Retro Computing (Sharing Technology)

There’s a Secret Patriot Act, Senator Says | Danger Room | Wired.com

2011-05-25T22:17:00.001-07:00

How will this effect our ability to work and interact with the US. More and more organisations in the UK and Europe are concerned about their data and in the drive for the cloud, organisations are holding back on both adoption and storage because they can’t control where their data resides.

Detailed as it is, our ability to function and maintain an operational structure is becoming even more difficult due to controls and restraints.

There’s a Secret Patriot Act, Senator Says | Danger Room | Wired.com

Cyber War - The risk to Government & Business

2011-02-06T11:25:00.000-08:00

Cyberwar hype is inhibiting government attempts to develop an appropriate response to cybersecurity threats, say computer scientists.

A heavyweight study by UK computer scientists for the Organisation for Economic Cooperation and Development (OECD) concludes that it is "highly unlikely" there will ever be a "pure cyber war”, comparable with recent conflicts in Afghanistan or the Balkans. Suggestions to the contrary are down to "heavy lobbying" by suppliers, the report's authors – Professor Peter Sommer of the London School of Economics and Dr Ian Brown of the Oxford Internet Institute, University of Oxford – conclude.

It is unlikely that there will ever be a true cyberwar. The reasons are: many critical computer systems are protected against known exploits and malware so that designers of new cyberweapons have to identify new weaknesses and exploits; the effects of cyberattacks are difficult to predict – on the one hand they may be less powerful than hoped but may also have more extensive outcomes arising from the interconnectedness of systems, resulting in unwanted damage to perpetrators and their allies. More importantly, there is no strategic reason why any aggressor would limit themselves to only one class of weaponry.
Instead of a standalone war in cyberspace, it is far more likely that cyber-conflicts will take place alongside conventional attacks by nation states and propaganda offensives. Cyber-spying is a real enough threat but it isn't helpful to conflate this threat with cyberwar – cyberespionage is not a “few keystrokes away from cyberwar”, the authors argue.

The study, aimed at global businesses and policymakers, concludes that hype over cyber-war (or information warfare) is clouding judgements and responses to real threats, such as denial of service attacks against critical infrastructure elements, perhaps along the lines of high-profile denial of service attacks against Estonia back in 2007.

Part of the problem in assessing cybersecurity responses comes from treating an easily ignoring phishing email as equivalent to a targeted, disruptive cyber-attack.

“We don’t help ourselves using ‘cyberwar’ to describe espionage or hacktivist blockading or defacing of websites, as recently seen in reaction to WikiLeaks” said Professor Sommer, visiting professor at LSE.

“Nor is it helpful to group trivially avoidable incidents like routine viruses and frauds with determined attempts to disrupt critical national infrastructure.”

The authors list "careful system design" and user education as well as the use of security products to mitigate risks. Applying contingency plans for disaster recovery is a more sensible course than treating cybersecurity as a war between miscreants and system defenders, they explain.

“We think that a largely military approach to cybersecurity is a mistake," Dr Brown said. "Most targets in the critical national infrastructure of communications, energy, finance, food, government, health, transport, and water are in the private sector. Because it is often difficult to be certain who is attacking you from cyberspace, defence by deterrence does not work.”

The military do have a role in cybersecurity, but that comes in protecting their own systems as well as developing potential offensive capabilities rather than taking the lead on cybersecurity, say the computer scientists.

Future shock
The study is part of a broader OECD review of Future Global Shocks that also covers possible disruption of the world financial system, climate change and possible future pandemics.

Very few single cyber-related events have the potential to cause global disruption, Sommer and Brown conclude. However, cyberattacks that cause "localised misery" – due to loss of telecoms service, for example – are a growing threat.

In addition, the report says, reliable net comms are important in co-ordinating response to other events. Governments therefore need to prepare contingencies to recover from either accidental or deliberate collapse of net services and telecoms.

Crucially governments need to work with public sector organisations because in most countries the elements of critical national infrastructure are in private ownership.

Possible cyber-threats might include attacks against internet routing protocols (such as BGP) and communication disruption as a result of a massive solar flare. These two problems might cause disruption on a global scale, whereas computer viruses or denial of service attacks are only likely to cause a little local difficulty. More disruptive attacks on a wider scale would need to combine "zero-day exploits; careful research of the intended targets; and methods of concealment both of the attack method and the perpetrators", among other factors.

The recent Stuxnet worm, targeted malware which infected industrial control systems and is blamed for high failure rates in high-speed uranium enrichment centrifuges in Iran – disrupting the country's controversial nuclear programme as a result – is one of the few attacks to date that combine these elements.

Every citizen to have personal webpage

2010-04-14T04:02:00.001-07:00

Everyone in the country is to be given a personalised webpage for accessing Government services within a year as part of a plan to save billions of pounds by putting all public services online, Gordon Brown is to announce.

The Prime Minister has previously hailed the potential for the internet to slash the costs of delivering services by reducing paper forms, face-to-face contact with officials, postage, phone calls and building costs.

He is now set to use a speech on Monday to unveil plans to give every voter a unique identifier allowing them to apply for school places, book GP appointments, claim benefits, get a new passport, pay council tax or register a car.

Within another three years, the Times reported, the secure site would include a Facebook-style interactive service allowing people to ask medical advice of their doctor or consult their children's teachers.

The move could see the closure of job centres and physical offices dealing with tax, vehicle licensing, passports and housing benefit within 10 years as services were offered through a single digital ''gateway'', Downing Street sources told the newspaper.

Private firms such as Amazon could be involved in a bid to make the processes as simple as possible, it said.

But the proposals came under fire from union leaders who complained that thousands of public sector workers would be made jobless and pointed to the Government's poor record of handling personal data.

Questions have also been raised about the impact on some older people unable to use the internet.

Mark Serwotka, general secretary of the Public and Commercial Services Union, said: ''Cutting public services is not only bad for the public who use services but also the economy as we are pushing people who provide valuable services on the dole.''

Among the Prime Minister's advisers on the drive to put services online is world wide web inventor Sir Tim Berners-Lee.

''I don't want to go to a government office to do a government thing. It should all be online. That saves time for people and it saves money for the Government - the processing of a piece of paper and mailing it back costs many times more than it costs to process something electronically,'' he told the newspaper.

''There will come a point where you don't need all the physical offices anymore.''

The Tories are also exploring ways to switch services to the web.

Microsoft OneNote 2010 Release Date

2010-04-08T07:21:00.001-07:00

I have been using OneNote 2010 now for coming 6 months. As a tablet notebook user, I rely heavily on the OneNote Suite and its integration with Outlook to manage all my meeting notes and client interactions.
I have recently started to introduce the platform to the medical profession and have found a very welcoming response. Aside from carrying loads of note journals, Doctors, Interns and students find managing client notes, records, journal entries and the like a complete pain. With OneNote and now OneNote Mobile, the medical profession can carry a single electronic device such as an ultra-portable tablet, PDA and Smartphone and manage all their notes from a single platform. The integration with Outlook extends the productivity element out to an extensive user base.
Non OneNote users can benefit from reading OneNote in HTML format. Alough they can read the output, they cannot add or edit any of the content. File recording and embedded video make the OneNote Platform a must have for every person who takes and shares notes.

‘Why enter notes twice and share, when you can utilise OneNote, enter once, e mail, share with SharePoint, edit, embed video and voice and index for Enterprise Search from a single platform’
“Why word hard when you can work Smarter with Microsoft OneNote”

Lost Council USB Key

2010-04-01T04:46:00.000-07:00

A USB stick that contained social services' confidential information about children in care has been found on a pavement in Stoke-on-Trent.

The Staffordshire newspaper The Sentinel reported that dozens of sensitive Stoke-on-Trent City Council documents were discovered on the memory stick, and includes records of foster cares, family court proceedings, parenting assessments, child custody arrangements and the psychological history of youngsters.

It reported that the information on the memory stick was not encrypted, which is against the council's own policy. Council officials have launched an urgent investigation into how the security breach happened.

A council spokesman said: "The safety of children in our care is our priority. We have procedures for ensuring that confidential and sensitive data is kept as secure as possible. We will conduct a thorough investigation to determine the circumstances in which the data was lost.”

A spokesman at the Information Commissioner's Office said: “We may serve an enforcement notice if an organisation has failed to comply with any of the data protection principles. We have statutory power to impose a financial penalty if there has been a serious breach of data protection.”

Nick Lowe, head of Western Europe sales at Check Point, said: “The data was not encrypted, which is against the council's own data protection policies. This highlights the fact that policies alone are not enough to protect sensitive data: the encryption has to be automated and 'always on' to stop these breaches happening and avoid penalties from the ICO.”

Dave Jevans, CEO of Ironkey, said: “This is a clear breach of UK data privacy regulations. It seems that local councils and government offices need much better training and enforcement in the areas of data protection and encryption. The use of self-encrypting secure storage devices, such as encrypted USB memory sticks, should be required and enforced.”

Thanks to the close relationship between BSS and Ironkey, several Northern Ireland Councils and all of the Central Departments have implemented the Ironkey Enterprise Solution. Developed with Military Grade Encryption, The Enterprise Ironkey delivers not only a robust, secure, efficient storage platform but also a low cost, efficient ‘Secure Remote Access Platform’ for Government, Health and Education establishments alike.

‘Watch this space’

Microsoft adds Facebook to Outlook 2010

2010-02-22T07:23:00.000-08:00

Social networking services will all be integrated into Outlook through its Connector system

Outlook 2010 will be able to pull in feeds and contacts from Facebook, LinkedIn and MySpace using its Social Connector.

The Outlook Social Connector (OSC), announced at the end of last year, brings in content such as contacts and social networking into Microsoft's e-mail client.

Microsoft said the LinkedIn beta was now available, and announced new deals that would see Facebook and MySpace follow suit. Microsoft's own Windows Live will also integrate with Outlook.

LinkedIn for Outlook lets users view details and photos of contacts from the site right in the e-mail system, as well as pull in updates from the social networking site to keep contacts up to date.

The Facebook and MySpace systems will pull status updates and photos into Outlook, and let users add friends without leaving their e-mail.

Microsoft said those connectors will be available "later this year" before the expected June arrival of Office 2010.

"The goal of the OSC is not to create another social network or set of privacy settings for you to manage, but rather to bring the networks you already value and use to the Outlook experience," Microsoft said in a blog post.

Privacy
With privacy a concern for many social networking users, Microsoft was quick to address the issue.

The post on the Outlook blog said that "privacy and permissions settings on each of the networks you use are represented and respected within this experience".

That means that your profile photo from Facebook will accompany your e-mail to other OSC users who also use that site - something to keep in mind before posting a goofy picture of yourself.

"Similarly, if you choose to restrict profile access on a given network, the OSC will respect that privacy," it added.

The LinkedIn for Outlook system only works with 32-bit editions of the e-mail client, and Microsoft advised Outlook beta users to uninstall previous versions of OSC before installing the new one

Windows 8 - We have just got the hold of 7

2009-11-24T02:23:00.000-08:00

Well on the same day as PDC 2009, since we won't hear anything about Windows 8, I took it upon myself to see what I could find. It look like there is a few more announcements to partners where Windows 8 Server is concerned. In the context of the roadmap anyhow. The information crew are all saying the same thing. Windows 8 is being releasid around the 2012. Funny enough that's the same same time as all this end of the world nonence.

Mc Millian Coffee Morning @ BSS Belfast

2009-10-12T09:35:00.001-07:00

BSS Belfast Raise £420.00 for the McMillian Cancer Coffee Morning.

Thanks to the efforts of all the BSS Staff for supporting a very worth while cause we raised a total of £210.00 which was kindly doubled to £420.00 by our managing director Willie McKee.

In frame are Willie, Anne Moss and the famous Rosi 'Lancette Kirker. During the course of 2009, Rosi was diagnosed with a form of bowl cancer. Not the type of lady to let a little thing like that slow her down, Rosi rallied the troops in the office to support the UK largest coffee morning. Well if anyone knows Rosi, this was not going to be just any coffee morning; this had to be a blow out of biblical proportions.

Conrad Traynor (Coffee Buff) not only ground and supplied his own coffee but supplied a very shinny looking coffee machine that made the most divine roast coffee I have ever had the pleasure of drinking. Con buys and blends his own beans so anything else would just be wrong.

Paul (Walk about Watson) commissioned his mother, a semi pro baker to the local church to make and supply two of the largest pavalova I have ever seen or tasted. Mrs Watson can bake them all day long and we would find a home for them.

My daughter (Princess Megan) made a beautiful sponge cake and decorated it in the McMillian logo. Not only did it go down well but it received the most ahhhhhhhhh of the day.

As usual ‘Mrs Moss’ or mother to the BSS crew took charge of the proceedings and delivered one of the best break times I have ever attended. I say break time, cuz it lasted from than a coffee or tea break. The rest of the team, Linda, Jenny, Sandra and some of the engineers all chipped in to supply tray bakes and buns.

Oh, one can’t forget the cake Rosi made. Noted as a Jami Oliver special and filled with fresh cream and nuts, there was no one getting seconds.

Dean had the best seat in the house as all the kit was served from his table.

As a follow up to this and to raise more funds for Rosi’s chosen charity, Chris Birt (Dancing Boy) is organising a cycle from the University of Ulster to the Bar in Cutters Warf. Now there’s a surprise.

Phishing attack targets Hotmail

2009-10-06T04:12:00.000-07:00

Should have used Ironkey & Cryptocard for 2FA and secure connectivity

Thousands of accounts on web-based e-mail system Hotmail have been compromised in a phishing attack, software giant Microsoft has confirmed.

BBC News has seen a list of more than 10,000 e-mail accounts, predominantly originating from Europe, and passwords which were posted online.

Microsoft said it had launched an investigation.

Phishing involves using fake websites to lure people into revealing details such as bank accounts or login names.

"We are aware that some Windows Live Hotmail customers' credentials were acquired illegally and exposed on a website," said a Microsoft spokesperson.

"Upon learning of the issue, we immediately requested that the credentials be removed and launched an investigation to determine the impact to customers."

Quick change

Graham Cluley, consultant at security firm Sophos, told BBC News the published list may just be a subset of a longer list of compromised accounts.

"We still don't know the scale of the problem," he told BBC News.

Technology blog neowin.net was the first to publish details of the attack. It said the accounts were posted on 1 October to pastebin.com, a website commonly used by developers to share code.

Although the details have since been removed, BBC News and Neowin has seen a list of 10,028 names beginning with the letters A and B.

BBC News has confirmed that the accounts are genuine and predominantly originate in Europe.

The list included details of Microsoft's Windows Live Hotmail accounts with email addresses ending hotmail.com, msn.com and live.com.

Mr Cluley advised Hotmail users to change their password as soon as possible.

"I'd also recommend that people change the password on any other site where they use it," he said.

Around 40% of people use the same password for every website they use, he added. With Ironkey's Password Manager, you need not worry about managing multiple log on details as the platform does it all for you.

Well worth the investment - www.ironkey.com

Windows 7 in Business

2009-08-28T08:22:00.000-07:00

There are a whole bunch of reasons why Windows 7 should appeal to businesses, but one threat--the still-sluggish economy--could overshadow all of those reasons to move to the new operating system.
"I think they have a really good product at a really bad time," Directions on Microsoft analyst Michael Cherry said in a telephone interview this week.

Among Windows 7's business-oriented features is "XP Mode"--a downloadable add-on that lets applications that won't work natively in Vista or Windows 7 run in a free, virtualized copy of Windows XP.(Credit: Microsoft)
While Cherry says that there is definitely a lot to like about Windows 7, the release comes at a time when IT budgets are shrinking and companies are trying to limit new technology projects, even ones as badly needed as updating aging stables of desktop and notebook PCs.
"Even if they like it, I don't know how fast it is going to go when it is ranked against all the things IT has to do against a shrinking budget," Cherry said.
Among the things that should appeal to businesses about Windows 7, Cherry said, are its improved compatibility and performance, Windows XP Mode and a DirectAccess feature that allows for automatic virtual private network-like connections to a corporate network anytime a PC is connected to the Internet. (See chart below.)
Windows 7 goes on sale to consumers and small businesses on October 22. However, large businesses with volume licensing deals can get access even earlier, although most will wait before putting it on anything other than test machines. Gartner analyst Michael Silver said that, as with other releases, most businesses will take a year or 18 months before starting to deploy Windows 7. However, he added that "we've had a surprising number of calls with organizations, some very large, planning to move fairly early."
With little appetite for widespread spending to beef up old machines, Cherry said that many businesses may just upgrade to Windows 7 as they buy new machines. "I'm not sure that isn't going to be the majority way that this is handled," Cherry said, pointing out that would still be an improvement from Vista, where most companies wiped the operating system off of new PCs and instead installed Windows XP.
One quibble that Cherry has is with the way that Microsoft bills Windows 7 as a major upgrade even though so little has changed under the hood.
"I think they confuse major with important," Cherry said. "It's an important update. It's one you want to take advantage of."
Windows 7, Cherry said, is noteworthy simply because it addresses many of Vista's shortcomings and makes the key improvements that Vista brought now accessible and attractive to businesses.
In many ways, he considers Windows 7 to be the "R2" release of Vista, borrowing the nomenclature Microsoft uses to describe updates to its server products. That's not a bad thing, he said, noting that server customers have rather liked the way Microsoft alternates between minor and major releases.
"R2 has been a very solid approach for (Windows Server)," Cherry said, "and people know what they are getting."
As an indication of just how close Windows 7 is to the border between minor and major, the server version that was developed simultaneously is being designated as Windows Server 2008 R2--a minor upgrade.

Cherry said that perhaps Microsoft should just embrace Windows 7's "minorness."
"You really don't want two major releases in a row," he said, arguing that the major architectural changes made with Vista are akin to pouring new concrete. "It needs time to cure. It needs time to settle in," he said. "It doesn't mean that, as an interim release, Windows 7 isn't important."

Just Back

2009-08-28T08:15:00.000-07:00

Sorry for the HUGE gap in my posts. I have been off line due to an operation on my spine. Well I'll get stuck back in on the posts as I've loads to blog about what with Microsoft releasing Officeel 2010 for TP and Apple stating they are about to release their first ever 'Tablet PC'.

I've attned WPC 09 andhv loads off feedbak on some of te key topics discussed.

IronKey Anti-Malware Protection

2009-02-05T04:02:00.000-08:00

Cyber-criminals are gaining access to corporate and government networks by getting malicious software malware and crimeware onto computers in the network by bringing it in on common USB flash drives and other removable media.

Unlike regular USB flash drives and memory sticks, IronKey devices are intelligent secure storage devices with strong, two-factor authentication and on-board security co-processors. IronKey Enterprise devices are managed remotely, allowing IronKey to provide automated security and anti-malware updates over the Internet or corporate network. This allows IronKey devices to provide you with the highest levels of malware and crimeware protection. IronKey has launched the industry’s most comprehensive anti-malware initiative for protecting removable storage media. Click here to read more detail and get answers to your questions about IronKey’s Anti-Malware Protection Initiative. What Is IronKey’s Expertise in Defending Against Malware and Crimeware?IronKey has worked closely with the US Department of Homeland Security Science & Technology Directorate to develop Next-Generation Crimeware Defense technologies. For a summary of the DHS HSARPA research into malware protection, click here. As part of this research, IronKey built a comprehensive malware analysis laboratory, and analyzed tens of thousands of different malware samples to develop threat models and prevention strategies. You can read a public summary of our initial research here. It is this deep background in malware research that has allowed IronKey to develop the industry’s most comprehensive malware protection for removable USB storage devices. Dave Jevans, IronKey's founder and Chief Executive Officer is the Chairman of the Anti-Phishing Working Group, the global pan-industrial and law enforcement association focused on eliminating the fraud and identity theft that result from phishing, pharming and email spoofing of all types. There are over 1,700 members of the APWG, including 9 of the top 10 US banks, the top 5 US ISPs, hundreds of security and technology vendors, and National & provincial law enforcement agencies worldwide.

2009-02-02T13:57:00.000-08:00

The Northern Ireland Department of Finance & Personnel (DFPNI)- Sign up for Enterprise Ironkey Platform

Thanks to the vision of number of key personal within the Northern Ireland Central Government, Civil Servants across the Provence will each be issued with a 2GB Enterprise Ironkey. After evaluating a number of encrypted devices, members of the Envisioning Team nominated the Ironkey platform as the platform of choice for delivering Military Grade mobile device encryption.

Working direct with the development team in Ironkey, the Envisioning Team in conjunction with Business & Scientific Services (BSS) developed a very special Ironkey that would benefit and secure Microsoft Vista machines across the entire Northern Ireland Civil Service and beyond. A Senior official within Microsoft commented 'Microsoft see huge benefit in this solution and believe it could be taken used within the Global Service Market'.

Building on the secure Ironkey platform, the NICS and the Envisioning Team believe Ironkey can address the required security needed for a modern day Government.

The Northern Ireland Envisioning Team are leading the way for our UK counterparts. A recent statement from Gordon Brown states 'Government cannot promise the safety of personal data entrusted by the public'. What a statement - Way to go Gordon

http://www.timesonline.co.uk/tol/news/politics/article5065795.ece Northern Ireland lead the way and are helping Ironkey develop the next generation Ironkeys. Some members of the team want to call the next generation 'The Nornironkey' Nice one Elaine, Jim, John and Fiona.

Cloud Computing with Pano Virtual Desktop

2009-01-19T12:24:00.000-08:00

I found this little device after looking for a 'Zero Client' PC.

Not only has this little device no CPU, no memory, no operating system, no drivers, no software and no moving parts it's footprint is less than a tea coaster.

Pano connects keyboard, mouse, display, audio and USB peripherals over an existing IP network to an instance of Windows XP or Vista running on a virtualised server. Pano is power friendly, consuming only 3% of the energy consumed by a traditional desktop computer. For those organisations considering reducing their carbon footprint and driving a clear desk policy, this is the device of choice.

For the Enterprise user it is clear that in a virtual world, pano alongside Microsofts, Application & Server Virtualisation makes for a very strong solution offering. To deploy a Pano device, simply connect it to peripherals, network and power. There is no configuration to perform, no firmware to update, and no software to download. As soon as a Pano is connected to a network, a logon screen appears. Users enter their Windows credentials and are automatically connected to their virtual machines. From there on, it's the same Windows experience.

From a security point, the Pano is secure because it does not run an operating system or any other software. Because there is nothing in a Pano that can be infected by a virus or have malicious code installed, it doesn't need to be scanned for vulnerabilities or exploits.

Even when a peripheral such as a USB thumb drive is connected, Pano remains secure. Peripherals work only when the user is authorised via policies enforced by the Pano Management Server. If the user isn't authorised, Windows doesn't even see the peripheral that is connected to the Pano. If a user is authorised, the peripheral is connected directly to Windows. Pano enforces fine-grained access policies based on Active Directory user group membership, USB device class, and operation. As an example, a user may be authorised to read from a CD, but not write to it. This policy allows users to copy files or load software onto their virtual desktop, but prevents data from leaking out. Even when users are authorised, Pano can record USB operations so that the business can keep track of all its information assets. This is a great move for those organisations considering 'Rights Management'.

I believe this is one product worth watching

Government Security - Miss Security Target

2009-01-17T15:02:00.000-08:00

Just 27 percent of IT systems at the Ministry of Defence and its agencies fully meet government security guidelines, the secretary of state for defence has admitted

Bob Ainsworth revealed the statistics on Monday in a written reply to a question from Conservative MP Shailesh Vara. In the reply, Ainsworth wrote that 58 percent of IT systems at the ministry and its agencies have been through the security accreditation process laid out by the government a year ago. The systems range from corporate IT set-ups serving thousands of users to business-level systems used by smaller groups.

Only 27 percent of these systems are fully security accredited and are being operated within the ministry's "senior information risk owner (SIRO)'s risk appetite", according to Ainsworth, which balances security risk against operational reward. The other 31 percent have conditional or interim accreditation, "with constraints placed on the operation of the system to ensure that identified risks are adequately managed within SIRO's risk appetite". The guidelines in question were instituted after an MoD laptop, containing the details of 600,000 people, was stolen. They cover issues such as the ability of staff to put sensitive or personal information onto flash drives or laptops — which may be mislaid — and the need to encrypt information. Forty-two percent of systems are not accredited at all. "This represents the significant workload undertaken to plan and develop solutions for new equipment systems or platforms," wrote Ainsworth. "This also includes applications from legacy systems, many of which will be migrated onto the developing defence information infrastructure."

Ainsworth's breakdown covered systems whose accreditation is controlled centrally by Defence Security and Standards Assurance (DSSA). These number in the hundreds. In addition to systems connected to Ministry of Defence networks, the total includes systems not connected but which contain sensitive or personal data — those given a rating of "stand alone above Secret" or "contain significant value to the MoD".

Platforms and systems that are not security-checked by the DSSA are not included.
On the same day, Ainsworth also provided a written answer to a question from the Tory MP Patrick Mercer, who had asked how many mislaid desktop computers, laptops, hard drives and USB flash drives had been lost then recovered by the MoD and its agencies in each year since 2003.

According to Ainsworth, a total of 43 such devices were recovered in 2008 by the MoD (up from 11 in 2007). This figure includes one desktop PC, 26 laptops, five hard drives and 11 USB flash drives. The answer did not state whether 2008 saw a jump in recorded recoveries because of improved recovery processes, or because more data-bearing devices were lost that year.

Do you think we should let them know IronKey exists.

Microsoft SideSight -"Look out Apple"

2009-01-17T14:42:00.000-08:00

A new Microsoft-developed technology called SideSight looks like something that deserves to be on a next-generation iPod touch. Or in a magician's repertoire.

The SideSight technology is contained in yet another paper that company executives are presenting at the User Interface Software and Technology conference this week. (See Microsoft's take on new ways that cell phones could "talk" as well as guided tours of images.), The paper in question is titled "SideSight: Multi-"touch" Interaction Around Small Devices," and is authored by Alex Butler, Shahram Izadi, and Steve Hodges, all with Microsoft Research UK.

Touch was a revolutionary concept when it debuted with the iPhone, in part because it was implemented so well with gestures. Pinching, sliding and tapping the iPhone and iPod touch all directly impact the interface.

SideSight removes "touch" from the device and makes it a function of the paper, tabletop, or even the air that's next to the device. What does this mean? According to Microsoft, it opens up the possibility for "touch" functions to be built into tiny devices that don't actually need a touchscreen.

"Despite the flexibility of touchscreens, using such an input mode carries a number of tradeoffs," the paper's authors wrote. "For many mobile devices, e.g. wristwatches and music players, a touchscreen can be impractical because there simply isn't enough screen real estate. With a continued trend for ever-smaller devices, this problem is being exacerbated. Even when a touch-screen is practical, interacting fingers will occlude parts of the display, covering up valuable screen pixels and making it harder to see the results of an interface action."
So what can you actually do with SideSight? Quite a bit, as it turns out. By twisting one's hands appropriately on either side of the phone, objects could be rotated in place. Pages could be panned and scrolled by moving a hand up and down, and Microsoft also proved that text could be entered and edited on the main screen through a stylus while the other hand scrolled the page -- a movement that would be akin to the motions a user's hands would make if he or she were writing on a sheet of paper.

A quick motion toward the device could also be interpreted as a "click," according to Microsoft.
The key is a row of tiny optical sensors that look "outside" the device. In a prototype Microsoft built for the paper, the researchers took a HTC Touch mobile phone, and augmented it with two linear arrays of discrete infrared (IR) proximity sensors, specifically ten Avago HSDL-9100-021 940nm IR proximity sensors spaced 10 millimeters apart. Although only the sides of the phone were enhanced, the entire periphery of a device could include these sensors, the researchers said. The sensors can read inputs up to 10 centimeters away, just through reflected infrared light.

We were pleasantly surprised by the performance of the SideSight sensors in the typical office environments we tried given that we took no special precautions to reject ambient light," the paper's authors wrote. "We attribute this in part to the fact that the sensors are looking horizontally rather than vertically upwards towards overhead lighting."
Individual fingers are sensed as a "blob" by the sensor array. One problem: users tend to drift one or more fingers into the area covered by the sensor field, the authors noted. Because they were unable to consistent determine which fingers were actively controlling the device and which were simply incidental, Microsoft decided to only look for a single finger, and use that to control the phone.

(The authors noted as well that the sensors weren't directly connected to the phone. Instead, they were connected via USB to a PC, and then to the phone via Bluetooth. The convoluted interface reduced the effective sensing capability to 11 frames per second, a limitation of the test rig and not the circuits.)

What does the future of SideSight look like? Improved power consumption, improved sensor range, and an enhanced prototype: "In the future we believe that it may be possible to print or-ganic electronic versions of such sensors, and so we are also interested in exploring a SideSight configuration that has the entire casing covered in this type of proximity sensing material," the Microsoft Research employees wrote.

See the Microsoft Research paper:

http://research.microsoft.com/en-us/um/people/shodges/papers/sidesight_crv3.pdf

Malware on Unsecure Flash Drives - The IronKey Response Part I

2009-01-17T14:25:00.000-08:00

The media has recently reported incidents involving the spread of the W32.SillyFDC worm, a low-risk piece of malware that sometimes infects PCs and networks via USB flash drives. Several government agencies have implemented a temporary ban on removable media.

IronKey have announced a comprehensive initiative to protect portable and mobile media from viruses, worms, trojans, botnets, crimeware and other malware threats. IronKey’s initial research was partially funded by the Department of Homeland Security’s (DHS) Science and Technology Directorate.

The IronKey secure USB devices can withstand both simple and sophisticated attacks and all IronKey products have been FIPS 140-2 Level 2 validated. IronKey devices are intelligent, secure storage devices with strong, two-factor authentication and on-board security co-processors. As security processor costs become more affordable, it is possible to embed increasingly sophisticated layers of protection inside portable devices to protect enterprise and government networks from media-borne malware and crimeware. This enables IronKey secure storage devices to provide the highest levels of anti-virus and anti-malware support in hardware. Hardware support for anti-malware provides an unbeatable layer of protection for mobile devices to prevent malware from spreading onto enterprise networks.

The IronKey Anti-Malware Initiative information can be found here.
Key points of the initiative include:- Always-on Milirary Grade hardware encryption.- Malware-protected software and firmware updates.- Secure manufacturing processes.- Secure provisioning and quality assurance processes.- Real-time anti-malware scanning.

Three Million Users hit by Windows Worm - Part 1

2009-01-17T14:16:00.000-08:00

A worm that spreads through low security networks, memory sticks, and PCs without the latest security updates is posing a growing threat to users. The malicious program, known as Conficker, Downadup, or Kido was first discovered in October 2008.
Although Microsoft released a patch, it has gone on to infect 3.5m machines. Experts warn this figure could be far higher and say users should have up-to-date anti-virus software and install Microsoft's MS08-067 patch.

According to Microsoft, the worm works by searching for a Windows executable file called "services.exe" and then becomes part of that code. It then copies itself into the Windows system folder as a random file of a type known as a "dll". It gives itself a 5-8 character name, such as piftoc.dll, and then modifies the Registry, which lists key Windows settings, to run the infected dll file as a service. Once the worm is up and running, it creates an HTTP server, resets a machine's System Restore point (making it far harder to recover the infected system) and then downloads files from the hacker's web site.

Most malware uses one of a handful of sites to download files from, making them fairly easy to locate, target, and shut down. But Conficker does things differently. Anti-virus firm F-Secure says that the worm uses a complicated algorithm to generate hundreds of different domain names every day, such as mphtfrxs.net, imctaef.cc, and hcweu.org. Only one of these will actually be the site used to download the hackers' files. On the face of it, tracing this one site is almost impossible.

Speaking to the BBC, Kaspersky Lab's security analyst, Eddy Willems, said that a new strain of the worm was complicating matters. "There was a new variant released less than two weeks ago and that's the one causing most of the problems," said Mr Willems "The replication methods are quite good. It's using multiple mechanisms, including USB sticks, so if someone got an infection from one company and then takes his USB stick to another firm, it could infect that network too. It also downloads lots of content and creating new variants though this mechanism." "Of course, the real problem is that people haven't patched their software. If people do patch their software, they should have little to worry about," he added. Technicians have reverse engineered the worm so they can predict one of the possible domain names. This does not help them pinpoint those who created Downadup, but it does give them the ability to see how many machines are infected. "Right now, we're seeing hundreds of thousands of unique IP addresses connecting to the domains we've registered," F-Secure's Toni Kovunen said in a statement. "We can see them, but we can't disinfect them - that would be seen as unauthorised use." Microsoft says that the malware has infected computers in many different parts of the world, with machines in China, Brazil, Russia, and India having the highest number of victims.

Cisco Security Data Leakage White Paper

2009-01-15T11:15:00.000-08:00

The findings from a global security study on data leakage revealed that the data loss resulting from employee behavior poses a much more extensive threat than many IT professionals believe. Commissioned by Cisco and conducted by U.S.-based market research firm InsightExpress, the study polled more than 2000 employees and information technology professionals in 10 countries. Cisco selected the countries based on their diverse social and business cultures, with the goal of better understanding whether these factors affect data leakage.
In the hands of uninformed, careless, or disgruntled employees, every device that accesses the network or stores data is a potential risk to intellectual property or sensitive customer data. Magnifying this problem is a disconnect between the beliefs of IT professionals and the realities of the current security environment for countless businesses. The new findings show that "insider threats" have the potential to cause greater financial losses than attacks that originate outside the company.
• 33 percent of IT professionals were most concerned about data being lost or stolen through USB devices.
• 39 percent of IT professionals worldwide were more concerned about the threat from their own employees than the threat from outside hackers.
• 27 percent of IT professionals admitted that they did not know the trends of data loss incidents over the past few years.
Mitigating data leakage from insider threats is a difficult challenge. Businesses must take advantage of every opportunity to better understand how employee behavior and intent relates to security issues, and to make security a priority in every aspect of business operations

Read the full story - http://www.cisco.com/en/US/solutions/collateral/ns170/ns896/ns895/white_paper_c11-506224.html

Could Computing on Steriods

2009-01-15T10:14:00.000-08:00

Salesforce.com is taking cloud computing to the next level:

Salesforce.com on Thursday announced Service Cloud, an extension to its software-as-a-service (SaaS) model that is intended as a way for companies to communicate with their customers over the web

The software provides an infrastructure through which companies can easily connect to their customers through various applications and services available on the web, such as blogs, Facebook, Google and Amazon.com.

Service Cloud will offer software bundles that will start at $995 (£680) per month and will include options to build online communities where customers can communicate with each other.
Introducing Service Cloud, Marc Benioff, chairman and chief executive of Salesforce.com, said: "This has been made possible through the emergence of native cloud-computing platforms like Force.com that are built to harness the power of other clouds like Facebook, Google, and Amazon.com."

Force.com uses platform-as-a-service software so customers can build applications and databases that can then be used as services on the Salesforce infrastructure.
According to Gartner analyst Michael Maoz, consumer demand will drive models such as Force.com. "[There is] consumer expectation that they can create answers and content as part of a community that will lead businesses and other organisations to adopt similar techniques to succeed."

These communities can be built by applications that gather information from websites such as Facebook, then feed that information into databases for use by a company's customer-service staff and partners. The communities build up and can then be used to improve relationships between companies and their customers.
Users of Salesforce software for these purposes include Dell and Starbucks.

Microsoft Seadragon

2009-01-15T10:00:00.000-08:00

Microsoft Seadragon was profiled to a live audience of more than eleven thousand people in WPC Denver 2007. Every one present was blown away by the functionality of the platform and how the partner community could utilise the software in a solutions offering. In addition to this and keeping with the same theme, Blaise Aguera y Arcas demoed Photosynth along with Seadragon to show how the developer community could greatly enhance the end user experience and drive so much functionality into their web offering. You can see Blaise Aguera y Arcas live demo on Ted - http://www.ted.com/index.php/talks/blaise_aguera_y_arcas_demos_photosynth.html.

Microsoft Live Mesh - Cool Tool

2009-01-15T09:33:00.000-08:00

What’s Live Mesh?

Live Mesh, enables you to synchronize and access information and files across your different PCs and it also lets you remotely control your PC through your web browser if you’re away from it.
Future releases will be adding support for more devices including Windows Mobile phones and Macs amongst others.

Live Mesh takes the best elements of the desktop and integrating them with the Internet to create a really valuable solution to keeping and sharing information and files.

https://www.mesh.com/Welcome/Default.aspx

Windows 7 Beta

2009-01-14T14:04:00.000-08:00

Windows 7 has reached its first major milestone in the form of Beta 1, which is now available for public scrutiny. We did a clean install of Build 7000 (32-bit version) on a VMware virtual machine with 2GB of RAM and 16GB of hard disk space, and set out to examine the changes since the pre-beta Build 6801 that we reported on at the end of October last year.

Another of Windows 7's Mac OS-like UI tweaks is the ability to float gadgets anywhere on the desktop — just drag them out from the Gadgets dialogue box

USB drive containing details of over 6,000 prisoners has been lost by Lancashire Primary Care Trust.

2009-01-14T13:47:00.000-08:00

Hi Folks. This is a great example of when an organisation should be using the Enterprise IronKey Platform. (https://www.ironkey.com/products)
While the data on the USB stick was encrypted, the password to access the data was attached to the drive on a Post-it note, a spokesperson from NHS Central Lancashire told ZDNet UK on Monday.
The drive went missing at HMP Preston on 30 December, and contained the details of up to 6,360 prisoners. The stick went missing as it was being taken from one area of the prison to another — from the medical clinic to the administration department — to be backed up. The clinic used a legacy, standalone computer to work with information on prisoners, and this was backed up using the data stick.
"We don't believe [transferring data on a USB drive within the prison confines] had been recognised as a security risk — it hadn't been highlighted as a potential issue," said the spokesperson.
The NHS Central Lancashirewas already in the process of developing a way to securely transfer medical data from the prison's healthcare system to an NHS server via a network connection, the spokesperson added. Three prisons served by the NHS Central Lancashire are currently being connected to NHS servers.
The prisoner details lost at Preston included surnames, age range, prison number, cell location, prison-clinic appointment times and review dates, said a PCT statement. In some cases, there was reference to clinics attended, medical condition and treatment offered. Conditions specified included asthma, diabetes and mental health, as well as "a very small number of sexual-health references", according to a statement from the PCT on Friday.

NHS Central Lancashire apologised for the loss of the USB drive. "We are deeply sorry — this never should have happened," NHS Central Lancashire chief executive Joe Rafferty said in the statement. "We have launched a full and thorough investigation, and we are taking all necessary steps to ensure it cannot happen again."
Rafferty said that the lost data relates to patients who have accessed HMP Preston's health clinic since the year 2000. Lancashire PCT will contact people affected, and a helpline has been set up for anyone concerned about the loss, details of which appear on the statement.
NHS North West, the Department of Health, the Home Office, the Information Commissioner and the Healthcare Commission have all been informed of the loss of the data stick.
The staff involved have been suspended pending the conclusion of an investigation, said the Lancashire PCT spokesperson, who declined to say how many staff had been suspended.
In addition, all of the PCT's USB drives, which are encrypted, have been recalled. They will be re-issued on a named basis. "People that have a data stick will have to understand how to use it, and use it within policy," the spokesperson said

Blogg Security

2009-01-11T12:30:00.001-08:00

Twitter has been the victim of a massive hacking and phishing attack. Over 30 member accounts were hijacked, including those of President-elect Obama, Britney Spears and CNN correspondent Rick Sanchez. Fox news’ twitter feed was also hijacked and used to post “Bob O’Reilley is gay” comments over supposedly legitimate Fox news twitter feeds. Many hijacked accounts are being used to spread links to web pages that attempt to install malware on unsuspecting user’s computers, turning them into bots which can be controlled by cyber-criminals.
Here are some links to the various incidents:
http://blog.twitter.com/2009/01/monday-morning-madness.html
http://bits.blogs.nytimes.com/2009/01/05/twitter-hit-by-hacker-phishers/
http://www.readwriteweb.com/archives/twitter_security_collapses_oba.php http://www.eweek.com/c/a/Security/Twitter-Phishing-Scam-Takes-New-Turn-With-Promises-of-iPhone/