Tag Archive for Computer

| October 22, 2013
Comments Off on More Tech Trouble at School

More Tech Trouble at School

More Tech Trouble at SchoolIt’s not a good time for tech in schools. The security woes at school are not limited to the iPad debacle at LAUSD. (rb- You can see my coverage here – Updates since the first article – LAUSD started confiscating the iPads and delayed the district-wide roll out one year until 2015.) GigaOM’s Ki Mae Heussner writes that Guilford County Schools in North Carolina has suspended its tablet program with Rupert Murdoch’s News Corp’s Amplify after reports of faulty equipment.

NC school district suspends tablet program

uspended its tablet programThe district reportedly spent $16.4 million ($299 / device + a 2-year subscription at $99 per year) of a $30 million Race to the Top grant to pay for the tablets and content. The device is a 10-inch ASUS (2357) tablet running the Google (GOOG) Jellybean Android operating system. It comes pre-loaded with content and apps curated by Amplify. It enables teachers to distribute content across a class or grade level and control the content on students’ screens.

GigaOM cites the school district’s website, which says they have sent 10% of their 15,000 devices back to Amplify because of broken screens. About 2,000 cases have also been problematic. In one instance, a student returned a defective charger, reporting that overheating caused the plastic to melt. While the district said it expected a few glitches with the rollout, school officials decided to pause the program for safety’s sake. GigaOM claims the pause is a big setback for Amplify, which launched its education-optimized tablet at hipster South by Southwest earlier this year.

NewsCorpSince its launch, skeptics have wondered how schools would respond to the privacy questions and the prospect of doing business with Amplify’s parent company News Corp. (given its phone-hacking scandal). Ms. Heussner speculates that the suspension could give schools more reason for pause when it comes to embracing the new technology.

Asus told GigaOM that out of 500,000 chargers of its kind that they have shipped globally, only the one in Guilford overheated and melted. Justin Hamilton, Amplify’s SVP of corporate communications seems to be blaming the customer. He claimed the broken screen rate in Guilford is higher than in other school districts. “We’re working very closely with the district on this and hope to have things resolved and the program back up and running very soon,” Mr. Hamilton said.

Indiana mobile security fail

circumvented the security on district-issued Apple iPadsIn Indiana, Education Week reports that between 300 and 400 students in the Center Grove school district circumvented the security devices on district-issued Apple (AAPL) iPads within hours of receiving the devices according to a report last week in the Daily Journal.

Apparently, students found ways to reprogram the iPads so they could download games and apps for social media sites, according to the report. Center Grove officials attributed the problem to their security program not being able to handle the 2,000+ devices they distributed.

spread like wildfireKeith Krueger, the CEO for the Consortium for School Networking, said such problems are increasingly common as districts deploy an increasing number of devices. “Kids and adults find ways to hack through things, and it can spread like wildfire,” he said. “It’s frustrating, and it’s a huge challenge for any district.”

Data center failures

In addition to the tablet troubles, Data Center Knowledge’s Rich Miller reports several school data center failures. According to DCK, two public school systems suffered data center failures that crippled their IT systems.

data center fire suppression systemIn Oregon, the Beaverton School District experienced several days of disruption after an errant alarm set off its data center fire suppression system. The fire suppression system damaged hard drives and servers. That left Beaverton schools unable to use email or access class lists, student schedules, and online textbooks. “It knocked all of the systems in the data center off-line,” said Steve Langford, chief technology officer. “All of the systems that staff needs to do their jobs.” District IT staff worked over the Labor Day weekend to replace the damaged systems.

In California, the Davis Unified School District started school without key IT services after the district’s servers overheated. DCK reports an air conditioner unit failed, allowing the temperature in the server room to rise to 120 degrees F. “There’s an incredible impact on everyone in the whole organization,” says the district’s Kim Wallace. “Students can’t access computers. Teachers can’t take attendance. Parents can’t email. We can’t email out.” The DCK article said staff were still troubleshooting damaged equipment and lost data.

rb-

The best strategy, COSN’s Krueger said, is to combine the best possible security filters and other technical measures with a comprehensive responsible or acceptable use policy that students and families must sign and a commitment to enforcement. “It’s not surprising that a school district would have some breaches,” he said. “The question is how do you leverage it into a teachable moment?”

Who needs the teachable moment? Sure the kids need to understand there are real consequences for their actions but, can the politicians administrators be taught to be serious about IT? Seems to me that most of these failures are management failures. It is probable that these failures could have been reduced with proper project management.

proper project managementIt is my experience that many administrators do not recognize project management professionals. It appears they would stick with the good ole boy network and hire their less qualified friends or the professional BSer’s.

Now about project management? Modern backup system? Disaster Recovery plan?  BCP?

Related articles

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedIn, Facebook, and Twitter. Email the Bach Seat here.

Category: Uncategorized | Tags: , , , , , , , , , , , , , , , , , , ,
| May 14, 2013
Comments Off on Did You Wipe Your Tablet?

Did You Wipe Your Tablet?

Did You Wipe Your Tablet?Techno prognostication firm IDC says (I think they are right on this one) that worldwide sales of tablets will surpass desktop PCs and laptops by the end of 2014. This will result in a boomlet in the second-hand tablet market and a recent article on Infosecurity says that in response, firms will need to start data wipe their old tablets just as thoroughly as old hard disks to protect their data.

take responsibility for removing dataThe company is responsible for any company data held on the mobile device; no matter the flavor of BYOD practiced so it is the company that must take responsibility for removing data from the device before disposal. The Infosecurity article says that ensuring that mobile device solid-state memory is completely clean is technically difficult.

Solid-state memory

The article highlights BlackBelt, which has just enhanced its data wiping product to include Apple (AAPL) and Google (GOOG) Android tablets explained the difficulty to the author. “Solid-state memory uses a technique called wear leveling to maximize the life expectancy of the memory chips.” BlackBelt’s business development manager Ken Garner told Infosecurity, “It works by spreading the binary information (0s and 1s) randomly across all the memory cells in the chip. This means that unlike on spinning disk memory, the location of the data on the user interface bears no relation to where it is stored on the drive, making traditional forms of deletion ineffective.”

end users can't data wipe their mobile devicesBlackBelt says end-users can’t data wipe their phones, “it isn’t possible for an individual to perform a full removal of personal data from any smartphone or tablet using a device’s in-built factory reset or by re-flashing the operating system.” the vendor explains to Help Desk Security that wear leveling will, “over-rule instructions to permanently overwrite old data.”

Solid-state memory wear leveling

Because of ‘wear leveling, neither remote wipes nor factory resets are guaranteed to remove all the data from solid-state memory. The blog points out that a low-cost product called Wondershare, can recover data from solid-state memory. Mr. Garner claims the software, “recovers just about everything after either a factory reset or a local (phone operating system) delete.”

Many data wiping solutions don’t work on solid state memoryWhen a tablet is retired it is incumbent on the company to make sure that all data held on the device is adequately deleted. One problem, says Garner, is that “Many data wiping solutions, more often than not, have been “…re-purposed from data wiping solutions for traditional hard disk drives,” and that simply doesn’t work on solid-state memory.

Three-stage process to wipe SSM

DataWipe, uses a three-stage process: first writing 0s in every memory cell, secondly writing 1s in every cell, and thirdly writing random 0s and 1s across every memory cell. The result, he claims, is guaranteed data erasure that can also provide audit, compliance, and reporting data in an industry-standard XML format that is easily exchanged with all the major DLP, SIEM, policy management, and mobile device management solutions solving both the technical difficulties around tablet recycling.

difficulties around tablet recyclingWiping data from a PC or a first-generation Apple iPad that is being retired is important because of the enormous amount of data they can store. This makes the proper destruction of that data on the device essential before it leaves the organization. Unfortunately, IT asset disposition firm Retire-IT sees that many firms simply swap the devices with new ones or merely format the drives without securely wiping the data. The Columbus, OH-based firm says this leaves organizations vulnerable.  Kyle Marks, CEO of Retire-IT told Help Net Security that:

99% of problems happen before a disposal vendor touches equipment. No vendor can destroy data if they don’t receive an asset, which is why we strongly encourage clients to destroy data before any move. Better safe than sorry. Of course, disposal vendors should destroy data (again) regardless

Retire-IT looked at tracking data from 1,072 corporate disposal projects encompassing 233 different companies and reported some shocking figures:

  • 4 out of 5 projects (81.5%) had at least one missing asset.
  • 1 out of 8 (11.6%) had a negative variance. The devil is in the details, but nobody looks very closely.
  • Only 79% of the serial numbers were matched with subjective matching.
  • Without subjective matching, only 58% of serial numbers were matched.

Sanitize IT equipment

Help Net Security offers some suggestions to help sanitize IT equipment:

Computers – Derik Boot and Nuke Linux Live CD for full disk wiping. It supports many types of wiping, including the DoD 5220.22-M method with 3 passes.

sanitize IT equipmentStarting with Windows Vista (and Windows 2008 Server), the Microsoft OS overwrites the contents of each sector when you do a Slow Format on your media. They recommend Microsoft’s SDelete for wiping files on Windows.

For Apple OS X there’s the Disk Utility.

On Linux use the “wipe”, “srm” or “shred” commands to securely sanitize files on most distributions.

Printers and copiers – Consult the manual to find out how to clear the memory or use third-party software to wipe the hard drive. Which I covered here

Mobile devices – Wired recommends a hammer and don’t forget to remove the SIM card.

Related articles
  • BYOD: Preventing Breaches Can Be A Challenge (healthsecuritysolutions.com)

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedIn, Facebook, and Twitter. Email the Bach Seat here.

Category: Uncategorized | Tags: , , , , , , , , , , , , ,
| November 27, 2012
Comments Off on Protecting Print Devices from Malware

Protecting Print Devices from Malware

Protecting Print Devices from MalwarePrinter/copier firm Xerox and anti-malware firm McAfee revealed new protection against malware and viruses with the first networked multifunction printer to use McAfee Embedded Control software, a filtering method that allows only approved programs to get through to protect print devices from malware.

Xerox, McAfee Protecting Print Devices from MalwareTom Moore, vice president, Embedded Security, McAfee told Help Net Security in a recent article, “When a multifunction device receives data and processes it for printing, copying, scanning or faxing, it becomes susceptible to malware attacks a susceptibility that often is overlooked.”

The Xerox and McAfee security solution simplifies processes for IT administrators with software embedded into a multifunction device’s controller to give an immediate alert and audit trail to track and investigate the time and origin of security threats – and take action. The blog says this eliminates the need for IT administrators to constantly stay on top of malware threats and proactively block them.

networked printers and multifunction devicesSurvey data from Xerox (XRX) and McAfee underscores the need for embedded security in networked printers and multifunction devices. In a poll of office workers taken earlier this year: 33% say they either don’t always follow their company’s IT security policies; 21% aren’t aware of the company’s IT security policies.

The survey also showed 39% of employees who copy, scan or print confidential information at work say they wonder whether information like customer credit card numbers, financial reports, human resources, and tax documents will remain secure on networked a device.

“IT administrators Self protecting networkdon’t always consider printers as a threat – and with the Embedded Control software, we’ve put up even more defenses in our products so they don’t have to,” said Rick Dastin, president, Xerox Office, and Solutions Business Group.

Xerox devices protected and managed by McAfee Embedded Control and McAfee Embedded Management software will become available beginning in 2013, with products in the Xerox WorkCentre and ColorQube product lines.

rb-

Finally, some tangible results from Intel‘s (INTC) acquisition of McAfee. We use McAfee where I manage shared technical services, and just we just rolled out version 8.8 which says Intel on it.

I have covered the risks of putting multifunction devices on your network here, here, and here. This is not what I expected, maybe this is the first evolution before Intel builds McAfee anti-virus into a chip that goes on the mainboard or even right into the processor as a way to protect print devices from malware.

Related articles

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedIn, Facebook, and Twitter. Email the Bach Seat here.

Category: Uncategorized | Tags: , , , , , , , ,
| September 11, 2012
Comments Off on ITU Regs Bad for Cybersecurity

ITU Regs Bad for Cybersecurity

ITU Regs Bad for CybersecurityEmma Llansó at the Center for Democracy & Technology writes that the International Telecommunication Union is ill-suited to regulate cybersecurity. The United Nations-backed ITU will meet in December to try to expand its control over the Internet. The CDT believes that the issue of cybersecurity perfectly illustrates why the ITU should not be given expanded regulatory authority to include matters of Internet governance.

Center for Democracy & TechnologyThe UN body is holding the World Conference on International Telecommunications (WCIT) this December in Dubai, UAE to renegotiate the International Telecommunication Regulations (ITRs), the UN’s core telecommunications treaty. The ITRs were in 1988 and sets forth general principles for the operation of international telephony systems. The CDT reports that some Member States of the ITU want to use the WCIT to expand these regulations to Internet matters by amending the ITRs. The CDT and others have warned of the risks to online freedom and innovation if the UN is allowed to regulate the Internet. The CDT has released a paper (PDF) that examines in detail some of the proposals pending before the ITU relating to cybercrime and cybersecurity.

The CDT states that cybersecurity is undeniably a critical issue for the future of telecommunications and indeed for global commerce, development, and human rights. On the other hand, it is ill-suited to the kind of centralized, government-dominated policy-making that the ITU represents.

ITU logoCybersecurity requires agility: Given the pace of technological change, governmental bodies are not likely to be the source of effective technical solutions. The CDT predicts those solutions will emerge from multi-stakeholder efforts, involving ICT companies, technologists, academics, and civil society advocates, as well as governments.

Moreover, the cybersecurity issue inevitably leads straight into questions of human rights and governmental power: surveillance, privacy, and free expression. None of these are issues the ITU has any expertise in or any ability to assess and balance. The CDT suggests, rather than adopting vague wording that could be used by governments as justification for repressive measures, the ITU should endorse existing standards initiatives such as those underway at the IETF and continue to serve as one forum among many for the development of consensus-based, private sector-led efforts.

According to the CDT briefing, the Arab States regional group has offered a proposal to amend the ITRs to require Member States to “undertake appropriate measures” to address issues relating to “Confidence and Security of telecommunications/ICTs,” including “… online crime; controlling and countering unsolicited electronic communication (e.g Spam); and protection of information and personal data (e.g. phishing).” The governments of the middle-east have a history of manipulating the Internet to silence dissent.

Another example of why the UN should not control the Internet comes from the African Member States cybersecurity proposal which deals with data retention. The CDT reports the requirement will force communications companies to retain data about customers and communications for the benefit of the government rather than for business purposes.

UN against U.S. ConstitutionAnalysis by CDT says that this requirement goes against American criminal laws. This data retention law turns the presumption of innocence on its head since these cybersecurity data retention laws apply to every citizen regardless of whether they have committed a crime. Further, because data retention laws require service providers to store information that identifies people online, they threaten anonymity online, implicating the rights to both privacy and free expression.

The CDT writes that several cybersecurity proposals to amend the ITRs refer to the routing of communications. One proposal from the Arab States regional group would amend the ITRs to specify that “A Member State has the right to know how its traffic is routed.”

national securityThe proposal is justified on the grounds of security, according to the CDT which some Member States clearly interpret to mean national security. In its comments, Egypt argued, “…  Member States must be able to know the routes used … to maintain national security. If the [Member State] does [not] have the right to know or select the route in certain circumstances (e.g. for Security reasons), then the only alternative left is to block traffic from such destinations…”

The brief explains that Internet protocol (IP) networks transmit communications and interconnect entirely differently than traditional telephone networks; in that context the Arab States proposal to “know how traffic is routed” simply would not work and could fundamentally disrupt the operation of the Internet. If the Arab States proposal were applied to all Internet communications, the requirement that countries be able to “know” how every IP packet is routed to its destination would necessitate extensive network engineering changes, not only creating huge new costs but also threatening the performance benefits and network efficiency of the current system.

The brief goes on to explain that the Arab States proposal could also serve to legitimize governmental efforts to set up controls on the Internet traffic, by enshrining in an international treaty. Changes to IP routing rules to carry out the Arab States’ cybersecurity proposal could give the Member States more technical tools to use to block traffic to and from certain websites or nations. The regulations on routing that the Arab States proposal condones could take a variety of forms, from prohibiting certain IP addresses from being received inside a country to tracking users by IP addresses and blocking specific individuals from sending or receiving certain communications. “Knowledge” of IP routing could also encompass countries keeping track of what websites their citizens visit or with whom they email – all in the name of national security.

These types of regulations, which could be legitimized if the Arab States proposal is adopted, could threaten user rights to privacy and freedom of expression on the Internet.

rb-

The UN must not be allowed to expand its control over the Internet.  ITU regulation will be bad for cybersecurity.

Related articles

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedIn, Facebook, and Twitter. Email the Bach Seat here.

Category: Uncategorized | Tags: , , , , , , , , , ,
| July 19, 2012
Comments Off on Cyber Insurance

Cyber Insurance

Cyber InsuranceJohn Moccia with Innovation Guard wrote a good primer on what happens when a firm needs to buy cyber insurance in a thread at Internet Evolution. The author writes that loss control/security precautions are built into the process of acquiring cyber insurance. There are firms like NetDiligence that partner with insurers. Apparently, when you buy a cyber insurance policy, the coverage is contingent upon a successful security audit performed by NetDiligence (penetration testing, ethical hack, etc).

Cyber InsuranceThe article goes on to state that when a company outsources their technologies, such as with a co-hosting facility where their actual servers reside, the insurer will seek information on the Colo firm’s security protocols, protection, and redundancy. In the end, those companies with better procedures/protections in place will get better rates…..those with worse or no security will get higher rates – or not be afforded coverage at all.

There are first and third-party implications to Cyber insurance according to Mr. Moccia.

The first party = your losses…such as the cost to notify the thousands or tens of thousands of people whose info has been compromised.

Third-Party = losses of others where they would seek restitution from you. A class action claim for failure to secure confidential data – defense costs, settlements, etc.

This whole area is still evolving. Some insurers offer just third-party, others offer both. They have different approaches to the way they offer the coverage’s, too. For example, while one insurer may offer you up to $250K for breach notification costs, another provides coverage for up to 2 million affected people with no specific dollar amount.

Coverage can be incorporated on some insurer’s policies to address the acts of “rogue” employees/insiders.

Read the fine printThe author points out that the insurance industry is a very old industry. It is also one that is slow to change its ways of doing business. Insurers package their policies the way they want to sell them, as opposed to the way people/businesses want to buy them. For example, the types of claims that we are discussing here are relevant and likely for any kind of company today. General Liability claims are very uncommon and unlikely (at least for vanilla office-based companies, like Tech businesses and professional service companies)…and traditional business interruption coverage doesn’t address these cyber issues. Yet, these coverage’s are part of the standard policy that all businesses carry. In order to get the total protection that a business needs, it has to buy several policies, usually from multiple insurers. The first progressive insurer that is willing to incorporate coverage for these modern exposures (even if they just dip their toe in the water… offer $10K or some other nominal amount!), as part of what is their standard commercial policy, will have a huge advantage on the rest of the market.

rb-

I am sure that many SMB organizations have holes in their coverage when it comes to their cyber insurance. I really doubt that they can pass the security audit. Many of the organizations I deal with have very low-security postures. Conversations about password policies, document retention, and user account life-cycle are a big deal, even when my counterpart has come from industry to industry to education.

Related articles

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedIn, Facebook, and Twitter. Email the Bach Seat here.

Category: Uncategorized | Tags: , , , , , , , ,
« Older Entries