes online activity anonymous, or a virtual-private-network service, such as OpenVPN, which adds privacy and security by encrypting your Internet traffic, suggests Paul Stephens, director of policy and advocacy at Privacy Rights Clearinghouse.

The New York Times

Burning Question: How Can Security Risks be Mitigated in Virtualised Systems

2010-11-26T13:07:00.000+02:00

"Virtualization is not inherently insecure. However, most virtualized workloads are being deployed insecurely."
That's what Gartner analyst Neil MacDonald wrote earlier this year in a report titled "Addressing the Most Common Security Risks in Data Center Virtualization Projects."

Planning for virtualization projects should always include the information security team, but according to Gartner survey data about 40% of virtualization projects were undertaken without the security team's involvement in initial architecture and planning stages.

Because the hypervisor has oversight over all the workloads running on a physical server, a threat "could result in the compromise of all hosted workloads" MacDonald notes. Under legacy architectures, a threat to one server would only put one workload at risk, but that is not true in a virtualized data center.

The hypervisor itself also adds to the attack surface. VMware, for example, is revamping its own virtualization architecture to get rid of a Linux-based service console in order to reduce the attack surface from about 2GB to 100MB.

While this is an improvement, customers still have plenty to think about on the security front. Gartner recommends treating the virtualization platform "as the most important IT platform in your data center from a security and management perspective."

IT shops need to establish policies regarding the consolidation of workloads of different trust levels, and when evaluating new security and management tools "favor those that span physical and virtual environments with the same management, policy and reporting framework," Gartner says.

IT must be concerned about vulnerabilities in any code installed in the hypervisor layer, including drivers, plug-ins and third-party tools, and keep everything up to date and patched, the report continues.

Even if the virtualization layer is just as secure as previous physical architectures, the tendency to provision more VMs means your footprint is larger and "whenever your footprint grows your security risk expands," Turner notes.
Turner is looking at a few systems management tools, such as Cfengine, Puppet Labs and Chef, to automate the processes of verifying patching, removing old user accounts, and ensuring that configuration files haven't been tampered with.

Even relatively simple tasks like running antivirus software can be more complicated after servers have been virtualized.

Harper notes that his staff had to manually change the times of all the weekly scans on Windows Server instances, because otherwise they would all occur at once and cause a too-high I/O load.

Harper says customers need a combination of new products and procedures to prevent virtualization troubles, because managing VMs as if they were identical to bare-metal machines simply doesn't work.

However, Harper and Jim Brewster, a senior IT pro at Sabre, are optimistic about security in the virtual world. Physical separation of security zones is giving way to software-based security zones, and virtualization management tools could make it difficult for rogue IT admins to alter systems without their actions being logged, Brewster says.

Microsoft and VMware have argued over how many processes should remain in the operating system and how many should be pushed to the hypervisor layer. But Brewster, for one, looks forward to security functionality moving to the hypervisor.

"I think you have more visibility and more control over what's happening, and what's talking to what in the VM space," Brewster says.

Network World

CIOs, CTOs Should be the Voices of IT Professionals in the Boardrooms

2010-11-26T13:06:00.000+02:00

Chief information officers, chief technology officers and general IT management have the responsibility to convince business about the fact that IT is no longer just about providing communication infrastructure and tools to support business.

IT has evolved dramatically in the past decade. Technologies such as services-oriented architecture and business process management tools help businesses to automate their manual processes and transform IT services from just mere support tools to business services in their own rights.

Many business executives still see IT as a supporting function, and for this perception we have to blame the IT management. It seems to me that most of our IT managers have low self-esteem and self-confidence, resulting in failure to justify the value that IT is adding to their organisations.

Perhaps the reason why IT professionals remain the underdogs compared to business professionals is due to the fact that IT professionals are the ones that approach business on how they can improve things within their organisations in many occasions.

However, in the process of providing these IT services usually seen as operational services aimed at reducing operations cost, those regarded as business professionals turn to ignore the fact that some of these services go beyond just being operational services and become standalone business services generating income directly to business; yet we only see those regarded as business professionals getting huge bonuses compared to IT professionals.

Many companies do not regard IT professionals as business professionals, but rather as operational professionals, claiming that they do not deal with customers directly. Today customers are accessing IT services directly to some extent without any human intervention. For example, services such as cellphone banking and Internet banking allow customers to make transactions wherever they are without having to visit banks. Another example would be the Online Share Trading service offered by some of the investment banks. Again this is a pure standalone IT service serving customers directly.

Furthermore, when banks advertise these services they don't regard them as IT services but rather as business services. There are so many other services that are currently being offered through IT, such as online reservations for accommodation/tickets for entertainment/flights, paying of fines and many more. I have no doubt that soon we will be paying almost all our bills online.

Besides the online services, one can argue that even applications such as enterprise resource planning cannot be seen as mere supporting tools, but rather part of business. For example, today accountants can pull out reports like the balance sheets or income statements from accounting systems such as Oracle Financials or SAP Financials. Another example would be investment banking systems, such as Calypso or Murex, that keep records of all the trades captured, with cash flows and settlement dates. In addition, most IT enterprise applications have the intelligence to provide users with various notifications that guide and help business to make informed decisions, for example, when there is a payment due, running out of stock, demand and supply and when something is missing.

It is clear that some IT services are serving customers directly and credit should be given to IT professionals who are responsible for these services on a daily basis. From my observation, I have learnt that many IT professionals don't show interest in the business itself to a point wherein they don't know their self-worth. IT professionals need to see themselves as part of business, and in order for them to earn the respect, they also need to make sure that their hard work gets to be recognised by business when they go to the boardroom. I think it is time for IT professionals to earn the respect and recognition for their enormous contribution towards company profits.

Of course this can only start from the top. Our chief information officers, chief technology officers and general IT management need to walk into the boardrooms with pride and negotiate better salaries and bonuses for their staff. Some of the reasons for business to slash bonuses of IT professionals compared to business professionals is based on the fact that IT professionals do not deal with customers directly, which is not true in some instances.

Some business executives justify their acts, pointing to the hefty licence fees they pay out to various IT vendors. I must say that not all companies have the patronising tendency towards IT professionals and those who are embracing technology, and who see IT as part of their business but rather not as a cost centre, are reaping the rewards and will remain competitive.

Nonetheless, business professionals still remain critical to any business and must also be respected. IT professionals need to be obsessed about business processes the same way they are obsessed about the technology to overcome these barriers. The future lies in our own hands.

IT Web

Gartner Urges Agile Business

2010-11-26T13:04:00.002+02:00

As business leaders look for IT to drive business results, the time is now for CIOs and IT leaders to recognise new realities, apply new rules and drive their organisation forward to embrace these.

This is according to Gartner analysts speaking at the Gartner Symposium/ITxpo 2010. Analysts told an audience of more than 7 000 IT leaders that businesses have different expectations for their CIO.

“This new type of CIO won't ask first what the implementation cost is, or whether something complies with the architecture, but whether it's good for the organisation,” said Hung LeHong, research vice-president at Gartner.

“They will train their teams to think like a business executive, asking first 'is this valuable?', and only then asking 'how can we make this work?' There will be people experimenting with new ideas, working with product development, marketing, public relations and the C-suite to come up with ways of delivering more value directly to the external customer.”

Gartner says the IT industry is at the start of a new era. For IT, the time to act is now, and how IT leaders' act will be shaped by realities of the new era; the power of choice, the Wide Open World and outcomes rather than outputs must be focused on.

New realities

“Business leaders now have the power of choice, and they will use it,” said Mark McDonald, group vice-president for executive programs at Gartner. “Choice is not just about cutting cost. Choice is about time to market. Choice is about capability, capacity, quality of service, and agility.”

In the Wild Open World, people leave a trail of what they've done online, leaving a rich body of information about their interests, intentions and activities. The data, much of it unstructured, contains nuggets of wisdom buried in various formats such as videos, podcasts, and blogs, the analysts said at the symposium.

In terms of outputs and outcomes, analysts pointed out that outputs are proxies for cost and risk. Gartner analysts say cost is important, but it is only one direction of a CIO's compass. In contrast, by focusing on outcomes, CIOs will also address value and innovation.

The symposium also brought social networking to the discussion. “Social network analysis – whether done manually by individual case workers, or on a more formalised basis using advanced analysis tools or services, can make a big difference,” said Andrea Di Maio, vice-president and distinguished analyst at Gartner.

Smart governance

Also noted were three new rules that will be constants into the new era. CIOs are urged to apply these rules to lead their business (not just the IT organisation) forward. These new rules include smart control, intelligent business and IT dynamism.

“CIOs and IT leaders must transform themselves from controllers to influencers; from implementers to advisers; from employees to partners,” said Eric Knipp, principal research analyst at Gartner. “You own this metamorphosis – as an IT leader, you must implement smart control. Open the IT environment to a Wild Open World of unprecedented choice, and better balance cost, risk, innovation, and value.”

Users can achieve incredible things without the IT department, but they can only maximise their IT capabilities with the IT department. Smart control is about managing technology in tighter alignment with business goals by loosening the grip on IT, according to Gartner.

The symposium pointed out that to support an intelligent business, people in the organisation will need to have access to the full spectrum of information that supports questions such as: What happened? Why did it happen? What is happening? And what is likely to happen?

“If IT leaders do not help, they will be locked out because employees will find the information from whatever source they can: transactions, video, mobile activity, tweets, search activity, blogs, text messaging, and social sites,” said analysts.

Regarding intelligent business, Gartner focused on information sharing. “In an intelligent business, people contribute and share, and there is zero tolerance for people who hoard information,” said Yvonne Genovese, vice-president and distinguished analyst at Gartner.

“To play by this new rule, you need employees to find and share intelligence by combining information and collaboration. To support this culture change, it will require you to create a collaboration platform that includes technologies such as presence, instant messaging, Web conferencing, social network analysis, and collaborative decision making to enable people to discover the right colleagues and experts to share insights and drive desired outcomes.”

Concluding the event, Nick Jones, vice-president and analyst said: “New CIOs and their teams will be entrepreneurial.”

“This team will make decisions to increase innovation and value, taking risks and placing bets. They will be comfortable with ambiguity and risk, having incomplete requirements and still making the decision to act because they would rely on their knowledge and judgment.”

IT Web

Windows 7 Wanted at Work: Consumer IT Strikes Again

2010-11-26T13:03:00.002+02:00

If you are happy with Windows 7 on your personal laptop, but grumble every time Windows XP boots up on your work computer, it may be time to tap your company's IT pro on the shoulder and ask for Windows 7. You might be surprised at the response you get.

As Windows 7 migrations begin at many enterprises, satisfied Windows 7 consumers are pushing the "consumerization of IT" envelope by asking enterprise IT to adapt. This trend has been prevalent with smartphone users and now Windows 7 users are doing the same. Research firm Forrester highlights this trend in a recent Windows 7 adoption report - and recommends that IT give users what they want, for several reasons.

Some enterprises are already getting the message. Part of the Forrester report, entitled "Updated 2010: Windows 7 Commercial Adoption Outlook", is a survey of 687 PC decision-makers at North American and European enterprises and SMBs. Forty-seven percent of survey respondents said they will allow users to be early adopters of Windows 7, even outside of specific upgrade campaigns.

There is more than just self-interest at stake for users. Yes, you will have a more modern OS and probably be more productive, but at notoriously slow-moving enterprises, user demand for Windows 7 could "go a long way toward speeding up your companywide deployments and will minimize the time needed to support dual operating systems," writes report authors and Forrester analysts Benjamin Gray and Christian Kane.

On top of the 47 percent who said they would upgrade users to Windows 7 upon request, 10 percent said they "don't know" if they would. So you have roughly a coin-flip chance of getting a Windows 7 upgrade if you ask - probably a better chance if you nag.

Naturally, Microsoft encourages users to demand Windows 7 at work. When giving Windows 7 guidance to customers, Microsoft lists the "blurring lines between work and home computing" as a top industry trend, just as important to Windows 7 migrations as the cloud computing movement and desktop virtualization tools.

Windows 7 consumer satisfaction, according to Microsoft, is a top reason why the OS has had a strong push in the enterprise. IT departments, in return, are giving less lip service and acting on user needs, says Gavriella Schuster, general manager of Windows Product Management Group.

"Workers are pushing IT to adopt," Schuster says. "When IT says, 'Hey, we're going to start piloting Windows 7,' you have that line out the door of users who want in."

The Forrester report says the reasons for migrating to Windows 7 are evolving beyond just the diminishing support for Windows XP and the need for new computers - although those are certainly important factors.

But IT departments are seeing more value in networking and security features built into Windows 7 such as DirectAccess, BranchCache and BitLocker to Go. Also, desktop and application virtualization tools (from Microsoft or other vendors like VMware) have matured to the point where they can round up incompatible applications and migrate them using virtualization technologies, thus simplifying and speeding up migrations.

The report acknowledges that Windows XP is still the dominant enterprise OS (75 percent of all companies surveyed are running it), but also finds that Windows 7 migrations are on the verge of busting out. Forty-six percent of firms report that they have already begun or will begin deploying Windows 7 within the next 12 months. Forty-two percent say they will deploy Windows 7 in more than 12 months.

Eager workers are in a position stoke this Windows 7 momentum, according to Forrester, and the firm cautions IT departments not to underestimate the influence of users.

"Firms should embrace empowered workers who request early access to Windows 7," the Forrester report states. "We encourage IT to prepare for - and embrace - the pull effect that Windows 7 is having on users."

CIO.com

Chinese Supercomputer Named Worlds Fastest

2010-11-26T13:02:00.003+02:00

China overtook the United States at the head of the world of supercomputing on Sunday when a survey ranked one of its machines the fastest on the planet.

Tianhe-1, meaning Milky Way, achieved a computing speed of 2,570 trillion calculations per second, earning it the number one spot in the Top 500 (www.top500.org) survey of supercomputers.

The Jaguar computer at a US government facility in Tennessee, which had held the top spot, was ranked second with a speed of 1,750 trillion calculations per second.

Tianhe-1 does its warp-speed "thinking" at the National Centre for Supercomputing in the northern port city of Tianjin -- using mostly chips designed by US companies.

Another Chinese system, the Nebulae machine at the National Supercomputing Centre in the southern city of Shenzhen, came in third.

The United States still dominates, with more than half of the entries in the Top 500 list, but China now boasts 42 systems in the rankings, putting it ahead of Japan, France, Germany and Britain.

It is not the first time that the United States has had its digital crown stolen by an Asian upstart. In 2002, Japan made a machine with more power than the top 20 American computers put together.

The supercomputers on the Top 500 list, which is produced twice a year, are rated based on speed of performance in a benchmark test by experts from Germany and the United States.

Allied Free Press

IT Governance Website Launched

2010-11-26T13:02:00.000+02:00

ISACA, the international association representing IT governance professionals and the leading authority in IT governance, has recently released results focused on understanding the governance of information technology.

The new 'Taking Governance Forward' Web site has been launched to help put all of the pieces of a governance system - objectives, enablers, views, roles, activities and relationships - together.ISACA believes delivering the results as an interactive Web site will foster more deliberation and discussion and provide a dynamic way for everyone to contribute to the current debate on what governance is and how it works.Winston Hayden, vice-president of ISACA South Africa, explains: "There are just so many misconceptions and misinterpretations of IT governance.

This is creating a lot of confusion, and in some instances, conflict, between governance stakeholders and the various participants. Unfortunately, this confusion is also being fuelled by ill-informed and unqualified advisories, consultants and service providers.

”The new Web site is the outcome of an initiative led by the IT Governance Institute (ITGI) to provide a high-level overview of governance: its definition, components, participants and views. It is designed to be brief, simple, straightforward and practical, with minimum theory. It is intended to depict “governance on a page” - holistically and completely.

The objective of the Taking Governance Forward initiative is to reach an agreement on a universally acceptable definition of governance; to clarify the debate on governance by providing a comprehensive, yet simple-to-use overview of the components and relationships of governance; and to provide the reader and user with practical tools to understand the governance views model and learn high-level ways to initiate its implementation.

The Web site's material will appeal to different audiences depending on their position and priorities. Those in senior executive ranks or on boards will find the strategic nature of the definition of governance and the one-page modelling of governance of interest.

Those who are charged with building governance frameworks or performing practical implementation of governance in the enterprise will find the mappings and implementation guidance useful.Hayden adds: “Governance is something that all IT practitioners and professionals should start to understand, it's not only for management and GRC practitioners, but also for those involved with business management, information security, service management, operations and assurance.

”The Web site's material has been through several rounds of review by groups of individuals representing differing job titles, years of experience, type of expertise and levels of engagement with governance issues. Now it is time for others to provide input. Visit the new Taking Governance Forward Web site to engage in the progress of the governance of IT.

IT Web

Enterprises May Resist Upgrading to Windows 8, Analyst Says

2010-11-26T13:01:00.000+02:00

Enterprises in the midst of migrating to Windows 7 are unlikely to repeat that same work in just two years with Windows 8, an analyst said last month.

"[Businesses] would certainly like to upgrade only to every other edition," said Gartner Inc. analyst Michael Silver. "If Windows 8 comes out in two years, many [enterprises] will be very suspect about migrating to the next release."

Silver said companies tire of migrating to new versions of operating systems, largely because businesses have critical applications that may or may not run on a new edition.

"It will depend on whether Windows 8 includes major architectural changes, or if it's more of a polishing release," Silver said. "If it's the latter, it will be kind of hard to skip. But if it's a major release, Microsoft will have a hard time selling [Windows 8] to the enterprise. They saw that when [companies] skipped Vista and stayed with XP."

Silver offered those comments after the Dutch arm of Microsoft Corp. suggested that the follow-on to Windows 7 -- dubbed "Windows 8" by most, if not by Microsoft -- will ship in 2012.

Michael Cherry, an analyst at Directions on Microsoft, said Microsoft faces a challenge with Windows 8 because "Windows 7 is a good operating system. It is reliable and works well."

ComputerWorld

Green IT's Next Step

2010-11-26T13:00:00.000+02:00

It's been several years since 'green IT' became a tech buzzword, and now the concept could advance to the next level with a combination of technology improvements and changes in corporate behavior.

The notion of a more energy-efficient IT operation isn't new, of course. But so far, many green IT initiatives have focused on low-hanging fruit, and some experts say companies have more work to do. According to the Climate Savers Computer Initiative, energy costs typically represent about 10% of an IT budget. "More companies are realizing when they get visibility into the electricity bill that they have to do more," says Patrick Tiernan, executive director of the nonprofit.

One of the green innovations on the horizon is technology that cuts down on the amount electricity wasted by IT equipment, says Paul Winstanley, director of energy initiatives at Stevens Institute of Technology in Hoboken, N.J. A staff member in the office of the provost, Winstanley seeks ways to increase energy efficiency in campus facilities through improvements to infrastructure, including IT equipment.

"IT is very, very inefficient in how it utilizes energy," he says. Computers, servers and other equipment are powered nearly constantly, even when not needed, generating huge amounts of wasted electricity.

Moreover, much of the electricity that devices such as PCs take from the wall is wasted, converted to heat, Tiernan says. "We want to focus on the energy efficiency of the box," he adds.

Power-management software that puts unused PCs into low-power sleep mode can save $50 to $80 in energy costs annually per computer, and buying Energy Star-rated computers can ensure you're getting an efficient machine. Energy Star 5.0 computers have an efficiency of at least 85%, compared to 80% with Energy Star 4.0, Tiernan says. Some PCs are more than 90% efficient.

But vendors are making equipment that is even more efficient, and smarter, too.

Up next, Winstanley says, are computers that can boot up very rapidly after being turned on. That capability could save energy because a computer that's off, most experts agree, is more efficient than one that's in sleep mode, and users wouldn't be as reluctant to turn their machines off if they didn't have to wait so long for them to come back on. However, there's no consensus on how much power would really be saved if more people turned their computers off more often.

Another promising new technology is what's known as cognition detection. Still a year or more away, cognition detection systems will recognize and react to demand, cutting energy consumption by automatically powering up to meet demand and scaling back once the demand has abated, Winstanley explains. "The whole area of cognition detection is going to be one of the big areas within IT, whereby there will be some substantial power savings gained," he says.

Consider, for instance, the way Wi-Fi sends out omnidirectional signals, even if there's no demand required from every direction. "I'm radiating power needlessly, and I can never recoup that power," Winstanley says. In the future, technology will be able to direct Wi-Fi signals only where and when there's a demand.

Inside the data center

Equipment in the data center is also ripe for improvements. Increasing the efficiency of servers is one way to do that, says Mark Monroe, the former director of sustainable computing at Sun Microsystems Inc. and a founding director of The Green Grid and now a sustainable-computing and energy consultant in the Denver area.

Already manufacturers are making systems that accept power at higher voltage, which cuts down on energy consumption, says Rich Lechner, vice president of energy and environment at IBM. Power enters a data center at a high voltage, typically 480 volts, and needs to be stepped down, usually to 208 volts or lower, before it goes into the computing devices. During that process, energy is lost and heat is generated. That, in turn, drives up cooling needs and thereby increases demand for power.

"There will [still] have to be some step-down, but we're working on systems that will allow you to accept up to 480 volts of power, so there's less step-down required," he explains.

Emerson Network Power in Columbus, Ohio, makes power distribution units designed for new high-density power servers that can handle 480 volts of power. Using industry averages and internal research and modeling, Emerson found that by eliminating step-downs, a data center with 1,000 servers could save $40,000 annually through reduced energy costs.

Emerson officials point out that the company itself is saving energy this way. It built a new corporate data center last year and expects to reduce its energy bill by 1% by using 240-volt power distribution instead of the traditional 208-volt.

Solar power and other innovations

Even more green-IT innovation is coming. Tiernan says solar-powered computers, already used in limited circumstances by some, could become more mainstream, and computers that scavenge the environment for ambient energy could possibly hit the market some day. Also on the horizon, according to Lechner, Tiernan and others, are devices with computer chips that use light rather than wired electric connections to transmit data, a change that could dramatically cut the amount of energy used in IT.

As promising as all of that might sound, these technologies aren't exactly right around the corner, cautions Paul Prince, chief technology officer in the Enterprise Product Group at Dell Inc. in Round Rock, Texas.

"We've seen some of that out there, but the reality is you're not going to be able grab ambient power anytime soon. It will take you weeks to charge your notebook. That sounds good, it's just not anywhere close to having a measurable impact," he says. "But at some point we're going to stop running on electrons and switch to light."

However, IT leaders don't need to rely on innovations in the machines themselves to take the next steps toward slashing energy consumption. Changes in IT strategies could deliver on that goal, too. Cloud computing could help cut energy costs by locating power-hungry gear outside the data center. IBM's Lechner notes that as much as 25% of a company's energy supply goes to networking devices like switchers and routers.

Data life-cycle management can help

But new corporate strategies and mechanical improvements to the devices themselves will do only so much to keep demand in check. Even with all of those kinds of innovations, Monroe says energy consumption (and the corresponding costs) will continue to go up.

"You'll never see power demand decrease, because there's always an increase in computing demands," he says.

Some IT leaders are considering ways to make a difference, though. In addition to designing applications so that they consume less memory and other resources, some IT executives are starting initiatives focusing on data compression and more intelligent data life-cycle management.

Consider, for example, that a midsize business might have 20 to 30 copies of the same Word or PowerPoint document. "If you can eliminate redundant copies, then you can impact the amount of storage you need -- and the energy required for that storage -- without impacting business," IBM's Lechner says.

Most companies aren't at that point yet, he says. Most are still in the early stages, tackling the easiest targets that require smaller investments of time and money. But for those who are ready to move on, there's a growing list of initiatives that are ripening into the next generation of green IT.

Computerworld

Business Process Improvement is the Number One Priority for CIO's Worldwide!

2010-10-26T10:10:00.001+02:00

To Learn More - visit our website www.mmc.za.com

Or Contact us at info@mmc.za.com

Your 2nd FREE Keyboard Shortcut Chart - Download it Now!

2010-10-15T15:01:00.003+02:00

In September, we delivered the first edition of our free Keyboard Shortcut Chart. This was a generalist shortcut chart to assist users in enhancing their experience of Windows 7. This month we have featured a selection of the best and most frequently used keyboard shortcuts that are suited specifically to Microsoft Excel 2010.

Print your chart out, hang it on your wall or notice-board for easy reference, share the chart amongst your colleagues and friends or even file for future reference, but whatever you do, be sure not to miss a single issue of our newsletter so that you add to your collection of valuable shortcut charts!

Please click on the link below to download your MMC Keyboard Shortcut Chart.

Keyboard Shortcut Chart - Excel 2010

IT Personality Types: 8 Profiles in Geekdom

2010-10-15T15:01:00.000+02:00

Forget Myers-Briggs. Here are the true archetypes that underlie the IT breed

In the workplace you'll generally meet three kinds of personalities: Type A, Type B, and Type IT. The last are a breed apart from the rest.

We're not sure what it is about technology that draws certain types of people while repelling others. Maybe it's all those electrons spinning through millions of miles of circuitry; maybe it's just the lack of sunlight and human interaction.

In any case we've identified the eight classic personality types you'll find in virtually any reasonably sized IT department. Some are suits who've been exiled to IT against their will or sharks who would happily sell ice to the Inuits once they got done selling sand to the Saudis. Others are of the more typical geek persuasion -- from scary system administrators and angry support drones to those who'd rather blend into the shadows or do their best to shoot down any project that ventures inside their crosshairs.

We bet many -- if not all -- reside in a nearby cubicle at this very moment. Consider this your field guide to the flora and fauna of your work life.

IT personality type No. 1: The Empty Suit

Job title(s): Department manager, business analyst

Profile: Hired to be a liaison between top-level management and the techies -- with whom top-level management, or anyone on the business side, would rather not deal directly. Acts as a go-between during client visits to keep the geeks at a safe distance. Has memorized most of the important acronyms and mastered the art of nodding knowingly in meetings and then surfing Wikipedia afterward to find out what everyone was talking about. May possess an MBA from a dubious online university.

"This guy may not be the most detailed thinker, but he's the most popular guy on the team -- and he would agree," says Tim Jewell, CTO at Data Deposit Box, which provides online backup services for SMBs. "If you're looking for some fun, ask him a complex technical question and watch him wiggle around the room. Despite this, he's the only one who can talk to customers because he has verbal ability and may actually care about what the end-user has to say."

Despite making him the butt of inside tech jokes, the geeks at times flock to him because he's the only one in the department with a remote chance of picking up chicks, Jewell adds.

Hobbies: Picking up chicks
Last book read: "The ClueTrain Manifesto" (Cliff Notes only)
Greatest accomplishment: Consistently losing at golf to the C-level executives, despite possessing a single-digit handicap
Identifying marks: Cheap knockoffs of Brooks Brothers suits
Role model: Michael Dell
Most resembles: Michael Scott (Steve Carrell) in "The Office"

IT personality type No. 2: The Scary Sys Admin

Job title(s): Network administrator, database administrator

Profile: Your company can't run without him -- and he knows it. Fortunately, he likes dealing with machines far more than people, so you can rest easy, confident that he spends way more time keeping your systems up and running than may even be necessary. Friends? Who needs friends? That's why God invented computers.

"This is the person on the team who will agree to do the 48-hour server upgrade on the weekend and have everything up and running by 6 a.m. Monday -- all for two extra-large pizzas and a case of Red Bull," says Jewell. "He's very helpful around the office because people interact with him -- unlike his dolls at home."

But get on his bad side, warns Jewell, and you'll find yourself swiftly locked out of all your computer accounts -- and possibly your home and your bank accounts as well.

Hobbies: Getting certifications; writing network security subroutines in binary code to safeguard logic bombs or surreptitious SQL queries to the HR database
Last book read: "Get Even: The Complete Book of Dirty Tricks"
Greatest accomplishment: Holding the network hostage by refusing to release passwords to the Empty Suit
Identifying marks: Handcuffs and an orange jumpsuit
Role model: Terry Childs
Most resembles: Terry Childs

IT personality type No. 3: The Human Roadblock

Job title(s): Software developer, enterprise architect, systems administrator

Profile: No matter what task or project is presented, the Human Roadblock responds in exactly the same manner: It can't be done. This is then followed by a painfully detailed list of all the reasons why this task or project will cost too much, deliver too little, and can't be implemented in anything resembling the proposed time frame. And, oh yeah: It was a stupid idea to begin with.

"This individual presents this feedback under the auspices of being the only 'rational voice' in the room," says Travis Van, co-founder of ITDatabase, a research tool for IT professionals. "The points may often be valid, but typically lead to 'paralysis by analysis' for the development group -- when a more optimistic look at 'what's possible' would have been preferable to their predictable laundry list of 'why this is not possible'."

Hobbies: Complaining
Last book read: "I Hate This Place: The Pessimist's Guide to Life"
Greatest accomplishment: Not accomplishing anything of note since 1979
Identifying marks: Knit shirt with collar, khakis; still carries a slide rule
Role model: Eeyore
Most resembles: Marvin the Paranoid Android from "The Hitchhiker's Guide to the Galaxy"

IT personality type No. 4: The Angry Support Drone

Job title(s): Support tech (what else?)

Profile: Hired to schlep from desk to desk fixing the computers of people deemed unworthy of their time. Will do what you ask, and not one iota more. Know more than you do about computers -- a point they manage to work into virtually every conversation -- but not really interested in sharing useful information. Might otherwise be flipping burgers if they could be trusted to handle sharp instruments around other humans.

"The IT support position in a startup is invested with near magical skills from the perspective of peers and yet manages to consistently disappoint 90 percent of the people he deals with," says Don Rainey, general partner at VC firm Grotech Ventures.

So they'll install that printer you asked for, but they won't test to see that it works correctly. Why not? Because you only asked them to install it. And if you question their abilities or work ethic, prepare for the consequences.
"These people are like the Energizer Bunny of anger," Rainey says. "Maybe it's the line of work, or it's because they're the starting point of a feedback loop for whatever is going wrong with the product or customers. But in any case, the Angry Support Drone can create a special kind of crisis."

Hobbies: Guns, shooting, random acts of violence
Last book read: "What Color is Your Parachute?" (unfinished)
Greatest accomplishment: Halo triple kill
Identifying marks: Permanent scowl, pair of Nikes circa 1982
Role model: William "D-fens" Foster (Michael Douglas) in "Falling Down"
Most resembles: Milton Waddams (Stephen Root) in "Office Space"

IT personality type No. 5: The Übergeek

Job title(s): Software engineer, senior programmer

Profile: Fiercely intelligent, stubbornly logical, and disturbingly anti-social. In other words, what most people think of when asked to describe a techie. In Myers-Briggs nomenclature, the Übergeek would be classified INTJ -- an introverted, intuitive-thinking, and judging person -- says Beth Armknecht Miller, co-founder of Executive Velocity, a professional coaching service. If the Übergeek absolutely must communicate with beings of inferior intelligence (i.e., you), she would rather do it by e-mail. But if she can avoid all human contact, that's OK, too.

"I call this type 'Mr. Artiste,'" says Don Rainey. "He is creating software -- sometimes the company's core product or hope for future success -- and he isn't limited by the contents of the requirements document. He isn't limited by it because he isn't reading it. He is creating, damn it, and brings his own vision. Plus, staying consistent with his vision keeps him closer to his imaginary specification with its imaginary time line -- and yes, he's on schedule."

Hobbies: What are these things you call hobbies?
Last book read: "Code: The Hidden Language of Computer Hardware and Software"
Greatest accomplishment: Completely rewriting and debugging every line of system code without anyone noticing
Identifying marks: Sometimes confuses real life with Second Life; unconscious "air typing"
Role model: Mr. Spock
Most resembles: Dr. Sheldon Cooper (Jim Parsons) from "Big Bang Theory"

IT personality type No. 6: The OS Fanboy

Job title(s): Help desk, support tech, programmervista

Profile: There is only one true path -- and, more important, only one true operating system -- for this person. All nonbelievers are heretics whose tech needs will be quietly ignored. Though most commonly associated with Apple products, often aligned with Windows or, more likely, Linux -- the more obscure the distro, the better. Every conversation ends with a discussion of why their OS of choice is superior, despite the fact that your company doesn't use it. Actually solving your problem with the OS at hand is an afterthought.

"The 'I'm really an Apple fan' is misplaced in the IT world," says Kevin Lightfoot, vice president of Affiliated Computer Services, a managed services company. "He or she really should be focusing on Apple products but, because of poor career decisions, is forced to support your desktop needs. Their lack of aptitude always leaves your computer performing slower and with more bugs than it did when you first called the help desk."

"The Serious IT Guy wants nothing to do with your toy Macintosh or Linux machine," counters Brian Dunning, technical editor for FileMaker Advisor magazine. "He's a Microsoft-certified engineer all the way, and he'll stand for no tomfoolery. If you're experiencing any kind of a problem or you have a question, it's your fault for not following strict Microsoft security guidelines and published Best Practices. Since nobody actually does all of those things, nothing is ever his fault."

Hobbies: Posting angry point-by-point rebuttals in the comments to online articles criticizing his/her OS of choice.
Last book read: None; only reads blogs about his/her favorite OS
Greatest accomplishment: Jailbreaking an iPhone, sticking with Windows Vista, taking complete editorial control over the Ubuntu wiki
Identifying marks: White ear buds, non-ironic Microsoft Bob T-shirt, stuffed penguin
Role models: Steve Wozniak, Bill Gates, Linus Torvalds
Most resembles: Genius Bar lackey, Steve Ballmer, a stuffed penguin

IT personality type No. 7: The Promiser

Job title(s): Outbound sales, business development

Profile: There is nothing this person won't say to close a deal. You want features the original product was never designed to deliver? Done. You need it within six months? The Promiser will get it to you in three. Of course, he or she doesn't have to deliver anything -- that's a job for the developers. Delays, cost overruns, and impossible feature-set requirements are all someone else's headache. On the Insights Discovery Wheel, the Promiser would fall into the "Fiery Red" quadrant.

"The Promiser does not appreciate erratic emotional outbursts if they get in the way of getting things done," says Jewell. "A master strategist, he is a born leader and doesn't like to be told what to do; instead, he'll tell you what to do. He's the guy who will tell the customer the code can be written flawlessly in two months when he knows it will take six -- and then work the team until they drop and do it all over again on the next project. But you're thankful he's on the team because if it wasn't for him, you wouldn't be the star team you are."

Hobbies: Golf, Michelob Ultra
Last book read: "The Art of War" by Sun Tzu
Greatest accomplishment: Closing a multimillion-dollar enterprise software deal using a demo downloaded off the Internet
Identifying marks: Starched button-down blue oxford, used car salesman smile
Role model: Blake (Alec Baldwin) in "Glengarry Glen Ross"
Most resembles: Jack Donaghy (Alec Baldwin) in "30 Rock"

IT personality type No. 8: The Shadow

Job title(s): Unknown

Profile: It's not my problem, it's not my job, it's not my fault -- that's the mantra of the Shadow, who somehow manages to take up space in the IT department (and on the payroll) without actually filling it. No one's sure what the Shadow does, mostly because he or she has become expert at doing as little as possible. Over time, the Shadow may be handed management responsibilities, at which point this individual morphs into the Human Roadblock.

"The Shadow knows everything that's happening around the office, ignores it, and is very happy that way," says Deborah J. Graham, senior programmer/analyst for a teaching hospital in Massachusetts. "This person doesn't report anything bad happening for fear of the paperwork and making it his or her 'responsibility' to fix, and avoids additional responsibilities by declaring -- so everyone around can hear -- that the job/task/problem is not his or her job."

And when things go wrong, says Graham, the Shadow is quick to point the finger elsewhere: "They're always able to find someone else to blame, no matter how shaky a relationship between cause and effect. The Shadow is never the one to take the heat."

Hobbies: Selling decommissioned company hardware on eBay during "breaks"
Last book read: "Ninjutsu: The Art of Invisibility"
Greatest accomplishment: Taking a month-long vacation without the boss noticing
Identifying marks: None, because the invisible don't have any
Role model: Sergeant Schultz (the late John Banner) in "Hogan's Heroes"
Most resembles: An unidentified cell in a payroll database

InfoWorld.com

5 Tips For a Smooth Windows 7 Migration

2010-10-15T14:59:00.000+02:00

The move to Microsoft's Windows 7 will be one of the biggest technology migrations in years, so it's important to get it right.

"This is a once-in-a-decade movement," IDC analyst Al Gillen says. "People that move to Windows 7 can expect to be on Windows 7 for a pretty long life cycle, much like we have with XP today. So whatever you do, and whatever decisions you make are decisions you're going to have to live with for a long time."

But many organizations face problems because of insufficient planning. According to a Gartner report, most organizations undergoing Windows migrations "underestimate how long it will take them to test applications and fix problems; don't build a business case or properly track the benefits of their projects; and allocate insufficient time for their pilot."

There are probably too many Windows 7 migration issues to list in a single article. But here are five tips to help you on the path to Microsoft's latest operating system.

1. Virtualize applications and user settings

Desktop virtualization commands much of the attention in the IT market today, with some vendors saying the technology will ease migration to Windows 7. But this isn't the only type of virtualization that can make Windows 7 upgrades and future OS migrations easier than they might otherwise be.

Two technologies to consider are application virtualization and user virtualization. Nik Gibson, the enterprise desktop practice leader at Forsythe, a technology consulting firm, has worked with many large enterprises on virtualization projects, and says it's often easier to virtualize applications than desktops. "We see that a lot. It takes longer to virtualize the desktops than the applications," he says. "The desktops are more unique," with various use cases depending on the employee.

Gibson says "virtualize your applications" is the first tip he would give to customers planning a large Windows 7 migration. "And that just makes sense," he says. "If you can decouple your applications from the base operating system, it's going to be easier to migrate that operating system."

Application virtualization will not only aid the current move to Windows 7, it will also make future upgrades to Windows 8 easier too, IDC's Gillen says.

Application virtualization isn't exactly new, but has undergone a bit of a marketing makeover in the past few years. What Citrix used to call its Presentation Server product for application streaming is now referred to as XenApp and labeled a "virtualization" technology. VMware's ThinApp, based on technology acquired in 2008, is another option in this market.

But application virtualization won't help move each user's personal data and settings from one OS to another to another. That's where user virtualization comes in. Software such as VMware's RTO and AppSense's user virtualization product will take a user's profile, data files and settings, and move them easily from one machine to another, for example from a Windows XP computer to one with Windows 7, Gibson says.

User virtualization is still maturing, though. Although VMware acquired RTO technology in February, it has not yet integrated the software into its desktop virtualization product.

Microsoft itself offers a User State Migration Tool to ensure that user settings and files survive OS upgrades. AppSense technology is on the market, and can be used for Windows 7 migrations both on physical PCs and in conjunction with virtual deployments. Another user migration toolkit is available from Tranxition, which can also be used for migrations involving either physical or virtual desktops.

2. Test applications to prepare for potential incompatibility

In a Gartner report titled "Pitfalls to Avoid on the Road to Windows 7 and Office 2010 Migration," analyst Michael Silver says organizations need to test applications on Windows 7 to make sure they will run and also determine whether the makers of the applications will support them on Windows 7.

"Most organizations have more applications than they know about that users consider to be important or critical," Silver writes. "Many organizations that have tested applications for Vista believe that these programs will run with Windows 7, but ISVs often limit support to specific versions."

For critical applications, which may carry financial and legal risks if they fail, "lack of ISV support may represent too much risk to move to Windows 7," he writes. A decade ago, "Windows 2000 Professional broke a lot of applications," Gillen says.

With Windows XP, Microsoft created some compatibility tools to run earlier applications. But if an application made it onto XP only because of the compatibility tools, there's no guarantee it will run on Windows 7, Gillen says.

Complicating matters even further is that some customers use Web-based applications that work only on Internet Explorer 6, an out-of-date Web browser that is two releases behind the IE8 that comes pre-installed on Windows 7.

Some companies are spending money to buy new applications or upgrade existing ones so they will work with Windows 7 or new versions of Internet Explorer. Although expensive, this is often the best long-term approach.
"Our research tells us customers are very much looking forward to Windows 7," Gillen says. "They realize it's not going to be a completely smooth transition. The life cycle is over on XP and customers get that."

3. Use Windows XP Mode -- but not for long

Not every application has to make the move to Windows 7 immediately. That's because virtualization technologies let older applications run on guest operating systems. Microsoft's virtualization technologies include Windows Virtual PC, MED-V (Microsoft Enterprise Desktop Virtualization) and the related Windows XP mode, which lets you run a virtual instance of XP on a Windows 7 desktop.

"It's a definite option for people," but is usually not the first choice for a widely used application, says Nortec consultant Tim McGilvery. "It usually is one or two users."

XP Mode is a surefire way of supporting XP-based applications on Windows 7, but Gillen says it shouldn't be used as a long-term solution. Rather, it should simply be used to ease the transition between XP and Windows 7.

Challenges include the fact that "you have two operating systems to manage and be responsible for," Gillen says. "If you're running XP Mode, it doesn't take away the fact that the base operating system is out of Mainstream Support. It solves the short-term compatibility problem, but it doesn't solve the long-term migration problem."

Microsoft recently ended support for Windows XP Service Pack 2. Service Pack 3 is eligible for support until April 2014, but only for "Extended Support," rather than the more comprehensive Mainstream Support.

4. Get your licensing straight

OS migrations can be costly. Gartner estimates that moving from Windows 2000 or XP to Windows 7 costs between $1,035 and $1,930 per user, while an upgrade from Vista to Windows 7 costs $339 to $510 per user.
The Gartner cost model is based on 2,500 users and involves many factors including labor, training, systems integration, application development and hardware acquisitions. The difference between migrations from XP and from Vista is explained by extra costs related to testing and fixing applications and replacing hardware. (A machine that runs Windows Vista could be upgraded to Windows 7, and applications that run on Vista can likely operate on Windows 7).

The cost of Windows licenses is part of the Gartner equation, and has also been examined in detail by Directions on Microsoft analyst Paul DeGroot.

DeGroot says in a worst-case scenario, customers can pay three times for the same Windows license -- once for the OEM license that comes with a physical desktop pre-installed with Windows; once for an "upgrade license" as part of a volume licensing plan, and once again for Software Assurance, which guarantees access to new software versions.

Windows 7 Enterprise is available only to Software Assurance (SA) customers, so avoiding that payment is difficult. But there are a few strategies to consider, DeGroot said in a recent Network World article titled "5 tips for managing Microsoft licensing costs."

Customers can purchase the "Open License," which lets them buy Software Assurance for two years rather than three. Although SA rights will expire after two years, the customer has the right to use Windows 7 Enterprise indefinitely. Microsoft's "Select" agreements also offer discounts by letting customers purchase Software Assurance for terms shorter than three years.

Customers should remember it's always smart to negotiate, particularly when certain portions of Microsoft licensing agreements seem inflexible. Analysts say Microsoft is often willing to give discounts, particularly to large customers with thousands of desktops.

5. Plan ahead -- and then plan some more

This may seem too obvious for words, but Windows 7 migrations require a significant amount of planning. Unfortunately, IT organizations all too often fall short in this area, according to Gartner. Windows 7 pilots should last at least three months and include a first phase for pushing Windows 7 out to a group of users to ensure that all applications work; a second phase to improve the deployment process; and a third phase focusing on education and support.

"Many enterprises plan pilots as short as a few weeks," Gartner's Michael Silver writes. "Shortening the pilot increases risk significantly and often results in logistical and compatibility problems during deployment, which makes the project look less successful to the users. A project the user community deems unsuccessful cannot be considered a success by the IT department."

One organization that takes this advice to heart is Del Monte Foods, a San Francisco-based food production and distribution company, which plans to upgrade 3,000 business users to Windows 7 over three years.

David Glenn, director of enterprise operations for Del Monte, says his company is piloting Windows 7 within its IT organization, representing 140 users across the country. Network testing is one of the key factors. Del Monte is examining how various applications perform over different network connections, and is in general finding good results.

"Windows 7 does offer a lot more stability and performance capabilities than XP did," he says.

If your company is still primarily a Windows XP shop, it's time to start planning for Windows 7 now even if you don't plan to upgrade all desktops immediately. XP support ends in 2014 but software vendors are "unlikely to support new versions of applications on Windows XP starting in 2011 [and] by 2012 it will be common," Gartner says. By 2013, few new PCs will include Windows XP drivers.

Microsoft is technically offering Windows XP "downgrade rights" until 2020, but for the reasons stated above few businesses are likely to take that option.

The speed of a company's Windows 7 migration will vary based on the age of its hardware, whether it is running on XP or Vista, the types of users it has and other factors including the length of its typiMoving from Vista to Windows 7 should be a lot easier than moving from XP because of application compatibility, Gillen says. "If you've already deployed Vista, you've done 95% of the work," he says. Although most OS refreshes occur when companies roll out new PCs, it's only practical for a company with Vista PCs to upgrade those same PCs to Windows 7.

Regardless of whether the upgrade happens over the course of a few months or is phased in over a couple of years, planning should happen far in advance and IT departments should consider all the new technologies that make desktop management more efficient, including desktop virtualization.

Instead of simply porting existing applications to Windows 7 and "recreating the architecture you've lived with for the last decade," Gillen says "my advice to customers is to seriously consider all the options they have."

The goal is to make the end user migration quick and easy, but "it's not a quick process for the IT department," Gillen says.

Network World

How To Recruit And Hire Millennial Tech Employees

2010-10-15T14:57:00.003+02:00

Dice.com CEO suggests ways that Millennials will continue to affect the workforce.

The Millennial generation increasingly streaming into the workforce is less focused on money and more on being challenged and contributing to the larger good, preferably at a job where technology is important to the overall operation and where it's acceptable to chat with friends via instant messaging and Facebook.

"This is the generation that wrote term papers while IMing and chatting on Facebook," said Scot Melland, CEO of Dice.com, a career website for technology and engineering professionals and their employees. "This is the ultimate multitasking generation we've seen so far."

Millennials are loosely defined as those born after 1980, who hit their 20s in 2000, and although they currently make up only about 15 percent of the U.S. workforce, as that percentage climbs, recruiters and prospective employers will find notable differences from other generations, Melland said.

"Generations, like people, have personalities, and Millennials ... have begun to forge theirs: confident, self-expressive, liberal, upbeat and open to change," found a major study of Millennials from The Pew Charitable Trusts, which is amassing a growing body of research and issuing reports about that generation. "They are history's first 'always connected' generation. Steeped in digital technology and social media, they treat their multi-tasking, hand-held gadgets almost like a body part -- for better and worse."

On the better side of the equation, at least as far as employers are concerned, Melland said that Millennials ask of prospective jobs, "is it challenging and is it giving back to the greater good -- these are admirable qualities." Those job attributes are far more important to this generation than a big paycheck, he added, but that presents a challenge for job recruiters.

"This is not just about putting up job postings and making people aware of your opportunities. You really have to sell them," he said. "It's a whole lot more work" for recruiters and employers to appeal to a generation that is focused on relationship building and social networks.

To that end, Melland is encouraging employers to establish a strong presence at sites like his, but also at Facebook -- that social media site came up again and again in a half-hour interview with Melland. Millennials also are more likely to be attracted to companies with well-developed corporate websites, regardless of the size of the business.

"We think the best way to reach them for recruiting is through the Internet and online because that's what they're accustomed to," he said.

On the flip side, employers and recruiters that check out information about job candidates at social media sites and personal blogs are likely to encounter information about religious beliefs, sexual orientation and other potential landmines. "When they go and they look at candidates at individual sites, we counsel them to be very careful because they may be exposed to information early on in the recruiting and hiring process that may be inappropriate" for them to have knowledge of, Melland said.

Oddly, for a group as Internet-savvy as Millennials, recent research has found that while the vast majority of employers use information they glean from social networking and other sites to evaluate candidates, only a small fraction of those candidates figured that prospective employers would be doing that, Melland said.

"Really, it was such a disconnect," he said, adding that he believes "they will definitely learn."

Other Pew research released in July, though, found that technology experts believe that Millennials will continue to share such personal details of their lives even as they age. Perhaps this suggests a way in which Millennials will influence and change the workplace and society, though at this juncture looking that far ahead is just guesswork.
Meanwhile, Melland suggested that employers who hire Millennials should focus on "continually reinforcing with them how their role adds to the success of the overall organization. They seem very sensitive to becoming a small cog in a big machine. They don't like being a small cog. ... They're less hierarchical. They believe they should be able to tap into senior people."

As part of that, Millennials are proving to be a generation that thrives on being mentored and coached. "When you coach someone or mentor someone, that tells them that they're special," Melland said.

While Millennials are proving amenable to tapping into the knowledge of those who have more experience, their expertise also should be tapped in return, Melland said.

His advice to employers: "First, use what these kids know. They are a window into how the market is changing. They are the early adopters of the Web technologies and the mobile technologies and the social networks. Use their knowledge to help you with your business."

IDG News Service

How To Keep Employees from Stealing Intellectual Property

2010-10-15T14:57:00.000+02:00

Your data is your business. And if you're not vigilant about your employees' access to that data, you're going to end up out of business. That's the advice of Patricia Titus, current CISO of Unisys and former CISO of the Transportation Security Administration.

Security quiz: How well do you know the insider threat?

Titus has first-hand knowledge of the insider threat in both the public and private sectors. We interviewed Titus about how she is managing this risk at Unisys through a combination of new technology and end user education. Here are excerpts from our conversation.

What trends are you seeing regarding the insider threat?

Probably the biggest problem is the consumerization of IT and the newer technologies which allow mobilization. While it increases efficiency, it also creates opportunity. As you start rolling out mobile applications, you want to get information into the right hands, but perhaps your access control isn't as good as it should be.

Do CISOs and CIOs realize what a big threat insiders are versus outside hackers?

Actually, we do. We do recognize the issues with our employees and data access, and that access management is a big problem. It's a problem in the public sector, and it's a problem in the private sector. Probably we are more focused on it in the private sector because data loss can be so damaging. We are spending resources to protect against the insider threat because of the amount of intellectual property we have and how valuable that information is outside the country. Especially for systems integrators like Unisys, the opportunity for employees to walk out of the building with our intellectual property so they can use it on the next contractor is quite great. There's a lot of right-sizing and a lot of transition in companies. Humans are creatures of habit, and as you try to change organizations to be more efficient, employees are unhappy. They might have access to HR information, and somebody forgot to remove their access. Employees are looking at an opportunity and thinking they won't get caught. CISOs and CIOs recognize this threat and are implementing those technologies that will catch the nefarious actors.

What technologies are CISOs deploying to address the insider threat?

One that we're getting ready to deploy is data-loss prevention technologies. The other is making sure that you are really looking at your access controls, to see who has access to what system and do they have the authority. That can be laborious, but it's critical. Lots of companies do an annual re-assessment of access control. We're finding out at Unisys that we're going to have to do it more frequently based on employee turnover. You need to make sure that you've got your applications tied to your Active Directory and make sure that your access is behind firewalls so that when you remove a person's domain, you remove their access to everything.

Which of these technologies is Unisys deploying?

We have integrated access cards, our Stealth product, data-in-motion and data-at-rest capabilities. For data-at-rest, we're moving to a stronger set of authentication, and we're moving toward hard-disk encryption for certain roles in the company. For data-in-motion, that data is encrypted as it is traversing our network. Unisys has created a product called Stealth that creates communities of interest, and data is encrypted from peer to peer. If you've got people working in HR with personally identifiable information, you want them to only communicate with each other and not have somebody who might be listening on the network who might be capturing their information. We've also integrated our common access card to a logical access card so the building card that gets me into the office physically also logically gets me into the remote access system. We're looking at integrated Security Information and Event Management technology, which integrates several different security tools into a single, consolidated analytical tool. We have a pilot of data loss prevention solutions. We're analyzing to see if white listing or black listing will work for us.

How do you address log files?

We have a tool that we use that looks for change management: if somebody makes a change in one place and it opens up a hole in another place and suddenly people have access to data. I also have somebody looking at the log files for certain behavior, such as large data transfers.

How do you address the insider threat in your hiring process?

I've just reviewed our hiring process that covers interns and employees. What we do is a corporate background investigation on every new hire.

What about IT staff? Do you find they are more likely to be involved in a security breach?

I wouldn't say they have a higher incidence of doing it, but I would say they have the tools to do it. You have to continue educating them. In the government, some of my folks thought they didn't need to follow the same rules that we were pushing to everyone because they were in security. The reality was they had the ability to crack passwords and eavesdrop on the network. We had those capabilities for good reason. As a CISO, you know that those people are the ones that can do the most damage. If you're letting a person go who has those types of rights, that person is someone you might want to say today is your last day but we'll give you two weeks pay. Most people do not want to do bad things because they want to keep their job. Usually there is a trigger for somebody, some sort of an HR change, and that's when you need to be really cognizant of what they have access to and what you need to do to protect the resources of the company.

What concrete things can CIOs and CISOs do to battle the insider threat?

We always talk about technology solutions, but I personally think that a lot of what you can do solve this problem is to educate. If you as CISO take the time to meet with the people in the trenches and give them the awareness of what to look for, they are the best at being able to find people sitting right next to them who are doing nefarious things. We tell them that if something is unusual, they should pass it off to the authorities in the company so we can look into it.

What data should companies focus on protecting?

You have to look at your business and your mission and figure out what data is critical to you. Look at what data is most valuable to you first, and then look at who has access to it. Then look at your third-party partners. They have access to a lot of data, and you need to know how they are protecting it on their site. Do they do corporate investigations of their employees? Do they have the right security protocols in place to protect the network? Small businesses are under attack, serious attack, and they don't necessarily have the corporate resources of Unisys or other major companies. These small businesses are also very high value targets, and they may not have taken the time to implement [proper security.] I'm going to venture a prediction that we see an upswing in lost data from third-party partners and small businesses.

How frequently do you find rogue insiders?

We find a handful a year. Most of the time it's people who are leaving the company who want to take information with them not recognizing that that information doesn't belong to them. I've been briefing people on situational awareness, current threats and vulnerabilities including the insider threat. Your biggest ally against the insider threat is having everyone pay attention to the guy next to him. The insider threat is going to be more serious as we look at companies losing their intellectual property, and it's going to affect their bottom line. Our CEO is very serious about protecting intellectual property. Companies that don't think the insider threat is real, won't be in business for too many years. Data is the business, and if you start losing the data, you're not going to be in the business for long.

Network World

Fake Browser Warnings Dupe Users into Downloading "Scareware"

2010-10-15T14:56:00.000+02:00

Makers of phony security software spoof anti-malware alerts in IE, Firefox and Chrome.

Scammers are spoofing the anti-malware warnings of popular browsers to dupe Windows users into downloading fake security software, Symantec said Monday.

Several malicious Web sites are displaying phony versions of the alerts that Google's Chrome and Mozilla's Firefox present when users encounter pages suspected of hosting attack code, said Symantec researcher Parveen Vashishtha in a post to the firm's blog .

Rather than simply warn users that the page they're about to visit may be dangerous -- as do the legitimate alerts -- the sham versions also include a prominent message that suggests downloading a browser security update.
In reality, no browser offers its users security updates from its anti-malware warning screen.

Anyone who accepts the update actually downloads bogus software, often called "scareware" because it bombards users with endless fictitious infection warnings until people pay $40 to $50 to buy the useless program.
Even the cautious can be nailed by these sites. Users who refuse the mock updates are assaulted by a multi-exploit toolkit that includes attack code for 10 different vulnerabilities in Windows, Adobe Reader, Internet Explorer and Java. Windows PCs that have been kept up-to-date with bug patches will be immune from the exploit kit, however.

"Malware authors are employing innovative social engineering tricks to fool users -- it's as simple as that," said Vashishtha.

The strategy that Symantec pointed out isn't new. A month ago, Microsoft 's malware protection center warned that fake antivirus scammers were putting up bogus alerts in Internet Explorer, Firefox and Chrome.

"The similarity between the fake warning pages [and the real things] is so accurate that it can trick even highly trained eyes," Microsoft said in early September .

It's no surprise that scareware dealers are constantly looking for new ways to con users into downloading their good-for-nothing software: It's a serious business.

According to the FBI, rogue security makers have made at least $150 million by duping the public.
Little wonder, then, that the fake security software industry is huge. During the 12 months from July 1, 2008, to June 30, 2009, more than 250 different phony programs tried to get on more than 43 million machines worldwide, Symantec said in a report issued last October.

Computerworld

The 17 Most Dangerous Places on the Web

2010-10-15T14:55:00.000+02:00

The scariest sites on the Net? They're not the ones you might suspect. Here's what to watch for and how to stay safe.

Those photos of Jessica Alba may be murder on your PC. That Google search result that looks as if it answers all your questions may do nothing but create a serious tech headache. The fun you had watching that hilarious video you downloaded may not be worth the misery it can cause your system.

You've been warned that the Internet is something of a security minefield--that it's easy to get in trouble. You can do everything you can think of to protect yourself and still be taken by a malware infection, a phishing scam, or an invasion of online privacy. We'd like to provide a little help. Here are some of the hazards you may encounter, how dangerous they are, and what you can do to stay out of harm's way.

Not all Web dangers are created equal. Thankfully, our friends at the Department of Homeland Security have made our work of classifying Web threats a little easier. Will you get taken just by visiting that unfamiliar site? Or will you have to look for trouble? Let our threat level indicator be your guide.

The Place: Websites that use Flash

Adobe's Flash graphics software has become a big malware target in recent years, forcing the company to push out frequent security patches. But another danger you might not know about is associated with Flash cookies. Flash cookies are small bits of data that their creators can use to save Flash-related settings, among other things. But like regular cookies, Flash cookies can track the sites you visit, too. Worse still, when you delete your browser's cookies, Flash cookies get left behind.

If You Have to Go There: To help protect against Flash-based attacks, make sure you keep your Flash browser plug-ins up-to-date. And you can configure the Flash plug-in to ask you before it downloads any Flash cookies.

Threat 2 >> Shortened links that lead you to potentially harmful places

The Place: Twitter

Scammers love Twitter since it relies so much on URL shorteners, services that take long Internet addresses and replace them with something briefer.

And it's very simple to hide malware or scams behind shortened URLs. A shortened link that supposedly points to the latest Internet trend-du-jour may be a Trojan horse in disguise.

If You Have to Go There: Simply don't click links. Of course, that takes some of the fun out of Twitter. The other option is to use a Twitter client app. TweetDeck and Tweetie for Mac have preview features that let you see the full URL before you go to the site in question.

Some link-shortening services, such as Bit.ly, attempt to filter out malicious links, but it seems to be a manual process, not an automatic one. TinyURL has a preview service you can turn on.

Threat 3 >> E-mail scams or attachments that get you to install malware or give up personal info

Place: Your e-mail inbox

Although phishing and infected e-mail attachments are nothing new, the lures that cybercrooks use are constantly evolving, and in some cases they're becoming more difficult to distinguish from legitimate messages. My junk mailbox has a phishing e-mail that looks like a legitimate order confirmation from Amazon. The only hint that something's amiss is the sender's e-mail address.

If You Have to Go There: Don't trust anything in your inbox. Instead of clicking on links in a retailer's e-mail, go directly to the retailer's site.

Threat 4 >> Malware hiding in video, music, or software downloads

The Place: Torrent sites

Torrent sites (such as BitTorrent) are often used for sharing pirated music, videos, or software, and are a trove of malware. No one vets the download files--they may be malware in disguise.

Ben Edelman, privacy researcher and assistant professor at Harvard Business School, thinks torrent sites are the most dangerous places to visit, since they don't have a business model or reputation to defend (by comparison, many porn sites rely on being deemed trustworthy). "The torrent customers, they really don't want to pay," he says.

If You Have to Go There: It's probably best to avoid torrent sites entirely, given their untrustworthy content, but if you must visit, use a secondary PC to protect your main system. Use antivirus software, and keep it updated. Scan downloaded files and wait a couple of days before opening them. Brand-new malware can be tricky to catch, but the delay in opening may allow your antivirus software to get the necessary signatures.

Threat 5 >> Malware in photos or videos of scantily clad women

The Place: ‘Legitimate' porn sites

Porn sites have a reputation of being less secure than mainstream sites, but that assumption doesn't tell the whole story. "There is no doubt that visiting Websites of ill-repute is deadly dangerous. If you make a habit of it, it's a given that you'll be attacked at some point," says Roger Thompson, chief research officer with security firm AVG. "Unfortunately, staying away from those sites won't keep you safe by itself, because innocent sites get hacked all the time, and are used as lures to draw victims to the attack servers."

And as mentioned earlier, many porn sites operate as actual, legitimate businesses that want to attract and retain customers. That said, it may be hard to tell the "legit" porn sites from malware-hosting sites that use porn as a lure.

If You Have to Go There: Be suspicious of video downloads, or sites that require you to install video codecs to view videos (see the next threat, below). Using tools like AVG's LinkScanner and McAfee's SiteAdvisor can help you weed out the malicious sites.

And, again, consider visiting such sites on a secondary machine. You don't want your browser history on the family PC.

Threat 6 >> Trojan horses disguised as video codecs, infecting your PC with malware

The Place: Video download sites, peer-to-peer networks

If you watch or download video online, you've likely been told to download a video codec--a small piece of software that provides support for a type of video file--at least once. Usually, these bits of software are perfectly legitimate (for example, the popular DivX codec), but some less-than-reputable download services or video sites may direct you to download a piece of malware disguised as a codec. Security software company Trend Micro provides a good example of what these attacks look like.

If You Have to Go There: Your safest option is to stick with well-known video sites such as YouTube and Vimeo. And for catching up on the latest episodes of your favorite TV shows, sites and services like Hulu, TV.com, ABC.com, and iTunes are safer than peer-to-peer networks.

Threat 7 >> Geolocation--your smartphone and perhaps other parties know where you are

The Place: Your smartphone

The smartphone market is still in its infancy, really, and so are the threats. One possible concern is the use--or abuse--of geolocation. Although plenty of legitimate uses for location data exist, the potential for inappropriate uses also exists. In one case, a game listed on the Android Market was in reality a client for a spy app. In a less invidious example, a site called pleaserobme.com showed that--for a time--a stream of FourSquare check-ins indicated that a person was away from their home (the site's goal, mind you, wasn't to condone theft, but to raise awareness of the issue).

Apple recently updated its privacy policy to reflect changes in how it handles location data in iOS 4. The policy now states that "to provide location-based services on Apple products, Apple and our partners and licensees may collect, use and share precise location data." You can read more on Apple's new privacy terms and what they mean for you.

If You Have to Go There: Be particular about the location-based sites, apps, and services that you use. As shown in the screenshot at right services such as Yelp provide good examples of useful location-aware apps. On the other hand, weigh the privacy implications of services like FourSquare or the new Facebook Places feature, and consider how much you feel comfortable divulging. (Read more on how to retain privacy on FourSquare and Facebook Places.)

Threat 8 >> 'Poisoned' search engine results that go to malware-carrying Websites

The Place: Search engines

Search engine poisoning is the practice of building tainted sites or pages that are designed to rank high in a search on a given topic. For example, according to a recent study by the security firm McAfee, 19 percent of search results for "Cameron Diaz and screensavers" had some sort of malicious payload. Breaking news topics and Facebook are also common search targets for attackers.

If You Have to Go There: Pick and choose which sites to go to. Don't just blindly click search results; check each URL first to make sure that it really leads to the site you want. Although any site can be hacked, visiting the Washington Post's story on a hot news topic, for example, is probably a wiser choice than following a link to a site you've never heard of before.

Threat 9 >> Malicious PDFs that try to fool you into installing malware

The Place: Hacked Websites, plus your inbox

As Microsoft has become more serious about Windows security over the past few years, would-be attackers have had to find new ways to infect PCs. Attacking flaws in Adobe Acrobat is one of these newer methods. So-called poisoned PDFs are PDF files that have been crafted in such a manner that they trigger bugs in Adobe Reader and Adobe Acrobat; posted on a hijacked Website, they may let an attacker commandeer your PC and access your files and personal info.

A newer variant takes an otherwise innocent-looking PDF document and inserts malware into it. Adobe Reader may pop up an alert asking if you want to run the malware, but hackers can edit those messages to trick you into opening the file.

How serious is this problem? In 2009, attacks using malicious PDFs made up 49 percent of Web-based attacks, according to security firm Symantec.

If You Have to Go There: First, always make sure that you're running the latest version of Adobe Reader.
You can also use a different PDF reader, such as Foxit Reader. This can protect you from attacks on holes in Adobe Reader itself, but it won't make you immune to all PDF attacks, such as the newer ones that embed malware inside the PDFs. Make sure, also, that you update to Adobe Reader 9.3.3 or later (Reader 8 users should update to version 8.3.3 or later); these updates change the way Adobe Reader handles non-PDF attachments and reduce the risk from such attacks.

You can turn off Adobe Reader's ability to open non-PDF attachments by going to Preferences, clicking Trust Manager, and unchecking Allow opening of non-PDF file attachments with external applications.

The next major release of Acrobat and Reader will provide a new "protected mode" against these attacks.

Threat 10 >> Malicious video files using flaws in player software to hijack PCs

The Place: Video download sites

Attackers have been known to exploit flaws in video players such as QuickTime Player and use them to attack PCs. The threats are often "malformed" video files that, like malicious PDFs, trigger bugs in the player software that let the attackers in to spy on you, plant other malware, and more.

If You Have to Go There: Keep your player software up-to-date. Apple and Microsoft periodically release patches for QuickTime and Windows Media Player, respectively. Avoid downloading videos at random. Stick to well-known video sites such as YouTube, or to download services like iTunes.

Threat 11 >> Drive-by downloads that install malware when you visit a site

The Place: Hacked legitimate sites

A drive-by download occurs when a file downloads and/or installs to your PC without you realizing it. Such downloads can happen just about anywhere. Some sites are built to lure people into a drive-by download; but in a common attack method, criminals will hack a Web page, often on an otherwise legitimate site, and insert code that will download malware to your computer.

If You Have to Go There: The first thing to do is to keep your security software up-to-date, and to run regular malware scans. Many security suites can flag suspicious downloads.

Threat 12 >> Fake antivirus software that extorts money--and your credit card information

The Place: Your inbox, hacked legitimate sites

Fake antivirus programs look and act like the real thing, complete with alert messages. It isn't until you realize that these alerts are often riddled with typos that you know you're in trouble.

Most fake antivirus software is best described as extortionware: The trial version will nag you until you purchase the fake antivirus software-which usually does nothing to protect your PC. Once you send the criminals your credit card information, they can reuse it for other purposes, such as buying a high-priced item under your name.

You can get infected with a fake antivirus app in any number of ways. For example, in drive-by downloads (see the previous item), a malicious payload downloads and installs without the user realizing it or having any time to react.
If You Have to Go There: If you get an alert saying you're infected with malware, but it didn't come from the antivirus software you knowingly installed, stop what you're doing. Try booting into Safe Mode and running a scan using your legitimate antivirus software.

However, such a scan may not clean up all of the malware-either the scanner doesn't have a signature for one fragment, or that piece doesn't act like traditional malware. This may render behavioral detection (which spots malware based on how it acts on your system) useless. If all else fails, you may need to call in a professional.

Threat 13 >> Fraudulent ads on sites that lead you to scams or malware

The Place: Just about any ad-supported Website

Hey--ads aren't all bad! They help sites pay the bills. But cybercriminals have taken out ads on popular sites to lure in victims. Last year, the New York Times site ran an ad from scammers, and earlier this year some less-than-scrupulous companies were gaming Google's Sponsored Links ad program and placing ads that looked like links to major companies' Websites.

"The bad guys have become very clever at exploiting online advertising networks, tricking them into distributing ads that effectively load malicious content--especially nasty, scaremongering pop-ups for rogue antispyware," says Eric Howes, director of research services for security firm GFI Software.

If You Have to Go There: Most large sites, such as PCWorld.com, have ad sales departments that work frequently with a core group of large advertisers, so it's probably safe to click a Microsoft ad on the New York Times site. But as the Google Sponsored Links incident shows, nothing is entirely fail-safe.

Threat 14 >> Questionable Facebook apps

The Place: Facebook

Facebook apps have long been an issue for security experts. You don't always know who's developing the apps, what they're doing with the data they may be collecting, or the developers' data security practices. Even though you have to approve apps before they can appear on your profile and access your personal information, from there the security of your data is in the developer's hands.

If You Have to Go There: Be selective about the apps you add to your profile--don't take every quiz, for example. Check your privacy settings for Facebook apps, as well: Click the Account drop-down menu in the upper-right corner of Facebook's site, select Privacy Settings, and then click Edit your settings under ‘Applications and Websites'. There, you can control which apps have access to your data, and which of your friends can see what information from apps (such as quiz results); you can also turn off Facebook apps altogether.

Threat 15 >> Sites that lure you in, get you to sign up, then sell your e-mail address for spam

The Place: 'Free electronics' sites

You've no doubt seen sites around the Web blaring, Get a free iPad! Get a free notebook! A free iPod! It's easy! These sites aren't typically dangerous in the classical sense--you probably won't get infected with malware--but your personal information could be sold to other businesses, who can then use it to sell more stuff to you.

If You Have to Go There: Read the privacy policies. And then read them again. Also, beware of privacy policy loopholes--even though a site says that it won't sell your private data to third parties, depending on the language of the policy, they may still be able to give your information to "affiliates."

Threat 16 >> Phishing 2.0 on social networks that tricks you into downloading malware or giving your Facebook login information to a criminal

The Place: Social networks

Questionable Facebook apps and malicious shortened links aren't the only dangers lurking on social networks. Sites like Facebook have given rise to new forms of phishing. Scammers might hijack one person's Facebook account, then use it to lure that person's friend into clicking a malicious link, going to spam sites, or giving up their Facebook login information--thereby giving scammers one more Facebook account to hijack.

"One of the bigger dangers currently facing users is malware, adware, and spyware spread through social networks like Facebook and Twitter," says Eric Howes, director of malware research with Sunbelt Software.

"Users may receive spam via these networks offering them free deals, links to interesting videos, or even widgets to enhance their Facebook profiles. In many cases what's really being pushed on users is adware, spyware, or even malicious software that can exploit users' PCs."

If You Have to Go There: Don't trust every link posted to Facebook, even if one of your friends posted it. Be especially suspicious if the post is out of the ordinary for that person. Check the person's wall or Twitter @-replies to see if anyone is concerned that the person's account has been compromised.

And if you suspect that your account has been hijacked, change your password immediately. Both Facebook and Twitter have resources to help you keep up-to-date on the latest threats on both sites. Facebook users should visit its security page; if you're on Twitter, be sure to follow @spam and @safety for Twitter security best practices.

Threat 17 >> Oversharing--exposing too much personal information on your social network profiles

The Place: Social networks

How many times have you seen friends on Facebook or Twitter publicly divulge a bit more information than is necessary? Oversharing isn't just a matter of getting a little too personal--it can leave your private information viewable to the general public. But it's avoidable.

"There is a subtle danger that few people understand with the social networking sites, and that is the idea of information leakage," says AVG's Roger Thompson. "People, particularly teens, put all sorts of information online, without realizing that many more people than just their friends can see that data."

Oversharing could very well lead to more serious privacy issues further down the road, Thompson adds. "As today's young teens reach an age to apply for a credit card, I fully expect an onslaught of fraudulent card applications on their behalf, because they unwittingly divulged so much information. Harvesting is going on now, and we have no idea who is doing the harvesting."

If You Have to Go There: This particular threat is relatively easy to avoid, in that a little common sense can go a long way: Just be mindful of what you post. Do you really need to publish your home address and phone number to your Facebook profile?

Finally, be certain to check your privacy settings to make sure that you're not divulging your deepest, darkest secrets to all 500 million Facebook users.

What Happens When You Surf Unprotected

11:45 a.m. I start the experiment with a pristine, clean PC running Windows Vista.

11:55 a.m. I need to check my e-mail. I download what appears to be a résumé file. Strange, I'm not hiring. I open it anyway. My screen flickers a little, but nothing starts. Hmm...

12:00 p.m. I start poking around on the Web, and start out easy. I run a Google search for free smilies, and sure enough, I find some. Who am I to refuse?

12:29 p.m. A couple smiley packs later, I am up to three browser toolbars. Junkware, but no malware...yet.
12:41 p.m. I download some random freebie antivirus software I've never heard of. Let's see what this does...
12:48 p.m. More random downloads, and my desktop is getting junked up. I now have icons for free games and 1000 free songs littered all over, plus more browser toolbars than I care to have.

12:55 p.m. IE is hating me right now. Still no signs of malware, but something's sure eating up system resources.
1:03 p.m. My PC locks up for a few moments.

1:25 p.m. After a restart, Windows throws up a warning about a program at C:\Users\PCW\AppData\Roaming\host32.exe. I have no idea what it is.

1:40 p.m. I think I killed IE. I can't launch it. Malware? But I uninstall a couple of toolbars, and it seems to work again.

3:00 p.m. It's unclear whether I've gotten infected by anything on the Web, but so far I haven't done anything too terribly risky. However, I've got to check my e-mail again; I'm expecting an important file from a friend.

3:05 p.m. Whoops. I think I clicked on the wrong file. I've got fake antivirus!

3:25 p.m. I now have three or four fake antivirus programs running. Malware has also planted three shortcut links to porn sites on my desktop. And whenever I open something in IE, a fake antivirus app kicks in with a fake warning.

4:13 p.m. Something just forced my PC to shut down and restart. I think I've successfully hosed this computer.

Tips from the Pros:

Top 5 Ways to Stay Safe Online

Stay up-to-date, stay paranoid, stay protected. That's the message from the security experts we spoke with while developing this story. Here are a few of their top tips and suggestions for protecting your computer against malware and hackers.

1) Keep up on patches.

Be sure to run Windows Update, as well as the software update features in the other programs that you use every day.

2) Be password smart.

As tempting as it is to use the same password in multiple places, don't. And use longer passwords, too-they're harder to crack. If you have lots of accounts to manage, use a password manager.

3) Use security software.

That may seem self-evident, but it can help block malware or software that is acting suspiciously, and security software companies are hard at work devising new ways to stop infections before they ever reach your PC. Check our antivirus and security software page regularly for the latest on security products.

4) If it sounds too good to be true... well, you know the rest.

No, someone in a faraway land isn't really offering you millions of dollars. No, attractive women from Russia probably aren't seeking you out specifically. No, those aren't magic cure-all pills.

5) Assume that everyone's out to get you.

PC security is one area where it pays to be paranoid. Just remember that no security software is fail-safe, and that you're still the one sitting at the keyboard. Assume that no site is safe. And don't automatically trust a link or file download, even if a friend sends it to you.

And a few final thoughts:

From Eric Howes, director of research services for security firm GFI Software:

"The user is always the weak link. Even the best antimalware protection and security patches cannot protect a PC from malware if the user sitting at the keyboard is being irresponsible while surfing the Web."

From Roger Thompson, chief research officer, PC security firm AVG:

"Good software designed to detect this stuff (in our case, LinkScanner) helps, but unfortunately, these are areas where the problem is in relative infancy, and is going to get much worse."

PC World

Cyber Crooks Con Linkedin Members

2010-10-15T14:51:00.005+02:00

San Fransisco - Cisco on Monday warned that crooks have inundated LinkedIn with emails crafted to trick members of the career-oriented social networking service into downloading software that loots bank accounts.

Cisco computer security specialists said the messages at times accounted for nearly a quarter of all the spam email sent to LinkedIn members.

The email is a phony contact request and contains a booby-trapped link that, if clicked on, infects computers with malicious software known as "ZeuS."

"ZeuS embeds itself in the victim's Web browser and captures your personal information," such as online banking credentials, and is widely used to criminals to pilfer commercial band accounts," Cisco said.

The US technology firm advised people to delete such contact requests, especially if they do not know who they are from.

Sapa-AF

ZeuS Botnet has a New Use: Stealing Bank Access Codes Via SMS

2010-10-15T14:51:00.002+02:00

The latest criminal activity linked to the ZeuS botnet is a software package tailored to BlackBerry and Symbian mobile phones and that picks off SMS messages, apparently to break the two-factor authentication that mobile bank customers use to access their accounts, researchers says.

Dubbed MITMO (man in the mobile) by IT security services firm S21sec, the attacker steals both user name and password from infected phones, and uses that information to access the victim's online bank account. When the bank sends the unique, temporary two-factor access code to the victim's cell phone, the malware intercepts it and forwards it to the attacker. The attacker enters the code and gains access to the account.

According to Fortinet blogger Axelle Apvrille, the victim is duped into going to a Web site where the malware is downloaded.

"Basically, the ZeuS network initiated some social engineering operations (via injection of HTML forms in the victims' browser) to get the phone number and phone model of its infected victims," Apvrille writes. "Based on that info, it sends an SMS with a link to the appropriate version of the malicious package (a Symbian package for Symbian phones, a BlackBerry Jar for BlackBerry phones etc)."

By stealing the user name and password, the attacker can initiate the attack even if the victim doesn't contact the bank directly. "Note: although it was possible before, with man-in-the-middle attacks, it required the victim to initiate a financial transfer in the first place," she writes.

The malware sends an SMS message to a phone number in the U.K. to confirm it has been successfully installed, she says.

By injecting HTML or Java code into phone browsers, attackers can dupe the user into filling out a form with the maker of the mobile phone, its model and its phone number. The phone is then sent an SMS with a URL for downloading a new security certificate that is actually a malicious applications, according to the S21sec blog.
"The application that the user installs in his mobile device is a simple application that will monitor all the incoming SMS and will install a backdoor to receive commands via SMS," the blog says.

Network World

How Much Should you Spend on IT Security?

2010-10-15T14:50:00.003+02:00

The industry average is about 5 percent of the total IT budget, according to research from Gartner

It may be difficult for enterprises to figure out how much they should spend on IT security, but research analyst Gartner has statistics on how much their peers are spending.

Security is a trade-off between risk and cost, and enterprises in different industries may spend more or less depending on their situation, said Ian Reeves, a managing vice president for Gartner Consulting.

A survey of 1,500 or so companies worldwide found businesses spend an average of 5 percent of their total IT budget on security, according to Gartner's IT Key Metrics Data for 2010. Gartner also broke it down to security spending per employee, which averaged around US$525 annually in 2009, compared to $636 in 2008 and $510 in 2007.

Of the total IT security budget, 37 percent is spent on personnel, 25 percent on software, 20 percent on hardware, 10 percent on outsourcing and 9 percent on consulting.

Companies should not necessarily worry if spending is higher or lower than the average, Reeves said. A more important question is why the spend is at a certain level and whether that is good or bad, Reeves said.

It's possible to spend a fortune on security, but if it's done poorly, it doesn't help a business, said David Lello, a director at Gartner Consulting.

The general drivers for security spending include targeted malicious software attacks, cybercrime, regulation, remote access and new delivery models for services, such as cloud computing and software-as-a-service.

Companies ranked intrusion detection and prevention as the top security priority, followed by patch management, data loss prevention, identity management and antivirus.

Professional services is the sector that has the highest number of employees dedicated to IT security, followed by government, banking and financial services, utilities, education, manufacturing, health care, insurance and finally transportation.

IDG News Service

Microsoft Sees Many Uses for Gesture - Controlled Interfaces

2010-10-15T14:50:00.000+02:00

Microsoft's Craig Mundie sees human user interfaces as doing away with controllers to play video games.

Motion sensing technologies like Microsoft Kinect won't be limited to PCs and video game consoles, Microsoft's chief research and strategy office Craig Mundie said in a speech at the Massachusetts Institute of Technology Thursday.

A surgeon in an operating room could move his hands over a screen and update a patient's information while keeping the environment sterile. Or a person could play a board game with an opponent at another location, by displaying the game on a surface and allowing the sensors to pick up the players gestures, Mundie said.

Sensors and display advancements will change how humans interact with computers and lead to more systems in which people gesture to operate machines, Mundie said.

Microsoft will target these HUI (human user interface) technologies first at the gaming space, said Mundie. Its first attempt enters markets in November when the Kinect system for its Xbox 360 gaming system goes on sale globally.

The aim is to eliminate controller-based gaming and "just operate quite normally" on an HUI system, he said. Kinect looks to meet this goal by allowing people to control games by movement and voice commands.

Nintendo popularized the concept of motion-controlled gaming in 2006 when it launched its Wii game console. The first Wii required a wireless controller to play games, moving the peripheral displayed motions, such as hitting a baseball or rolling a bowling ball, on screen. The company has improved the system considerably over the past four years.

Microsoft is also working on avatars, such as a virtual receptionist, that "try to emulate the social experience of interacting with a person," he said.

3D technology, which every player in the IT industry is adding to their products, also ties in nicely with HUI, according to the demonstration. Attendees donned glasses and shopped with Mundie as he virtually picked up, disassembled, turned around and eventually placed an item in a box for purchase. He also showed a 3D television show that allows viewers to participate in the plot. He also spoke commands to control and interact with the computer.

"Whether games and TV will emerge in this way is hard to tell" but the technology is there, Mundie said.
Microsoft plans on learning from what initial uses are developed for HUI technology and develop the system accordingly. For example future developments could account for recurring actions, like writing a signature.
"We're going to see what emerges from using this thing across a wide range of applications," Mundie said.

The HUI system Mundie demonstrated combines imagines from an infrared and a regular camera to develop a "skeletal map" of a person and microphones on the device pick up audio commands. In the case of the Kinect system, this data is sent to the Xbox 360 for processing. Placing the computing power in the HUI system would have increased the price, Mundie said.

Do not expect cloud computing to handle the data gathered from HUI systems, or at least those from Microsoft.
During a question-and-answer session following his talk, Mundie was asked if cloud computing, an increasingly popular method of processing data, factored in to how an HUI system would compute the input.

"A lot of this HUI interaction will be locally computed," he said after saying that he sees the future as the "client plus the cloud taken as one thing, not two things."

Companies and users do not want to pay for the bandwidth to transmit data for remote processing and cloud computing's latency issues mean a smooth interaction is unlikely, Mundie said.

"Humans are very sensitive to latency," he said.

IDG News Service

Virtualization to Supercharge New Tablets, Smartphones

2010-10-15T14:49:00.000+02:00

Multicore chips, faster processors could bring powerful cloud applications and multiple OSes to tablets, phones.
Next-generation smartphones and tablets will run multiple operating systems and powerful cloud applications like high-definition gaming thanks to the growing use of virtualization on mobile devices, experts said this week.

A new generation of mobile devices containing faster processors could help applications run faster, while virtualization could help consolidate applications without wasting resources, said Linley Gwennap, principal analyst at Linley Group, during the Linley Tech Processor conference in San Jose, California.

Virtualization has already been widely adopted in data centers, where the technology has helped consolidate servers and cut energy costs. The technology is now having an impact on handheld devices such as smartphones, helping run critical tasks in real-time and securing disparate software environments.

Users should be able to start enjoying the benefits of these powerful next-generation mobile devices later this year. LG Electronics, for example, has already announced the Optimus smartphone with a dual-core Arm processor running at 1GHz, which is also capable of playing 1080p video. The phone will ship in the fourth quarter. It's one example of more powerful mobile gadgets that could take advantage of virtualization.

Virtualization could also result in cheaper smartphones with longer battery life, said Steve Subar, CEO and Founder of Open Kernel Labs, which develops virtualization technology for embedded devices. Virtualization saves on the cost of chips inside a smartphone by requiring less RAM and Flash, for example.

But until now, smartphones were stymied by limited processing power, which allowed devices to run only a specific set of applications. But as mobile devices gain more processing power, virtualization will also enable users to load and run multiple operating systems and take advantage of powerful cloud computing applications on their mobile devices.

Smartphones and tablets are primarily a means of communication and receiving video, data and other Internet services from the cloud. A virtualized environment could be established for a specific cloud service, or for data exchange with a PC, said Les Forth, field applications engineer at Freescale Semiconductor.

For example, users will be able to establish a remote connection with home PCs to run applications or play back multimedia files in real time. Using a separate environment, virtualization could also help users play high-definition multiuser games in the cloud, Forth said.

Many applications are written in code that may not be compatible with a mobile device's operating system, which is why a virtualized environment needs to be established.

In fact, virtualization is already helping execute some real-time communication and network functions critical to smartphones. Virtualization is helping load multiple operating systems, and create separate environments to securely run software.

"You can have a real-time operating system running on one virtual partition to ensure you always get a real-time response to critical tasks and have Android running in another partition," Gwennap said.

But running too many operating systems and other advanced software could drain battery life.

An important aspect of virtualization is the hypervisor, which isolates operating systems and various software processes. Software-based hypervisors used on many smartphones could burn CPU cycles by spending a lot of time scanning through object code and enforcing virtualization protocols, which could squeeze battery life out of devices, Gwennap said.

Device makers may consider loading OSes and software over multiple cores until there are battery life improvements, Gwennap said.

Freescale's Forth agreed, saying that putting two operating systems on separate cores could minimize the effect of battery life on devices. Many smartphones and tablets today come with single-core Arm processors, on which an OS would need to be stripped down to the bare minimum to work alongside a fatter OS, like Android, without affecting battery life.

"In a sense it's the large classical machine problem, except it's now projected down to these very small machines," Forth said.

Hardware is already being improved to support virtualization technology in low-power devices. Mobile processors are being designed with extensions to implement virtualization technology, which could help reduce the number of CPU cycles. Arm earlier this month announced the Cortex-A15 MPCore chip design, which includes extensions to run virtualized operating systems.

But OKL's Subar pointed out that some smartphones already run multiple OSes on separate cores, which actually raises system costs and consumes battery capacity. Virtualization, on the other hand, cuts down on redundant hardware to save costs.

Moreover, with multicore mobile CPUs, virtualization performs load management, enabling wholesale shutdown of CPU cores, which could help reduce energy consumption, Subar said.

But peeking into the future, observers said that virtualization technology could change the way handheld devices are used in three to five years.

"We ultimately will be handling handheld computers with the capability of today's PCs," Forth said.

IDG News Service

Gartner: 1 in 4 Server Workloads will be Virtual by Year End

2010-10-15T14:48:00.002+02:00

Gartner says one out of every four server workloads will be in a virtual machine by the end of 2010, and that enterprises should attempt to double or triple the size of their virtualization deployments.

"More than 80 percent of enterprises now have a virtualization program or project, but only 25 percent of all server workloads will be in a virtual machine (VM) by year-end 2010," Gartner reports, suggesting that the analyst firm believes enterprises haven't gone far enough. Virtualization is "the highest-impact issue challenging infrastructure and operations," the analyst firm says.

Virtualization has been around for decades on the mainframe, but the adoption of virtulization on x86 servers, which make up 90% of the server market, is where the technology has seen its greatest growth.

According to VMware, its customers include every member of the Fortune 100. But some enterprises are still reluctant to place their most critical applications in virtual machines because of security concerns, performance issues and software licensing complications.

The proportion of virtualized workloads should continue growing significantly, as TheInfoPro and other researchers have reported that more than half of newly deployed servers are actually virtual machines, and that this number will hit 80% by 2012.

With Gartner saying "only" one quarter of workloads are virtualized, that means a lot of workloads that were running on physical machines have stayed put.

Server hypervisors are often free or sold inexpensively, so the ability to consolidate workloads onto fewer physical machines is readily available. But "as virtualization matures, the next 'big thing' will be automating the composition and management of the virtualized resources," Gartner said.

VMware, Microsoft and Citrix, the most widely used virtualization vendors, are all touting their ability to automate management of virtual resources and build cloud networks. But they have competition from Red Hat, Novell and others.

Network World

5 Must Have IT Skills of the Future

2010-10-15T14:47:00.002+02:00

The IT job market continues to change, but these five indispensable IT skills will help you keep a job for some time to come

In the year 2020, technical expertise will no longer be the sole province of the IT department. Employees throughout the organization will understand how to use technology to do their jobs.

Yet futurists and IT experts say that the most sought-after IT-related skills will be those that involve the ability to mine overwhelming amounts of data, protect systems from security threats, manage the risks of growing complexity in new systems, and communicate how technology can increase productivity.

1. Analyzing data

By 2020, the amount of data generated each year will reach 35 zettabytes, or about 35 million petabytes, according to market researcher IDC. That's enough data to fill a stack of DVDs reaching from the Earth to the moon and back, according to John Gantz, chief research officer at IDC.

Demand will be high for IT workers with the ability to not only analyze dizzying amounts of data, but also work with business units to define what data is needed and where to get it.

These hybrid business-technology employees will have IT expertise and an understanding of business processes and operations. "They are people who understand what information people need" and how that information translates into profitability, says David Foote, president and CEO of IT workforce research firm Foote Partners LLC. "You'll have many more people understanding the whole data 'supply chain,' from information to money," he says.

2. Understanding risk

Risk management skills will remain in high demand through 2020, says futurist David Pearce Snyder, especially at a time when business wrestles with growing IT complexity. Think of IT problems on the scale of BP's efforts to stop the Gulf of Mexico oil spill, or Toyota's work to correct sudden acceleration in some of its cars, Snyder says.
"When you're in the time of rapid innovation," which is happening now and will continue into 2020, he contends, "you run into the law of unintended consequences -- when you try something brand-new in a complex world, you can be certain that it's going to produce unexpected consequences." Businesses will seek out IT workers with risk management skills to predict and react to these challenges.

3. Mastering robotics

Robots will have taken over more jobs by 2020, according to Joseph Coates, a consulting futurist in Washington. IT workers specializing in robotics will see job opportunities in all markets, he adds.

"You can think of robots as humanlike devices, but you have to widen that to talk about anything that is automated," Coates says. Robotics jobs will involve research, maintenance and repair. Specialists will explore uses for the technology in vertical markets. For example, some roboticists might specialize in health care, developing equipment for use in rehabilitation facilities, while others might create devices for the handicapped or learning tools for children.

4. Securing information

Since we're spending more and more time online, verifying users' identities and protecting privacy will be big challenges by 2020, because fewer interactions will be face-to-face, more personal information may be available online, and new technologies could make it easier to impersonate people, according to a report by PricewaterhouseCoopers. Teleworkers will also represent a larger portion of the workforce, opening up a slew of corporate security risks.

"We're in a dangerous place," because many employees are tech-savvy, yet they "don't understand the first thing about data security," Foote explains. "That will change in 2020," when companies will cast an even wider net over data security -- including the data center, Internet connectivity and remote access, he predicts.

5. Running the network

Network systems and data communications management will remain a top priority in 2020, but as companies steer away from adding to the payroll, they will turn to consultants to tell them how to be more productive and efficient, says Snyder, who follows predictions from the U.S. Bureau of Labor Statistics.

"You have already cut as many people as you can, so now you can only increase productivity," he says. "Someone has to come in here and tell me how to better use the technology that I have."

Computerworld

IE9: What You Need To Know

2010-10-15T14:46:00.002+02:00

Washington - Microsoft has raised the stakes again in the heated browser battle. The company's recent public beta release of Internet Explorer 9 (IE9) shows that the software giant has taken seriously the criticisms levied against previous versions of the browser - especially in the areas of performance and usability.

But there's more to IE9 than faster page loads and fewer hassles when viewing websites. IE9 represents a substantial overhaul of the world's most popular browser. Does that mean it should have a place right now on your desktop? Read on for some answers.

Q: What's so special about IE9?

A: IE9 shows that Microsoft has been learning from its competitors - most notably, Google's Chrome. Microsoft has also clearly been listening to the complaints of the legions who have made rival browsers Firefox and Chrome serious threats to IE's dominance in the browser market.

The first thing you'll notice about IE9 is its interface, which is immediately reminiscent of Google's Chrome. Like Chrome, IE9 is stripped of most screen elements by default. The title bar, menu bar, and most toolbar buttons are hidden by default. Instead, along the top of the browser window, you'll see only the Back and Forward buttons, an Address bar which doubles as a search field, tabs for your open websites, and View Favorites and Tools icons, reminiscent of similar icons along Chrome's top edge. The effect of this lack of clutter is that web pages start to feel more like applications rather than pages running inside of another program.

Happily, all keyboard shortcuts for accessing hidden menus and other features still work. Press Alt-A, for instance, and your Favourites menu appears. The interface is also thoroughly customisable and reacts to changes the way you imagine it would. For instance, if the Address bar seems too narrow to you, just grab it by the right-hand side and extend it as far as you'd like.

Also reminiscent of Chrome is the way IE9 shows your "most popular" (favourite) sites whenever you create a new tab. You can change what appears on new tabs, as you can with Chrome, but the default behaviour of the two browsers is now identical in this respect.

Microsoft's headline feature for IE9 is hardware-accelerated text, video, and graphics. What this means is that IE9 takes advantage of the hardware in your PC in ways that previous versions did not. The result: faster pages loads and faster display of graphics. Most unofficial tests since the beta release of IE9 show the browser's speed to be at least on a par now with Firefox, with some tests showing IE9 pulling ahead.

Also out in front on the feature list is tight integration with Windows 7. The most notable evidence of this is the Pinned Sites feature, which refers to the ability to drag a tab from the browser and drop it onto the Windows 7 taskbar, where the site then becomes available with one click in the future. In testing, this feature worked only when the taskbar was located at the bottom of the screen, however - not when it had been moved to the left or right edge.

There are assorted other changes in IE9, as well, and most of them again bring IE up to the performance and usability standards set by other browsers. There are beefed-up security features, for instance, to help protect you against phishing attacks or stumbling upon malware-infested websites. There's a new download manager that arguably makes downloads easier to organise and find. Also to help with the safety of downloads is a new "download reputation rating" system, which will help you know whether you're downloading a file from a trusted source. Noteworthy, too, is a new "no add ons" option for launching the browser, which should aid in troubleshooting issues caused by browser plug-ins.

Q: Is IE9 compatible with all versions of Windows?

A: Unfortunately, no. The IE9 beta is not compatible with Windows XP. And according to Microsoft insiders, the company has no intention of making the final release of IE9 compatible with Windows XP, either.

IE9 is compatible with Windows Vista and, of course, Windows 7. It is also compatible with Windows Server 2008. Its memory and disk space requirements are unremarkable. Essentially any computer running Vista, Windows 7, or Server 2008 should work fine with IE9.

Q: Is IE9 stable enough for me to use now?

A: IE9 is still beta software. That means that it has too many bugs to be considered ready for widespread release. When the final version is available, it will show up in Windows Update as an upgrade option for users of Windows Vista and Windows 7. You'll also be able to download the final version separately.

That said, however, the current beta of IE9 will work without issue on the majority of websites. Some sites that don't display =properly will be automatically switched to "compatibility view" by the browser, which takes just a few seconds. Some have also reported browser crashes with IE9 that they did not experience before.

The bottom line is that IE9 will run fine on your computer now, but you should be prepared for the occasional glitch. If that idea bothers you, stick with IE8 or whatever browser you're currently using. It's important to note that you cannot run IE9 simultaneously with an earlier version of IE. Once you upgrade, IE9 is the only version of Internet Explorer that you'll have.

Q: Where can I download IE9?

A: Microsoft has set up a Test Drive site (http://ie.microsoft.com/testdrive). Click Get the Beta button to begin the process. Note that if you're using Windows XP, you won't see the Get the Beta button, since IE9 will not install on XP.

Sapa-dpa

Green IT's Next Steps

2010-10-15T14:45:00.000+02:00

New software and hardware will help tame the energy beast.

It's been several years since 'green IT' became a tech buzzword, and now the concept could advance to the next level with a combination of technology improvements and changes in corporate behavior.

The notion of a more energy-efficient IT operation isn't new, of course. But so far, many green IT initiatives have focused on low-hanging fruit, and some experts say companies have more work to do. According to the Climate Savers Computer Initiative, energy costs typically represent about 10% of an IT budget. "More companies are realizing when they get visibility into the electricity bill that they have to do more," says Patrick Tiernan, executive director of the nonprofit.

One of the green innovations on the horizon is technology that cuts down on the amount electricity wasted by IT equipment, says Paul Winstanley, director of energy initiatives at Stevens Institute of Technology in Hoboken, N.J. A staff member in the office of the provost, Winstanley seeks ways to increase energy efficiency in campus facilities through improvements to infrastructure, including IT equipment.

"IT is very, very inefficient in how it utilizes energy," he says. Computers, servers and other equipment are powered nearly constantly, even when not needed, generating huge amounts of wasted electricity.

Moreover, much of the electricity that devices such as PCs take from the wall is wasted, converted to heat, Tiernan says. "We want to focus on the energy efficiency of the box," he adds.

Power-management software that puts unused PCs into low-power sleep mode can save $50 to $80 in energy costs annually per computer, and buying Energy Star-rated computers can ensure you're getting an efficient machine. Energy Star 5.0 computers have an efficiency of at least 85%, compared to 80% with Energy Star 4.0, Tiernan says. Some PCs are more than 90% efficient.

But vendors are making equipment that is even more efficient, and smarter, too.

Up next, Winstanley says, are computers that can boot up very rapidly after being turned on. That capability could save energy because a computer that's off, most experts agree, is more efficient than one that's in sleep mode, and users wouldn't be as reluctant to turn their machines off if they didn't have to wait so long for them to come back on. However, there's no consensus on how much power would really be saved if more people turned their computers off more often.
Another promising new technology is what's known as cognition detection. Still a year or more away, cognition detection systems will recognize and react to demand, cutting energy consumption by automatically powering up to meet demand and scaling back once the demand has abated, Winstanley explains. "The whole area of cognition detection is going to be one of the big areas within IT, whereby there will be some substantial power savings gained," he says.

Consider, for instance, the way Wi-Fi sends out omnidirectional signals, even if there's no demand required from every direction. "I'm radiating power needlessly, and I can never recoup that power," Winstanley says. In the future, technology will be able to direct Wi-Fi signals only where and when there's a demand.

Inside the data center

Equipment in the data center is also ripe for improvements. Increasing the efficiency of servers is one way to do that, says Mark Monroe, the former director of sustainable computing at Sun Microsystems Inc. and a founding director of The Green Grid and now a sustainable-computing and energy consultant in the Denver area.

Already manufacturers are making systems that accept power at higher voltage, which cuts down on energy consumption, says Rich Lechner, vice president of energy and environment at IBM. Power enters a data center at a high voltage, typically 480 volts, and needs to be stepped down, usually to 208 volts or lower, before it goes into the computing devices. During that process, energy is lost and heat is generated. That, in turn, drives up cooling needs and thereby increases demand for power.

"There will [still] have to be some step-down, but we're working on systems that will allow you to accept up to 480 volts of power, so there's less step-down required," he explains.

Emerson Network Power in Columbus, Ohio, makes power distribution units designed for new high-density power servers that can handle 480 volts of power. Using industry averages and internal research and modeling, Emerson found that by eliminating step-downs, a data center with 1,000 servers could save $40,000 annually through reduced energy costs.

Emerson officials point out that the company itself is saving energy this way. It built a new corporate data center last year and expects to reduce its energy bill by 1% by using 240-volt power distribution instead of the traditional 208-volt.

Solar power and other innovations

Even more green-IT innovation is coming. Tiernan says solar-powered computers, already used in limited circumstances by some, could become more mainstream, and computers that scavenge the environment for ambient energy could possibly hit the market some day. Also on the horizon, according to Lechner, Tiernan and others, are devices with computer chips that use light rather than wired electric connections to transmit data, a change that could dramatically cut the amount of energy used in IT.

As promising as all of that might sound, these technologies aren't exactly right around the corner, cautions Paul Prince, chief technology officer in the Enterprise Product Group at Dell Inc. in Round Rock, Texas.

"We've seen some of that out there, but the reality is you're not going to be able grab ambient power anytime soon. It will take you weeks to charge your notebook. That sounds good, it's just not anywhere close to having a measurable impact," he says. "But at some point we're going to stop running on electrons and switch to light."
However, IT leaders don't need to rely on innovations in the machines themselves to take the next steps toward slashing energy consumption. Changes in IT strategies could deliver on that goal, too. Cloud computing could help cut energy costs by locating power-hungry gear outside the data center. IBM's Lechner notes that as much as 25% of a company's energy supply goes to networking devices like switchers and routers.

Data life-cycle management can help

But new corporate strategies and mechanical improvements to the devices themselves will do only so much to keep demand in check. Even with all of those kinds of innovations, Monroe says energy consumption (and the corresponding costs) will continue to go up.

"You'll never see power demand decrease, because there's always an increase in computing demands," he says.
Some IT leaders are considering ways to make a difference, though. In addition to designing applications so that they consume less memory and other resources, some IT executives are starting initiatives focusing on data compression and more intelligent data life-cycle management.

Consider, for example, that a midsize business might have 20 to 30 copies of the same Word or PowerPoint document. "If you can eliminate redundant copies, then you can impact the amount of storage you need -- and the energy required for that storage -- without impacting business," IBM's Lechner says.

Most companies aren't at that point yet, he says. Most are still in the early stages, tackling the easiest targets that require smaller investments of time and money. But for those who are ready to move on, there's a growing list of initiatives that are ripening into the next generation of green IT.

Computerworld

MMC's Value Offer - Get your very first FREE Microsoft Keyboard Shortcut Chart Here!

2010-09-27T13:10:00.000+02:00

Over the following months, MMC will be providing you with your own printable keyboard shortcut charts covering a range of widely used programs that you encounter every day.

For September, we start off our Keyboard Shortcut Chart Collection with a generalist selection of shortcuts that will not only enhance your experience of the Windows 7 operating system, but can also be used within various other applications such as Microsoft Office (Outlook, Word, Excel, PowerPoint etc.).

Print your chart out, hang it on your wall or notice-board for easy reference, share the chart amongst your colleagues and friends or even file for future reference, but whatever you do, be sure not to miss a single issue of our newsletter so that you can build your collection of valuable shortcut charts!

Please click on the link below to download your MMC Keyboard Shortcut Chart.

Keyboard Shortcut Chart - Windows 7 Access

Earn a Microsoft Specialist Certification (MOS) and stand out from your peers!

2010-09-27T13:09:00.002+02:00

Information taken from www.microsoft.com. To view the original text, as well as more detailed information, please CLICK HERE

Discover the only performance-based certification that validates the skills needed to get the most out of Microsoft Office. Whether you want to drive your career or increase your productivity on the job, earning the Microsoft Office Specialist (MOS) certification demonstrates the valuable expertise you need to succeed.

Overview

You can earn a Microsoft Office Specialist (MOS) certification on Microsoft Office programs and Windows operating systems. This certification features Web-based pretests, program-specific certification exams, and a series of Microsoft Press step-by-step books that help you demonstrate expertise in accomplishing essential job tasks across multiple programs. After earning an MOS certification, you receive access to a member Web site where you can print transcripts to demonstrate proof of certification and receive a certificate that verifies your successful completion of the exam. Additionally, professionals who earn this certification gain access to a certification logo that they can display on their resumes and other business materials.

Why get certified

Earning a Microsoft Office Specialist certification can help you differentiate yourself in today's competitive job market, broaden your employment opportunities by displaying your advanced skills, and result in higher earning potential. Microsoft Office Specialist certification can also lead to increased job satisfaction. Research indicates that certified individuals have increased competence, productivity, and credibility with their employers, co-workers, and clients.

For employers, the certification provides skill-verification tools that not only help assess a person's skills in using Microsoft Office programs but also the ability to quickly complete on-the-job tasks across multiple programs in the Microsoft Office system.

Microsoft Office Specialist on Microsoft Office 2010

A Microsoft Office Specialist (MOS) certification helps validate proficiency in using Microsoft Office 2010 and meets the demand for the most up-to-date skills on the latest Microsoft technologies. Candidates who pass a certification exam show that they can meet globally recognized performance standards.

Candidates must pass one certification exam in order to earn a MOS certification.

Certification	Exam number
MOS: Microsoft Office Word 2010	Exam 77-881
MOS: Microsoft Office Word 2010 Expert	Exam 77-887*
MOS: Microsoft Office Excel 2010	Exam 77-882
MOS: Microsoft Office Excel 2010 Expert	Exam 77-888*
MOS: Microsoft Office PowerPoint 2010	Exam 77-883*
MOS: Microsoft Office Outlook 2010	Exam 77-884*
MOS: Microsoft Office Access 2010	Exam 77-885*
MOS: Microsoft SharePoint 2010	Exam 77-886*

*Exams in development

Microsoft Office Specialist for the 2007 Microsoft Office System and Windows Vista

Microsoft Office Specialist (MOS) certifications, which focus on demonstrating skills in using the 2007 Microsoft Office System and the Windows Vista operating system are still very much in demand. Candidates who pass a certification exam show that they can meet globally recognized performance standards.

Candidates must pass one certification exam in order to earn a MOS certification.

Certification	Exam number
MOS: Windows Vista for the Business Worker	Exam 77-600
MOS: Microsoft Office Word 2007	Exam 77-601
MOS: Microsoft Office Word 2007 Expert	Exam 77-850*
MOS: Microsoft Office Excel 2007	Exam 77-602
MOS: Microsoft Office Excel 2007 Expert	Exam 77-851*
MOS: Microsoft Office PowerPoint 2007	Exam 77-603
MOS: Microsoft Office Outlook 2007	Exam 77-604
MOS: Microsoft Office Access 2007	Exam 77-605

*Exams in development

Note For information about Microsoft Office Project certification, visit the following pages:

MCTS: Managing Projects with Microsoft Office Project 2007
MCTS: Enterprise Project Management with Microsoft Office Project Server 2007
MCITP: Enterprise Project Management with Microsoft Office Project Server 2007

Microsoft Office Specialist on Microsoft Office 2003, Office XP, and Office 2000

The Microsoft Office Specialist (MOS) certification continues to offer tracks for Microsoft Office 2003, Microsoft Office XP, and Microsoft Office 2000. To earn a MOS certification, you must pass one or more certification exams. MOS certification exams help provide a valid and reliable measure of technical proficiency and expertise. These MOS certification exams evaluate a candidate’s overall comprehension of Microsoft Office or Office Project programs, as well as his or her ability to use advanced features and integrate Microsoft Office programs with other software.

How to Roll Out Full Disk Encryption on Your PC's and Laptop

2010-09-27T13:04:00.000+02:00

Hardly a week goes by when some organization or another doesn't lose some laptops and face a litany of IT security questions. One that always comes up: Were the systems' disks fully encrypted?

Sometimes the answer is "Yes", but plenty of organizations have yet to make the leap to full disk encryption.

Quiz: Do you know IT security?

I asked Michael Kamens, information security officer at WGBH Educational Foundation in Brighton, Mass., to lay out the basics of what desktop and laptop encryption entails since he's been spearheading an encryption project involving hundreds of computers at his organization.

If an IT shop is starting from scratch, what's technically involved in encrypting PCs and laptops?

It is a huge undertaking as each computer must be touched, first by pushing the agent out and second it must be configured by the user. By configuration, the service desk must show the end user how to set up a secure passphrase that will allow their computer to move past the BIOS. Additionally, the encryption process takes anywhere from four to six hours and does impact the speed of the computer, so it should be run after hours. Probably the biggest source of errors is not disabling the hard drive from going to sleep, which will stop the process from completing.

What are the benefits of desktop and laptop encryption from a compliance standpoint?

It is mandatory under MA Privacy Law 201 CMR 17 and under Payment Card Industry Data Security Standards (PCI DSS) on any computer containing Personal Identifiable Information (PII) and/or credit card data. The real benefit is that a lost laptop that "might" contain such data will be unreadable to anyone other than the company and/or owner. This provides a safeguard that eliminates the risk of violation as today most companies have difficulty knowing exactly what's stored on the computer. But the question I raise at my presentations is: Can you afford to be on the front page of your newspaper or the 6 and 11 o'clock news. The obvious answer is everyone should do it to protect privileged data from been read if (really when) a laptop is stolen.

Are there separate challenges in encrypting Macs vs Windows PCs?

There are only two companies that offer Mac encryption – PGP and Check Point and since Apple does not play nice in the sand box, the vendors cannot deliver a single sign-on solution. On a PC, once you enter your passphrase on boot up, you are automatically logged into the network. However, with a Mac, you must enter your encryption password and then you are presented the network log-in, which requires another log-in. Additionally, during your project installation phase you must ensure that every OS is compatible. One stumbling block is that only Intel-based Macs can be encrypted today, which could have an impact if you have PowerPCs that cannot be encrypted, requiring replacement or no encryption.

Is there any reason to go with third-party tools when vendors offer their own (like Microsoft's BitLocker for Windows 7)?

You must use a third-party vendor as the PC and OS vendors' offerings (Apple and Microsoft) are not geared for truly effective centralized management. Without centralized management you don't have an easy way to manage, recover lost passphrases or view all encrypted computers to see their status. We use PGP and users do forget their PGP passphrase. The centralized management console allows us to provide a 32-bit one-time unlock token that we give to the user. Since security is critical, whenever we request this token (every token is different for every computer – no universal token) we are prompted with a "pop up" informing us that all actions are tracked and audited. Just think if you don't have the ability to provide an unlock token, you'd have to format these computers and re-image.

What are the human (as opposed to technical) challenges in encrypting desktops and laptops?

You must be tough -- as in, it's my ball and my glove, so if you want to play you need to do as I say. We do not make the choice of encryption optional. If you are in a protected class, your computer is encrypted. We have IT, HR, Legal, Finance and Executives in the protected class in addition to those handling credit cards and/or intellectual property and privileged information.

Is it expensive?

Depending on number of licenses, the cost can range between $150 to $200 per user, plus the cost for vendor professional services to assist in the installation, configuration, roll-out and training the trainer. So is it expensive when compared to the cost of fines for violating privacy laws or PCI, which can run in the millions not to mention brand damage. I think it's a bargain.

Is it time consuming?

To do it right with Macs and Windows I would say two support people can do 10 to 25 machines a day as long as you have the ability to push the clients out and can dedicate resources. In our case, JAMF Software's Casper and Microsoft's System Center Configuration Manager is used to push out the agent. One area that most do not account for is the time for user training.

Network World