Archive for August 14, 2014

Projector Lamp Risks

Projector Lamp RisksI have done over a dozen audio-video projects in my career. One of the constant complaints I would get from Owners were about projector lamps. The Owners would inevitably complain about the sticker shock for replacement bulbs. Despite the fact, I recommended a mass purchase of replacement bulbs as part of the project. A bulk buy of 50 to 100 lamps would have saved a lot of money. Nobody wants to spend that money upfront. It’s easier to push the costs off of the capital budget into OPEX. It is somebody else’s budget.

Grey-market protector bulbs

This penny-foolish procrastination could end up costing organizations a great deal more. When a department is required to purchase its own consumable goods, they often buy the cheapest goods they can find and the results can be tragic. A recent example comes from Scotland. Back in May 2014, the 175-year-old Glasgow School of Art (GSA) Charles Rennie Mackintosh building caught fire. The blaze inside the historic building is believed to have started when a projector exploded in its basement according to the MailOnline.

Luckily there were no reports of serious injuries. If it turns out to be an exploding projector, the cause could have been a grey-market bulb. Grey-market goods are often sold on dodgy websites as original equipment. They are cheaper and are often packaged in convincing counterfeited packing. Monoprice had this same problem a while ago (which I reported on here).

In order to educate yourself, and protect your clients, projector bulb reseller – JustLamps.net –  published a website – Counterfeitlamps.com – which provides some pointers on how to recognize counterfeit lamps and what to do if you get one (or twenty).

Clean out the projector filters

TClimb the ladderhe second step to protect the installation is to service the projector. Everybody hates to climb the ladder and clean out the filters, but it’s got to be done. It increases the life of the lamp, so you save money by increasing the lamp life which reduces the risk of buying a counterfeit lamp and possibly burning down a building.

rb-

Protect your equipment (and buildings) by replacing projector lamps before they exceed their rated hours. Do not keep using it until it stops working. It could get ugly.

There are opportunities in here, many mid-high quality projectors will now generate alerts when it exceeds a number of hours. Maybe you can be the on the ladders cleaning the filters for them.

Related articles

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedInFacebook, and Twitter. Email the Bach Seat here.

Who Needs Two-Factor Authentication

Who Needs Two-Factor AuthenticationThe recent epidemic of online security breaches has shown the folly of passwords as the sole protector of your online data. As I have covered several times, most users depend on the same passwords. So what are we to do? One solution is Two-Factor Authentication.

John Shier at SophosNaked Security blog provided a primer on multi-factor authentication. Two-Factor Authentication is a subset of Multi-factor authentication (MFA).  MFA is an authentication process where two of three recognized factors are used to identify a user:

  • Sommulti-factor authenticationething you know – usually a password, passphrase, or PIN.
  • Something you have – a cryptographic smartcard or token, a chip-enabled bank card, or an RSA SecurID-style token with rotating digits
  • Something you are – fingerprints, iris patterns, voiceprints, or similar

How two-factor authentication works

Two-factor authentication works by demanding that two of these three factors be correctly entered before granting access to a system or website. So if someone manages to get hold of your password (something you know), the article says they still will not be able to get access to your account unless they can provide one of the other two factors (something you have or something you are).

Data breachThe author explains that secure tokens with rotating six-digit codes can be used to remotely access internal systems via a VPN session. Users need to give a username, a password, and the six-digit code from the secure token appended to a PIN. Home users can use a sort of two-factor authentication using SMS code verification. This is where, in addition to correctly entering your password (something you know), you must also correctly enter a numeric passcode sent to your mobile phone via SMS (something you have).

The availability of mobile network service and the unreliable nature of SMS can make SMS 2FA difficult. However, some services allow you to use an authenticator app in addition to your password which presents you with a different numeric one-time password (OTP) for each service that you register with the app. Both Google and Windows make these apps freely available in their respective stores.

Authenticator apps can be great for signing into sites like Google, Facebook, and Twitter even when your phone does not have service (mobile or otherwise).

Two-factor authentication makes it harder

SPAM emailParker Higgins at the EFF, says normal password logins, which use single-factor authentication, just check whether you know a password. This means anybody who learns your password can log in and impersonate you. Adding a second factor, like a PIN, something you know, with your ATM card, something you have, makes it harder to impersonate you. You need to both have a card and know its PIN to make a withdrawal.

Online two-factor authentication brings the same concept to your services and devices by using your phone—which means that even if your password is compromised by a keylogger in an Internet café, or through a company’s security breach, your account is safer according to the EFF.

That’s important because phishing, which is one of the most common ways in which accounts are compromised, only gets information about passwords. By adding a different factor, phishing attacks become much more complicated and much less effective according to Mr. Higgins.

APhishings two-factor authentication systems become more popular, they have gotten increasingly user-friendly; the EFF believes it doesn’t have to be a difficult trade-off of convenience for security. Major services like Twitter, Google (GOOG), LinkedIn (LNKD), Facebook (FB), Dropbox, Apple (AAPL), Microsoft (MSFT). GitHub, Evernote, WordPressYahoo (YHOO) Mail and Amazon (AMZN) Web Services have enabled two-factor authentication.

rb-

Users should get used to two-factor authentication. 2FA is not available everywhere but many of the most popular sites and services on the internet use the technology.  Hopefully, this will compel the rest to follow suit. There is Android malware in the wild that is specifically designed to steal SMS verification codes trying to thwart 2FA so you still need anti-malware on your mobile devices.

In the wake of recent POS attacks (which I covered here), DHS has recommended 2FA for POS systems. While it is not bulletproof, it does increase your security by making it harder for your accounts to be compromised. All users will need Two-Factor-Authentication Authentication.

Related articles
  • Fending off automated attacks with two-factor authentication (cloudentr.com)

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedInFacebook, and Twitter. Email the Bach Seat here.

Tips to Blend Agile, Waterfall

Tips to Blend Agile, WaterfallThere is a battle waging for the hearts and minds of project managers. The battle is between Agile advocates and Waterfall supporters according to Eric Morgan, in a recent FierceCIO article. The CEO of AtTask explains that Agile loyalists see the benefit of empowering people and teams in a bottom-up approach that produces a faster, more responsive way of working.  Meanwhile, traditionalists prefer a top-down Waterfall approach that neatly outlines all the steps in the project and defines the scope, budget, and schedule upfront–minimizing risk and uncertainty.

use a mixed approach

So who is right? The article says neither. Rather the article says that organizations with successful development cycles seem to use a mixed approach, using both methodologies for different projects. They cite Amazon (AMZN), an Agile powerhouse, could not have built s core web services product without some top-down dictation of standards. According to the AtTask CEO, the real difficulty for organizations, therefore, lies not in choosing one methodology over the other, but in successfully mixing the two methodologies.

Whether your organization is already juggling multiple methodologies or is considering adding Agile into the project management mix, here are four tips from the AtTask CEO on how to hybridize without sacrificing the visibility and productivity you need:

1. Transition to agile slowly

ScrumThe biggest issue organizations face in adopting or expanding Agile is the cultural transition. Change is never easy, and moving from a top-down culture of command and control to a bottom-up approach where workers self-organize and self-prioritize will certainly test your leadership team. the article stresses it’s a cultural transition that many people in an organization feel is disruptive and too much of a challenge to the established culture. To make the transition smoother and improve adoption, you should try to slow down your process transition. Understand that onboarding a system like Agile is a long-term commitment and because only certain teams will benefit from its methodology, make sure that your organization takes the time to strategically consider where it would be most effective.

Define up front what you are trying to accomplish with Agile so everyone can understand the benefits. In addition, developing a culture of respect and appreciation for both methodologies within the organization is important. Acknowledge what works well with Waterfall and when it is most appropriate to use. This extra effort will build trust; make people more open and resilient to trying new methods; increase buy-in from management and team members; and ensure that everyone is on the same page and trying to accomplish the same goals.

2. Provide professional agile training

With dozens of different aspects and processes, Agile is complex. The AtTask CEO warns that one of the biggest strategic mistakes organizations make is not getting professional training at the start. In particular, it is crucial that middle management participates in training. “Middle management really holds the keys to the success of Agile adoption. They create all the procedures and policies. If the middle is not on board, the transformation will be shunned,” says Dean Leffingwell, author of “Agile Software Requirements: Lean Requirements Practices for Teams, Programs, and the Enterprise.” When middle management is properly trained, not only do they understand the value of Agile for themselves, but they can be influential in mentoring the team and in demonstrating the value of Agile to the leadership.

3. Allow teams to communicate

In Allow teams to communicatemany organizations, Agile teams often become insulated from the rest of the organization. According to Mr. Morgan, they work in a kind of bubble, rarely interfacing with other teams or departments. However, communication and collaboration are two of the most critical elements of an effective mixed-methodology enterprise. Finding a way to enable visibility and communication across distributed teams, such as developing standard processes for organizing requirements and cross-team development, ensuring comprehensive release visibility for both upstream and downstream stakeholders, and managing the entire work life-cycle within one tool, will make hybrid organizations much more productive.

4. Speak a language everyone understands

The nuanced terminology associated with Agile is often an area ripe for miscommunication according to the author. In addition to making sure everyone understands the terminology and is speaking the same language, it’s important to identify key data points, such as what the team is working on, where the team is along their work process, and when the team will complete the task. Then, translate the data points into either methodology. No matter what methodology your teams choose, the work being done ultimately must be visible to the organization’s management and executive teams. Because manager reports and dashboards tend to focus on Waterfall-centric metrics, Agile teams need to ensure they are able to translate their results and progress accordingly. Moving to a mixed management style will always present challenges.

The article concludes that adoption may happen in baby steps, and not leaps and bounds. Following these four tips, however, can make implementation much more successful and enable you to structure projects in a more productive way to meet your business goals.

rb-

I have talked to several grey-hair PM’s and they have basically told me that Agile/Scrum is the best tool when you don’t know what you want and use PMBOK when you know what you want?

Related articles

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedInFacebook, and Twitter. Email the Bach Seat here.

Remote Desktop Opens Door to POS Malware

Remote Desktop Opens Door to POS MalwareThe U.S. Department of Homeland Security (DHS) has issued a warning to retailers. DHS reports that cybercriminals are using remote desktop software to open up retailers’ networks to point-of-sale malware attacks. Point of Sale (POS) systems have been at the heart of many of the recent data breaches. Retailers impacted include Target, Jimmy John’sP.F. Chang’s, Neiman Marcus, Michaels, Sally Beauty Supply, and Goodwill Industries International the New York Times reported.

Research conducted by the DHS, the Secret Service, the National Cybersecurity and Communications Integration Center, and security firm Trustwave SpiderLab. have following the attacks. During the attacks, Cybercriminals are scanning corporate systems for remote desktop software. The attackers are looking for Microsoft (MSFT) Remote DesktopApple (AAPL) Remote Desktop, Google (GOOG) Chrome Remote Desktop, Splashtop, Pulseway, and LogMeIn’s join.me.

Install malware

After finding an exposed system, attackers launch brute force attacks on the login feature. FireceIT Security reports that once the attackers gain network access, they deploy Backoff POS malware.  steal customer payment data and hide the theft using encryption.  An alert was issued by US-CERT on 07-31-2014 that explained how the malware gets installed.

At the time of discovery and analysis, the [Backoff] malware variants had low to zero percent anti-virus detection rates, which means that fully updated anti-virus engines on fully patched computers could not identify the malware as malicious

malwareUS-CERT has informed anti-virus vendors of the threat from Backoff malware and they will be updating their software to detect and block the malware. The malware can scrape memory for track data, log keystrokes, engage in command and control communication, and inject a malicious stub into explorer.exe that ensures “persistence in the event the malicious executable crashes or is forcefully stopped.”

The article concludes, “The impact of a compromised POS system can affect both the businesses and consumer by exposing customer data such as names, mailing addresses, credit/debit card numbers, phone numbers, and e-mail addresses to criminal elements. These breaches can impact a business’ brand and reputation, while consumers’ information can be used to make fraudulent purchases or risk compromise of bank accounts.

rb-

Lesson learned?If mega-firms like Target can be breached, what chance do small mom-and-pop POS firms in schools, food trucks, kiosks at the airport stand? I say not much. I have worked with several POS vendors and it seems they barely understand their own product, let alone SSL certs, VPNs.

Here are some tips from Verizon’s 2012 research into security breaches affecting companies that use POS systems to process customer payments. Make sure your POS vendor does the following:

1.  Change administrative passwords on all POS systems. (Hackers are scanning the Internet for easily guessable passwords).

2.  Implement a firewall or access control list on remote access /administration services. (If hackers can’t reach your systems, they can’t easily steal from it).

3.  Avoid using POS systems to browse the web (or anything else on the Internet).

4.  Make sure your POS is a PCI DSS compliant application (ask your vendor)

5.  Use password management software like LastPass to generate secure passwords. (LastPass allows you to avoid storing passwords in your browsers and can generate ready-to-use secure passwords for you).

Related articles

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedInFacebook, and Twitter. Email the Bach Seat here.