10 Quick Tips to Mobile Security

Mobile security is a topic I return to again and again and why not? Considering the proliferation of smartphone among the urban population of India and the demand for the same even in rural outbacks with poor internet connectivity, it is imperative to remind ourselves that along with all the advantages (and there are many) these devices can be sources of danger for users, especially kids. And though we are aware of many of these threats, we may not be aware of ALL of them.

I was reminded of the dangers related to these phones upon reading the McAfee Q4 2011 Threat Report.  Some findings related to mobile malware caught my attention:

•     Growth in almost all areas of malware and spam declined, with the exception of mobile-based malware
•     Mobile malware rose during the quarter and recorded its busiest year to date
•     Android firmly fixed as the largest target for writers of mobile malware
•     Much of the Android malware has been for-profit SMS-sending Trojans, which help cybercriminals to hijack phones to send messages that cost their owners money

So here are the promised 10 quick tips to protect your mobile phones:

1.    Beware of third-party applications; download from a reputable app store only

2.    Read other users’ reviews and make sure the app’s access permissions make sense

3.    Be wary of unnecessary permissions asked for, like an alarm clock app asking to access your contacts

4.    Protect yourself against data loss, by backing up your mobile device regularly

5.    Be wary of what you click while browsing the web, as malware makers use ads to trick smartphone users into installing infected apps

6.    Have difficult-to-guess passwords for your phone, just like you do for your PC

7.    Turn off Bluetooth and other connections when not in use

8.    Don’t use geotagging while clicking snaps. When you share them immediately, people will come to know your exact location

9.    Install an advanced and comprehensive security software in your phone to protect your devices

10.  Do use a personal firewall

 A quick word on the next generation of McAfee® MobileSecuritysoftware, which offers greater control to smartphone and tablet owners over their privacy as well as protects them from financial fraud, identity theft and viruses. It is inclusive of the new McAfee App Alert™, which provides important information about what apps are doing with users’ personal information. Besides this, it also offers:

•     Call and SMS Filtering: Easily filters out spammers, incorrect numbers and unwanted texts
•     Online Management: The McAfee Web portal lets users quickly execute needed security tasks, such as backup, restore, locate, and remote lock and wipe
•     Uninstall Protection: Prevents a thief or another user from bypassing their McAfee mobile protection
•     Complete Anti-virus, Anti-spyware and Anti-phishing Protection
•     Anti-theft protection including device locking

So go on, enjoy your smartphone to the hilt, confident in the knowledge that you, your kids, your phone and your data are all safe.


By Anindita Mishra

The Four Phases of Every Attack

Let’s face it, threats have gotten much more complex; like complex mechanisms they use multiple, consecutive methods to attack. At McAfee, our research teams continually analyze the threat landscape, and define threats in terms of their attack mechanisms, which consistently fall into four categories. First malware needs a way to come in contact with unsuspecting users.  Second, they then use a diversity of ways to enter your system and begin to write files to disk and modify your system. Third, they use several means to hide from detection before they even begin to do their dirty work of stealing personal information or scare you into buying useless  security software. Its not until the fourth phase do they really start to do their unscrupulous business.

In this discussion, we will share some research showing the four phases of every malicious attack and in a follow on blog, with provide some recommendations as to how you can protect yourself and your business.

    First, lets look at the first phase of how modern threats operate; How the attacker first crosses path with its victim.  The most common form of first contact is via a malicious web site. The web continues to be a dangerous place for the uninformed and unprotected. Websites can become malicious on purpose or by infection and host malware, potentially unwanted programs, or phishing sites. In 2011, McAfee Labs recorded an average of 6,500 new bad sites per day; in one quarter that figure shot up to 9,300. We also noticed that about one in every 400 URLs we attempted to load were malicious; some days that number was one in every 200 URLs!  Protecting users from these sites becomes essential to protection and actually offers the least expensive way to maintain a secure environment. Other important methods include physical access such as thumb drives used by Advances Persistent Threats or APT’s,  unsolicited messages from social media sites,  and network access from misconfigured or unsecure wireless networks.

    Phase 2 is the ways the attacker gets code running first time on target machine. The vast majority of the time the code will exploit one or more of the thousands of vulnerabilities in common, legitimate applications or in the operating system itself.  If the malware can take down or otherwise subvert the protections in existing software it can write its code to disk and move onto phase three.

    In phase 3, the goal is to persist the malicious code on the system, so that it can survive reboot, stay hidden from security measures as well as hide itself from the user. The code can hide itself in known good processes, block access to security software updates, disable the Windows task manager, Windows Safe Mode, System Restore, the Firewall, Microsoft Security Center as well as change browser security settings. Rootkits and other advanced attacks have been particularly difficult to stop as they will many times load prior to the operating system, effectively hiding from security software

    And finally in phase 4, we get to the real reason for the malware, its ‘business logic’; what the attacker wants to accomplish. This could be stealing identities, passwords, bank fraud, force the purchase Fake AntiVirus software, steal intellectual property, or sell bot network services.

In my next blog, I will discuss ways in which today’s security products can be used  protect you in each of the 4 phases.

By Dan Wolff

Social Media Security Best Practices

Facebook, Twitter, LinkedIn and other social media platforms are invaluable tools for 21st century enterprise collaboration and marketing, but they introduce multiple security hazards that organizations struggle to address. Dangers include confidential data leakage, reputational damage, social engineering opportunities for hackers, malware, and lawsuits stemming from inappropriate use by employees who see social media as platforms for personal expression.

Prohibiting social media use is not an option for organizations looking to be on the cutting edge of technology and marketing and to attract younger, more tech savvy job seekers. Instead, these companies have to address the challenges of social media the best way they can with education, policy, and technology. Here are some best practices to consider.

Education

Social media users tend to see Facebook and Twitter as a vehicles for personal expression and often don’t understand the risks they pose to your organization. You can put policies and tools in place, but if your employees don’t buy or understand the logic behind them they won’t comply. It’s important to educate employees about social media hazards, including those listed above.

Reputational damage and data leakage are two of the risks organizations find most difficult to control. They need to educate users that anything they say about any company’s products, customers or any town or city’s inhabitants may be seen as opinions expressed by the organization they work for. Any personal profile information about their title or organizational role or details they divulge about company initiatives, travel, technologies, or management may be used by hackers for social engineering or phishing purposes. Inappropriate use of social media for bullying, harassment, or racist purposes may subject employees or your organization to lawsuits. Users should also understand that postings on these sites will be there for a long time, possibly forever.

Users also have to be extra vigilant about friending bogus Facebook accounts. A perfect example is a bogus account impersonating NATO supreme Allied commander Admiral James Stavridis, which was used by hackers to harvest thousands of sensitive user photos, phone numbers, and email addresses for social engineering attacks. It’s important to reinforce education periodically through additional seminars or emails and to draw attention to social media exploits that get significant media coverage.

Policy

Every organization should have acceptable use policies for general Web use and social media that detail which social media sites are acceptable for use by whom, for what purpose they are acceptable, and what types of behavior are not permitted on these sites. Spell out what confidential information should not be revealed by employees on these sites, what information should not be included in profiles, and how to use disclaimers for any personal opinions expressed by an employee. You may want to have specific policies for sites such as Facebook, which have unique privacy concerns and controls. Your policy should also spell out disciplinary actions that will be taken if policies are not followed.

Users should also be cautioned not to use their work user names and passwords for public social media sites and to use caution when clicking on Facebook links or downloading applications. If necessary you can forbid and block Facebook downloads. You may also want to consider a different set of policies for human resources, marketing, sales, or any department for which social media can be a benefit versus other departments. Make sure you get employee input when devising your policy so that it’s practical and likely to be followed.

Tools

Tools are essential for controlling and monitoring social media use, but they are not a substitute for education and policy. Several security tools and services can be applied to social media use with varying success. Some of these are gateway and endpoint anti-malware solutions, web use monitoring and filtering tools, and social media aware data loss prevention tools. Make sure you don’t neglect tools that can apply policy to smart phones and other non-PC devices.

Social media security is a work in progress, so make sure you follow the trends and solutions as they evolve.

For more on how McAfee technology solutions can help prevent both malicious and careless social media incidents, be sure to read the McAfee whitepaper Securely Enabling Social Media, and follow McAfee’s own social media team, @McAfeeBusiness, on Twitter. 

By Leon Erlanger

Optimizing Security for Virtualized Environments

Virtualized servers and desktops have increasingly become the norm in many enterprise environments. As a result, vendors are beginning to adapt their endpoint protection platforms to meet these changing needs. But not all security vendors are created equal. Organizations need to be aware of the different approaches available among vendors, and can’t assume that their current vendor provides the best solutions for virtualized environments.

One issue is that while virtualization is happening rapidly, most host-based protection software was designed with the notion that the security stack would be running on dedicated hardware. This creates a significant impact on performance when, for example, multiple scheduled scans are initiated virtually on the same physical hardware. Techniques such as randomized scanning, scanning of offline guests, gold image whitelisting, scan result catching and randomizing signature updates can provide improved performance, and are among the ways that McAfee is looking to address the need to optimize security for virtualized environments.

In a recent Gartner study, Make Optimizing Security Protection in Virtualized Environments a Priority, analysts outlined a framework to evaluate EPP solutions. The bottom line: explicit support and optimization for virtualized environments is an essential part of an effective endpoint security tool evaluation.

Gartner’s Recommendations:

•     Look for solutions that natively support and optimize anti-malware scanning in a virtualized environment in your EPP evaluation for servers and desktops.
•     Favor vendors that offer solutions spanning physical and virtual servers and desktops with a consistent management and reporting interface and a consistent way to set policies across all environments.
•     To reduce complexity and consolidate licensing costs, use the same anti-malware-scanning solution across desktops and servers – virtual or physical – where possible.

As a core component of our Security Connected framework, McAfee Endpoint Protection provides continuous, updated and powerful security for all endpoints, including the latest virtualized environments. We also unify endpoint security and management with McAfee ePolicy Orchestrator, our web-based management console that enhances efficiency, reduces costs, and helps maintain and prove compliance.

Take a look at our website for more on how McAfee Endpoint Protection can help secure your virtualized environments, and be sure to follow us on Twitter at @McAfeeBusiness for the latest updates on McAfee news and events.

By Brian Contos

QR Codes Could Deliver Malware

You’ve seen barcodes all your life. So you know what they look like: rectangles “boxes” comprised of a series of vertical lines. When a cashier scans a barcode, you hear a familiar beep and you are charged for that item.

A QR code looks different and offers more functionality. QR stands for “quick response.” Smartphones can download QR readers that use the phone’s built-in camera to read these codes. When the QR code reader application is open and the camera detects a QR code, the application beeps and asks you what you want to do next.

Today we see QR codes appearing in magazine advertisements and articles, on signs and billboards; anywhere a mobile marketer wants to allow information to be captured, whether in print or in public spaces, and facilitate digital interaction. Pretty much anyone can create a QR codes.

Unfortunately, that’s where the cybercriminals come in. While QR codes make it easy to connect with legitimate online properties, they also make it easy for hackers to distribute malware.

QR code infections are relatively new. A QR scam works because, as with a shortened URL, the link destination is obscured by the link itself. Once scanned, a QR code may link to an malicious website or download an unwanted application or mobile virus.

Here’s some ways to protect yourself from falling victim to malicious QR codes:

•     Be suspicious of QR codes that offer no context explaining them. Malicious codes often appear with little or no text.
•     If you arrive on a website via a QR code, never provide your personal or log in information since it could be a phishing attempt.
•     Use a QR reader that offers you a preview of the URL that you have scanned so that you can see if it looks suspicious before you go there.
•     Use complete mobile device security software, like McAfee® Mobile Security, which includes anti-virus, anti-theft and web and app protection and can warn you of dangerous websites embedded in QR codes.

By Robert Siciliano

Increase in Hit & Run Spam

During the past two weeks, Symantec has observed an increase in hit & run spam activities (also known as snowshoe spam) in its Global Intelligence Network. Hit & run spam messages have the following characteristics:

    Usually originates from IP ranges with neutral reputation
    Uses a large IP range to dilute the amount of spam sent from each IP address
    Contains features (such as Subject line, From line, and URLs) which change quickly
    URL is the call-to-action
    Often uses large quantity of “throw-away” domains in a single spam campaign

In addition to above, there were also hit & run messages promoting the following products or services:

    Auto warranty
    Satellite TV
    Learning new language
    Floral products
    Auto loan
    Free credit reports
    Online dating service
    Work-at-home opportunities
    LASIK service

The spammer uses varying subject lines to offer the same type of product or service. For example, here is a list of sample subject lines offering a hair loss product:

Subject: Finally a hair solution that works for Women
Subject: Attention Women: Get fuller hair risk free
Subject: See the latest trick for thinning hair
Subject: Try the newest solution to regrow hair. Risk Free
Subject: See how celebs get fuller thicker hair
Subject: Attention Women: See the latest trick to restore hair

In addition, some spammers insert hyphens at random locations to further increase their chances of successfully delivering the spam message.  Here is a list of sample subject lines offering home security:

Subject: [BRAND NAME REMOVED] De-aler $99 Install He-re to help Pro-tect You
Subject: [BRAND NAME REMOVED] monitored and Dea-ler installed
Subject: [BRAND NAME REMOVED] De-aler Installed se-curity sy-stem $99
Subject: [BRAND NAME REMOVED] De-aler Fr-ee Sys-tem Of-fer
Subject: [BRAND NAME REMOVED] Home Security is #1- Fr-ee Security Sy-stem!
Subject: [BRAND NAME REMOVED] is #1 This De-aler has a $99 Install
Subject: [BRAND NAME REMOVED] monitored se-curity from Top De-aler $99 install
Subject: [BRAND NAME REMOVED] can help pro-tect your home in 2012
Subject: [BRAND NAME REMOVED] Auth De-aler $99 install with Fr-ee S-ystem
Subject: [BRAND NAME REMOVED] De-aler $99 Of-fer Dont settle for le-ss

While the presence of URLs is not the only condition to make the message qualify as hit & run spam, the chart below shows the percentage of spam messages containing an URL increasing during the past week:



By Eric Park

Consumer Devices Changing the Public Sector Workspace

The Bring Your Own Device (BYOD) movement is taking hold in workplaces around the world, but some of my recent reading has led me to explore more deeply the impact of this trend on communication and security in the public sector.

An article in Forbes summed it up well: people rely more and more on smaller, mobile gadgets, and they’re using these devices to support telepresence and other collaboration tools to conduct work-related business. Though this embrace of BYOD (also called consumerization) means more flexibility to work from anywhere, more accessibility to coworkers and supervisors, and more opportunities for collaboration, it raises security concerns.

Despite these new worries, the worst mistake an organization can make, the Forbes article said, is not accepting and working to accommodate BYOD. Public sector organizations need strategies in place to support consumer grade and enterprise class devices that enable mobile collaboration. While necessary, these policies don’t always develop easily--accommodating consumerization while still protecting classified information can require an IT overhaul, writes ZDNet’s Dion Hinchcliffe.

According to Hinchcliffe, we are reaching a “tipping point” where IT will shift from controlling all things technology to instead enabling safe information exchange. It will no longer be about tying all devices to one network and governing that network, but rather organizing and managing the cloud and protecting that space from unwanted intrusions, he said.

With the right strategies and support systems in place to promote safe BYOD, organizations can maximize the benefit of technologies like telepresence. The military can safely give each soldier a Smartphone and know the video applications used on those devices can operate without risking national security. Doctors can see patients from their personal devices, saving late night trips to the hospital but still enabling proper, timely care.  And, professors can hold extra office hours, even telepresence-based, recordable review sessions without worrying about room availability or juggling schedules.

Does your organization support BYOD? What challenges does it bring up for you, and what solutions have you found?

By Janet Lyons

Video and Telepresence Integral to Supporting a Mobile Workforce

Whether you work for a government agency, a hospital, or a school (or you attend school as a student) the verdict is in--you needn’t spend all day in your office, classroom, or examination room to productively do your job or complete your assignments.

Consider these examples: In San Antonio, Texas, detectives obtain search warrants via in-vehicle laptop telepresence connections to judges; doctors in a California hospital use tablets to videoconference with their colleagues; and, thanks to a telepresence-equipped mobile robot, Lyndon Baty, a 16-year old with kidney disease who cannot attend regular high school, interacts from home with his teachers and peers and participates in lessons as if he were sitting in the classroom.

The common denominator here? Each technology user relies on a mobile device, and, each depends on video collaboration functions available through the hardware to realize optimal remote productivity.

It’s not surprising that mobile video would prove so crucial, considering the rampant proliferation of mobile devices throughout workspaces and organizations. According to Forrester Research, in 2012 mobile users will account for 73 percent of the enterprise workforce.

But with people working and learning in disparate locations, it takes video technology to ensure strong personal relationships among co-workers and peers. Video collaboration through tools like telepresence puts people at the center of the conversation; seeing each other builds trust and breaks down barriers that otherwise faceless, remote communication can build. Quality video lets mobile workers connect and communicate as if they sat in the same physical office space.

With telepresence and video available to mobile technology users, the Bring Your Own Device movement stands to build stronger workspaces and communities. Mobile video collaboration in the pubic sector speeds justice, streamlines healthcare, and ensures educational opportunity. It’s a movement we’re very excited to be a part of!

Also, join Cisco experts, selected partners, and industry leaders this week at the 2012 Government Solutions Forum where one of our four tracks is mobile collaboration.

Have you mobilized your work? Does video play a role? Please share your stories with us and come and hear what others have to say at the Government Solutions Forum!

By Janet Lyons

Are You Susceptible to Phishing? Learn How to Stay Safe

This morning I received another of those “You have won a lottery!” mails.

This made me realize that cyber criminals will continue to try baiting unsuspecting net users, and so I should periodically remind my readers to how to stay off the Scammers net. So let’s talk about “Phishing” today.

What is Phishing?

According to McAfee Security Tips, “Phishing are scams that attempt to acquire confidential information such as credit card numbers, personal identity data, and passwords by sending out emails that look like they come from real companies or trusted individuals.”

The common phishing mails usually involve communications regarding the winning of a lottery; the imminent closure of bank account; order confirmation; verification of billing information and return of excess payments made to the tax dept.

Usually scammers send the mails to many victims, whose e-mail ids they might have harvested from the net, hoping that at least some will fall prey to their trap and click on a malicious link or open a malicious attachment.

I have provided snapshots of two very common types of phishing mail, courtesy Hoax-slayer:

Citibank Member,

This email was sent by the Citibank server to verify your e-mail address. You must complete this process by clicking on the link below and entering in the small window your Citibank ATM/Debit Card number and PIN that you use on ATM. This is done for your protection – because some of our members no longer have access to their email addresses and we must verify it.

To verify your e-mail address and access your bank account, click on the link below. If nothing happens when you click on the link (or if you use AOL), copy and paste the link into the address bar of your web browser.

Dear MSN Customer,

During one of our regular automatical verification procedures we’ve encountered a technical problem caused by the fact that we could not verify the information that you provided during registration.

We urgently ask you to submit your information so that we could fully verify your identify, otherwise an access to MSN services for your account will be deactivated until you pass verification process.

To submit your information please use our secure online application – apply here (LINK REMOVED).

Thank you for using our services, MSN Payment Processing Department.

Watch out for these signs of a phishing mail, courtesy Microsoft Safety & Security Center:

Ever wondered what scammers do with your information?

    Access your bank account: They harvest your passwords, user names and other details and directly access your account. After that, they can easily transfer funds, conduct transactions etc. They can also change the password and lock you out of your own account.

    Use your credit card: Similarly, once they get you to share your credit card details including expiry date and user name, they can carry out transactions and charge it to your account

    Steal your identity: If you have been naïve enough to offer details like PAN number, bank account and credit card details, the scammer will find it very easy to create a profile using your details. Thy can use this profile or sell it to others for various criminal reasons. It will take months or even years to resolve legal issues, clear your name and pay off debts

If you receive a suspicious message that looks like a phishing mail:

•     Delete the mail, without clicking on the links or opening attachments
•     Don’t enter personal or financial information into pop-up windows
•     Type addresses directly into your browser or use your personal bookmarks. Don’t use links in e-mails to access netbanking facilities
•     If in doubt it is better to contact the company or individual directly
•     Don’t wire money to friends supposedly stranded in foreign countries without first confirming with him/her or others
•     Don’t share bank details with any online seller/employer without proper verifications

What if you accidentally get “phished”?

•     Change email id and password
•     Inform your bank immediately
•     Inform all your friends so that the scammer can’t touch them by sending mails from your account
•     File a report with the nearest cybercrime cell if your bank details get stolen

How to safeguard yourself against phishing attacks

•     Use a comprehensive internet security software that includes advanced ant-phishing software
•     Periodically change your passwords/log in id
•     Keep spam filter “on” while accessing the net
•     Always report spams
•     Carry out transactions from secure sites that have the ‘padlock’ symbol, begins with https//: and is certified to be ‘visa secure’

By Anindita Mishra

5 Lessons Learned from RSA

A couple of weeks ago, the RSA Security conference took place in San Francisco, CA.  The increasing sophistication of hackers and visibility of data breaches (including one on the conference’s namesake company last year) makes this an exciting time to be in the security business.. While this show is for corporate IT and security professionals, there are some things that consumers can take away from all of this.

• Social networking sites are prime targets for cybercriminals: Hackers are aware of the large numbers of people using sites like Facebook, Twitter, YouTube, and are using this to their advantage by putting offers out there to try and get you to click on malicious links. Security companies are using it to get the word out on protection. Security companies are using social media to help educate consumers – take the time to read their advice. McAfee pulls together lots of great content and advice and has over 575k on Facebook.

• Hackers are targeting intellectual property: For a decade now credit card numbers, Social Security numbers and everything needed to take over accounts or open news ones has been a target. Criminals still want all that, and they also want proprietary data that will help their nation or company get an edge.

• Advanced Persistent Threats (APTs) will be a bigger topic: You’ve heard the term “it’s not a matter of IF, but WHEN” and this applies to APTs. APTs are ongoing threats where the intent to persistently and effectively target a specific entity and can take criminals days to decades to achieve their goal.

• Multiple layers of protection: For the enterprise, this is protection at all points, but this also applies to consumers. It used to be that all you needed was a firewall, then you needed antivirus, now you need anti-spam, anti-phishing, anti-spyware and for heavens sake make sure your wireless is protected too.  This is just the beginning! Expect more layers to come.

• Protect the data and the device: It used to be all you had to be concerned about was protecting your PC. Now you have to be equally proactive in protecting your Mac, tablet and mobile phone. You still need antivirus and all the different layers of protection mentioned in the point above, but you also need to be aware of what stuff you have all your devices that can expose your personal information and identity.

By Robert Siciliano

The State of Security – Haste Makes Waste

In McAfee’s recent State of Security report, only 35% of respondents felt they were well aware and well protected against information security risks, and 38% responded that they were aware but not protected. This second group admits that they don’t have all of the security strengths necessary to protect critical business information.  However, those that have a formal strategic security plan are more likely to classify themselves as having optimized security.

Take a look at this report and learn more about what others are including as key components of a formal strategic security plan, and how companies who have a plan do not overlook steps in the process. Successful organizations work to build an internal culture from the top down that looks at information security that includes identifying data sources, understanding potential threats and using a risk-based approach with business impact input to determine what to protect next.

For the respondents who acknowledged they have weakness in their protection, they can find the conviction to do what’s right in the long run by leveraging a formal strategic security plan. Your business continues to create, manage and protect its data year over year, and a strategic security plan should be reviewed and refined to adjust for changes to business risk in order to provide security and security purchasing recommendations that result in overall  improved security and optimization.

By Kim Singletary

Keep Your Digital Lives and Devices Safe in 2012

Well, I don’t know about you, but the relaxing summer days now seem like a distant memory. The crazy combination of work, kids, school, sport and social activities has returned. Plus let’s not forget the kids’ social lives!

Sometimes, when I am feeling completely strapped for time, I cut corners. I dry shirts in the clothes dryer to avoid ironing them, I use instant mashed potato and we have sandwiches for dinner.

Some of my shortcuts pay off while others don’t. The school shirts are (almost!) totally acceptable and the kids are thrilled to have sandwiches for dinner. The instant mashed potato – well, that’s always a big disaster.

But when it comes to protecting your collection of mobile phones, computers and tablets at home, taking a shortcut could end just like the instant mashed potato does – badly! Keeping your family’s personal identity and information safe when shopping, banking and interacting online is just not worth mucking around with.

So here are a few tips that may help keep your digital lives and devices safe in 2012:

1. Protect your data
The thought of losing my children’s precious baby photos just makes me feel sick. In a recent survey, Australian home Internet users estimated that their photos, contacts and entertainment (their digital assets) were worth almost AU$22,000! So find yourself a security solution that offers data backup and restore features and keep those treasured memories safe and protected.

2. Educate your family and always pay attention to your children’s online activities
Come on – be brave! Banish those computers from the bedroom and position the computer in a high-traffic area in the house. The kitchen is always a great option. And make sure you talk to your kids about what information is and isn’t appropriate to share online.

3. Don’t neglect your Apple devices
The popularity of Apple devices has led to a significant increase in threats which are currently growing by 10 per cent per month, according to McAfee labs. So please install security software that has been developed specifically for the Mac.

4. Mobile’s and tablets also need protection
Don’t assume your mobile and tablets are automatically safe – they aren’t! Threats to mobile phones are growing at a rapid rate with Android devices now the most targeted platform. Be careful when downloading apps and only download from a reputable app store.  Also remember that the Internet is the Internet regardless of where you’re accessing it from, so remember to stay protected and take the same precautions as you would on your PC.

With many kids using their mobile phones to trade games and music via Bluetooth, make sure you factor their devices into your security plan as well.

Now, I know that is a lot to digest. But in the spirit of avoiding an ‘instant mashed potato style disaster’, I think it is important you have all the essential tips.

But please don’t feel overwhelmed. It doesn’t have to be hard work addressing these issues. Just stay one step of the cybercriminals (and your kids!) and invest in active, comprehensive protection for all the devices you use to access the Internet.  See you next time.

By Cybermum Australia

Don’t Let Location-Based Services Put You in Danger

Location-based services utilize geo-location information to publish your whereabouts. In some cases, these services can also provide discounts or freebies as a reward for “checking in” at participating businesses and gathering “points.” These services can also be used to share photos and other media in real-time with your friends and followers.

Geo-location or geo-tagging can be used on PCs, but is primarily applicable to mobile phones. The geo-location software usually obtains its data from your device’s Internet protocol (IP) address or your global positioning System (GPS) longitude and latitude. Many of today’s social networking sites are now incorporating location-based services that allow users to broadcast their locations via smartphone.

Carnegie Mellon University has identified more than 80 location-sharing services that either lack privacy policies or collect and save user data for an indefinite period of time.

Some companies have even adopted the technology, which they’ve dubbed “GPS dating,” to connect singles with other local singles anywhere, any time. These dating services make it easy to find other users by providing photos and personal descriptions.

This technology is immensely useful to predators, thieves, and other criminals, since it makes it so simple to determine where you are, and where you are not. They can access a full profile of your itinerary, all day, every day. Someone who is paying unwanted attention to you can see your exact address each time you “check in.”

One of the most extreme examples of the dangers posed by GPS-locators is the issue of domestic abuse victims who seek safety at a shelter; volunteers have adopted a policy of removing batteries from women’s phones as soon as they arrive, so that abusers cannot track their victims to the shelter.

Thieves use geo-location to determine whether you are home or not, and then use that data to plan a burglary.

Stalkers who use the phone’s GPS are usually close to the victim—a family member or ex-boyfriend or girlfriend, for example—and use their personal access to manually turn on GPS tracking.

To protect yourself from broadcasting your location, you should:

•     Turn off your location services on your mobile phone or only leave it enabled for applications like maps. Most geo-location services are turned on by default.
•     Be careful on what images and information you are sharing on social networks and when. For example, it’s best to wait until you are home to upload those vacation photos.
•     Make sure you check your privacy settings on your social networking sites that you’re sharing information on to make sure you are only sharing information with your friends and not everyone.

By Robert Siciliano

Protecting the Data You Don’t Know About

Many customers have come to me and said “I understand the importance of data loss prevention (DLP) for my organization; but where do I start?”   Not only does data in enterprises double every 18 months, organizations don’t always know where all their data resides, who use it and how it is being used.   With most approaches to DLP this would be challenging.

With traditional approaches to DLP, you’d start with a set of initial policies.  The policies are then deployed in a production environment and then you wait …. and wait.  Most of the time, the policies are not optimized and so you’ll end up with too many potential security violations (false positives) or too little (false negatives).  So, you will need to go back and tweak the policies and then wait again.  In speaking with people implementing traditional DLP, I’ve learned that this process can take months! During that time, your organization continues to face the risk of data loss and has to invest precious resources in order to create an optimized policy.

Another problem with this traditional approach is that data that doesn’t match an existing policy is let go. It’s water under the bridge, and goes straight out the firewall into the wild. You’ll have no visibility into what has left the organization, and that has an impact on future policy development.

McAfee took a different approach to data loss prevention. In addition to the set of policies that we use to evaluate and log violations, we also log all outgoing data. We do this using unique Capture technology that is available with McAfee Data Loss Prevention. We hash the data, index it, and perform analytics on it.

So you may ask “how are you using the data you have captured?”  We use it to help in many ways.

1. Test policies before they go live

Use the real data you have captured in the last few months and test your new DLP policies on the data.  It allows you stop guessing and build effective polices with confidence without having to wait for weeks to verify efficacy.

2. Perform quick, complete investigations

This is better explained with an example.   Let’s say that an employee left your company, and unbeknownst to you, took sensitive corporate information with him to his next employer. A month later, you noticed the competitor was making announcements about a technology that sounded like yours.  Before this employee left, you didn’t know that you needed to be watching what he was doing, so no specific policy was in place.  But with McAfee’s Capture technology, you can go back in time, almost like a digital video recorder, and figure out what that employee did before he left, and identify whether or not, he in fact, took information that wasn’t rightfully his.

3.  Stay ahead of your data risks

The captured data helps you see the patterns of real-world data being used in your organization. It gives you visibility to look at events that lead up to a breach to identify current broken business processes. As you understand how your organization uses data you will be more able to predict risks and be proactive in avoiding them. This vastly increases the efficiency and effectiveness of your data protection.

You cannot protect what you don’t know.  Unique McAfee Capture technology, available in McAfee Data Loss Prevention, gives you a faster and more efficient and cost effective way to leverage your data for your DLP solution.

By Cindy Chen

The Top Ten Pitfalls In ITaaS Transformation

By now, the story should be starting to be more familiar. 

The business needs more from the IT function, but IT can't easily deliver.  Inevitably, business leaders start searching outside of IT to get the flexible and easy-to-consume services they need.

IT leadership suddenly realizes that they're now being forced to compete for internal business , and IT isn't a monopoly any more.

Fail to compete successfully for your internal IT customers, and the future is not bright.

And so begins the uncomfortable process of IT groups transforming to look more like modern IT service providers, and less like the inwardly focused, siloed IT departments of yesteryear.

What started a few years ago as just a modest handful of customer examples quickly expanded to dozens, then hundreds and now many thousands. 

Personally, I think this has created a great opportunity for IT leaders to learn from each other as they each embark on their own transformational initiatives. 

But -- as with most things -- you tend to see patterns: where things work, and -- sometimes more importantly -- where things tend to bog down.

So, allow me to share my personal list of sand traps where IT leaders occasionally get stuck. 

Why?  Because knowing where the problems might lie is often half the battle ...

#1 -- Not Realizing The Game Has Fundamentally Changed

Nobody likes disruptive change.  Indeed, we as human beings have a strong ability to see things as we would like them to be vs. how they might really be. 

Myself included :)

We rationalize.  We position.  We justify.  Sometimes, we just make excuses.

All of that normal human behavior tends to delay the stark reality: there's a massive task at hand, so let's get started.

For example, some IT leaders will tell me that they've implemented new processes over the existing environment and organization to improve a few key indicators (such as time-to-provision, or perhaps utilization) in an attempt to move the needle by what they believe to be a big number -- say, 10 or 15% over some historical baseline.

Alternatively, someone might say that they've established new procurement enforcement procedures to keep those pesky users from sourcing around the enterprise IT group -- and now the problem is under control.

Or, occasionally, they'll attempt to gift-wrap the legacy IT function with a set of internal communications that paint glowing pictures of just how good the internal IT group is.

To my way of thinking, these are all symptoms of a clear underlying root cause: the relationship between the business and IT is fundamentally changing, and no incremental measures are likely close the widening gap.

For me, it's pretty clear.  It's gut check time: the IT game is fundamentally changing. 

And as an IT leader, you've got a tough decision to make -- are you in, or are you out?

#2 -- Making It About Technology

This one is very understandable -- many of us are technologists, so we tend to frame most problems and solutions in technological terms.

I am less-than-popular within various product groups at EMC because I steadfastly refuse to frame IT transformation and learning to compete as a "technology challenge". 

IT transformation is an organizational challenge -- nothing more, and nothing less.

Sure, you'll need modern tools to get the job done.  And I believe there are unwise technology choices that can make the task at hand much harder than it needs to be.  And, of course, I believe that EMC makes great stuff to support these environments.

But the conversations doesn't start (or end) there.  We must exit the familiar world of product feature/function, and enter the squishy and uncomfortable world of people and politics.

IT professionals -- in general -- are hired for their technology and process skills, and not necessarily their people or political skills.  The natural tendency (for some) is thus to steer the conversation back to familiar territory, e.g. what are the "right" technologies? 

Trust me: without organizational context, an isolated technology debate is an unproductive diversion.

I've shared this slide before, but it illustrates the point well.

At one of our IT Leadership Forums last year, we asked the senior audience where they saw the challenges going forward. 

Not one of them picked "technology".  Zero, zilch, nada. 

Think about that when you see the cloud pundits passionately arguing about various technologies back and forth on the interwebs. 

Sheesh.

#3 -- Overwhelmed By The Legacy

This one is also very understandable.  About 30 minutes into the ITaaS discussion, many IT leaders look around their shop and see the end result 20 years of IT decisions that now look somewhat questionable in the light of the new day.

Legacy applications.  Legacy infrastructure.  Legacy IT processes.  Legacy business processes.  Legacy funding models.  Legacy skill sets, roles and organizational models.

Where to start?  Can we ever get there? And how will be bring all this stuff forward?

Taken in aggregate, it all can be intellectually and emotionally overwhelming. 

The most productive answer -- as it turns out -- is to create a small pocket where you do things the new way vs. the old way. 

Give the new team a few interesting (and non-critical) use cases to cut their teeth on, like development and test, or perhaps self-service analytics.  Prove that the model can work -- for both IT and the people who consume it.

As the new way of doing things quickly matures and gains traction, more new projects will find their way to the new environment vs. the old one.  Over the course of time, there ends up
being a lot less legacy to deal with. 

And then you can make informed decisions around what stuff needs to be brought forward vs. simply retired in place.

#4 -- New Mission, New Leadership Style Required

When organizational situations are familiar and stable, you need a familiar flavor of manager -- one who's comfortable process, measurement and predictable results.  A very useful and important managerial style when it's business-as-usual.

However, when you're trying to drive accelerated change in a decent-sized IT organization, a very different leadership profile is needed. 

You need leaders who inspire and motivate people to do things differently and take a few risks.  You need someone who can figure stuff out as they go along while believing in the bigger mission. 

There aren't many people out there who are adept at both styles.  To make matters even more sticky, you're sill going to need those critical operational skills to keep the lights on at the same time you're working on building out your new model.

The farther you are along in your career, the more difficult it can be to adapt and evolve your leadership style.

But that's exactly what needs to be done -- and not everyone is up to this challenge.

#5 -- Trying To Implement Entirely New Functions With Existing People

When you look at the business model of any IT service provider (or any IT organization that is competing like one), you'll find newer functions where there usually isn't anyone inside of the current IT organization who has any relevant background.

One classic example is the go-to-market function.  Ask yourself: how many people with good marketing and sales DNA end up in an enterprise IT organization? 

Answer: usually none. 

So the tough part is to acknowledge that (a) you're going to need the function, (b) you don't have any internal candidates, and (c) better figure out where you're going to get a few of these critical skills.

Another classic example is IT finance: the ability to model and price variable IT services takes a whole lot more firepower than simply negotiating with vendors and allocating traditional IT costs.

And yet another classic example is "product management": the function that manages the portfolio of IT services -- what do people want, how is it justified, how is it introduced, how is it measured, etc.  Anyone who's worked for a product or services company is familiar with the function, but -- once again -- you don't find it in many IT shops.

If you're a successful IT service provider, you have all of the above functions, and more.  If you're an enterprise IT organization who wants to compete with IT service providers, you're going to need the exact same functions.

The bad news?  Very often IT leaders attempt to use existing internal IT candidates, often with poor results all around. 

The good news?  These skills aren't really that hard to find -- that is, if you look outside of traditional IT settings.

#6 -- Backing Away From The Finance Challenge

It's a simple truism: how IT is paid for will dictate how IT is built.

If your funding model is per-project, IT will end up being an interesting collection of projects. 

Finance If your funding model is IT as a corporate cost center, you'll be the perpetual organ donor for every round of budget cutting that comes along.

But if you make IT "pay its way" by delivering attractive IT services that internal customers prefer to consume, you get the privilege to grow and invest in your business much the same as any other business owner.

If you think transitioning an IT organization is hard work, wait until you sit down with a bunch of finance guys and start to argue that the IT funding model needs to change. 

Fortunately, we cracked that code internally here with EMC IT, and we've seen several of our customers do the same.

The natural inclination, though, is to avoid the discussion for as long as humanly possible :)

#7 -- Not Thinking Like An Entrepreneur

If you were starting up a new IT services business, you'd probably pick out a few big clients, and try to build something they'd like.

You wouldn't make the fatal mistake that people would want to automatically consume exactly what you had built.  And you wouldn't try and please everyone from the outset.

Well, if you think of IT transformation as an "intrepreneurial startup", you'd probably want to do the same thing --  find a few internal stakeholders who are willing to work with you,
and build something they'd like to consume -- but do it as the starting point for a broader set of capabilities, and not an end unto itself.

Everyone else can continue to use the legacy environment and processes -- for a while, until you expand and grow your capabilities.

The trap I see people falling into is thinking that somehow the CFO is your "internal customer". 

A better way to think of it is that the CFO is your VC firm :)

#8 -- Not Investing Over-Communicating

Any senior exec that's been through any major organizational or strategic transformation -- of any sort -- will say the same thing: you spend most of your time communicating and overcommunicating. 

Since most IT professionals weren't exactly hired for their communication skills, IT leaders involved in transformation often have to suck it up and get on the internal speaking circuit -- and do so for quite a while, both internal to IT and especially externally.

Sure, there's a role for written communications: memos, newsletters, powerpoint decks and the like. 

But a wise man once told me that meaningful communication can only happen when two people are face-to-face. 

Yes, it's a big investment in time.  But there doesn't seem to be any shortcut.

#9 -- Not Planning For Inevitable Mistakes

Yes, when dealing with critical IT systems, there's a strong incentive to plan, schedule and double-check everything to plan for each and every eventuality.  That doesn't become any less important.

Mistake But when starting on an ITaaS initiative, you're essentially investing in learning a new way of doing things.  That means that you'll never get it 100% right from the outset, nor should you attempt to.

The implication? 

Work your strategy, schedules and plans so that people have the slack to make a few mistakes.  Make sure the new team knows it's OK to get a few things wrong as the learning progresses.

I've seen more than a few nascent ITaaS transformation initiatives completely sstrangled by this "we're running this like a military operation" mindset.  That's hard on everyone involved, and -- besides -- you're encouraging people to take a few risks. 

Give your teams the room to learn, adapt, grow and mature.

#10 -- Not Celebrating Progress

If you've ever climbed a modest mountain, it's very rewarding to stop every so often, and look back at just how far you've come.  Doing so can give you that extra boost of motivation to tackle the next ascent.

I can't tell you how many IT groups I've met that have been able to achieve meaningful progress in relatively short time frames, but don't easily acknowledge just how much progress they've made under challenging circumstances. 

Maybe I met them a year ago, and they were just getting started.  And I see them a year later, and I'm duly impressed with their substantial progress.

But for some reason, they're usually not that impressed with their results. 

I find that puzzling.

Yes, there's always more to do.  I get that.

But at the same time, everyone deserves a hard-earned victory lap once in a while.

Even IT people :)

Why Bother?

I know it.  You're reading this and thinking "why should I bother?". 

It all sounds so -- well -- uncomfortable.

I'll tell you why: because there's a big pot of gold at the end of this rainbow.  And I've seen more than a few IT groups get to it.

IT is now seen as a value generator by the business, as opposed to just another cost to be minimized. 

IT professionals elevate their careers by getting closer to the business rather than deeper into technical minuteia. 

The IT group is now perceived as a business within a business, with all of the benefits that brings.

The work doesn't stop there: progressive IT organizations are now building on their ITaaS capabilities to move into cool, really-move-the-needle IT topics: enabling big data analytics, mobilizing their user and customer experiences, building new app factories, --  ultimately helping to create "digital business models" that can power their businesses through the next few decades.

It isn't quick, and it isn't easy.

But for those that decide to undertake the journey, the rewards are clearly visible ...

Dos And Don’ts Of Online Shopping

Let me begin with a confession. I am addicted to shopping. Nothing lifts off those blues faster than a purchasing spree across several of my favourite stores. And not only for myself or my family- I am happy to accompany others too on their shopping spree; like for my cousin’s trousseau, my sister’s kid’s birthday return gifts or New year’s gifts for my friend’s business associates. I am equally happy shopping for school uniforms and groceries, decorative items and linens. Shopping is cathartic for me.

But the mad traffic and the even madder crowds at the shops often act as deterrents. At such times, online shopping is a heaven-sent opportunity to shop from the safety and comfort of your homes. Another plus point is that you don’t have to lug around heavy packages, nor have to pack and parcel gifts to friends! You simply ask them to deliver the packages to the address of your choice!

For shopophoebics (there is no term for fear of shopping) like my husband, online shopping is a boon! Our preferred sellers send him birthday and anniversary reminders and he just selects and pays for what he wants to gift me that year. And voila! You have the Husband of the Year- the pride of my life, the envy of my friends.

However, as Cybermum India, I can’t but add a word of caution. You should be extra cautious while doing online transactions because:

    You don’t know the seller personally
    You can’t verify the address, phone number, sales figures
    You can’t physically check the goods
    You are unsure of the site’s security policies and ethics

But it definitely does not mean you keep away from online shopping. It just means be careful. Do a background check of the seller you select. Start with the site address. Check whether it looks authentic and begins with https//. Another check is to see if the site is encrypted, with a lock sign on top right.

It is recommended that you read  buyer reviews. You should also find out whether they have any return or refund policies. Most importantly, you need to investigate payment modes-do they have a safe Visa Secure or Paypal payment mode? It is preferable to select credit cards or “Cash-on-delivery” modes of payments. Check for address and contact nos. If possible, call up their customer service and discuss their sales, delivery, and refund policies, when placing orders for the first time. Upon delivery, check the items minutely. Check your credit card statements. Keep printed records of all transactions.

McAfee lists some Do’s and Don’ts of Online Shopping

Do’s :

• Do your homework, research web sites

• Do pay by credit card or online payment services

• Do buy from a web site that has encryption

• Don’t buy from a web site unless it is certified for safety

• Do check the web site’s policies before you order.

• Do use comprehensive computer security software

• Don’t forget to inspect your new purchase as soon as it arrives

• Do check your credit card statements

Don’ts :

• Don’t buy from spammers

• Don’t pay by debit card, cash, or wire transfer

• Don’t buy from a web site unless it is certified for safety

• Don’t buy from a site with which you aren’t totally comfortable

• Don’t forget to inspect your new purchase as soon as it arrives

• Don’t let children buy games, gifts online without any adult supervision

For additional information, check this site

By Anindita Mishra

Response Now as Important as Prevention

The National Institute of Standards and Technology (NIST) has updated its Computer Security Incident Handling Guide to take into account the increasingly dire state of cyber security. As anyone who has followed the rush of high-profile incursions over the past year knows, it’s looking less and less possible to prevent the inevitable attack, no matter how many security controls and technologies you put in place. Instead, thanks to the increase in stealthy persistent threats, early, rapid, effective detection and response is now as important or possibly even more important than prevention, according to the guide. The guide also emphasizes the importance of reporting attacks to law enforcement, service providers, and developers of vulnerable hardware and software so that future attacks can be prevented and additional victims spared.

What about prevention? The guide emphasizes that prevention strategies and technologies are still critical for reducing the number of attacks, since prevention is much less expensive than mitigation and organizations can quickly become overwhelmed as the number of attacks increases.

The guide is full of valuable, detailed advice and information, recommending that organizations carefully document their incident response handling roles, responsibilities, policies, and procedures and do an extensive analysis of lessons learned after each attack and response to continually improve their response capabilities. It even covers handling the inevitable media response to a high profile attack.

As for the response itself, it should be implemented by carefully chosen and trained incident response teams. The guide outlines the following guidelines, with much more detail than you’ll see here:

1. Document everything, including every action taken, every piece of evidence, and every conversation with users, system owners, and others.

2. Recruit coworkers to provide assistance. Even the smallest company or incident will need at least one person to perform actions while the other documents them.

3. Analyze the evidence to confirm an incident has occurred. You may need to do additional research and reach out to technical professionals within your organization to help you better understand the evidence.

4. Notify the appropriate people within the organization immediately, including the CIO, head of information security, and the local security manager. Tell only those who need to know, and make sure you use secure communications to do so.

5. Notify US-CERT and/or other external organizations for assistance in dealing with the incident.

6. Stop the incident if it is still in progress either by disconnecting affected systems from the network or modifying firewall and router configurations in the case of a DOS attack.

7. Preserve evidence using backups of affected systems and log files containing incident information.

8. Wipe out all effects of the incident by eradicating malware infections and Trojan files, reversing all changes made to systems, rebuilding the systems from scratch, or restoring them from a backup.

9. Identify and mitigate all exploited vulnerabilities to prevent the incident from happening again.

10. Confirm that operations have been restored to normal including data, applications, and all affected services.

11. Create a final report detailing what happened and how it was responded to. At some point the report should also include a “lessons learned” section based on an in-depth discussion and analysis after the incident has passed.

The NIST is accepting comments on the guide draft until March 16th. 

By Leon Erlanger

Protect Yourself from “SMiShing”

“SMiShing” is a silly word—even sillier than “phishing,” but equally dangerous.
Phishing occurs when scammers send emails that appear to have been sent by legitimate, trusted organizations in order to lure recipients into clicking links and entering login data and other credentials. The term is a reference to the scammers’ strategy of luring the victim with bait and thus, fishing for personal information.

SMiShing is a version of phishing in which scammers send text messages rather than emails, which appear to have been sent by a legitimate, trusted organization and request that the recipient click on a link or provide credentials in a text message reply. The term is a condensed way of referring to “short message service phishing,” or “SMS phishing.”

Criminal hackers have access to technology that generates cell phone numbers based on area code, then plugging in a cell carrier’s given extension, then generating the last four numbers. They then use a mass text messaging service to distribute their SMiShing bait. (An online search for “mass sms software” turns up plenty of free and low-fee programs that facilitate mass texting.)
This ruse tends to be effective because while most of us have learned to recognize phishing emails, we are still conditioned to trust text messages. Also, there’s no easy way for us to preview links in a text message like we can if we are viewing an email on a PC.

Some SMiShers send texts with links that, if clicked, will install keyloggers or lead to malicious websites designed to steal personal data, while others trick targets into calling numbers that rack up outrageous charges to their phone bills.

To protect yourself from SMiShing:

• Be aware of how this type of scam works. Once you understand how it works, you are better positioned to recognize smishing
• Avoid clicking links within text messages, especially if they are sent from someone you don’t know
• Don’t respond to text messages requesting personal information
• Consider using a comprehensive mobile security application that includes SMS (text) filtering as well as anti-theft, antivirus and web protection like McAfee Mobile Security.

By Robert Siciliano

Analysts Expect Explosion in Mobile Malware

As consumers have overwhelmingly flocked to purchase smartphones—149 million were shipping in Q4…a 37% increase over Q4 2010—mobile operating systems from the likes of Apple, Google, and Microsoft are becoming big targets.

Malware, which consists of viruses, spyware, scareware, and other digital infections designed to steal data, is known to be a serious issue for PCs. And in response, there are complete security solutions that include antivirus, anti-spyware, anti-phishing protection, anti-spam and firewall protection. As smartphones gradually eclipse PCs in usage volume, criminals will direct their malware efforts toward mobile devices. But at present, the world of mobile security offers very few options.

According to McAfee Labs™, “nearly all the types of threats to desktop computers that we have seen in recent years are also possible on mobile devices (parasitic viruses may be a notable exception for modern mobile OS’s, more on this below). Moreover, we are bound to see threats readapted to mobile environments and, unfortunately, we are also likely to see new kinds of malware that target smartphone capabilities that are not available on desktops.”

Now would be a good time to install a mobile security product on your smartphone.


By Robert Siciliano
 

Nitro IT Business Solutions Announces Acquisition by TUC™ Brands

March 1, 2012, Ottawa, Ontario – Nitro IT Business Solutions today announced that it has been acquired by TUC™ Brands, an investment firm focused on the managed IT services and cloud computing industry with headquarters in Ottawa, Ontario. 

Although acquired, Nitro IT Business Solutions will remain as its own entity, and will continue to operate as a wholly-owned subsidiary of TUC Brands. However, the acquisition will mean substantial growth for Nitro including a drastic expansion of its professional services team––a tremendous advantage for Nitro’s client base. 

The combination of the two companies will provide Nitro IT Business Solutions with a greatly enhanced Help Desk with improved efficiencies and better support capabilities. The acquisition by TUC Brands means the addition of more highly trained support personnel and a multitude of new and better tools to assist customers.

The acquisition will mean additional growth in other areas of the company as well. Aside from the addition of more service personnel, Nitro will also be expanding its Sales Division to accommodate the forecasted growth in its Managed Services Division––a market in which the company has seen exceptional growth. 

“The Managed Service Provider (MSP) space has evolved a lot over the past decade. Our senior management team assessed our options and decided we needed to join forces with an organization with national reach and a proven ‘next-generation’ remote managed services operating model to take Nitro to the next level,”  stated Larry Poirier, CEO of Nitro. “There’s no question that adding the skills and capabilities of Nitro has the potential to help expand TUC’s service offerings through its franchise network to the small- and mid-sized business market. Nitro’s clients will continue to have the same high level of service they have come to expect.”

Nitro’s acquisition provides TUC Brands with a large customer, revenue and employee base, along with a strong technical bench with key vendor relationships and certifications in areas such as networking, virtualization and security. Nitro’s key vertical markets include professional services, technology, government, non-profit and healthcare. Nitro is a long-standing member of Ingram’s VentureTech Network, a North American organization of independent professional IT firms.

“We are very excited with the acquisition of Nitro and adding their team of experienced professionals,” stated Mark Scott, CEO and founder of TUC Brands. “A year ago we set out to establish a larger footprint in Ottawa as our flagship market, which the acquisition of Nitro allows us to achieve. What’s interesting is how complementary the personnel and skill sets are between the two companies with little overlap.” 

The Nitro acquisition was funded by TUC’s capital division, MSPXchange, along with institutional investors. The transaction is subject to customary closing conditions.

About Nitro IT Business Solutions

Nitro provides comprehensive IT business solutions, products and services. Nitro’s customized solutions institute best-practice processes and are architected with best-in-class products from Tier-One manufacturers. Nitro’s principal service offering is the award winning managed services solution, NitroSure, which delivers cost-effective IT Service Management (ITSM) to small- and medium-sized businesses and organizations. With NitroSure, clients have a partner who takes full responsibility for their IT infrastructure; gives them access to highly qualified technicians; guarantees service levels; and provides a host of proactive services that help prevent the catastrophic impact of downtime. For more information visit www.nitro.ca. 

About TUC™ Brands

TUC™ Brands develops businesses and ideas in the managed IT services and cloud computing industry. Our Franchise 2.0 opportunity provides entrepreneurs and investors with a complete framework to build, buy and accelerate a managed IT services business. Our MSPXchange program provides managed service providers (MSP) with the ability to monetize their business through either a structured merger or acquisition strategy, leveraging our proven MSP business and technology platform. Learn more about joining our team today at www.tucbrands.com.

For more information contact: 

Nitro IT Business Solutions

Larry Poirier

CEO

613-228-8096

larryp@nitro.ca

TUC Brands

Aaron Bradley

Director of Marketing

613-271-7674

abradley@tucbrands.com

Is Your Network Ready for a Mobile Workforce?

Ready or not, governments, healthcare providers, and schools are going mobile. If your workforce isn’t mobile yet, it soon will be: by 2013, 80 percent of businesses will support a mobile workforce (one that specifically relies on tablet technology), according to Gartner.

As I mentioned before, mobile employees will depend on telepresence and video collaboration tools to optimize their work experiences: these technologies do a wonderful job of filling the gap in personal interaction that can occur when an entire office works outside of the actual office.

But telepresence and video are only as good as the networks that support them.

As organizations issue tablets en masse and open their networks to employees’ (and students’) personal smartphones and other devices, they have to ensure security and well-managed network resources. Properly supporting mobile workers requires a strategic approach to the network. While every organization will have its individual needs, several key components are necessary to ensure safe, quality video experiences.

First, organizations need a network optimized to support video. A medianet is a network that gives priority to video traffic and delivers an excellent video experience without downgrading the performance of other applications. Organizations can convert existing IP networks into medianets. Some medianets, like Cisco’s, incorporate security features that recognize and authenticate mobile devices that join the network. Likewise, these comprehensive medianets have built-in monitoring capabilities that let network administrators control for quality and performance across the network as a whole and within individual telepresence connections.

Beyond the medianet, it is important to base a network on an architectural approach that allows for scalability and granular policy control. As more and more mobile devices enter a network, the network’s bandwidth needs to be able to scale to meet ever-increasing Wi-Fi demands. Likewise, as the number of attached devices multiplies, networks need built-in, customizable access controls that can track all of the hardware relying on the connection.

They may sound complicated, but these networking solutions really are simple, and they should be standard for any network supporting mobile video and telepresence.

So what do you think? Is your network ready to support a thriving mobile workplace?

By Janet Lyons