Are Your Mobile Apps Up To No Good?

Most of us have heard the saying “It’s 2am, what are your kids doing?” and you may know, but do you know what your mobile apps are doing? I know before I started working in the industry, I would not have given a second thought to this, but consider this.

Why would an app designed to monitor your mobile’s battery need to know your location via your GPS? How come some gaming applications ask users for their phone numbers? Mobile applications, especially free ones, require some level of your personal data in order to supplement development costs. This means “free” isn’t exactly free.

Unsurprisingly 97% of users don’t understand how permissions correspond to the risk of an app. The consequences of not knowing is once you share your personal data, it now can be use and sometimes abused and is out of your control forever.

If it’s digital then that means it’s also “repeatable” and can be copied, pasted, duplicated and sent an infinite amount of times. For example 18.3 million US adult Smartphone owners have looked up medical information.  32.5 million US adult Smartphone owners access banking information. Using applications that don’t care much about your privacy can expose this data.

Android applications can ask for 124 types of permissions and with these permissions someone can turn on your camera, monitor or modify or even kill outgoing calls, record images of your screen while you enter personal information, monitor and view texts or pictures and even scarier capture conversations in the room when no call is active!!

What’s troubling is 33% of apps ask for more permissions than they need, 42% of users don’t know what these permissions are and 83% of users don’t pay attention to permissions when installing an app. This all adds up to needing to know what your apps are doing.

To help you protect your privacy and identity when using apps you should:

•     Research apps by checking their ratings and reviews before you download
•     Only download apps from reputable apps stores
•     Read the Terms of Service (TOS) to determine what data the app is going to access on your mobile device.
•     Use comprehensive  mobile security app with app privacy features, such as McAfee Mobile Security, that will provide insight into the activity and safety of your apps

By Robert Siciliano

The Real Cost of Losing Your Phone

About four weeks ago, I lost my much loved BlackBerry at Sydney airport. I felt like my life was over – and you know what, it was for a few days.

I had lost years’ worth of contacts, apps and precious photos of my boys! I was shattered.

Now just because I am Cybermum doesn’t mean I am perfect. Far from it! So, I am confessing – I hadn’t backed up my phone, since Christmas! I hadn’t even had enough time to even download the pics of my kids. I was too busy – life got in the way.

So, as punishment, it took me days to get myself sorted out. And to be honest, I am still not quite back to normal. With research showing that around 28% of digital assets cannot be restored when smartphones are lost, I think I have to accept that life will never be the same.

But, this won’t happen again. Yes – there is an insurance policy available. I am in the throes of loading McAfee Mobile Security onto my new Android device which means if it happens again, my life will not go on hold. I will be able to locate and track my phone, remotely wipe the data if I need to and, backup and restore data if I was to lose it again! If only I had been more organised!!

Note to Self – never leave your phone at the airport again, continue to use a security password, get some mobile security software and don’t blow $1000 replacing your smartphone! Just imagine how far that could go at Westfield!

By Cybermum Australia

Keep Your Gadgets Secure During Summer Travel

Traveling isn’t at all fun. Vacationing is fun, but getting there and dealing with taxis, rental cars, airplanes, hotels and all the unfamiliarity can be unpleasant. And in the midst of all this, criminals are on the lookout for people vacationing. You tend to be more relaxed and your “guard” is down. You also may be in a unfamiliar place.

To make sure your vacation isn’t spoiled by cybercriminals and to make sure you travel with more ease, here’s some things to be aware of.

Taxis
From the moment you leave your home make sure your cab driver thinks you will be back that night and give the impression your home is alarmed, there is an attack dog there and your roommate Rocco will be home. You don’t want to let the taxi driver know your address and that no one is going to be home for a week.

We often leave stuff in cabs, such as mobile phones, tablets and flash drives. And usually, once it’s left, it’s lost for good. Create sticky labels with your contact information and stick them on the device. If the cabbie or the next person in the taxi is honest, you may get your devices back. You should also consider using a security product on your mobile devices that lets you remotely locate, lock and wipe them in case your mobile phone or tablet is permanently lost or stolen so no one can access all the personal data you have on the device.

Airplanes
Keep your devices with you or under the seat in front of you. You probably don’t want to check them in with your luggage and you should be wary when putting them in the overhead compartments. Make sure you check all the area behind you when you deplane and if you get up to use the restroom or walk around, take your device with you or make sure a traveling companion is watching it.

Hotel Rooms
Hotel rooms are not secure. More than once I’ve entered a hotel room with somebody else’s stuff laid out on the dresser and on the bed. Sometimes the clerk assigns the same room to two people, or the keys work in multiple rooms. Never ever leave anything of value in your room, including in the hotel safe.

Rental Cars
My wife traveled to Spain, got off the plane, and rented a car, and drove off the lot. At the first stop sign, a man knocked on her passenger window and pointed, saying, “Tire, tire.” She put the car in park and walked over to the passenger side. The tire was fine and the man was gone. When she got back in the car her purse had disappeared from the front seat. Her driver’s license, passport, cash, and credit cards were all gone. Don’t leave things unattended in the rental car and be sure to check everywhere before you return the car as mobile phones can easily slide under the seat or between the dashboards.

Wi-Fi
Wi-Fi connections are hotbeds for thieves, especially if they are unsecured, like most public hotspot or free Wi-Fi access locations are. When you’re a Wi-Fi connection in a hotel, café or wherever you are when traveling, make sure you don’t access financial sites or do online shopping. It’s easy for criminals to setup fake connections that appear legitimate but are traps to capture information from unknowing victims.

I hope these travel tips help keep your devices safe when you’re traveling so you can enjoy your vacation!


By Robert Siciliano

The ‘Other’ Kind of Healthcare Breach

What if a criminal held your healthcare information for ransom, so you and your doctor had no way of accessing critical medical records?

The adoption of electronic healthcare records has brought to light a plethora of security concerns. Worries about unauthorized access, information breaches, and questions about how the proliferation of sensitive data could impact a patient’s future are very real threats, and they must be addressed sooner rather than later. HIPAA goes a long way to help regulate how this sensitive data can be viewed and shared, but what happens when a hacker finds a weakness in the system?

We’ve seen this happen in other industries time and time again: a hacker finds a weakness and takes advantage. Unfortunately, this has now become a reality for the healthcare industry as well. Recently at a medical practice in Illinois, a hacker was able to encrypt the organization’s electronic records, then demand ransom for a password that would allow them to unlock the data. The organization responded appropriately, immediately turning off the server and contacting authorities.

The practice was then required to disclose the nature and scope of the breach to the Office of Civil Rights (OCR), to be added to what is known in the healthcare industry as The Wall of Shame. According to the OCR, the healthcare records of 20,970,222 people have been compromised since September 2009. In this case, the breach was listed under the category “other”. I guess there haven’t been many attempts at extortion via medical records so far, but as we approach nearly 21 million people affected, breaches like the Illinois extortion attempt could very well increase. Will “extortion” be a category in the future?

Let us know your thoughts on this topic in the comments below, and be sure to follow @McAfeeBusiness on Twitter for the latest updates on industry news and events.

By Kim Singletary

Shedding Light on Electronic Healthcare Record Outage

In my research, healthcare providers have rated their use and desire to use the cloud as relatively low compared to other industries. Since the HITECH Act of 2009 encouraged the adoption of electronic health records, many providers have been looking for a cost-effective way to support the infrastructure needed for electronic records. And while the cloud could provide a solution, many providers are still concerned about the privacy, security and availability of cloud environments.

Nevertheless, many of these healthcare providers regularly utilize the services of business partners who absolutely use cloud technology to stay competitive. And as with any partner that provides a high value service, these partners must be vetted for their service quality. In the healthcare industry, this means going beyond providing the standard set of marketed packages; it includes adherence to compliance, business rules, and escalated notification for possible service issues.

But there needs to be additional work on behalf of the healthcare provider. Whenever critical systems and services are co-managed by multiple parties, organizations must plan for contingency. A recent story from the LA Times tells about a 5-hour outage that left healthcare providers unable to access the electronic records of their patients. The providers have the ability to revert to paper-based record creation during the downtime, but what they lacked were relevant digital records like test results, past diagnoses and treatment protocols. The work-around for general practices might have caused an inconvenience, but in areas of critical care or triage situations, this data outage could have been a much larger and possibly life-threatening concern.

Unfortunately, healthcare IT providers have been working with very strong constraints as they balance business, privacy and infrastructure issues. In a recent conversation, one healthcare provider security leader pointed to the painful reality that doctors, clinicians, and workers assume everything will work just like turning on the lights. Setting up and paying for resilient electronic contingency plans for electronic health records and putting money aside for partner risk, security and compliance assessments of their infrastructure and cloud services just doesn’t happen today.

Yet as with all businesses, the healthcare industry is relying more and more on connected partners for the integrity and access of their data. As a result, these kinds of outages and security incidents will start to drive more sophisticated and risk-based business rules and time-sensitivity. In a situation where an unconscious 30-year-old enters the emergency room, what medical data would be more important? Would it be the fact that she’s allergic to penicillin, or that she broke her ankle when she was 25, which may play an important part in her treatment?

Healthcare is at the point where they are just dipping their big toe into digital records, with all of the business and patient ramifications that come with that technology. From physicians to customers, more awareness needs to happen to make this work in the long run, and of course some hard lessons will need to be learned along the way. After all, it wasn’t until after WWI that household electric lighting became widely available across the country, and there are still concerns today about protecting this critical infrastructure.

By Kim Singletary

Security In A Multitenant Cloud

One of the biggest conceptual barriers to enterprise public cloud use is mulitenancy. It’s difficult enough for IT to give up control of the infrastructure to a cloud provider, but the thought of sharing physical servers and storage with other organizations is a big stumbling block for enterprises considering running sensitive applications or storing sensitive data in the cloud.

If you’re terrified by the concept of multitenancy, consider a report released by Forrester in March, 2012 entitled Understanding Multitenancy. One of its conclusions is that a public cloud multitenant architecture can actually be more secure than the typical in-house IT infrastructure. Why?  IT security is mostly perimeter based, making organizations vulnerable to inside attacks. A properly architected multitenant service secures all assets at all times.

If you’re looking at potential public cloud providers to host your sensitive applications or data, here are some issues to consider.

•     What constitutes a tenant? With an infrastructure provider, a tenant is likely a collection of customer virtual machines (VM’s) sharing the providers’ physical servers with other customers’ virtual machines.  With a software as a service (SaaS) provider, a tenant may actually be sharing a single application instance or database with many other tenants. In one case you’ll want to know how VM’s are kept isolated, in another you’ll probably be more interested in how one tenant is prevented from accessing another tenant’s data.
•     Who are the tenants and who are the providers? The answer can be tricky. The multitenant software as a service provider (SaaS) you’re considering may be running its applications on one or more infrastructure as a service (IaaS) providers’ servers, or you may have multiple layers of SaaS, IaaS, and even Platform as a Service (PaaS) combining to produce a single service. You may have to consider the security implications of each.
•     How much security information does the provider offer?  Does it describe its security architecture on its Web site? If you’re talking with representatives of the service are they willing to discuss security architecture in depth? You’d be surprised at how many cloud services insist on remaining very vague about security.
•     What certifications does the provider have? ISO 27001 and, depending on your organization, HIPAA and PCI certification are reasonable indications that the provider is taking the right security measures to protect its tenants.
•     Sometimes the best security is simply living in a good neighborhood. Who are the provider’s other tenants? Are any of them security sensitive organizations in areas like government, finance, and health care? Does the provider accept anyone or does it have a process for weeding out potentially risky tenants? This is important, because a hacker sharing a server with you inside the perimeter firewall may have an easier path to your sensitive applications and data.
•     What measures does the provider take to isolate tenants? At minimum an IaaS provider should separate tenant traffic using VLAN’s and use hypervisor-based stateful inspection firewalls and intrusion detection or prevention to block potential interVM attacks. In the case of an SaaS provider, strong authentication and authorization are essential and data encryption is important. What measures does the provider take to liquidate data that has been released by a cloud tenant?
•     What security visibility does the cloud provider offer? Do you get security and incident reports at the end of the month? Do you get a portal that shows any security  and attack mitigation information? Does the provider have a policy for contacting the tenant if an attack moves past a certain risk or attack level?

As Forrester points out, the multitenancy in a private cloud is not an insurmountable issue for the enterprise, but it is one that you should research very carefully when choosing a provider.

By Leon Erlanger

On the Road to True Connected Security

Here’s a quick summary of my webcast yesterday on next-generation network security.

There’s a lot of hype about the changing threat landscape and challenges to traditional security strategies. The reality is that we need both familiar and new tools as we evolve the conversation from point-based solutions, which typically protect one stage in an attack sequence, to integrated, connected solutions – the best way to protect against next-generation attacks.

Some hard truths about security today:

•     Borderless networks are more susceptible. Data in transit is data exposed; losing physical boundaries has serious security implications. Everything is connected, therefore potentially vulnerable to takeover. Concentration of data in warehouses promises a possible bigger payoff from a single hack.
•     Attacks are growing more sophisticated. Remote procedure calls and SQL injections are increasing. Hackers are getting smarter about evading traditional defenses.
•     The stakes are getting higher. We’ve just seen a massive electric failure in India which, due to malicious action or not, illustrated the potential fallout from a system attack. Loss of electric grids or phone or transit networks can have massive impact on a country’s security.
•     IT is growing more complex. By 2015 Cisco predicts we’ll have 15 billion mobile devices in use. Each is a potential target. But we aren’t growing the ranks of network or security administrators at nearly the same pace, so security tools have to get smarter.

In the face of all this complexity, firewalls are a powerful but not total solution. Firewalls place an emphasis on enforcing policy and limiting and controlling access. They’re more effective at deterring broad-scale attacks than smaller, targeted ones. Security is an ongoing battle that can’t be won with a single weapon; you need a concert of weapons and individuals. The best approach is a framework that facilitates a connected approach to security.

We haven’t always referred to it this way, but McAfee has had a “next-generation” IPS (intrusion protection system) in place for some time. It combines traditional IPS with more advanced elements like behavior analysis, application awareness, and network visibility.

More and more, the threat prevention paying field is going to focus on anomaly detection heuristics – behavior analysis – in addition to the traditional safeguards.

With a platform approach that spans an entire network, using the same tools throughout the infrastructure and coordinating threat response, we now have heightened “context awareness” that highlights anomalies. We can tell when a machine starts behaving in unexpected ways – when a computer known to be someone’s personal device starts acting like a mail server, for example. We can tell when a user’s browsing or protocol behavior changes.

As for content awareness, nearly all security vendors still use signature detection as a baseline defense – it’s not true that those strategies are “dead,” as some claim – but we increasingly use reputation data, measuring a current file or IP address against past data, and file anomaly detection. (If a PDF seems to be running an executable, for example, it begs for attention.) Botnet detection is as big an issue as ever; we can look a dozens of heuristics to identify a bot on the network. When a system reaches out to many IP addresses in rapid-fire fashion, for example, that profile says “bot” very quickly.

It adds up to more accurate, timely threat detection; these additions improve security defenses by up to 30 percent compared to signature defense alone.

Beyond heuristic analysis, the next big value-add is generation and analysis of an enterprise-wide data layer with the help of external intelligence. Part of McAfee’s Security Connected framework  is McAfee Event Reporter, a log management tool that collects and correlates millions of events from across the organization. A correlation engine analyzes them against reputation data from the cloud, isolates threatening trends, and even identifies particular events based on historical data. This turns a simple log manager or event manager into a security solution and generates a global, company-wide view of your risk posture. It doesn’t even require an all-McAfee technology landscape across the organization; the big idea here is to strive for a connected approach.

To get on the road to a true connected security posture, I think you need a construct that lets you leverage “next-generation” benefits like these without forgetting about traditional safeguards. You may have a stack of individually effective one-off security solutions, but the changing threat landscape and the available streamlining potential say it’s time to combine them into a single, connected approach.  In a world of more genuine threats and mushrooming network complexity, it’s the best way to stay ahead.

By Tyler Carter

Your Next Breath May Be Compromised By Malware

For some, breathing requires the assistance and support of healthcare providers and medical respiratory equipment. But as a patient or caretaker of a loved one who relies on these devices, would you be concerned about receiving updates from the manufacturer through the Internet?

We often take for granted how connected our lives are and how the things we rely on are constantly updated. We have become accustomed to updating our applications without hesitation – from downloading updates to mobile devices to regularly checking for Microsoft patches on your laptop to avoid Trojans and malware.

This is NOT the proper reaction when it comes to devices that are critical to health and life support, even if they are connected and able to do so.

Recently, the support website for a respiratory manufacturer’s updates was repeatedly found guilty of proliferating malware. Viruses may have been streamed to patients’ devices via automatic software updates, raising concerns about how many devices were compromised and what should be the next steps for both patients and manufacturers. There is no easy solution, and devices that are integral to patient health present unique IT challenges. Updates need to be tested and verified to make sure that the process of delivery does not cause any issues with the performance, availability or the integrity of the device.

Registered mail ensures that a letter is delivered without being tampered with, and it requires the signature of the recipient completing the delivery. Connected medical devices can leverage a similar business process that ensures delivery without compromise. It takes a few more steps and technologies like McAfee’s Embedded Control, which uses application whitelisting with digital certificate updater support, but it can provide the verification and protection needed to manage updates to critical devices.

No one wants to hinder innovations in healthcare technology, but patients don’t want their next breath to be compromised by malware either. By choosing the right security solutions for connected medical devices, we can all breathe easier.

By Kim Singletary

Will The Tech Industry Ever Fix Passwords?

Recently, CIO magazine published an article “Will Tech Industry Ever Fix Passwords?”, pointing out that “…in this age of cloud computing, SaaS and increased mobility, users are spreading their credentials everywhere. Passwords are inherently weak. Dictionary attacks are standard and rainbow tables can be used to crack more sophisticated passwords.”

Rather than trying to come up with more complicated and difficult-to-manage password management rules and procedures, the industry needs to come up with an approach to eliminate the need for passwords altogether – that approach is single sign-on (SSO). Standards-based federated SSO that depends on the exchange of tokens between an identity provider and a service provider has proven itself as the best alternative to user ID/password-based authentication.

SAML (Security Assertion Markup Language) is a widely used federated SSO industry standard, but it is typically used for B2B access management. OpenID has become popular for reusing credentials from social media providers (e.g., Facebook and Google), but, as the article points out, it contains some security holes that need to be plugged.

While there is no single panacea available today—especially for consumers—eventually the industry will settle on a single, widely accepted standard, such as SAML, as the basis for authentication. Two-factor authentication will also achieve greater prominence as a way of securely identifying an individual using more than a user ID/password combination. The good news is that 2-factor authentication, using a variety of approaches, such as delivering a one-time password to a mobile device, or facial recognition using standard webcams and mobile cameras, is readily available today and is becoming increasingly consumer-friendly.

Businesses are already deploying SSO portals, either inside the firewall or in the cloud as a service, for their employees, contractors, business partners and customers. It is likely that a consumer-oriented service will emerge that provides a personalized portal that will allow consumers to create a customized web page—protected by 2-factor authentication tools—that they can use to quickly and easily federate their identity with all the various SaaS apps and web sites they want to access.

The technology exists today to provide both business users and consumers with secure access to any web app, from any device, without needing to remember dozens of user ID/password combinations. Now, it’s mostly a question of defining the business model and making a solution available that ordinary consumers will find useful. To find out more, visit McAfee.com or intelcloudsso.com and be sure to follow @McAfeeBusiness on Twitter.

By Robert Craig

Scams Are a Sport This Summer

Scammers tend to follow an editorial calendar much like journalists do. For example when the holiday season is coming journalists often write about bargains to be had while scammers use the season as an opportunity to try and entice users with deals that are “too good to be true.”

This same practice is also used for high-value news items such as a natural disasters, celebrities and high-profile sporting events. Many of us are not aware of the risks and threats associated with such high-profile sporting events and the impact this could have on you, your devices and your personal data. In fact, in a recent survey done by OnePoll for McAfee, only 13% of Brits are worried about a cyber threat spoiling their enjoyment of the summer’s sporting events.

As the world descends into a sporting frenzy this summer, it can be easy to become a little sloppy about keeping your mobile devices safe and secure. However, now is the time when we need to be more cautious.

McAfee has recently identified several scams related to sports which encourage consumers to share their personal details. These can take the form of text messages, social network spam or emails offering fake tickets or lottery wins.

In order to help you keep your mobile devices protected during this summer of sport, you should:

•     Heed the advice of too good to be true
•     Be wary of phony websites, emails, texts and pop-ads offering “too good to be true” deals on tickets to sporting events, autographed merchandise, and “winning” a trip to events.
•     Back-up your data
•     Before you leave on a vacation to a major sporting event, make sure you’ve made a replica of your data from your smartphone, tablet, laptop or any other devices you’re taking with you. That way in case your device is lost or stolen, you still have all our data. Also consider deleting any personal information on the device that isn’t absolutely necessary.
•     Disable location services
•     Before posting photos on sites like Facebook, turn off GPS to avoid having your location information falling into the wrong hands.
•     Don’t let your apps remember your user names and passwords: Also make sure you don’t store credit card information or passwords on websites. If your smartphone or laptop is lost criminals can easily access these accounts
•     Be careful when using Wi-Fi networks
•     Avoid using public or free Wi-Fi networks when trying to access information online. Your information could easily be stolen without your knowledge and you should log in to any financial or shopping sites.
•     Use “safe search” technology
•     Make sure that install software the alerts you to risky sites that you may receive via email, texts, IMs or social networking sites. This will prevent you from going to a site that could download malicious software on your mobile device that could steal your identity and financial information.

The world’s biggest sporting event is something to be enjoyed by all and by following these tips, you can stay safe and just enjoy the event!

By Robert Siciliano

Yahoo! Hacked: 15 Tips To Better Password Security

In light of the Yahoo Voices hack where 450,000 passwords have been compromised, it’s time again to let the world know what they are doing wrong when it comes to passwords. CNET pointed out that:

2,295: The number of times a sequential list of numbers was used, with “123456″ by far being the most popular password. There were several other instances where the numbers were reversed, or a few letters were added in a token effort to mix things up.

160: The number of times “111111″ is used as a password, which is only marginally better than a sequential list of numbers. The similarly creative “000000″ is used 71 times.

Protect your information by creating a secure password that makes sense to you, but not to others.

Most people don’t realize there are a number of common techniques used to crack passwords and plenty more ways we make our accounts vulnerable due to simple and widely used passwords.

Common Ways Hacks Happen

Dictionary attacks: Avoid consecutive keyboard combinations— such as qwerty or asdfg. Don’t use dictionary words, slang terms, common misspellings, or words spelled backward. These cracks rely on software that automatically plugs common words into password fields. Password cracking becomes almost effortless with a tool like John the Ripper or similar programs.

Cracking security questions: Many people use first names as passwords, usually the names of spouses, kids, other relatives, or pets, all of which can be deduced with a little research. When you click the “forgot password” link within a webmail service or other site, you’re asked to answer a question or series of questions. The answers can often be found on your social media profile. This is how Sarah Palin’s Yahoo account was hacked.

Simple passwords: Don’t use personal information such as your name, age, birth date, child’s name, pet’s name, or favorite color/song, etc. When 32 million passwords were exposed in a breach last year, almost 1% of victims were using “123456.” The next most popular password was “12345.” Other common choices are “111111,” “princess,” “qwerty,” and “abc123.”

Reuse of passwords across multiple sites: Reusing passwords for email, banking, and social media accounts can lead to identity theft. Two recent breaches revealed a password reuse rate of 31% among victims.

Social engineering: Social engineering is an elaborate type of lying. An alternative to traditional hacking, it is the act of manipulating others into performing certain actions or divulging confidential information.

Tips to Make Your Passwords Secure

•     Make sure you use different passwords for each of your accounts.
•     Be sure no one watches when you enter your password.
•     Always log off if you leave your device and anyone is around—it only takes a moment for someone to steal or change the password.
•     Use comprehensive security software and keep it up to date to avoid keyloggers (keystroke loggers) and other malware.
•     Avoid entering passwords on computers you don’t control (like computers at an Internet café or library)—they may have malware that steals your passwords.
•     Avoid entering passwords when using unsecured Wi-Fi connections (like at the airport or coffee shop)—hackers can intercept your passwords and data over this unsecured connection.
•     Don’t tell anyone your password. Your trusted friend now might not be your friend in the future. Keep your passwords safe by keeping them to yourself.
•     Depending on the sensitivity of the information being protected, you should change your passwords periodically, and avoid reusing a password for at least one year.
•     Do use at least eight characters of lowercase and uppercase letters, numbers, and symbols in your password. Remember, the more the merrier.
•     Strong passwords are easy to remember but hard to guess. Iam:)2b29! — This has 10 characters and says “I am happy to be 29!” I wish.
•     Use the keyboard as a palette to create shapes. %tgbHU8*- Follow that on the keyboard. It’s a V. The letter V starting with any of the top keys. To change these periodically, you can slide them across the keyboard. Use W if you are feeling all crazy
•     Have fun with known short codes or sentences or phrases. 2B-or-Not_2b? —This one says “To be or not to be?”
•     It’s okay to write down your passwords, just keep them away from your computer and mixed in with other numbers and letters so it’s not apparent that it’s a password.
•     You can also write a “tip sheet” which will give you a clue to remember your password, but doesn’t actually contain your password on it. For example, in the example above, your “tip sheet” might read “To be, or not to be?”
•     Check your password strength. If the site you are signing up for offers a password strength analyzer, pay attention to it and heed its advice.

In the end, it’s the responsibility to the public to protect themselves. This disclosure now requires those currently exposed to change their password. The rule of thumb is to change your passwords frequently, every six months. It’s a cliché, but true, passwords need to be strong. Let the keyboard be your palate and be creative. A common mistake people make is that they use dictionary or slang terms. Beware. Dictionary attacks use software that automatically plugs common words into password fields making password cracking effortless for various tools.



By Robert Siciliano

Robert Siciliano is an Online Security Expert to McAfee. See him discussing identity theft on YouTube. (Disclosures)

What Are The Risks Of A Lost Or Stolen Mobile Device?

Have you ever thought about what would happen if you lost your mobile phone? These days we rely on our mobile phones more than ever. For a lot of us, it can also be a nightmare if it’s lost, stolen or hacked, especially since today it’s become our most personal computer,

But despite the fact that 1/2 of of us would rather lose our wallet than our mobile phone, only 4% of us have taken steps to protect our mobile device with security.

For most of us, our first reaction when we lose our wallet is I have to cancel my credits cards, get a new license, etc. When we lose our phones, we think about the pain and cost of replacing the device. But that’s just the tip of the iceberg.

We don’t realize that our photos, emails, text messages and our apps can be an open door for thieves into our personal information, privacy and financial accounts.

And the time to replace your smartphone and its contents can consume as much as 18 hours of your life.

Mobile devices are on the move, meaning they can more easily be lost or stolen and their screens and keyboards are easier targets for “over the shoulder” browsing.

Take time to protect your mobile device. Here’s some tips to keep your mobile safe:

•     Never leave your phone unattended in a public place
•     Put a password on your mobile and set it to auto-lock after a certain period of time.
•     If you use online banking and shopping sites, always log out and don’t select the “remember me” function
•     Use mobile device protection that provides anti-theft which can backup and restore the information on your phone, as well as remotely locate it and wipe data in the case of loss or theft, as well as antivirus and web and app protection.

By Robert Siciliano

Robert Siciliano is an Online Security Evangelist to McAfee. Watch him discussing information he found on used electronic devices YouTube. (Disclosures)

Phisher Use Olympic Lottery Scams For Summer Games

Fishing, of course, is the sport of tossing a baited hook into the water and then patiently waiting for a fish to bite.

Phishing is similar. The cybercrook sends out spam email and waits for a victim to take the bait. A phisher can send thousands of phishing emails a day, and eventually some people will get hooked.

Phishing is a multi-billion dollar business. Unlike the ongoing depletion of the ocean’s fisheries, there are still plenty of people out there to phish. Today, many victims in developing nations like India and China have only recently gotten broad­band Internet access, and are considered fresh meat by the bad guys.

Phishers follow a similar editorial calendar as newspaper and magazine editors, coordinating their attacks around holidays and the change in seasons. They capitalize on significant events and natural disasters, such as Hurricane Katrina, the Japanese Tsunami and the swine flu. On their radar right now is the 2012 Olympics.

Francois Paget, Senior Threat Researcher at McAfee discovered numerous emails combining scam lotteries and the Olympics. Like chocolate and peanut butter these two topics go great together.

“These mails inform the recipients that they have won a substantial amount of money. After contacting the lottery manager, the victims of these rip-offs will be asked to pay “processing fees” or “transfer charges” so that the winnings can be distributed. In some cases, the organizers ask for a copy of the winner’s passport, national ID, or driver’s license. With that personal information compromised, future identity theft activities are guaranteed.”

Awareness is the best way to avoid being scammed. Knowing what the bad guys are doing to hook their victims and learning not getting caught is your best protection. Here’s  a video that explains what phishing is and how to detect if an email is phishing. You should also be aware of phishing when reading emails on our mobile phone. For more information about mobile phishing, read this.

•     Invest in security software that includes antivirus, anti-spyware anti-phishing and a firewall.
•     Never click links in the body of an email unless you are 100% sure it’s legit
•     Don’t go snooping around your spam folders opening emails that look suspect.
•     When in doubt, delete. Like mom said, if it’s too good to be true, it is.

By Robert Siciliano

Robert Siciliano is an Online Security Expert to McAfee. See him discussing identity theft on YouTube.

NFC at the Summer Games Could Be Exploited

NFC is an acronym for near field communication, a wireless technology that allows devices to talk to each other. In the case of a mobile wallet application, those devices would be a mobile phone and a point of sale device at a checkout counter.

Visa is testing out its NFC service PayWave contactless payment service at the Summer Olympics in London. Every athlete will get a Samsung Galaxy SIII phone enabled with near-field communication (NFC) along with Visa’s payment app.

NFC can be used in other ways beyond credit card transactions. It can integrate with hardware, such as your car, to unlock a door. It can activate software.

Soon enough, using your phone as a credit card will be commonplace. Mobile contactless payments, in which you pay by holding your phone near the payment reader at the register, are expected to increase by 1,077% by 2015.

All of this is good and well, however, there are security issues with NFC that still need addressing. McAfee researchers point out a scam called “fuzzing the hardware”, which involves feeding corrupt or damaged data to an app to discover vulnerabilities. Once such vulnerability is found, the attacker must research and develop an exploit to perform various attacks (e.g. steal credit card info. export the data to the attacker, leak credit card info to any requester). The attacker will then need to find a method to have the victim run the exploit. This entire process costs attackers and criminals in time and money, which can be justified in the case of NFC enabled phones and a multitude of stores with card readers.

McAfee discovered exploitable vulnerabilities on Android and iOS phones. If someone has NFC turned on, an attacker in close proximity can pick up every signal to gather private information or payment information on an athlete’s device.  It is almost like pick pocketing, but they don’t even have to touch you.

McAfee researcher Jimmy Shah stated an attacker wishing to target the Samsung Galaxy SIII devices at the summer games can purchase one easily and use the researcher’s data to help find vulnerabilities and eventually develop exploits to steal a victim’s credit card. The large number of readers at the Olympics will provide places where a successful attacker can use stolen credentials to make purchases.

Users can protect themselves by obtaining apps from the Google Play Market, Amazon’s Appstore, or their carrier’s app store, avoiding 3rd party stores that may have pirated or maliciously modified software. Reviews from other users are also helpful in determining safer apps.

NFC handsets are set to increase to about 80 million next year. Gartner estimates that that 50% of Smartphone’s will have NFC capability by 2015. Pay attention to what’s happening in the world of NFC, mobile payment and mobile security  because before you know it, your wallet will be your mobile phone.

By Robert Siciliano

Robert Siciliano is an Online Security Evangelist to McAfee. See him discussing identity theft on YouTube. (Disclosures)

Workload Mobility Is More Real Than You Might Think

One of the many holy grails in data center architectures has been the notion of workload mobility: the ability to pick up an arbitrary set of applications (and their data!), move them over a distance, and do so with an absolute minimum of effort and disruption.

It's an incredibly useful capability, especially if you've got multiple data centers and veritable zoo of applications in your menagerie. 

Move apps to get to newer hardware.
Move apps to get more performance.
Move apps to save some money.
Move apps to rebalance.
Move apps because you need to take some infrastructure off-line.
Move apps to increase protection levels.
Move apps because you've got a new data center location.

No shortage of good, practical reasons of why you'd occasionally want to move a set of workloads.

They put casters on heavy appliances for a reason!

But moving applications around has always been a complex and disruptive pain -- lots of planning, lots of coordination, lots of downtime.  Not the sort of thing that IT professionals warmly embrace with enthusiasm and passion.

But -- for some IT shops -- that's started to change.  And we'll see more in the near future -- I'm sure of it.

Why Is Moving Applications So Hard?

By "moving", what I'm really talking about is  "moving an application from one data center to another, separated by distance".   If you've never contemplated what's involved, you might be asking -- what could be so hard?

The data has to be moved.  The application has to be shut down in one location and restarted in the new one.  Network addresses have to be updated.  The "supporting cast" -- backup, security, management, monitoring, etc. has to be notified and perhaps reconfigured.

On and on and on.

Think of everything you'd have to do to move your home between two states.  For me, it hurts my head just thinking about it.  Lots of interrelated and sequential activities, with  significant disruption involved.  And, of course, no shortage of complaints from the family during the process.

The inherent friction means you won't do it very often -- unless there's a compelling set of circumstances.

Now, take away almost all of the friction.  Take away almost all the complexity.  Take away the dependencies and sequential processes.  Once configured, easily move the whole shebang from here to there anytime there's a good reason -- no drama, no fuss, no complaints.  Just pack and go.

To those who've been in the IT business for a while, this might sound like science fiction.  Well, so did quantum entanglement -- at one time.

But -- very quietly -- workload mobility has now started become a core capability that's getting routinely baked into IT infrastructure.

Meet Katten Muchin Rosenman LLP

They're a good-sized law firm -- 600 attorneys.  What makes them exceptional in this discussion is that -- well -- they don't appear to be particularly unique from an IT perspective.

Their law firm has to do the same sort of bread-and-butter IT stuff that law firms around the world have to do.  Like most of their peers, they have to provide a wide range of capabilities to demanding professionals, keep service levels high, while watching the expense line.

Interesting, but not exactly bleeding-edge IT stuff.  And that's the point.

The press release tells the story.  Business has been good for them.  They needed more data center capacity.  Not a bad problem to have in the general scheme of things.

Rather than simply find a larger facility, the EMC team presented a scenario of active/active data centers where workloads could easily move back and forth with a minimum of hassle.  Keep what you have, just add another increment of data center capacity, and think of it all as one, dynamic pool.

Katten was fortunate in that most of their environment was already fully virtualized using VMware.  And, based on their EMC relationship, they were willing to give the EMC VPLEX approach a try.

Enter EMC's VPLEX

There's a lot to VPLEX, but -- at its core -- it uses very sophisticated caching technology to make data appear in two places at the same time when needed.  That's a very useful trick when you're moving applications around non-disruptively.

It's especially good at doing this with "hot" transactional data and traditional enterprise applications -- as you'd find with   a busy email system, billing database and so on.

VplexVPLEX is currently packaged as an appliance that sits in the data path -- typically a redundant pair at each end of the network.  It works with most popular enterprise storage arrays, including non-EMC ones. 

I wouldn't recommend trying to compare it with similar products, because -- today -- there's nothing else that does what it does.

By itself, it's pretty darn capable.  But couple VPLEX with VMware's vMotion, and you've got a very complete and very robust workload mobility solution.

Since the VPLEX introduction a few years back, it's quietly turned into (yet another) one of those EMC innovative technology success stories.  For example, the VCE folks now routinely use VPLEX to do cool workload mobility demos and zero RPO / zero RTO failover demos on Vblocks.

Life Made Easier At Katten

At Katten, over 250 production applications were moved from one data center to another. With no drama, and no disruption -- and no one the wiser.

Alexander Diaz of Katten offered this observation in the press release:

"For a major data center migration, we were able to move a running virtual machine across our cloud to the new data center 25 miles away in about 15 to 20 seconds with VPLEX and vMotion. With VPLEX's capabilities, I have confidence that we could move the data across an even further distances should our data center needs evolve over time."

"VPLEX kept the storage in synch in both data centers. Four engineers moved 30 to 40 virtual machines the first weekend and then gradually moved over 250 systems during the next three weeks. The servers stayed up the whole time and no one in the firm knew that we had migrated our entire data center. The 'old' way would have meant days or up to a week of downtime for certain systems and a dozen engineers working around the clock."

"VPLEX has allowed us to raise the bar and provide our firm with enterprise-class business continuity—and a truly active/active data center model. Using the VPLEX for our virtual machines and stretch clusters, we can do maintenance and upgrades on hardware whenever it's needed without any downtime. We're also getting more utilization out of our infrastructure by balancing workloads across multiple sites."

"When someone in the firm needs a new application, we're expected to respond quickly. EMC technologies along with virtualization enable us to bring up a new system in about 40 minutes—start to finish. Before, it would take weeks. Sometimes our users think it is magic, so you could say VPLEX gave us a special wand to get the job done".

Here's what I think is cool about this story: we're not talking about a bleeding edge web company, or an intergalactic financial institution, or a military research lab or similar IT exotica.  Katten is a very successful large law firm, and -- as such -- they use IT to get their work done -- it is clearly not an end in itself.

Workload mobility was one of the tools they had access to, and they decided to use it to their advantage.  Not just for this project, but to create a capability they could come back to over and over again.  Good work, guys.

But -- step back a bit -- and perhaps you'll agree with me that this is just the beginning of something much, much bigger.

Scale-Out Comes To Aggregations Of Data Centers?

When you contemplate computing or storage architectures, you quickly get enamored with the notion of properly implemented scale-out architectures that aggregate smaller resources into much bigger pools.

Start small.  Add more performance and capacity in small increments, when needed.  Automatically and transparently readjust workloads and resources as usage patterns change.  Improve redundancy at lower costs.  No downtime.  Use older gear and newer gear together.  Get real efficient.  Get real fast.  Or anything in between at any time.

Why? All resources are one, big seamless pool with no significant walls or boundaries.  That's what scale-out can do for you -- if done right.

Then you start considering cloud, and big data -- and you inevitably come to the conclusion that -- yeah -- this is the way things are going to be done everywhere before too long.  If you're a technology vendor, game on!

But at one level, a data center is really nothing more than a physical container for computing resources -- a really big, complicated server if you will.  The same benefits that come from aggregating computing and storage resources using scale-out approaches within the data center could potentially apply across multiple data centers that have many of the same properties.

Start with a small data center.  Add more performance and capacity in small increments, when needed.  Automatically and transparently readjust workloads and resources as usage patterns change.  Improve redundancy at lower costs.  No downtime.  Use older sites and newer sites together. Get real efficient, get real fast, or anything in between.

But it's one thing to virtualize, pool and create scale-out technologies in the confines of a single data center with very short distances and trivial latencies.  It's another thing entirely to do the same sort of thing with meaningful distances and significant latencies involved.

Years ago, I jokingly described the thought as RAID -- a redundant array of inexpensive datacenters.  Eliminate the impact of moving things over a distance, and how you thought about data centers would change drastically.  VPLEX hadn't been publicly announced yet, but it was clear where the technology could eventually lead up over time.

lI've started to use the phrase "virtualizing  distance" to help describe what's needed here.  Some people here at EMC use the term "federation" or "dissolving distance" to describe similar concepts.

To each their own.

Regardless of the terms used, the ultimate goal is to make the appearance of data center distance to disappear as much as possible -- just as we would want the appearance of "distance" to disappear between pooled scale-out servers and storage nodes in a local setting.

Removing those barriers between resources -- and enabling them to be easily and dynamically pooled -- is what scale-out is really all about.

True for servers.  True for storage.  Also true for multiple data centers.

How Do You Virtualize Distance?

We could wait for someone to crack the speed-of-light problem, but I'm not optimistic.  On a more pragmatic note, I would argue that there are three core technologies needed to effectively virtualize distance for these use cases.

One core technology is the need to virtualize network addressing and topologies over distance and separate domains.  Your world needs to look like one, big, flat network where IP addresses could move around if needed.  That's what Cisco's OTV technology does well, among other things.

Another is the need to virtualize and encapsulate server resources so they can be moved.   Obviously, that's something that VMware's vMotion does uniquely well.   But there's a problem with moving the data -- especially if you want to minimize disruption.

Essentially, you're going to want updated data to be in two places at the same time during the move. That's what VPLEX does uniquely well, amount other things.

Use these three technologies separately, or use them integrated together in something like a VCE Vblock if you choose.  It's there today, and it works quite well.  But I don't think everyone sees the implications just yet.

For me, it's pretty clear: I see people starting to think about data centers differently.  Architectural patterns tend to repeat themselves at different scale; just as we clearly see scale-out concepts infuse server and storage design, we're also seeing scale-out concepts slowly filtering their way into aggregations of data centers.

Perhaps it won't be too long before we think of "adding and rebalancing a data center" much the way we routinely think about adding and rebalancing a compute or storage node today.

And, given the ginormous amount of IT resource that goes into data center planning, construction, implementation, operations, etc. -- that particular shift in thinking is going to end up being a really big deal.

Many Of Our Architectural Assumptions Are Changing-- As They Should Be

Virtualization has changed the way we think about compute.  Tablets have changed the way we think about end user compute.  Java has changed the way we think about writing code.  Flash has changed the way we think about storage performance.  Cloud has changed the way we think about producint and consuming IT services.

On and on and on -- no shortage of the overused "paradigm shifts" to choose from.

Perhaps that's why so many of us are attracted to this space -- there's so much changing all the time.

To this long list, I now want to add "virtualizing distance" -- as evidenced by technologies such as VPLEX -- where we start to think of distance as something to exploit to our advantage -- as opposed to something that has to be merely overcome.


By Chuck Hollis

BYOD and Back to School…Already?

Popsicles, water balloon fights, fireflies and staying up past your bedtime. These summertime rituals haven’t changed since I was a kid. What has changed is technology and the buying cycle for back-to-school.  Last week in Target I saw an entire wall display of back packs.  My kids have been out of school for exactly one month and retailers are already pushing school supplies!

Sunday I woke up brewed a pot of coffee and sat down with my iPad to check Facebook and peruse my email. Cisco has embraced Bring Your Own Device (BYOD), so I have secure access to my work email on my iPad at home. I checked a few work emails, but I just couldn’t resist the Red, White and Blue 20% off coupon in my inbox.  Had I not seen the back-to-school display last week and received the coupon in my inbox would I be buying khaki pants and blue shirts the 2nd week of July?  Shopping on a laptop is easy. Shopping on an iPad is just downright dangerous!  Consumerism was starting to take over, but in my mind I justified it as one less thing on my to-do list for August.

We have an 802.11n access point at home which gives us reliable coverage.  On Sunday it gave us enough bandwidth to support my basic email and web surfing, our AuPair on Skype with her family in Germany, my husband surfing the web, and my kids watching Back to the Future on Apple TV.  I had uniforms ordered before lightning struck the clock tower and Marty flew the DeLorean time machine back to 1955.

I can’t wait to get the next generation of Wi-Fi— 802.11ac is currently an IEEE draft standard and is expected to deliver up to 1.3 Gbps.  Not quite the 1.21 gigawatts required for Doc Brown’s flux capacitor to reach 88 mph, but enough bandwidth to address some critical pain points faced by users of Wi-Fi today— such as reliable connections for multiple devices and tons of  video!

Back to the Future II was released in 1989.  23 years later many of the technology predictions in the movie are amazingly accurate.  Think back to the television sets of the 1980’s.  They certainly weren’t flat panels.  In one scene Marty’s son uses voice commands to pull up 6 TV shows at the same time. In 1985 I’m sure this looked like an overload of information, but it’s really not that far off from the device and technology multi-tasking  of 2012.  In a typical work day I can think of few scenarios where I’ve been on WebEx or a Cisco TV meeting on my laptop, checking email, Facebook, or texting on my iPhone and instant messaging with a colleague all at the same time.

The use of ubiquitous video is also pretty accurate. In another scene Marty is working from home and accepts a video call from his boss in Asia.  The device looks remarkably similar to the Cisco EX 90  unit that my Director based in Tel Aviv uses to call me via TelePresence at my office in Richfield, Ohio.

And finally, how does back-to-school tie into Back to the Future?  I wonder what Hill Valley High School Principal Gerald Strickland would think of think of the Flipped learning model?  Certainly students can’t be slackers in 2012.  In a flipped classroom students are expected to watch a teacher lecture via video prior to class.  Instead of a one-way dialogue where teachers present to the students, in the flipped learning model students and teachers now use classroom time for interactive discussion.

There’s no question that demand for network capacity and bandwidth is growing. By the year 2015, it is projected there will be 15 billion new networked mobile devices.  Let’s just hope that like the time machine in Back to the Future, that all the devices and technology that we develop are used for the greater good of mankind, oh yeah, and that the bell tower is saved!

For more details on Preparing Your Business for 802.11ac, Register Now for a webcast on July 17.

By Beth Dannemiller

Operation High Roller and the Future of Finance

Late last month, Guardian Analytics and McAfee Labs released the joint report “Dissecting Operation High Roller,” which details a new breed of sophisticated fraud attack. Unlike previous attacks using Zeus and SpyEye, these new tactics use server-side components and heavy automation to bypass traditional network security. 

New Heights in Heists: What’s New Compared to SpyEye and Zeus?

Extensive Automation – While most Zeus/SpyEyes attacks rely on active participation by the fraudster to process a fraudulent transfer, most of the High Roller attacks were completely automated. This allows for repeated thefts once the system has been launched at a given bank.

Server-side Automation – Operation High Roller also adopted sophisticated server-side automation to conceal how the system interacts with online banking platforms. By moving fraudulent transaction processing from the client to a fraudster’s protected server, activity becomes more difficult to detect.

Rich Targets – The United States victims were all companies with accounts with a minimum balance of several million dollars (hence the name, Operation High Roller). Most of these victims were found through online reconnaissance and spear phishing.

Automated Bypass of Two-Factor Physical Authentication – The malware discovered within Operation High Roller is the first to work around the “smartcard/physical reader + PIN” combination of two-factor authentication. Normally, a victim inserts a smartcard into a reader device and enters a PIN, generating a digital token to authorize the transaction. The Operation High Roller attacks are able to generate an authentic simulation of this process during login to capture the token, using it to validate the transaction later in the online banking session.

Fraudsters Know the Banking Industry – The bad guys behind Operation High Roller clearly knew what they were doing as they carefully navigated around the regulatory triggers of bank fraud detection. For example, automated transactions were set to check the balance and not to exceed a fixed percentage of the account value.

The Future of Finance and Network Security

The Operation High Roller attacks hold implications for banks of all sizes, as targets ranged from some of the most respected financial institutions to small credit unions and regional banks. Moving forward, the finance industry should anticipate more automation, obfuscation and increasingly creative forms of fraud.

However, there are fraud prevention solutions that have been proven effective, even against the attacks documented in Operation High Roller. Anomaly detection solutions like those integrated into the McAfee Network Security Platform have been proven to detect the widest array of fraud attacks, including manual and automated schemes, as well as well-known and newly emerging techniques.

Share your thoughts on this topic in the comments below, and be sure to follow @McAfeeBusiness on Twitter for the latest updates on McAfee news and events.

By Tyler Carter

Human Power Still Fuels Network Security

Earlier this month, I had the honor of presenting the keynote at the Cyber Defense Symposium 2012.  I was invited to share the McAfee strategy and my vision around how we’re working to develop network protection against growing global cyber security threats and protect critical information networks of our financial markets, power grids, intelligence and defense systems.  Not only was I excited to be part of this cause, but I was very interested to hear the ideas from other business leaders around this world-impacting topic.

During my 20-minute speaking slot I shared a bit of background on the security landscape, what McAfee has learned from years of threat intelligence and analysis, and the protection we’ve developed.  I then moved into our vision of creating a future of even greater business confidence.  I wanted the audience to understand, given the growing impact of highly targeted attacks, that the industry needs to get out of the mode of ‘reacting’ to threats. I explained that McAfee has focused, and will continue to focus, on creating solutions that can anticipate all strains of cyber attacks and implement preemptive measures. With this intelligence, we can then develop and deploy sophisticated and targeted protection in advance of the malevolent actors.

After I took my seat, I was able to listen to the presentations from other business leaders throughout the industry.  The information was good, but I learned that at least one security provider believes that it’s unnecessary and archaic to integrate people into the cyber security foundation.  This intrigued me.  In my opinion, and in line with the McAfee philosophy, it’s absolutely critical to invest in human middleware to provide proactive security. Expert researchers are the key to identifying and preempting zero-day attacks.  Of course, a vendor that cannot afford the high cost associated with security research will try to argue that compute cores and software can deliver a similar level of protection.  I say, “Show me the money.”

Yes, I am proud of our innovations – in finding new ways to help enterprises actually prevent the negative impacts of attacks whether they are botnets, malicious URLs, malware or anything else.  But I am even more proud of our people.  I know we have the best team in place to create a platform that can anticipate the strikes, which is why we invest heavily in human capital.  We know that it’s critical to integrate predictive protection against the multiple threat vectors and attacks being created and injected into business networks through dozens of new entry points.  It was my intention to encourage enterprises to rethink their security architecture and refrain from a very common and pervasive reactionary strategy.  Putting people at the core of network security will augment the holistic approach McAfee believes will protect million-dollar enterprise networks from the typical (but stealthier) dime store hacker.

By Pat Calhoun

IT Transformation: Does Your IT Group Fit The Profile?

I started writing in earnest about clouds and IT transformation back in January 2009 -- a little more than three years ago.

At the time, most IT groups would politely listen to me talk about the coming world of service catalogs, hybrid clouds, et. al., nod a bit -- and that would be that.

Interesting, but not practical for them at that point.   Thank you for your time.

But, every so often, I'd meet an IT group that was intensely interested in the subject.   Their passion and enthusiasm stood in stark contrast to a vastly larger and vastly more passive crowd.

What made them different?  Why were they so interested, and everyone else wasn't?

I became very curious about these particular customers, and started to take the time to look deeper.  I began to construct profiles of the IT groups I was talking to, and looking for a correlation between their expressed enthusiasm (or lack thereof), and what I could discern externally.

Over time, patterns repeated themselves, and an "ITaaS profile" (IT as a service) began to emerge.

During early 2011, I began to test my model.  I'd research a customer I was scheduled to talk to, score them using my profile, and attempt to predict the likelihood they'd be interested in the topic of IT transformation when I got in front of them.  I quickly discovered I had a very good predictor.

It's sort of nice to know what's going to happen before you show up with a bunch of powerpoint :)

So, today, I thought I'd share with you what I've learned.

And, perhaps, figure out if your IT group fits the profile.

Real IT Transformation Isn't For The Faint Of Heart

Organizational transformations come in many sizes and shapes.  The particular transformation I'm discussing here is nothing less than a fundamental shift in the business model of an enterprise IT group.

IT starts by assuming they need to compete for internal IT spend, and aren't a monopoly or a government agency anymore.  They then set about to refashion themselves as the internal IT service provider of choice.  Along the way, they add new functions they didn't need in the past.  Roles, processes, skill sets and metrics all significantly change. 

The ITaaS model itself isn't all that new -- you'll find it at work inside every successful IT service provider.  It's just sort of new to the enterprise IT crowd.

Unless there was a strong motivation to change, why would you even bother?  Wouldn't it be easier to just continue on as before, making small and incremental changes as time and inclination warrants?   Why would you invest in completely rewiring the IT function?  Who would want to re-engineer how IT is produced -- and how IT is consumed?

To sign up for that mission, you'd have to be pretty motivated indeed.

And that's what my ITaaS profile is all about -- discerning who's motivated, and who's not.  Quickly and efficiently.  It's not a judgment statement; it's simply acknowledging that everyone's situation is different.

In my ITaaS profile, there are three things I'm looking for.  Hit all three aspects, and there's a good chance that we'll have a long and rich discussion around the IT transformation topic with plenty of follow-on and a deeper dives.

One of the inevitable outcomes is that you'll start to look at technology very differently, e.g. how well they can be used to deliver services vs. isolated functions.  Things like Vblocks become much easier to appreciate, for example.

Miss any one of the profile elements, and your interest in ITaaS will probably be academic at best.  You'll wonder why we're building some of the stuff we do.  And we'll probably end up talking about something else that you're more interested in.

So, what am I looking for?  See how many of these apply to you.

A Meaningful Change In The Business Strategy That Directly Impacts IT

If it's business-as-usual for the organization at large, it's probably business-as-usual for the IT group as well.  Conversely, change in the business inevitably drives change in the IT function.

Unless there's a sharp and disruptive change in the business approach; there's unlikely to be the need for a sharp and disruptive change in the IT approach.   It's a fairly simple idea when you think about it that way.

So, what constitutes a "meaningful change in the business strategy"?   Let me share what I'm looking for.

Obviously, if there's a new CEO or other senior business leadership, there's a good chance the organization will start to move in a new direction.  IT will inevitably be affected at some point.

A significant business strategy, new product line, or a change in the go-to-market strategy qualifies as well.   A sharp increase in competition, a rapid decline in revenue or profits, or perhaps a major batch of new regulatory requirements.  Significant M&A certainly qualifies.  Expanding into new geographies (e.g. China, India, et. al.) qualifies.  And that's just a partial list.

These external markers aren't hard to find.  A bit of google-fu, and it's pretty easy to discern if there's a visible shift in the business causing a shift in IT.

A Critical Mass Of Empowered IT Leadership

By "empowered leadership", I mean there's a clearly discernible team in place with a mandate to change the way things are being done in the IT organization.

They're not looking for mere incremental improvements; they're motivated to re-engineer the IT function.

Sometimes, these IT leaders are folks who've been with their company and in their role for a while.  That's a great thing -- when you find it, but you don't find it too often.

More likely, these empowered leaders are new to the role and brought in from elsewhere: another company or industry, perhaps from the business side, or maybe a substantial re-organization.  Sad but true: familiar faces tend to make familiar decisions; new faces tend to make new decisions.

Put differently: there isn't going to be any IT transformation without a critical mass of strong, passionate and dedicated leadership.  This stuff doesn't happen by itself.

A Reasonable Starting Point

This is actually two things: something to build on; and something to point it at.

You can't (or shouldn't) try and change everything at once, especially in larger IT settings.  Instead, the idea is to put the new concepts and operational models to work in a small part of the IT function, and then expand as processes mature and familiarity grows.

But you need a place to start, and I've found that not everyone can easily find that logical starting place.

The "something to build on" is pretty easy to assess: a reasonable mass of virtualized servers (usually VMware) and the required skill sets to make it all work predictably.  Unless you're comfortable with virtualization technology and processes, it's just too far a leap to jump to an ITaaS model in one go.  And, yes, you'll find environments out there that just haven't gotten around to doing much with VMware, or haven't invested in the skills and processes to fully exploit what it can do.

In these cases, there's a good deal of foundational work to get the basics in place -- prior to contemplating an IT transformation of this nature.  No shortcuts that I've found so far.

The second component is finding an interesting place to point the first efforts: a use case that's (a) somewhat relevant to the business, (b) isn't mission critical, and (c ) whose needs aren't being well-served by the current IT approach.  Better yet if you can find some business leader who's interested in a new approach to delivering IT services ...

Examples vary, but there are some popular favorites: test and dev for the app team, perhaps a VDI pilot, maybe a self-serve IaaS capability for the R&D team, and so on.

It's less about the individual project itself; it's more about creating an operational template for the future.  You're simply looking for a place where you can try doing things a new way, gain some experience -- and without betting the farm.

What Are You Interested In?

If you fit this profile, you're most likely not very interested in a detailed technology discussion.  You tend to assume that the required technology pieces are largely in place to do what needs to be done.  And you'd be right.

Instead, you're most likely interested in four things -- in order.

First, you're probably interested in creating the case for transformation.  You, the progressive IT leader, are largely convinced.  But there are a few more people in the organization that might need convincing: the executive committee, your business peers and -- of course -- your IT organization itself.

Making and communicating "the case" to these three audiences is important, and not something that's done routinely.  Here at EMC, we are fortunate to have plenty of assets as well as some nice professional services to help customers do just that.

Second, you'll want to study some blueprints: what's the new model, how is it different than the current one, what makes it different, etc.  We routinely supply our own examples of this to customers as a matter of routine.  Your blueprints may end up being somewhat different, but you'll certainly want to take a look at a successful one as a reference point.

Third, you'll be very interested in the people side: roles, skills, measurement, alignment and the rest of it.  If our own internal EMC ITaaS transformation is any indication, a significant number of the job descriptions will have to be seriously reworked in the new model.  I like to joke that -- in this new world -- the "run book" for IT belong to HR -- human resources.

The larger your IT organization, the more you tend to be interested in the people side.

Finally, you'll want to think about how you eventually grapple with the underlying financial model for IT.  I have observed that the way IT is constructed is largely a function of how IT is paid for.

If IT is paid for as a flat tax, you'll likely have a relatively bureaucratic IT function.  If IT is funded through major projects, you'll have an IT organization comprised of major projects and little else.  However, if IT funded to create attractive IT services that business people want to consume, well -- that's what you'll end up building.

• Making the case.
• Understanding the models.
• Transforming your people.
• Modernizing the IT funding model.

Like I said, not for the faint of heart.

Putting It All Together

So, consider these three aspects I've learned to look for:

- a meaningful change in the business that's causing a meaningful change in IT
- a critical mass of empowered IT leaders
- a reasonable place to start: technology and use case

What I've found is that -- once you fit this profile -- you're strongly interested in IT transformation.  And if this isn't you, we end up talking about something else more relevant to you and your particular situation.

Note what's missing from this list.  For example, there's scant mention of ROI -- unless it's Risk Of Ignoring.  Nor are there many caveats around industry, geography, organizational size, etc.   Or much of a budget discussion.  Or the fact that some of your software vendors don't like virtualization.  Or a detailed technology discussion.

None of these topics really comes up in any depth -- if you fit the profile.  Instead, you are highly motivated to get moving in the right direction -- sooner, rather than later.

I look at all the cloud banter on the internet and in the press.  I read it, but very little of it correlates with the hundreds and hundreds of customer discussions I've had on the topic over the last few years.  I think vendors might look at the world differently.

I know what to look for.  I know who's going to be interested, and exactly why they're going to be interested.  If they fit the profile, I'm relatively certain of how the conversation will progress from topic to topic.  It's scary sometimes just how linear the conversations can be.   I've written about most aspects; you can see the entire collection of deep-dives here if you're interested.

But this is really isn't about me.  It's about you.

Does your IT group fit the profile?

If so, we should chat :)

By Chuck Hollis

70% of Teens Hide Online Activities from Parents—Why We Should be Concerned

Most major media picked up on a study that McAfee released called “The Digital Divide: How the Online Behavior of Teens is Getting Past Parents” that shines a scary light on how much trouble kids are getting themselves in online and how clueless most parents are.

Many people commented saying “I don’t need McAfee telling me kids lie” and I get that. But those who recognize the obvious may not realize the actions and consequences of those lies.

I’ll be the first to admit, and I’ve said this on national TV and radio, I should be buried 6 feet under based on the way I lived my teen years. I lied as a means of survival to cover up my various acts that would have surely got me the belt. But what I did compared to what teens are doing today was a different kind of trouble.

People snicker when they learn that almost half of teens are looking at porn weekly. Really? This is no big deal? It’s true they say “we become what we think about” and a 13-year old isn’t in an emotional or physical position to be consuming hard core violent porn.

Another example is that more than 10% of 13-17 year olds are meeting strangers online then actually meeting them in the real world. I doubt before social media there were as many teenage girls meeting 30-year old men on the street and then getting in his car. But with the Internet these “friends” can seduce teens girls via text or social networking sites and fill her emotional needs until he’s “got her.”

Are you really aware what this hidden behavior and lying is concealing? From the study, McAfee revealed that teens readily admitted to:

    Breaking into others’ social media accounts
    Hacking and manipulating grades in school
    Downloading illegally pirated movies, music and software
    Bullying, whether it was actively being a bully, being bullied or witnessing bullying

All of these activities could potentially get you, as parents, involved in numerous lawsuits because of these illegal activities.

This study more than anything points out how outrageous kids are acting online and how oblivious and overwhelmed their parents are. Perhaps Kevin Parrish, journalist and parent of teens from Toms Guide summed it up best when he said:

“The Internet can be a dangerous place, and allowing teens to run free in a virtual new frontier seemingly run by hackers is just downright insane. Allowing children to do whatever they want online is a huge security risk to your personal data, and a potential legal risk for them. Bottom line, the Internet is a privilege, not a right. Teens should be allowed to express themselves, but not to the point where predators come calling or the FBI comes knocking at the front door. Teens are propelled by emotion, not knowledge and experience, especially early on.”

At least one parent gets it.

By Robert Siciliano

5 Lessons from the LinkedIn Password Hack for Online Retailers

Whether it’s clicking on spam links or using “1234” as a password for both Twitter and banking, online merchants will always have to be mindful of consumers’ impressive ability to jeopardize their own information. It’s man against the machine. As merchants try to stay one step ahead with the latest security tools, it can be frustrating when customers unwittingly play into the bad guys’ hands.

We gained some valuable insight into this world of user-based threats just this month, when over six million LinkedIn passwords were breached and posted online. As it turns out, there were hundreds of duplicate passwords and patterns, most having to do with the site’s theme – ‘link’, ‘work’ and ‘job’ were all among the top five.

What retailers need to realize is that strong password management doesn’t just mean protection for customers. It also affects your bottom line – protecting your business from fallout in the event that a customer’s account is hacked.

So how can you, as an online retailer, help customers help themselves?

1. Be proactive and warn of  “phishy” emails

One of the most surefire ways to get hacked is by clicking on malicious links in email. Email is ridiculously easy to forge, and links are easy to manipulate and redirect. Does your address bar read “ebay.com” or “ebayy.com”? Most consumers won’t think to check. This can become a serious problem for online companies, as LinkedIn now knows all too well. Hackers are quick to exploit news of a breach by crafting phishing emails – phony messages that mimic the language and style of your company’s messaging to extract sensitive information.

Help teach your customers security best practices by example – never send or request private information via email, including passwords or identity verification. Remind your customers of these security measures in the emails you do send, helping to decrease the likelihood that a malicious actor can leverage your content for a phishing attack.

2. Follow the news

When a crisis occurs that could affect your customer base, let them know! Staying on top of the latest news and keeping your customers up-to-date isn’t just about password protection – it’s also about customer service. Looking out for your customers is the hallmark of great service both on and offline, and providing security insight is one way to build trust and loyalty for your online presence.

3. Be an educator

Retailers need to lead by example. Customers don’t always know how to create a strong password, and they don’t always understand why using different passwords for different sites is so important. Educate your customers by encouraging a password that contains a combination of uppercase and lowercase letters, numbers, and symbols with a minimum length – and let them know why. A general industry trend is to include a clause during sign-up that shares your company’s security policy, or a widget that rates their password strength from weak to strong.

4. Easy password recovery

One of the highest cost elements of customer service is dealing with lost passwords, and this will certainly become an issue if your company recommends password complexity. It’s like locking yourself out of your house or apartment – it may not happen often, but it happens to everyone. Your site must have a simple, secure and straightforward procedure for managing customer passwords that will make them easy to retrieve on-demand. Once customers know that their password information can be securely and easily recovered, they’ll be more likely to choose a variety of complex passwords across accounts – increasing their overall security.

5. Security from the inside out

By implementing a trusted website vulnerability scan like the McAfee SECURE™ service, you can proactively protect your business with daily scanning that checks for thousands of vulnerabilities that could lead to security breaches. The cost of a breach can be devastatingly expensive, especially for small retailers, when you take into consideration legal fees, call center expenses and lost employee productivity. When you add in the impact on brand image and the loss in customer confidence, this fallout could literally end your career as an online retailer – a fate no business should take lightly.

Unlike most consumers, retailers have a responsibility not only to themselves, but to the entire eCommerce community. It’s up to you to educate and protect your customers, which will in turn boost trust in online retail as a whole.

Share your thoughts on this topic in the comments below, and be sure to follow us on Twitter at @McAfeeSECURE for the latest eCommerce news and events.

By Nancy Levin

More On Mobilizing Your Enterprise

Just about every aspect of enterprise IT is in play these days, if you think about it.

One of the more challenging aspects is fully embracing the new endpoint for IT service consumption -- the ubiquitous mobile device.

To be clear, we're not simply talking about a BYOD (bring your own device) program, or re-hosting legacy apps on mobile devices via VDI -- although those are pieces of the bigger picture.

No, what we're really talking a fundamental re-thinking about how application experiences are built, distributed and consumed.  Mobile first, if you prefer.

And whether that new capability is pointed at your employees, your partners or your customers -- the changes are turning out to be very far reaching indeed.

EMC's own IT group is no stranger to these forces.  For the last few quarters, a small team has been working towards enabling mobility across our entire organization and business model.  I first introduced this story back in January of this year.

Now, five months later, I thought it would be good to circle back with the EMC IT team and get a status report: what have we done, and what have we learned?

Quite a bit, it turns out.

 What Makes This Hard?

The rationale behind this transition is pretty obvious to just about everyone: we live in a mobile world.  We all carry powerful easy-to-use mobile devices, and we all prefer easy-to-consume application experiences to go with them.  The desktops and laptops are getting less use; the tablets and smartphones have quickly become our first go-to device.

We -- as IT consumers -- have made our preferences pretty clear.  Now it's up to enterprise IT organizations to figure out what to do about it.

And it’s not easy.  For example, IT has to think about devices and networks differently.  We have to think about security differently.  We have to think about how applications are constructed and consumed differently.  And, oh by the way, there are still plenty of desktops and laptops hanging around that aren't going away anytime soon.

But -- like most things in life -- there really isn't a choice about the general direction: it's pretty much a given.  The devil is in the details: how to organize, how to build capabilities, and how to mainstream into the general flow of activities.

In a nutshell, that's the idea behind an enterprise mobility platform and overall strategy: move the organization into the new world, and -- hopefully -- make it better than the world it replaced.

Catching Up With KK

One of my favorite characters at EMC is KK -- Narayanan Krishnakumar, the chief architect within EMC IT.  He's always working on cool stuff, including playing a very strong role in the definition and execution of EMC IT's approach to the mobility challenge.

So, KK, where is the team today?

We've made good progress over the last two quarters.

We've got our MDM (mobile device management) platform up and we now are actively managing 4500 mobile devices around the globe.  Once a device is registered, we essentially take control of the device from a security standpoint.

We've had a few issues in certain countries where it's not acceptable to remotely wipe an employee's device, but -- generally speaking -- we've seen strong adoption.

Part of the adoption success has been an important "carrot" we've created, which we call mWiFi.  If you walk into an EMC facility anywhere and have registered your device with us, you're instantly on our wireless network: no need to manually configure and authenticate.  It sounds like a little thing, but it's enough of a practical convenience that it's driving adoption nicely.

We have an enterprise app store that enables us to make available the right apps for the right users and manage the distribution. We now have three categories of apps in our enterprise app store.  One, obviously, are pointers to useful apps in the Apple app store.  Another category are mobile applications from enterprise vendors, such as SAP BI.  And there's a third category of EMC IT-developed applications.

Securing the first category is fairly straightforward, as is the category of our internally-developed applications.  We're still working through the best way to secure vendor-supplied enterprise mobile apps, but we're making progress.

Our EMC enterprise app store authenticates you, it validates your device characteristics, shows you the applications you're entitled to, manages the installs and updates, logs all the relevant data, and so on.  We had to do a significant amount of building on top of the vendor-supplied platform to achieve all of this, though.

There's a lot to talk about here, so let's start with security -- that's a big issue with everyone.

As it should be.

Our approach starts with securing the device, for example, we can detect if someone has jailbroken their phone.  We've created an EMC container that provides local encryption services, as well as REST API access to EMC authentication mechanisms.

Ultimately, the application designer has to be responsible for how they'd like to handle security; we supply the services they'll need to accomplish that.

We've tried out the approach on applications that aren't all that demanding, like our conference room finder, as well as around applications that handle secure data, like our employee lookup database.  We’ve been very pleased with the results at both ends of the security spectrum.  Now we believe the right approach is to provide the services that application developers need.

You mentioned that EMC IT had created a mobile application container -- can you say more about that?

Well, we discovered that people were using groups of applications during the day, rather than just an isolated one once in a while.  By using a container-based approach, we can provide, for example, a persistent security identity across multiple applications in a container vs. forcing the user to re-authenticate themselves with each and every application.  The same sort of thing applies to data sharing between applications, like cut and paste.

We couldn't find anything we really liked on the marketplace, so we decided to build our own lightweight container which enables the user experience with key shared services.  It’s turning out to be a win for the application developers as well as our infrastructure and operations groups.  And it results in a notably better user experience across applications.

What about application development -- how are you approaching that?

Well, I think we all realize that mobile application development is somewhat different than traditional enterprise application development.  You're not simply miniaturizing a desktop application, you're thinking about finger-friendly applications that run natively on the mobile device.

And one thing we've learned is that a great user experience is absolutely paramount.  People's patience with mobile apps is incredibly short; they hit any sort of bump and they're off doing something else.

And of course, we have to always balance the user experience with risk, so we strive for as seamless a model for sensitive data access as possible.

Early on, we created a small design center around mobile technology competencies.  Initially, we had high hopes around HTML5, but we're not waiting for the standard to stabilize - we have been going after more of a hybrid approach to native app development.

So the developers mostly work in a cross-mobile-platform javascript environment, and then augment with native iOS Xcode -- again, using the services we've provided in the mobile container. That coding environment is augmented by a design–time repository with the catalog of services we support, as well as a separate runtime repository for things like license entitlement.

Our Mobility Technical Competency Centre team supports anyone interested in building a mobile app -- be it a business user, or an IT application developer who needs to build a mobile version of some sort of application.  The goal is to slipstream mobile application competencies into our day-to-day application development work so it's just a normal part of how we do things going forward.

The implication is that you're embracing iOS and leaving Android and others for later?

We started off saying that we would rather support one platform really well, rather than spread our efforts across multiple user devices.  While not everyone is a 100% fan of that approach, it's what we have been  doing, and it's worked out rather well.

However,  the cross-mobile-platform development environment I mentioned allows us to reuse the code base for Android as well. We are doing exactly that for a customer-facing service request app.

You didn't go for a MEAP -- a mobile enterprise application platform?

No, we really didn't find anything we liked.  For one thing, the marketplace is moving very fast, and we'd like to make as few big bets as possible, or at least to delay them as long as we need to.   We're a large enterprise with many hundreds of potential use cases, and we didn't want to limit our abilities by signing up for a finite and bounded approach.

More importantly, we've got our own application integration cloud that we're using for all enterprise applications going forward, and we really don't want to have some vendor's idea of an application architecture impacting what we're creating for ourselves.

So it seems that we've made a great start -- what do you think will really drive adoption?

Well, one big driver is our new SAP implementation -- we're using it as one of the cores of our business.  We expect that most EMC employees -- and, over time, partners and customers -- will be interacting with our SAP implementation at least at some level.

We've made the decision to think "mobile first", so we fully expect that most everyone will be interacting with SAP through a mobile device.

Now that the EMC IT team is well down the road, what advice would you offer for others?

The first point might seem obvious, but it needs to be stated anyway: you'll need to organize for success.  When we started, we didn't have the skills, the team and the organizational structure to make progress.  From a modest start, we've augmented and enhanced our organizational model as we've progressed, but it all centers around having the right model.

Second, we realized our goal was to enable mobility across EMC's entire ecosystem, and not just stand up a handful of mobile apps.  We want to think mobile first and foremost going forward, which means you tend to think in terms of sustainable and scalable platforms and processes vs. specific point technologies and isolated use cases. We also think in terms of the entire "stack" of app use cases, app user experience, security and risk, access, and supporting services.

Third, we realized we had to learn our way into this arena, and that means a healthy incubation period followed by branding your efforts as "beta" for quite a while.  We'll be running as beta for at least three quarters, maybe longer.

And, as I mentioned before, no matter how well you think you've got the user experience nailed, you can always do better.  That's turning out to be very important.

We also realize that the broader IT industry is also learning their way into this space.  There are very few off-the-shelf approaches we found that met our needs.  That's OK, those will come in time.  As I mentioned before, we're trying to delay any big technology bets in this space as long as we can.

Finally, we're very mindful of enlisting our users and our business partners as part of the journey.  We're very open and transparent as to what our capabilities are, where the potential problems may be, here's what we can do now, here's what we can do later.  While I'm sure there are some who'd like to have everything today, we're getting extremely positive feedback on where we are and where we'll be before too long.

For example we use our internal social platform (EMC|One) to communicate, get feedback and improve the user support experience.  In particular, we're using our internal Innovation Conference to sponsor a contest to come up with a list of potential "killer apps" for mobile devices.  There are literally dozens of great ideas there to go consider, and I'm sure we'll see more in the future.

If I had to offer a single big thought, it's that you're investing in a new way of delivering IT services that people want to consume.  It's not really just about saving money, it's about delivering new forms of value based on what the technology can now do.

Not only are we excited within IT -- it's a great project to be associated with -- but the business is seriously excited as well.  We have established great collaborations with the business groups and we’re all changing the traditional way of thinking about applications.

Great work, KK, and a great story.  My congratulations to the EMC IT team.

Thanks -- it's been a big effort on the part of a lot of people.  And we're not done yet -- not by any stretch of the imagination.  But we're confident that we've turned a corner and can plainly see where we'll be next quarter, and the quarters after that.

It's very exciting stuff, indeed.


By Chuck Hollis